From 777166e19e8374616e134ca4ad2c6609cb65ece7 Mon Sep 17 00:00:00 2001 From: Marten Seemann Date: Thu, 22 Oct 2026 09:44:23 +0200 Subject: [PATCH] quic: document redacting of IP addresses and ports in qlog --- content/docs/quic/qlog.md | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/content/docs/quic/qlog.md b/content/docs/quic/qlog.md index 8d4708f..006cad6 100644 --- a/content/docs/quic/qlog.md +++ b/content/docs/quic/qlog.md @@ -46,6 +46,30 @@ quic.Config{ } ``` +## Redacting IP Addresses and Ports + +By default, qlog logs IP addresses and ports in the following events: + +* `transport:connection_started` +* `transport:parameters_set` + +Applications can redact sensitive addresses by wrapping a connection tracer with `qlog.RedactIPs`: + +```go +tracer := qlog.RedactIPs( + qlog.DefaultConnectionTracer, + func(addr netip.AddrPort, isLocal bool) (string, bool) { + if isLocal { + return "***", true + } + // Don't redact remote addresses. + return "", false + }, +) +``` + +The callback receives the IP address and port, and a flag indicating whether the address belongs to the local endpoint. Returning `true` replaces the IP address with the returned string and omits the port; returning `false` preserves the original values. The example above only redacts local addresses. + ## Events not associated with a Connection When listening for QUIC packets on a UDP socket, there are a couple of events that can happen before an incoming packet can be associated with a QUIC connection. For example, the QUIC packet header might be invalid, forcing us to drop the packet. Or the server might be overloaded and reject a new connection attempt.