Fixed invalid QUIC header parsing

2 files changed, 40 insertions, 35 deletions

diff --git a/src/lib/protocols/quic.c b/src/lib/protocols/quic.c
index 35b8d0911..5a7fc70ab 100644
--- a/src/lib/protocols/quic.c
+++ b/src/lib/protocols/quic.c
@@ -81,40 +81,44 @@ void ndpi_search_quic(struct ndpi_detection_module_struct *ndpi_struct,
     NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "found QUIC.\n");
     ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_QUIC, NDPI_PROTOCOL_UNKNOWN);
 
-    if(udp_len > quic_hlen + 17 + 4 &&
-         !strncmp((char*)&packet->payload[quic_hlen+17], "CHLO" /* Client Hello */, 4)) {
-      /* Check if SNI (Server Name Identification) is present */
-      for(i=quic_hlen+12; i<udp_len-3; i++) {
-	if((packet->payload[i] == 'S')
-	   && (packet->payload[i+1] == 'N')
-	   && (packet->payload[i+2] == 'I')
-	   && (packet->payload[i+3] == 0)) {
-	  u_int32_t offset = *((u_int32_t*)&packet->payload[i+4]);
-	  u_int32_t prev_offset = *((u_int32_t*)&packet->payload[i-4]);
-	  int len = offset-prev_offset;
-	  int sni_offset = i+prev_offset+1;
-
-	  while((sni_offset < udp_len) && (packet->payload[sni_offset] == '-'))
-	    sni_offset++;
-
-	  if((sni_offset+len) < udp_len) {
-	    int max_len = sizeof(flow->host_server_name)-1, j = 0;
-
-	    if(len > max_len) len = max_len;
-
-	    while((len > 0) && (sni_offset < udp_len)) {
-	      flow->host_server_name[j++] = packet->payload[sni_offset];
-	      sni_offset++, len--;
+    if(packet->payload[quic_hlen+12] != 0xA0)
+      quic_hlen++;
+	     
+    if(udp_len > quic_hlen + 16 + 4) {
+      if(!strncmp((char*)&packet->payload[quic_hlen+16], "CHLO" /* Client Hello */, 4)) {
+	/* Check if SNI (Server Name Identification) is present */
+	for(i=quic_hlen+12; i<udp_len-3; i++) {
+	  if((packet->payload[i] == 'S')
+	     && (packet->payload[i+1] == 'N')
+	     && (packet->payload[i+2] == 'I')
+	     && (packet->payload[i+3] == 0)) {
+	    u_int32_t offset = *((u_int32_t*)&packet->payload[i+4]);
+	    u_int32_t prev_offset = *((u_int32_t*)&packet->payload[i-4]);
+	    int len = offset-prev_offset;
+	    int sni_offset = i+prev_offset+1;
+
+	    while((sni_offset < udp_len) && (packet->payload[sni_offset] == '-'))
+	      sni_offset++;
+
+	    if((sni_offset+len) < udp_len) {
+	      int max_len = sizeof(flow->host_server_name)-1, j = 0;
+
+	      if(len > max_len) len = max_len;
+
+	      while((len > 0) && (sni_offset < udp_len)) {
+		flow->host_server_name[j++] = packet->payload[sni_offset];
+		sni_offset++, len--;
+	      }
+
+	      ndpi_match_host_subprotocol(ndpi_struct, flow, 
+					  (char *)flow->host_server_name,
+					  strlen((const char*)flow->host_server_name),
+					  NDPI_PROTOCOL_QUIC);
+	    
 	    }
 
-	    ndpi_match_host_subprotocol(ndpi_struct, flow, 
-					(char *)flow->host_server_name,
-					strlen((const char*)flow->host_server_name),
-					NDPI_PROTOCOL_QUIC);
-	    
+	    break;
 	  }
-
-	  break;
 	}
       }
     }
diff --git a/tests/result/youtube_quic.pcap.out b/tests/result/youtube_quic.pcap.out
index b5e31b109..0ca9427bb 100644
--- a/tests/result/youtube_quic.pcap.out
+++ b/tests/result/youtube_quic.pcap.out
@@ -1,5 +1,6 @@
-QUIC	289	191639	3
+YouTube	258	178495	1
+Google	31	13144	2
 
-	1	UDP 192.168.1.7:53859 <-> 216.58.205.66:443 [proto: 188/QUIC][18 pkts/8665 bytes]
-	2	UDP 192.168.1.7:54997 <-> 216.58.205.66:443 [proto: 188/QUIC][13 pkts/4479 bytes]
-	3	UDP 192.168.1.7:56074 <-> 216.58.198.33:443 [proto: 188/QUIC][258 pkts/178495 bytes]
+	1	UDP 192.168.1.7:53859 <-> 216.58.205.66:443 [proto: 188.126/QUIC.Google][18 pkts/8665 bytes][Host: googleads.g.doubleclick.net]
+	2	UDP 192.168.1.7:54997 <-> 216.58.205.66:443 [proto: 188.126/QUIC.Google][13 pkts/4479 bytes][Host: pagead2.googlesyndication.com]
+	3	UDP 192.168.1.7:56074 <-> 216.58.198.33:443 [proto: 188.124/QUIC.YouTube][258 pkts/178495 bytes][Host: yt3.ggpht.com]