mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
397f7e5c0e
Add full support for RFC 9460's SvcParams list.
Amend the existing `dns_svcb_rr` record by a vector of new
`dns_svcb_param` records containing aptly typed SvcParamKey and
SvcParamValue pairs. Example output:
```
@load base/protocols/dns
event dns_HTTPS( c: connection , msg: dns_msg , ans: dns_answer , https: dns_svcb_rr ) {
for (_, param in https$svc_params)
print to_json(param); # filter uninitialised values
}
```
```
$ dig https cloudflare-ech.com +short | tr [:space:] \\n
1
.
alpn="h3,h2"
ipv4hint=104.18.10.118,104.18.11.118
ech=AEX+DQBBHgAgACBGL2e9TiFwjK/w1Zg9AmRm7mgXHz3PjffP0mTFNMxmDQAEAAEAAQASY2xvdWRmbGFyZS1lY2guY29tAAA=
ipv6hint=2606:4700::6812:a76,2606:4700::6812:b76
```
```
{"key":1,"alpn":["h3","h2"]}
{"key":4,"hint":["104.18.10.118","104.18.11.118"]}
{"key":5,"ech":"AEX+DQBBHgAgACBGL2e9TiFwjK/w1Zg9AmRm7mgXHz3PjffP0mTFNMxmDQAEAAEAAQASY2xvdWRmbGFyZS1lY2guY29tAAA="}
{"key":6,"hint":["2606:4700::6812:a76","2606:4700::6812:b76"]}
```
Values with malformed data or belonging to invalid/reserved keys
are passed raw bytes in network order for script-level inspection.
Follow up to "Initial Support to DNS SVCB/HTTPS RR"
https://github.com/zeek/zeek/pull/1808
|
||
|---|---|---|
| .. | ||
| ad-cd.zeek | ||
| binds.zeek | ||
| caa.zeek | ||
| dns-edns-cookie.zeek | ||
| dns-edns-ecs.zeek | ||
| dns-edns-tcp-keepalive.zeek | ||
| dns-key.zeek | ||
| dnskey.zeek | ||
| dnssec.zeek | ||
| ds.zeek | ||
| duplicate-reponses.zeek | ||
| dynamic-update.zeek | ||
| ech.zeek | ||
| edns-rcode.zeek | ||
| event-handler-warning.zeek | ||
| flip.zeek | ||
| hinfo.zeek | ||
| https.zeek | ||
| huge-ttl.zeek | ||
| loc.zeek | ||
| multiple-txt-strings.zeek | ||
| naptr.zeek | ||
| nsec.zeek | ||
| nsec3.zeek | ||
| nsec3param.zeek | ||
| rrsig.zeek | ||
| spf.zeek | ||
| sshfp.zeek | ||
| svcb.zeek | ||
| tkey.zeek | ||
| tsig.zeek | ||
| wks.zeek | ||
| zero-responses.zeek | ||