Log client's source connection id, too.

Seem reasonable give we log the server SCID. Interestingly, the Chromium examples actually have zero length (empty) source connection IDs. I wonder if that's part of their "protocol ossification avoidance" effort.
zeek · Jan 26, 2024 · 67126dc · 67126dc
1 parent 8d3679f
commit 67126dc
Show file tree

Hide file tree

Showing 9 changed files with 31 additions and 26 deletions.
diff --git a/scripts/main.zeek b/scripts/main.zeek
@@ -27,10 +27,13 @@ export {
 		## by client and server.
 		client_initial_dcid: string  &log &optional;
 
+		## Client's Source Connection ID from the first INITIAL packet.
+		client_scid:         string  &log &optional;
+
 		## Server chosen Connection ID usually from server's first
 		## INITIAL packet. This is to be used by the client in
 		## subsequent packets.
-		server_scid:        string  &log &optional;
+		server_scid:         string  &log &optional;
 
 		## Server name extracted from SNI extension in ClientHello
 		## packet if available.
@@ -122,7 +125,9 @@ function set_session(c: connection, is_orig: bool, version: count, dcid: string,
 	if ( is_orig && |dcid| > 0 && ! c$quic?$client_initial_dcid )
 		c$quic$client_initial_dcid = bytestring_to_hexstr(dcid);
 
-	if ( ! is_orig && |scid| > 0 )
+	if ( is_orig )
+		c$quic$client_scid = bytestring_to_hexstr(scid);
+	else
 		c$quic$server_scid = bytestring_to_hexstr(scid);
 	}
 

diff --git a/testing/Baseline/tests.chromium/quic.log b/testing/Baseline/tests.chromium/quic.log
@@ -5,7 +5,7 @@
 #unset_field	-
 #path	quic
 #open XXXX-XX-XX-XX-XX-XX
-#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	version	client_initial_dcid	server_scid	server_name	client_protocol	history
-#types	time	string	addr	port	addr	port	string	string	string	string	string	string
-XXXXXXXXXX.XXXXXX	CHhAvVGS1DHFjwGM9	82.239.54.117	53727	110.213.53.115	443	1	95412c47018cdfe8	d5412c47018cdfe8	api.cirrus-ci.com	h3	ISisH
+#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	version	client_initial_dcid	client_scid	server_scid	server_name	client_protocol	history
+#types	time	string	addr	port	addr	port	string	string	string	string	string	string	string
+XXXXXXXXXX.XXXXXX	CHhAvVGS1DHFjwGM9	82.239.54.117	53727	110.213.53.115	443	1	95412c47018cdfe8	(empty)	d5412c47018cdfe8	api.cirrus-ci.com	h3	ISisH
 #close XXXX-XX-XX-XX-XX-XX
diff --git a/testing/Baseline/tests.curl-http3/quic.log b/testing/Baseline/tests.curl-http3/quic.log
@@ -5,7 +5,7 @@
 #unset_field	-
 #path	quic
 #open XXXX-XX-XX-XX-XX-XX
-#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	version	client_initial_dcid	server_scid	server_name	client_protocol	history
-#types	time	string	addr	port	addr	port	string	string	string	string	string	string
-XXXXXXXXXX.XXXXXX	CHhAvVGS1DHFjwGM9	172.17.0.2	34347	64.233.166.94	443	1	815d62c70884f4b51e8ccadd5beed372	c15d62c70884f4b5	www.google.de	h3	ISishIhHhhH
+#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	version	client_initial_dcid	client_scid	server_scid	server_name	client_protocol	history
+#types	time	string	addr	port	addr	port	string	string	string	string	string	string	string
+XXXXXXXXXX.XXXXXX	CHhAvVGS1DHFjwGM9	172.17.0.2	34347	64.233.166.94	443	1	815d62c70884f4b51e8ccadd5beed372	e5ec6b26584229be98a164349ae910351c40d10b	c15d62c70884f4b5	www.google.de	h3	ISishIhHhhH
 #close XXXX-XX-XX-XX-XX-XX
diff --git a/testing/Baseline/tests.firefox/quic.log b/testing/Baseline/tests.firefox/quic.log
@@ -5,7 +5,7 @@
 #unset_field	-
 #path	quic
 #open XXXX-XX-XX-XX-XX-XX
-#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	version	client_initial_dcid	server_scid	server_name	client_protocol	history
-#types	time	string	addr	port	addr	port	string	string	string	string	string	string
-XXXXXXXXXX.XXXXXX	CHhAvVGS1DHFjwGM9	82.239.54.117	44174	250.58.23.113	443	1	c5a5015ae8f479784a	01275b138ee6aca8a6276b132ae6b3547cf7773f	blog.cloudflare.com	h3	ISiishIhhhHHhHH
+#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	version	client_initial_dcid	client_scid	server_scid	server_name	client_protocol	history
+#types	time	string	addr	port	addr	port	string	string	string	string	string	string	string
+XXXXXXXXXX.XXXXXX	CHhAvVGS1DHFjwGM9	82.239.54.117	44174	250.58.23.113	443	1	c5a5015ae8f479784a	34696c	01275b138ee6aca8a6276b132ae6b3547cf7773f	blog.cloudflare.com	h3	ISiishIhhhHHhHH
 #close XXXX-XX-XX-XX-XX-XX
diff --git a/testing/Baseline/tests.quic-log/quic.log b/testing/Baseline/tests.quic-log/quic.log
@@ -5,7 +5,7 @@
 #unset_field	-
 #path	quic
 #open XXXX-XX-XX-XX-XX-XX
-#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	version	client_initial_dcid	server_scid	server_name	client_protocol	history
-#types	time	string	addr	port	addr	port	string	string	string	string	string	string
-XXXXXXXXXX.XXXXXX	CHhAvVGS1DHFjwGM9	669b:cb7a:de99:6a13:4a9b:46ef:3bed:cb6c	57538	6699:ded3:da8c:be73:5a99:ca73:5a99:cadb	443	1	5a37463b0eb7cc5d	da37463b0eb7cc5d	www.google.de	h3	ISishIhHhhHH
+#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	version	client_initial_dcid	client_scid	server_scid	server_name	client_protocol	history
+#types	time	string	addr	port	addr	port	string	string	string	string	string	string	string
+XXXXXXXXXX.XXXXXX	CHhAvVGS1DHFjwGM9	669b:cb7a:de99:6a13:4a9b:46ef:3bed:cb6c	57538	6699:ded3:da8c:be73:5a99:ca73:5a99:cadb	443	1	5a37463b0eb7cc5d	(empty)	da37463b0eb7cc5d	www.google.de	h3	ISishIhHhhHH
 #close XXXX-XX-XX-XX-XX-XX
diff --git a/testing/Baseline/tests.quicdoq/quic.log b/testing/Baseline/tests.quicdoq/quic.log
@@ -5,7 +5,7 @@
 #unset_field	-
 #path	quic
 #open XXXX-XX-XX-XX-XX-XX
-#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	version	client_initial_dcid	server_scid	server_name	client_protocol	history
-#types	time	string	addr	port	addr	port	string	string	string	string	string	string
-XXXXXXXXXX.XXXXXX	CHhAvVGS1DHFjwGM9	127.0.0.1	46907	127.0.0.1	853	1	fda05288ab9ff546	a31f4933d8727231	-	doq	ISishH
+#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	version	client_initial_dcid	client_scid	server_scid	server_name	client_protocol	history
+#types	time	string	addr	port	addr	port	string	string	string	string	string	string	string
+XXXXXXXXXX.XXXXXX	CHhAvVGS1DHFjwGM9	127.0.0.1	46907	127.0.0.1	853	1	fda05288ab9ff546	0fb934775f247b8e	a31f4933d8727231	-	doq	ISishH
 #close XXXX-XX-XX-XX-XX-XX
diff --git a/testing/Baseline/tests.quicv2-echo-443/quic.log b/testing/Baseline/tests.quicv2-echo-443/quic.log
@@ -5,7 +5,7 @@
 #unset_field	-
 #path	quic
 #open XXXX-XX-XX-XX-XX-XX
-#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	version	client_initial_dcid	server_scid	server_name	client_protocol	history
-#types	time	string	addr	port	addr	port	string	string	string	string	string	string
-XXXXXXXXXX.XXXXXX	CHhAvVGS1DHFjwGM9	127.0.0.1	49320	127.0.0.1	443	quicv2	fa603212c8688817af3d3238735bc7	b168b5cc	localhost	quic-echo-example	ISIIisIH
+#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	version	client_initial_dcid	client_scid	server_scid	server_name	client_protocol	history
+#types	time	string	addr	port	addr	port	string	string	string	string	string	string	string
+XXXXXXXXXX.XXXXXX	CHhAvVGS1DHFjwGM9	127.0.0.1	49320	127.0.0.1	443	quicv2	fa603212c8688817af3d3238735bc7	(empty)	b168b5cc	localhost	quic-echo-example	ISIIisIH
 #close XXXX-XX-XX-XX-XX-XX
diff --git a/testing/Baseline/tests.quicv2-http3-443/quic.log b/testing/Baseline/tests.quicv2-http3-443/quic.log
@@ -5,7 +5,7 @@
 #unset_field	-
 #path	quic
 #open XXXX-XX-XX-XX-XX-XX
-#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	version	client_initial_dcid	server_scid	server_name	client_protocol	history
-#types	time	string	addr	port	addr	port	string	string	string	string	string	string
-XXXXXXXXXX.XXXXXX	CHhAvVGS1DHFjwGM9	127.0.0.1	50841	127.0.0.1	443	quicv2	bdf0c5b27927cc667e58d95b	cdc8b6e6	-	h3	ISishIHH
+#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	version	client_initial_dcid	client_scid	server_scid	server_name	client_protocol	history
+#types	time	string	addr	port	addr	port	string	string	string	string	string	string	string
+XXXXXXXXXX.XXXXXX	CHhAvVGS1DHFjwGM9	127.0.0.1	50841	127.0.0.1	443	quicv2	bdf0c5b27927cc667e58d95b	71b8f3f4	cdc8b6e6	-	h3	ISishIHH
 #close XXXX-XX-XX-XX-XX-XX
diff --git a/testing/Baseline/tests.vector-max-size-crash/quic.log b/testing/Baseline/tests.vector-max-size-crash/quic.log
@@ -5,7 +5,7 @@
 #unset_field	-
 #path	quic
 #open XXXX-XX-XX-XX-XX-XX
-#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	version	client_initial_dcid	server_scid	server_name	client_protocol	history
-#types	time	string	addr	port	addr	port	string	string	string	string	string	string
-XXXXXXXXXX.XXXXXX	CHhAvVGS1DHFjwGM9	1.2.3.4	45492	7.7.7.7	443	unknown-10010000	00	-	-	-	U
+#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	version	client_initial_dcid	client_scid	server_scid	server_name	client_protocol	history
+#types	time	string	addr	port	addr	port	string	string	string	string	string	string	string
+XXXXXXXXXX.XXXXXX	CHhAvVGS1DHFjwGM9	1.2.3.4	45492	7.7.7.7	443	unknown-10010000	00	(empty)	-	-	-	U
 #close XXXX-XX-XX-XX-XX-XX