Project

General

Profile

Actions
Copy link

Feature #8520

closed
JI OD

quic: include server header in default eve record as a field

Feature #8520: quic: include server header in default eve record as a field

Added by Jason Ish 23 days ago. Updated 16 days ago.

Status:
Rejected
Priority:
Normal
Assignee:
OISF Dev
Target version:
9.0.0-beta1
Effort:
Difficulty:
Label:

Description

Hoist the server header field, as it makes sense for QUIC. Much like http.

Related issues 1 (1 open — 0 closed)

Copied from Suricata - Feature #8516: http: include server header in default eve record as a field TriagedOISF DevActions

JI Updated by Jason Ish 23 days ago Actions
Copy link
 #1

  • Copied from Feature #8516: http: include server header in default eve record as a field added

PA Updated by Philippe Antoine 22 days ago Actions
Copy link
 #2

  • Status changed from New to Triaged

Do you mean the hostname/sni ?

PA Updated by Philippe Antoine 22 days ago Actions
Copy link
 #3

  • Status changed from Triaged to Feedback

Because you already have quic.sni hoisted up even if you can see it also in the array of extensions

  "quic": {
    "version": "1",
    "sni": "msquic.net",
    "ja3": {
      "hash": "292bd0719190dff4cb1033de8573310d",
      "string": "771,4865-4866-4867,51-0-16-43-13-10-57-45-41,23-29," 
    },
    "extensions": [
      {
        "name": "key_share",
        "type": 51
      },
      {
        "name": "server_name",
        "type": 0,
        "values": [
          "msquic.net" 
        ]
      },
      {
        "name": "alpn",
        "type": 16,
        "values": [
          "h3-29" 
        ]
      },

JI Updated by Jason Ish 17 days ago Actions
Copy link
 #4

  • Description updated (diff)

JI Updated by Jason Ish 17 days ago · Edited Actions
Copy link
 #5

Ping @eleblond @Peter Manev - is the SNI here enough? Or did you have some other idea about quic?

JI Updated by Jason Ish 17 days ago Actions
Copy link
 #6

Jason Ish wrote in #note-5:

Ping eleblond @pevma, is the SNI here enough? Or did you have some other idea about @quic?

@eleblond @Peter Manev

EL Updated by Eric Leblond 16 days ago · Edited Actions
Copy link
 #7

Jason Ish wrote in #note-6:

Jason Ish wrote in #note-5:

Ping eleblond @pevma, is the SNI here enough? Or did you have some other idea about @quic?

@eleblond @Peter Manev

IMO, the sni key is enough and it is not confusing as similar to what is in TLS.

PA Updated by Philippe Antoine 16 days ago Actions
Copy link
 #8

  • Status changed from Feedback to Rejected

So, I understand there is nothing more to do thanks

PM Updated by Peter Manev 16 days ago Actions
Copy link
 #9

SNI is good for me as well. If there is fingerprint that would be lovely too as it allows matching inline.

Actions
Copy link

Also available in: PDF Atom