zeek/scripts/base/protocols
Klemens Nanni 397f7e5c0e Parse SVCB/HTTPS SvcParams list
Add full support for RFC 9460's SvcParams list.

Amend the existing `dns_svcb_rr` record by a vector of new
`dns_svcb_param` records containing aptly typed SvcParamKey and
SvcParamValue pairs.  Example output:

```
@load base/protocols/dns
event dns_HTTPS( c: connection , msg: dns_msg , ans: dns_answer , https: dns_svcb_rr ) {
	for (_, param in https$svc_params)
		print to_json(param);  # filter uninitialised values
}
```

```
$ dig https cloudflare-ech.com +short | tr [:space:] \\n
1
.
alpn="h3,h2"
ipv4hint=104.18.10.118,104.18.11.118
ech=AEX+DQBBHgAgACBGL2e9TiFwjK/w1Zg9AmRm7mgXHz3PjffP0mTFNMxmDQAEAAEAAQASY2xvdWRmbGFyZS1lY2guY29tAAA=
ipv6hint=2606:4700::6812:a76,2606:4700::6812:b76
```

```
{"key":1,"alpn":["h3","h2"]}
{"key":4,"hint":["104.18.10.118","104.18.11.118"]}
{"key":5,"ech":"AEX+DQBBHgAgACBGL2e9TiFwjK/w1Zg9AmRm7mgXHz3PjffP0mTFNMxmDQAEAAEAAQASY2xvdWRmbGFyZS1lY2guY29tAAA="}
{"key":6,"hint":["2606:4700::6812:a76","2606:4700::6812:b76"]}
```

Values with malformed data or belonging to invalid/reserved keys
are passed raw bytes in network order for script-level inspection.

Follow up to "Initial Support to DNS SVCB/HTTPS RR"
https://github.com/zeek/zeek/pull/1808
2025-09-03 09:53:55 +03:00
..
conn Optimize Conn::set_conn to minimize operations 2025-07-29 09:11:57 +01:00
dce-rpc dce-rpc: Make named_pipe filed docs extensive 2025-07-25 11:12:38 +02:00
dhcp Prefer explicit construction to coercion in record initialization 2025-07-11 16:28:37 -07:00
dnp3 Prefer explicit construction to coercion in record initialization 2025-07-11 16:28:37 -07:00
dns Parse SVCB/HTTPS SvcParams list 2025-09-03 09:53:55 +03:00
finger Add BIF have_spicy_analyzers(). 2023-02-03 13:47:26 +01:00
ftp Prefer explicit construction to coercion in record initialization 2025-07-11 16:28:37 -07:00
http Remove length limiting on string fields for HTTP 2025-08-12 17:31:29 -07:00
imap Merge remote-tracking branch 'origin/topic/seth/zeek_init' 2019-04-19 11:24:29 -07:00
irc Prefer explicit construction to coercion in record initialization 2025-07-11 16:28:37 -07:00
krb Prefer explicit construction to coercion in record initialization 2025-07-11 16:28:37 -07:00
ldap Prefer explicit construction to coercion in record initialization 2025-07-11 16:28:37 -07:00
modbus Prefer explicit construction to coercion in record initialization 2025-07-11 16:28:37 -07:00
mqtt Prefer explicit construction to coercion in record initialization 2025-07-11 16:28:37 -07:00
mysql Prefer explicit construction to coercion in record initialization 2025-07-11 16:28:37 -07:00
ntlm Prefer explicit construction to coercion in record initialization 2025-07-11 16:28:37 -07:00
ntp Prefer explicit construction to coercion in record initialization 2025-07-11 16:28:37 -07:00
pop3 Add STLS command to POP3 DPD signature 2025-05-14 16:37:25 +02:00
postgresql Report PostgreSQL login success only after ReadyForQuery 2025-08-18 10:59:44 +08:00
quic Prefer explicit construction to coercion in record initialization 2025-07-11 16:28:37 -07:00
radius Prefer explicit construction to coercion in record initialization 2025-07-11 16:28:37 -07:00
rdp Prefer explicit construction to coercion in record initialization 2025-07-11 16:28:37 -07:00
redis Prefer explicit construction to coercion in record initialization 2025-07-11 16:28:37 -07:00
rfb Prefer explicit construction to coercion in record initialization 2025-07-11 16:28:37 -07:00
sip Prefer explicit construction to coercion in record initialization 2025-07-11 16:28:37 -07:00
smb Prefer explicit construction to coercion in record initialization 2025-07-11 16:28:37 -07:00
smtp SMTP: Adapt scripts for enable_rfc822_msg_file_analysis 2025-07-16 12:37:33 +02:00
snmp Prefer explicit construction to coercion in record initialization 2025-07-11 16:28:37 -07:00
socks Prefer explicit construction to coercion in record initialization 2025-07-11 16:28:37 -07:00
ssh Prefer explicit construction to coercion in record initialization 2025-07-11 16:28:37 -07:00
ssl Update CT/CA lists to versions from NSS 3.114 2025-07-31 11:34:23 -07:00
syslog Prefer explicit construction to coercion in record initialization 2025-07-11 16:28:37 -07:00
tunnels Add Teredo packet analyzer, disable old analyzer 2021-11-23 19:36:50 -07:00
websocket Prefer explicit construction to coercion in record initialization 2025-07-11 16:28:37 -07:00
xmpp Merge remote-tracking branch 'origin/topic/seth/zeek_init' 2019-04-19 11:24:29 -07:00