zeek/testing/btest/scripts/base/protocols
Klemens Nanni 397f7e5c0e Parse SVCB/HTTPS SvcParams list
Add full support for RFC 9460's SvcParams list.

Amend the existing `dns_svcb_rr` record by a vector of new
`dns_svcb_param` records containing aptly typed SvcParamKey and
SvcParamValue pairs.  Example output:

```
@load base/protocols/dns
event dns_HTTPS( c: connection , msg: dns_msg , ans: dns_answer , https: dns_svcb_rr ) {
	for (_, param in https$svc_params)
		print to_json(param);  # filter uninitialised values
}
```

```
$ dig https cloudflare-ech.com +short | tr [:space:] \\n
1
.
alpn="h3,h2"
ipv4hint=104.18.10.118,104.18.11.118
ech=AEX+DQBBHgAgACBGL2e9TiFwjK/w1Zg9AmRm7mgXHz3PjffP0mTFNMxmDQAEAAEAAQASY2xvdWRmbGFyZS1lY2guY29tAAA=
ipv6hint=2606:4700::6812:a76,2606:4700::6812:b76
```

```
{"key":1,"alpn":["h3","h2"]}
{"key":4,"hint":["104.18.10.118","104.18.11.118"]}
{"key":5,"ech":"AEX+DQBBHgAgACBGL2e9TiFwjK/w1Zg9AmRm7mgXHz3PjffP0mTFNMxmDQAEAAEAAQASY2xvdWRmbGFyZS1lY2guY29tAAA="}
{"key":6,"hint":["2606:4700::6812:a76","2606:4700::6812:b76"]}
```

Values with malformed data or belonging to invalid/reserved keys
are passed raw bytes in network order for script-level inspection.

Follow up to "Initial Support to DNS SVCB/HTTPS RR"
https://github.com/zeek/zeek/pull/1808
2025-09-03 09:53:55 +03:00
..
arp Initial implementation of Lower-Level analyzers 2020-09-23 11:13:25 -07:00
bittorrent testing/btest/*zeek: Comment all @TEST lines 2025-04-17 16:30:23 +02:00
conn GH-1252: rename files with colons for Windows compatibility 2020-11-04 10:29:52 -08:00
dce-rpc Btests: don't use -C in Zeek invocations that don't actually need it 2025-06-06 13:46:45 -07:00
dhcp btest remaining: Use generic cluster-layout.zeek 2025-05-20 20:30:01 +02:00
dnp3 General btest cleanup 2020-08-11 11:26:22 -07:00
dns Parse SVCB/HTTPS SvcParams list 2025-09-03 09:53:55 +03:00
finger Provide infrastructure to migrate legacy analyzers to Spicy. 2023-02-01 11:33:48 +01:00
ftp Settle on analyzer.log for the dpd.log replacement 2025-06-03 17:33:36 +01:00
http Btests: don't use -C in Zeek invocations that don't actually need it 2025-06-06 13:46:45 -07:00
icmp Remove deprecated ICMP events 2021-01-27 10:52:40 -07:00
imap Remove @load base/frameworks/dpd from tests 2022-08-31 17:00:55 +02:00
irc Expand coverage of IRC analyzer with more commands 2025-07-28 14:13:55 -07:00
krb Make enc_part value from kerberos response available to scripts 2025-01-31 12:58:14 +00:00
ldap Btests: don't use -C in Zeek invocations that don't actually need it 2025-06-06 13:46:45 -07:00
modbus dpd->analyzer.log change - rename files 2025-06-03 16:32:52 +01:00
mount GH-239: Rename bro to zeek, bro-config to zeek-config, and bro-path-dev to zeek-path-dev. 2019-05-01 21:43:45 +00:00
mqtt Remove full scripts marked as 6.1 deprecations 2023-06-14 10:07:22 -07:00
mysql mysql: Implement and test COM_CHANGE_USER 2024-08-14 10:20:01 +02:00
ncp General btest cleanup 2020-08-11 11:26:22 -07:00
nfs GH-239: Rename bro to zeek, bro-config to zeek-config, and bro-path-dev to zeek-path-dev. 2019-05-01 21:43:45 +00:00
ntp NTP: Detect out-of-order packets 2023-05-04 19:44:02 +02:00
pop3 Btests: don't use -C in Zeek invocations that don't actually need it 2025-06-06 13:46:45 -07:00
portmap GH-684: Fix parsing of RPC calls with non-AUTH_UNIX flavors 2019-11-13 13:14:14 -08:00
postgresql Report PostgreSQL login success only after ReadyForQuery 2025-08-18 10:59:44 +08:00
quic Btests: don't use -C in Zeek invocations that don't actually need it 2025-06-06 13:46:45 -07:00
radius Convert pcapng test suite files to pcap format 2019-11-08 13:08:06 -08:00
rdp Btests: don't use -C in Zeek invocations that don't actually need it 2025-06-06 13:46:45 -07:00
redis Handle more Redis RESP3 protocol pieces 2025-07-01 14:14:15 -04:00
rfb regularize test suite names to avoid custom/outdated suffices 2022-05-12 13:32:49 -07:00
sip GH-1507: Tolerate junk data before SIP requests 2021-04-14 15:34:07 -07:00
smb smb2/read: Parse only 1 byte for data_offset, ignore reserved1 2025-08-08 16:12:20 +02:00
smtp btest: Add tests for full email extraction 2025-07-16 12:37:33 +02:00
snap Make SNAP analyzer use both OUI and protocol for forwarding 2025-03-24 15:20:50 -07:00
snmp General btest cleanup 2020-08-11 11:26:22 -07:00
socks testing/btest/*zeek: Comment all @TEST lines 2025-04-17 16:30:23 +02:00
ssh Settle on analyzer.log for the dpd.log replacement 2025-06-03 17:33:36 +01:00
ssl Only pass session ticket data in ssl_session_ticket_handshake event 2025-06-24 16:33:14 +01:00
syslog General btest cleanup 2020-08-11 11:26:22 -07:00
tcp Add testcase for TCP segment offloading. 2021-11-23 12:37:55 +00:00
websocket Settle on analyzer.log for the dpd.log replacement 2025-06-03 17:33:36 +01:00
xmpp Btests: don't use -C in Zeek invocations that don't actually need it 2025-06-06 13:46:45 -07:00