Struct L7Summary 

#[non_exhaustive]
pub struct L7Summary {
    pub app_proto: Option<&'static str>,
    pub server_name: Option<String>,
    pub ja3: Option<String>,
    pub ja4: Option<String>,
    pub tls_version: Option<u16>,
    pub tls_cipher: Option<u16>,
    pub user_agent: Option<String>,
    pub http_method: Option<String>,
    pub http_uri: Option<String>,
    pub dns_queries: Vec<String>,
}

Available on crate feature analysis only.

Curated security-relevant L7 facts observed on a flow.

Every field is optional / additive; a flow with no observed L7 yields the Default (all-empty) summary. #[non_exhaustive] — future protocols add fields without breaking construction (build via Default and the observe_* mutators).

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

app_proto: Option<&'static str>

Detected application protocol label ("tls" / "http" / "dns"). Last writer wins when a flow upgrades (e.g. HTTP CONNECT → TLS).

server_name: Option<String>

The server name the client asked for — TLS SNI or HTTP Host. The single most useful pivot field.

ja3: Option<String>

JA3 TLS client fingerprint (MD5 hex), if observed.

ja4: Option<String>

JA4 TLS client fingerprint (FoxIO format), if observed.

tls_version: Option<u16>

Negotiated TLS version as the raw 16-bit code point (e.g. 0x0303 = TLS 1.2).

tls_cipher: Option<u16>

Negotiated TLS cipher suite code point.

user_agent: Option<String>

HTTP User-Agent header value.

http_method: Option<String>

HTTP request method (GET / POST / …).

http_uri: Option<String>

HTTP request path / URI.

dns_queries: Vec<String>

DNS query names observed on the flow (bounded to MAX_DNS_QUERIES).

Implementations

impl L7Summary

pub fn is_empty(&self) -> bool

true if nothing L7 was observed (the default state).

pub fn observe_tls(&mut self, hs: &TlsHandshake)

Available on crate feature tls only.

Fold the facts from a completed TLS handshake into the summary: SNI → Self::server_name, JA3/JA4, negotiated version + cipher.

pub fn observe_http(&mut self, msg: &HttpMessage)

Available on crate feature http only.

Fold the facts from an HTTP message into the summary. Only requests carry security-relevant identity (Host / UA / method / path); responses are ignored here.

pub fn observe_dns_query(&mut self, q: &DnsQuery)

Available on crate feature dns only.

Record the query names from a parsed DNS query, bounded to MAX_DNS_QUERIES.

pub fn observe_dns_response(&mut self, r: &DnsResponse)

Available on crate feature dns only.

Record the query names from a parsed DNS response, bounded to MAX_DNS_QUERIES.

Trait Implementations

impl Clone for L7Summary

fn clone(&self) -> L7Summary

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for L7Summary

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for L7Summary

fn default() -> L7Summary

Returns the “default value” for a type.

impl Deserialize<'static> for L7Summary

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'static>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for L7Summary

fn eq(&self, other: &L7Summary) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for L7Summary

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for L7Summary