Recodede QUIC from scratch to make it more robust and export SNI (server name) as with SSL/HTTP

4 files changed, 126 insertions, 113 deletions

diff --git a/src/lib/protocols/quic.c b/src/lib/protocols/quic.c
index 5be4e955f..c26b8990c 100644
--- a/src/lib/protocols/quic.c
+++ b/src/lib/protocols/quic.c
@@ -1,11 +1,12 @@
 /*
  * quic.c
  *
+ * Copyright (C) 2012-16 - ntop.org
+ *
+ * Based on code of:
  * Andrea Buscarinu - <andrea.buscarinu@gmail.com>
  * Michele Campus - <campus@ntop.org>
  *
- * Copyright (C) 2012-15 - ntop.org
- *
  * This module is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Lesser General Public License as published by
  * the Free Software Foundation, either version 3 of the License, or
@@ -24,117 +25,125 @@
 
 #include "ndpi_api.h"
 
-#define QUIC_NO_V_RES_RSV 0xC3 // 1100 0001
-
-#define QUIC_FLG_VERS 0x01     // 0000 0001
-#define QUIC_FLG_RSET 0x02     // 0000 0010
-#define QUIC_FLG_NNCE 0x04     // 0000 0100
-#define QUIC_FLG_CIDL 0x08     // 0000 1000
-#define QUIC_FLG_PACK 0x30     // 0011 0000
-#define QUIC_FLG_PATH 0x40     // 0100 0000
+#ifdef NDPI_PROTOCOL_QUIC
 
-#define OFF_LEN_00 0x00        // 0000 0000
-#define OFF_LEN_04 0x04        // 0000 0100
-#define OFF_LEN_08 0x08        // 0000 1000
-#define OFF_LEN_0C 0x0C        // 0000 1100
+static int quic_ports(u_int16_t sport, u_int16_t dport)
+{
+  if ((sport == 443 || dport == 443 || sport == 80 || dport == 80) &&
+      (sport != 123 && dport != 123))
+    return 1;
 
-#define PKN_LEN_1 0x00         // 0000 0000
-#define PKN_LEN_2 0x10         // 0001 0000
-#define PKN_LEN_4 0x20         // 0010 0000
-#define PKN_LEN_6 0x30         // 0011 0000
+  return 0;
+}
 
+/* ***************************************************************** */
 
-#define INT(C) (C - '0')
-#define DIGIT(X, Y, Z) ((isdigit(X) && isdigit(Y) && isdigit(Z)) ? (INT(X) * 100 + INT(Y) * 10 + INT(Z)) : 0)
+static int quic_payload(const u_int8_t *payload) {
+  if((payload[0] == 'Q')
+     && isdigit(payload[1])
+     && isdigit(payload[2])
+     && isdigit(payload[3]))
+    return(1);
 
-#ifdef NDPI_PROTOCOL_QUIC
-static void ndpi_int_quic_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
-{
-    ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_QUIC, NDPI_PROTOCOL_UNKNOWN);
+  return(0);
 }
 
-static int ports(u_int16_t sport, u_int16_t dport)
-{
-    if ((sport == 443 || dport == 443 || sport == 80 || dport == 80) &&
-        (sport != 123 && dport != 123))
-        return 0;
-    return 1;
+/* ***************************************************************** */
+
+static int quic_len(u_int8_t l) {
+  switch(l) {
+  case 0:
+    return(1);
+    break;
+  case 1:
+    return(2);
+    break;
+  case 2:
+    return(4);
+    break;
+  case 3:
+    return(8);
+    break;
+  }
+  
+  return(0); /* NOTREACHED */
 }
 
-static int offset(const unsigned char pflags)
-{
-    u_int offs;
-
-    switch (pflags & (QUIC_FLG_CIDL | QUIC_FLG_NNCE))
-    {
-    	case OFF_LEN_08: offs = 8; break;
-    	case OFF_LEN_0C: offs = 8; break;
-    	default:
-            return 1;
-    }
-    return offs + 1;
-}
+/* ***************************************************************** */
 
-static int vers(const unsigned char *payload)
+void ndpi_search_quic(struct ndpi_detection_module_struct *ndpi_struct,
+		      struct ndpi_flow_struct *flow)
 {
-    int voffs = offset(*payload);
-    const uint8_t *vers = &payload[voffs];
-
-    if (*vers == 'Q')
-    {
-        short int res = DIGIT(vers[1], vers[2], vers[3]);
-
-        switch (res)
-        {
-            case 9:  case 10: case 11: case 12: case 13: case 14:
-            case 15: case 16: case 17: case 18: case 19: case 20:
-            case 21: case 23: case 24: case 25: case 26: case 27:
-            case 29: case 30: case 31: case 32: case 33: case 34:
-                return 0;
-                break;
-            default:
-                return 1;
-        }
-    }
-    return 1;
-}
+  struct ndpi_packet_struct *packet = &flow->packet;
+  u_int32_t udp_len = packet->payload_packet_len;
+  u_int version_len = ((packet->payload[0] & 0x01) == 0) ? 0 : 4;
+  u_int cid_len = quic_len((packet->payload[0] & 0x0C) >> 2);
+  u_int seq_len = quic_len((packet->payload[0] & 0x30) >> 4);
+  u_int quic_hlen = 1 /* flags */ + version_len + seq_len + cid_len;
+
+  if(packet->udp != NULL
+     && (udp_len > (quic_hlen+4 /* QXXX */))
+     && ((packet->payload[0] & 0xC2) == 0x00)
+     && (quic_ports(ntohs(packet->udp->source), ntohs(packet->udp->dest)))
+     ) {
+    char *begin;
+    int i;
+
+    if((version_len > 0) && (packet->payload[1+cid_len] != 'Q'))
+      goto no_quic; 
+
+    NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "found QUIC.\n");
+    ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_QUIC, NDPI_PROTOCOL_UNKNOWN);
 
-void ndpi_search_quic(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
-{
-    struct ndpi_packet_struct *packet = &flow->packet;
-    u_int32_t udp_len = packet->payload_packet_len;
-
-    if (packet->udp != NULL && udp_len > 2)
-    {
-    	u_int16_t sport = ntohs(packet->udp->source), dport = ntohs(packet->udp->dest);
-
-    	NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "calculating QUIC over udp.\n");
-
-        if ((ports(sport, dport) == 0 && (packet->payload[0] & QUIC_NO_V_RES_RSV) == 0)
-            || vers(packet->payload) == 0)
-        {
-            NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "found QUIC.\n");
-            ndpi_int_quic_add_connection(ndpi_struct, flow);
-        }
-        else
-        {
-            NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "exclude QUIC.\n");
-            NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_QUIC);
-        }
-    }
-    else
-    {
-        NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "exclude QUIC.\n");
-        NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_QUIC);
+    if(!strncmp((char*)&packet->payload[quic_hlen+17], "CHLO" /* Client Hello */, 4)) {
+      /* Check if SNI (Server Name Indetification) is present */
+      for(i=quic_hlen+12; i<udp_len-3; i++) {
+	if((packet->payload[i] == 'S')
+	   && (packet->payload[i+1] == 'N')
+	   && (packet->payload[i+2] == 'I')
+	   && (packet->payload[i+3] == 0)) {
+	  u_int32_t offset = *((u_int32_t*)&packet->payload[i+4]);
+	  u_int32_t prev_offset = *((u_int32_t*)&packet->payload[i-4]);
+	  int len = offset-prev_offset;
+	  int sni_offset = i+prev_offset+1;
+       
+	  while((packet->payload[sni_offset] == '-') && (sni_offset < udp_len))
+	    sni_offset++;
+	
+	  if((sni_offset+len) < udp_len) {
+	    int max_len = sizeof(flow->host_server_name)-1, j = 0;
+
+	    if(len > max_len) len = max_len;
+
+	    while((len > 0) && (sni_offset < udp_len)) {
+	      flow->host_server_name[j++] = packet->payload[sni_offset];
+	      sni_offset++, len--;
+	    }
+	  }
+
+	  break;
+	}
+      }
     }
+    return;
+  }
+
+ no_quic:
+  NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "exclude QUIC.\n");
+  NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_QUIC);
 }
 
-void init_quic_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
+/* ***************************************************************** */
+
+void init_quic_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id,
+			 NDPI_PROTOCOL_BITMASK *detection_bitmask)
 {
-    ndpi_set_bitmask_protocol_detection("QUIC", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_QUIC, ndpi_search_quic,
-    NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK);
+  ndpi_set_bitmask_protocol_detection("QUIC", ndpi_struct, detection_bitmask, *id,
+				      NDPI_PROTOCOL_QUIC, ndpi_search_quic,
+				      NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD,
+				      SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK);
 
-    *id += 1;
+  *id += 1;
 }
 
-#endif
+#endif /* NDPI_PROTOCOL_QUIC */
diff --git a/tests/result/6in4tunnel.pcap.out b/tests/result/6in4tunnel.pcap.out
index 8e7d1cec7..7786f4a3a 100644
--- a/tests/result/6in4tunnel.pcap.out
+++ b/tests/result/6in4tunnel.pcap.out
@@ -4,13 +4,13 @@ SSL	28	15397	1
 ICMPV6	48	7862	3
 Facebook	37	14726	3
 
-	1	TCP [2001:470:1f17:13f:3e97:eff:fe73:4dec]:443 <-> [2a03:2880:1010:6f03:face:b00c:0:2]:53234 [proto: 91.119/SSL.Facebook][33 pkts/13926 bytes][SSL client: www.facebook.com]
-	2	UDP [2001:470:1f16:13f::2]:6404 <-> [2a03:2880:fffe:b:face:b00c:0:99]:53 [proto: 5.119/DNS.Facebook][2 pkts/394 bytes][Host: star.c10r.facebook.com]
+	1	TCP [2001:470:1f17:13f:3e97:eff:fe73:4dec]:443 <-> [2a03:2880:1010:6f03:face:b00c::2]:53234 [proto: 91.119/SSL.Facebook][33 pkts/13926 bytes][SSL client: www.facebook.com]
+	2	UDP [2001:470:1f16:13f::2]:6404 <-> [2a03:2880:fffe:b:face:b00c::99]:53 [proto: 5.119/DNS.Facebook][2 pkts/394 bytes][Host: star.c10r.facebook.com]
 	3	TCP [2001:470:1f17:13f:3e97:eff:fe73:4dec]:443 <-> [2604:a880:1:20::224:b001]:60205 [proto: 91/SSL][28 pkts/15397 bytes][SSL client: mail.tomasu.net]
 	4	ICMPV6 [2001:470:1f16:13f::2]:0 <-> [2604:a880:1:20::224:b001]:0 [proto: 102/ICMPV6][1 pkts/200 bytes]
-	5	ICMPV6 [2a03:2880:1010:6f03:face:b00c:0:2]:0 <-> [2001:470:1f17:13f:3e97:eff:fe73:4dec]:0 [proto: 102/ICMPV6][1 pkts/1314 bytes]
+	5	ICMPV6 [2a03:2880:1010:6f03:face:b00c::2]:0 <-> [2001:470:1f17:13f:3e97:eff:fe73:4dec]:0 [proto: 102/ICMPV6][1 pkts/1314 bytes]
 	6	TCP [2604:a880:1:20::224:b001]:993 <-> [2001:470:1f17:13f:6d69:c72:7313:616f]:35610 [proto: 51/IMAPS][2 pkts/258 bytes]
 	7	ICMPV6 [2001:470:1f17:13f:3e97:eff:fe73:4dec]:0 <-> [2604:a880:1:20::224:b001]:0 [proto: 102/ICMPV6][46 pkts/6348 bytes]
 	8	TCP [2604:a880:1:20::224:b001]:993 <-> [2001:470:1f17:13f:6d69:c72:7313:616f]:56381 [proto: 51/IMAPS][2 pkts/258 bytes]
-	9	UDP [2001:470:1f16:13f::2]:53959 <-> [2a03:2880:fffe:b:face:b00c:0:99]:53 [proto: 5.119/DNS.Facebook][2 pkts/406 bytes][Host: star.c10r.facebook.com]
+	9	UDP [2001:470:1f16:13f::2]:53959 <-> [2a03:2880:fffe:b:face:b00c::99]:53 [proto: 5.119/DNS.Facebook][2 pkts/406 bytes][Host: star.c10r.facebook.com]
 	10	TCP [2001:470:1f17:13f:3e97:eff:fe73:4dec]:80 <-> [2604:a880:1:20::224:b001]:41538 [proto: 7/HTTP][10 pkts/1792 bytes][Host: mail.tomasu.net]
diff --git a/tests/result/http_ipv6.pcap.out b/tests/result/http_ipv6.pcap.out
index 71cb7be63..ab9b3e6ef 100644
--- a/tests/result/http_ipv6.pcap.out
+++ b/tests/result/http_ipv6.pcap.out
@@ -14,6 +14,6 @@ QUIC	65	16479	2
 	10	TCP [2a00:d40:1:3:7aac:c0ff:fea7:d4c]:443 <-> [2a00:1450:4006:803::2008]:58660 [proto: 91/SSL][2 pkts/172 bytes]
 	11	TCP [2a00:d40:1:3:7aac:c0ff:fea7:d4c]:443 <-> [2a00:1450:4001:803::1012]:59690 [proto: 91/SSL][2 pkts/172 bytes]
 	12	TCP [2a00:d40:1:3:7aac:c0ff:fea7:d4c]:60124 <-> [2a02:26f0:ad:1a1::eed]:443 [proto: 91/SSL][2 pkts/172 bytes]
-	13	TCP [2a00:d40:1:3:7aac:c0ff:fea7:d4c]:40308 <-> [2a03:2880:1010:3f20:face:b00c:0:25de]:443 [proto: 91/SSL][2 pkts/172 bytes]
-	14	UDP [2a00:d40:1:3:7aac:c0ff:fea7:d4c]:443 <-> [2a00:1450:4001:803::1017]:45931 [proto: 188/QUIC][62 pkts/15977 bytes]
+	13	TCP [2a00:d40:1:3:7aac:c0ff:fea7:d4c]:40308 <-> [2a03:2880:1010:3f20:face:b00c::25de]:443 [proto: 91/SSL][2 pkts/172 bytes]
+	14	UDP [2a00:d40:1:3:7aac:c0ff:fea7:d4c]:443 <-> [2a00:1450:4001:803::1017]:45931 [proto: 188/QUIC][62 pkts/15977 bytes][Host: www.google.it]
 	15	UDP [2a00:d40:1:3:7aac:c0ff:fea7:d4c]:55145 <-> [2a00:1450:400b:c02::5f]:443 [proto: 188/QUIC][3 pkts/502 bytes]
diff --git a/tests/result/quic.pcap.out b/tests/result/quic.pcap.out
index 28942be11..9c56d2d75 100644
--- a/tests/result/quic.pcap.out
+++ b/tests/result/quic.pcap.out
@@ -1,12 +1,16 @@
-QUIC	518	348566	10
+Unknown	6	7072	1
+QUIC	512	341494	9
 
-	1	UDP 192.168.1.105:48445 <-> 216.58.214.110:443 [proto: 188/QUIC][3 pkts/2863 bytes]
-	2	UDP 192.168.1.105:53817 <-> 216.58.210.225:443 [proto: 188/QUIC][2 pkts/2784 bytes]
-	3	UDP 216.58.212.101:443 <-> 192.168.1.109:57833 [proto: 188/QUIC][413 pkts/254874 bytes]
+	1	UDP 192.168.1.105:48445 <-> 216.58.214.110:443 [proto: 188/QUIC][3 pkts/2863 bytes][Host: i.ytimg.com]
+	2	UDP 192.168.1.105:53817 <-> 216.58.210.225:443 [proto: 188/QUIC][2 pkts/2784 bytes][Host: yt3.ggpht.com]
+	3	UDP 216.58.212.101:443 <-> 192.168.1.109:57833 [proto: 188/QUIC][413 pkts/254874 bytes][Host: mail.google.com]
 	4	UDP 172.217.16.3:443 <-> 192.168.1.105:40461 [proto: 188/QUIC][3 pkts/364 bytes]
-	5	UDP 172.217.16.4:443 <-> 192.168.1.105:45669 [proto: 188/QUIC][5 pkts/4334 bytes]
-	6	UDP 192.168.1.105:34438 <-> 216.58.210.238:443 [proto: 188/QUIC][7 pkts/6545 bytes]
-	7	UDP 192.168.1.109:35236 <-> 216.58.210.206:443 [proto: 188/QUIC][69 pkts/58433 bytes]
-	8	UDP 192.168.1.105:40030 <-> 216.58.201.227:443 [proto: 188/QUIC][6 pkts/5729 bytes]
-	9	UDP 192.168.1.105:55934 <-> 216.58.201.238:443 [proto: 188/QUIC][4 pkts/5568 bytes]
-	10	UDP 10.0.0.3:6121 <-> 10.0.0.4:40134 [proto: 188/QUIC][6 pkts/7072 bytes]
+	5	UDP 172.217.16.4:443 <-> 192.168.1.105:45669 [proto: 188/QUIC][5 pkts/4334 bytes][Host: www.google.com]
+	6	UDP 192.168.1.105:34438 <-> 216.58.210.238:443 [proto: 188/QUIC][7 pkts/6545 bytes][Host: www.youtube.com]
+	7	UDP 192.168.1.109:35236 <-> 216.58.210.206:443 [proto: 188/QUIC][69 pkts/58433 bytes][Host: www.youtube.com]
+	8	UDP 192.168.1.105:40030 <-> 216.58.201.227:443 [proto: 188/QUIC][6 pkts/5729 bytes][Host: fonts.gstatic.com]
+	9	UDP 192.168.1.105:55934 <-> 216.58.201.238:443 [proto: 188/QUIC][4 pkts/5568 bytes][Host: s.ytimg.com]
+
+
+Undetected flows:
+	1	UDP 10.0.0.3:6121 <-> 10.0.0.4:40134 [proto: 0/Unknown][6 pkts/7072 bytes]