From 7d5a0e1f04bce1b3de1eb5f4eea07fc4d25c8c92 Mon Sep 17 00:00:00 2001 From: Nardi Ivan Date: Tue, 8 Sep 2020 11:03:22 +0200 Subject: QUIC: extract User Agent information --- src/lib/protocols/quic.c | 35 ++++++++++++++++++++++++++++------- 1 file changed, 28 insertions(+), 7 deletions(-) (limited to 'src/lib/protocols/quic.c') diff --git a/src/lib/protocols/quic.c b/src/lib/protocols/quic.c index 84ad23799..1913a8d85 100644 --- a/src/lib/protocols/quic.c +++ b/src/lib/protocols/quic.c @@ -43,7 +43,10 @@ */ extern int processClientServerHello(struct ndpi_detection_module_struct *ndpi_struct, - struct ndpi_flow_struct *flow, int is_quic); + struct ndpi_flow_struct *flow, uint32_t quic_version); +extern int http_process_user_agent(struct ndpi_detection_module_struct *ndpi_struct, + struct ndpi_flow_struct *flow, + const u_int8_t *ua_ptr, u_int16_t ua_ptr_len); /* Versions */ #define V_Q024 0x51303234 @@ -141,9 +144,13 @@ static int is_version_with_tls(uint32_t version) return is_version_quic(version) || ((version & 0xFFFFFF00) == 0x54303500) /* T05X */; } +int is_version_with_var_int_transport_params(uint32_t version) +{ + return (is_version_quic(version) && is_quic_ver_greater_than(version, 27)) || + (version == V_T051); +} - -static int quic_len(const uint8_t *buf, uint64_t *value) +int quic_len(const uint8_t *buf, uint64_t *value) { *value = buf[0]; switch((*value) >> 6) { @@ -1015,7 +1022,8 @@ static uint8_t *get_clear_payload(struct ndpi_detection_module_struct *ndpi_stru } static void process_tls(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, - const u_int8_t *crypto_data, uint32_t crypto_data_len) + const u_int8_t *crypto_data, uint32_t crypto_data_len, + uint32_t version) { struct ndpi_packet_struct *packet = &flow->packet; @@ -1027,7 +1035,7 @@ static void process_tls(struct ndpi_detection_module_struct *ndpi_struct, packet->payload = crypto_data; packet->payload_packet_len = crypto_data_len; - processClientServerHello(ndpi_struct, flow, 1); + processClientServerHello(ndpi_struct, flow, version); /* Restore */ packet->payload = p; @@ -1049,6 +1057,7 @@ static void process_chlo(struct ndpi_detection_module_struct *ndpi_struct, uint32_t prev_offset; uint32_t tag_offset_start, offset, len, sni_len; ndpi_protocol_match_result ret_match; + int sni_found = 0, ua_found = 0; if(crypto_data_len < 6) return; @@ -1086,7 +1095,19 @@ static void process_chlo(struct ndpi_detection_module_struct *ndpi_struct, (char *)flow->host_server_name, strlen((const char*)flow->host_server_name), &ret_match, NDPI_PROTOCOL_QUIC); - return; + sni_found = 1; + if (ua_found) + return; + } + if((memcmp(tag, "UAID", 4) == 0) && + (tag_offset_start + prev_offset + len < crypto_data_len)) { + NDPI_LOG_DBG2(ndpi_struct, "UA: [%.*s]\n", len, &crypto_data[tag_offset_start + prev_offset]); + + http_process_user_agent(ndpi_struct, flow, + &crypto_data[tag_offset_start + prev_offset], len); + ua_found = 1; + if (sni_found) + return; } prev_offset = offset; @@ -1235,7 +1256,7 @@ void ndpi_search_quic(struct ndpi_detection_module_struct *ndpi_struct, if(!is_version_with_tls(version)) { process_chlo(ndpi_struct, flow, crypto_data, crypto_data_len); } else { - process_tls(ndpi_struct, flow, crypto_data, crypto_data_len); + process_tls(ndpi_struct, flow, crypto_data, crypto_data_len, version); } if(is_version_with_encrypted_header(version)) { ndpi_free(clear_payload); -- cgit v1.2.3 From 8db084ab06ae73e26c2373e92b35cbc5407d41bd Mon Sep 17 00:00:00 2001 From: Nardi Ivan Date: Thu, 10 Sep 2020 18:19:18 +0200 Subject: TLS: fix memory accesses in QUIC transport parameters extension --- src/lib/protocols/quic.c | 16 ++++++++++++++++ src/lib/protocols/tls.c | 25 +++++++++++++++++++++---- 2 files changed, 37 insertions(+), 4 deletions(-) (limited to 'src/lib/protocols/quic.c') diff --git a/src/lib/protocols/quic.c b/src/lib/protocols/quic.c index 1913a8d85..f58c030f5 100644 --- a/src/lib/protocols/quic.c +++ b/src/lib/protocols/quic.c @@ -170,6 +170,22 @@ int quic_len(const uint8_t *buf, uint64_t *value) return 0; } } +int quic_len_buffer_still_required(uint8_t value) +{ + switch(value >> 6) { + case 0: + return 0; + case 1: + return 1; + case 2: + return 3; + case 3: + return 7; + default: /* No Possible */ + return 0; + } +} + static uint16_t gquic_get_u16(const uint8_t *buf, uint32_t version) { diff --git a/src/lib/protocols/tls.c b/src/lib/protocols/tls.c index 18a56622f..0545d4972 100644 --- a/src/lib/protocols/tls.c +++ b/src/lib/protocols/tls.c @@ -37,6 +37,7 @@ extern int http_process_user_agent(struct ndpi_detection_module_struct *ndpi_str const u_int8_t *ua_ptr, u_int16_t ua_ptr_len); /* QUIC/GQUIC stuff */ extern int quic_len(const uint8_t *buf, uint64_t *value); +extern int quic_len_buffer_still_required(uint8_t value); extern int is_version_with_var_int_transport_params(uint32_t version); // #define DEBUG_TLS_MEMORY 1 @@ -1374,13 +1375,17 @@ int processClientServerHello(struct ndpi_detection_module_struct *ndpi_struct, } } else if(extension_id == 65445 /* QUIC transport parameters */) { u_int16_t s_offset = offset+extension_offset; - uint32_t final_offset; + uint16_t final_offset; int using_var_int = is_version_with_var_int_transport_params(quic_version); if(!using_var_int) { - u_int16_t seq_len = ntohs(*((u_int16_t*)&packet->payload[s_offset])); - s_offset += 2; - final_offset = MIN(total_len, s_offset + seq_len); + if(s_offset+1 >= total_len) { + final_offset = 0; /* Force skipping extension */ + } else { + u_int16_t seq_len = ntohs(*((u_int16_t*)&packet->payload[s_offset])); + s_offset += 2; + final_offset = MIN(total_len, s_offset + seq_len); + } } else { final_offset = MIN(total_len, s_offset + extension_len); } @@ -1389,17 +1394,29 @@ int processClientServerHello(struct ndpi_detection_module_struct *ndpi_struct, u_int64_t param_type, param_len; if(!using_var_int) { + if(s_offset+3 >= final_offset) + break; param_type = ntohs(*((u_int16_t*)&packet->payload[s_offset])); param_len = ntohs(*((u_int16_t*)&packet->payload[s_offset + 2])); s_offset += 4; } else { + if(s_offset >= final_offset || + (s_offset + quic_len_buffer_still_required(packet->payload[s_offset])) >= final_offset) + break; s_offset += quic_len(&packet->payload[s_offset], ¶m_type); + + if(s_offset >= final_offset || + (s_offset + quic_len_buffer_still_required(packet->payload[s_offset])) >= final_offset) + break; s_offset += quic_len(&packet->payload[s_offset], ¶m_len); } #ifdef DEBUG_TLS printf("Client SSL [QUIC TP: Param 0x%x Len %d]\n", (int)param_type, (int)param_len); #endif + if(s_offset+param_len >= final_offset) + break; + if(param_type==0x3129) { #ifdef DEBUG_TLS printf("UA [%.*s]\n", (int)param_len, &packet->payload[s_offset]); -- cgit v1.2.3