QUIC: extract User Agent information

2 files changed, 75 insertions, 9 deletions

diff --git a/src/lib/protocols/quic.c b/src/lib/protocols/quic.c
index 84ad23799..1913a8d85 100644
--- a/src/lib/protocols/quic.c
+++ b/src/lib/protocols/quic.c
@@ -43,7 +43,10 @@
    */
 
 extern int processClientServerHello(struct ndpi_detection_module_struct *ndpi_struct,
-                                    struct ndpi_flow_struct *flow, int is_quic);
+                                    struct ndpi_flow_struct *flow, uint32_t quic_version);
+extern int http_process_user_agent(struct ndpi_detection_module_struct *ndpi_struct,
+                                   struct ndpi_flow_struct *flow,
+                                   const u_int8_t *ua_ptr, u_int16_t ua_ptr_len);
 
 /* Versions */
 #define V_Q024		0x51303234
@@ -141,9 +144,13 @@ static int is_version_with_tls(uint32_t version)
   return is_version_quic(version) ||
     ((version & 0xFFFFFF00) == 0x54303500) /* T05X */;
 }
+int is_version_with_var_int_transport_params(uint32_t version)
+{
+  return (is_version_quic(version) && is_quic_ver_greater_than(version, 27)) ||
+    (version == V_T051);
+}
 
-
-static int quic_len(const uint8_t *buf, uint64_t *value)
+int quic_len(const uint8_t *buf, uint64_t *value)
 {
   *value = buf[0];
   switch((*value) >> 6) {
@@ -1015,7 +1022,8 @@ static uint8_t *get_clear_payload(struct ndpi_detection_module_struct *ndpi_stru
 }
 static void process_tls(struct ndpi_detection_module_struct *ndpi_struct,
 			struct ndpi_flow_struct *flow,
-			const u_int8_t *crypto_data, uint32_t crypto_data_len)
+			const u_int8_t *crypto_data, uint32_t crypto_data_len,
+			uint32_t version)
 {
   struct ndpi_packet_struct *packet = &flow->packet;
 
@@ -1027,7 +1035,7 @@ static void process_tls(struct ndpi_detection_module_struct *ndpi_struct,
   packet->payload = crypto_data;
   packet->payload_packet_len = crypto_data_len;
 
-  processClientServerHello(ndpi_struct, flow, 1);
+  processClientServerHello(ndpi_struct, flow, version);
 
   /* Restore */
   packet->payload = p;
@@ -1049,6 +1057,7 @@ static void process_chlo(struct ndpi_detection_module_struct *ndpi_struct,
   uint32_t prev_offset;
   uint32_t tag_offset_start, offset, len, sni_len;
   ndpi_protocol_match_result ret_match;
+  int sni_found = 0, ua_found = 0;
 
   if(crypto_data_len < 6)
     return;
@@ -1086,7 +1095,19 @@ static void process_chlo(struct ndpi_detection_module_struct *ndpi_struct,
                                   (char *)flow->host_server_name,
                                   strlen((const char*)flow->host_server_name),
                                   &ret_match, NDPI_PROTOCOL_QUIC);
-      return;
+      sni_found = 1;
+      if (ua_found)
+        return;
+    }
+    if((memcmp(tag, "UAID", 4) == 0) &&
+       (tag_offset_start + prev_offset + len < crypto_data_len)) {
+      NDPI_LOG_DBG2(ndpi_struct, "UA: [%.*s]\n", len, &crypto_data[tag_offset_start + prev_offset]);
+
+      http_process_user_agent(ndpi_struct, flow,
+                              &crypto_data[tag_offset_start + prev_offset], len);
+      ua_found = 1;
+      if (sni_found)
+        return;
     }
 
     prev_offset = offset;
@@ -1235,7 +1256,7 @@ void ndpi_search_quic(struct ndpi_detection_module_struct *ndpi_struct,
   if(!is_version_with_tls(version)) {
     process_chlo(ndpi_struct, flow, crypto_data, crypto_data_len);
   } else {
-    process_tls(ndpi_struct, flow, crypto_data, crypto_data_len);
+    process_tls(ndpi_struct, flow, crypto_data, crypto_data_len, version);
   }
   if(is_version_with_encrypted_header(version)) {
     ndpi_free(clear_payload);
diff --git a/src/lib/protocols/tls.c b/src/lib/protocols/tls.c
index aa3836442..18a56622f 100644
--- a/src/lib/protocols/tls.c
+++ b/src/lib/protocols/tls.c
@@ -31,7 +31,13 @@
 
 extern char *strptime(const char *s, const char *format, struct tm *tm);
 extern int processClientServerHello(struct ndpi_detection_module_struct *ndpi_struct,
-				    struct ndpi_flow_struct *flow, int is_quic);
+				    struct ndpi_flow_struct *flow, uint32_t quic_version);
+extern int http_process_user_agent(struct ndpi_detection_module_struct *ndpi_struct,
+                                   struct ndpi_flow_struct *flow,
+                                   const u_int8_t *ua_ptr, u_int16_t ua_ptr_len);
+/* QUIC/GQUIC stuff */
+extern int quic_len(const uint8_t *buf, uint64_t *value);
+extern int is_version_with_var_int_transport_params(uint32_t version);
 
 // #define DEBUG_TLS_MEMORY       1
 // #define DEBUG_TLS              1
@@ -864,7 +870,7 @@ struct ja3_info {
 /* **************************************** */
 
 int processClientServerHello(struct ndpi_detection_module_struct *ndpi_struct,
-			     struct ndpi_flow_struct *flow, int is_quic) {
+			     struct ndpi_flow_struct *flow, uint32_t quic_version) {
   struct ndpi_packet_struct *packet = &flow->packet;
   struct ja3_info ja3;
   u_int8_t invalid_ja3 = 0;
@@ -876,6 +882,7 @@ int processClientServerHello(struct ndpi_detection_module_struct *ndpi_struct,
   u_int16_t total_len;
   u_int8_t handshake_type;
   char buffer[64] = { '\0' };
+  int is_quic = (quic_version != 0);
   int is_dtls = packet->udp && (!is_quic);
 
 #ifdef DEBUG_TLS
@@ -1365,6 +1372,44 @@ int processClientServerHello(struct ndpi_detection_module_struct *ndpi_struct,
 		    }
 		  }
 		}
+	      } else if(extension_id == 65445 /* QUIC transport parameters */) {
+		u_int16_t s_offset = offset+extension_offset;
+		uint32_t final_offset;
+		int using_var_int = is_version_with_var_int_transport_params(quic_version);
+
+		if(!using_var_int) {
+		  u_int16_t seq_len = ntohs(*((u_int16_t*)&packet->payload[s_offset]));
+		  s_offset += 2;
+	          final_offset = MIN(total_len, s_offset + seq_len);
+		} else {
+	          final_offset = MIN(total_len, s_offset + extension_len);
+		}
+
+		while(s_offset < final_offset) {
+		  u_int64_t param_type, param_len;
+
+                  if(!using_var_int) {
+		    param_type = ntohs(*((u_int16_t*)&packet->payload[s_offset]));
+		    param_len = ntohs(*((u_int16_t*)&packet->payload[s_offset + 2]));
+		    s_offset += 4;
+		  } else {
+		    s_offset += quic_len(&packet->payload[s_offset], &param_type);
+		    s_offset += quic_len(&packet->payload[s_offset], &param_len);
+		  }
+
+#ifdef DEBUG_TLS
+		  printf("Client SSL [QUIC TP: Param 0x%x Len %d]\n", (int)param_type, (int)param_len);
+#endif
+		  if(param_type==0x3129) {
+#ifdef DEBUG_TLS
+		      printf("UA [%.*s]\n", (int)param_len, &packet->payload[s_offset]);
+#endif
+		      http_process_user_agent(ndpi_struct, flow,
+					      &packet->payload[s_offset], param_len);
+		      break;
+		  }
+		  s_offset += param_len;
+		}
 	      }
 
 	      extension_offset += extension_len; /* Move to the next extension */