From f517a6a373f3f12d3fcd4ab3d33e88cf6def0277 Mon Sep 17 00:00:00 2001 From: Andrea Buscarinu Date: Tue, 17 May 2016 22:30:11 +0200 Subject: Fix QUIC --- src/lib/protocols/quic.c | 149 ++++++++++++++++++----------------------------- 1 file changed, 57 insertions(+), 92 deletions(-) (limited to 'src/lib/protocols/quic.c') diff --git a/src/lib/protocols/quic.c b/src/lib/protocols/quic.c index a3e247134..5be4e955f 100644 --- a/src/lib/protocols/quic.c +++ b/src/lib/protocols/quic.c @@ -24,133 +24,97 @@ #include "ndpi_api.h" -#define QUIC_NO_V_RES_RSV 0xC3 // 1100 0011 +#define QUIC_NO_V_RES_RSV 0xC3 // 1100 0001 -#define QUIC_CID_MASK 0x0C // 0000 1100 -#define QUIC_VER_MASK 0x01 // 0000 0001 -#define QUIC_SEQ_MASK 0x30 // 0011 0000 +#define QUIC_FLG_VERS 0x01 // 0000 0001 +#define QUIC_FLG_RSET 0x02 // 0000 0010 +#define QUIC_FLG_NNCE 0x04 // 0000 0100 +#define QUIC_FLG_CIDL 0x08 // 0000 1000 +#define QUIC_FLG_PACK 0x30 // 0011 0000 +#define QUIC_FLG_PATH 0x40 // 0100 0000 -#define CID_LEN_8 0x0C // 0000 1100 -#define CID_LEN_0 0x00 // 0000 0000 +#define OFF_LEN_00 0x00 // 0000 0000 +#define OFF_LEN_04 0x04 // 0000 0100 +#define OFF_LEN_08 0x08 // 0000 1000 +#define OFF_LEN_0C 0x0C // 0000 1100 -#define CID_LEN_4 0x08 // 0000 1000 -#define CID_LEN_1 0x04 // 0000 0100 +#define PKN_LEN_1 0x00 // 0000 0000 +#define PKN_LEN_2 0x10 // 0001 0000 +#define PKN_LEN_4 0x20 // 0010 0000 +#define PKN_LEN_6 0x30 // 0011 0000 -#define SEQ_LEN_6 0x30 // 0011 0000 -#define SEQ_LEN_4 0x20 // 0010 0000 -#define SEQ_LEN_2 0x10 // 0001 0000 -#define SEQ_LEN_1 0x00 // 0000 0000 #define INT(C) (C - '0') #define DIGIT(X, Y, Z) ((isdigit(X) && isdigit(Y) && isdigit(Z)) ? (INT(X) * 100 + INT(Y) * 10 + INT(Z)) : 0) #ifdef NDPI_PROTOCOL_QUIC - - - static void ndpi_int_quic_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_QUIC, NDPI_PROTOCOL_UNKNOWN); } +static int ports(u_int16_t sport, u_int16_t dport) +{ + if ((sport == 443 || dport == 443 || sport == 80 || dport == 80) && + (sport != 123 && dport != 123)) + return 0; + return 1; +} -static int connect_id(const unsigned char pflags) +static int offset(const unsigned char pflags) { - u_int cid_len; + u_int offs; - // Check CID length - switch (pflags & QUIC_CID_MASK) + switch (pflags & (QUIC_FLG_CIDL | QUIC_FLG_NNCE)) { - case CID_LEN_8: cid_len = 8; break; - case CID_LEN_4: cid_len = 4; break; - case CID_LEN_1: cid_len = 1; break; - case CID_LEN_0: cid_len = 0; break; + case OFF_LEN_08: offs = 8; break; + case OFF_LEN_0C: offs = 8; break; default: - return -1; + return 1; } - - // Return offset - return cid_len + 1; + return offs + 1; } - -static int sequence(const unsigned char *payload) +static int vers(const unsigned char *payload) { - char test[6] = {0}; - int cid_offs = connect_id(payload[0]); - int seq_lens; + int voffs = offset(*payload); + const uint8_t *vers = &payload[voffs]; - // Retrieve SEQ offset. - if (cid_offs >= 0) + if (*vers == 'Q') { - // Search SEQ bytes length. - switch (payload[0] & QUIC_SEQ_MASK) + short int res = DIGIT(vers[1], vers[2], vers[3]); + + switch (res) { - case SEQ_LEN_6: seq_lens = 6; break; - case SEQ_LEN_4: seq_lens = 4; break; - case SEQ_LEN_2: seq_lens = 2; break; - case SEQ_LEN_1: seq_lens = 1; break; - default: + case 9: case 10: case 11: case 12: case 13: case 14: + case 15: case 16: case 17: case 18: case 19: case 20: + case 21: case 23: case 24: case 25: case 26: case 27: + case 29: case 30: case 31: case 32: case 33: case 34: return 0; + break; + default: + return 1; } } - - // Return SEQ comp value; - return memcmp(payload + cid_offs, test, seq_lens); + return 1; } - void ndpi_search_quic(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; - int ver_offs; + u_int32_t udp_len = packet->payload_packet_len; - // UDP 2-bytes F/P - if(packet->udp != NULL && packet->payload_packet_len > 2) + if (packet->udp != NULL && udp_len > 2) { u_int16_t sport = ntohs(packet->udp->source), dport = ntohs(packet->udp->dest); NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "calculating QUIC over udp.\n"); - if (sport == 80 || dport == 80 || sport == 443 || dport == 443) + if ((ports(sport, dport) == 0 && (packet->payload[0] & QUIC_NO_V_RES_RSV) == 0) + || vers(packet->payload) == 0) { - // Check if NO_VERS. PUBLIC FLAGS & SEQ/CID MASK == 0x0. SEQ must be -gt 0. - if ((packet->payload[0] & QUIC_NO_V_RES_RSV) == 0 && sequence(packet->payload)) - { - NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "found QUIC.\n"); - ndpi_int_quic_add_connection(ndpi_struct, flow); - } - - // Version presence; CID length - if (packet->payload[0] & QUIC_VER_MASK) - { - // Skip CID length - ver_offs = connect_id(packet->payload[0]); - - if (ver_offs >= 0) - { - const uint8_t *vers = &packet->payload[ver_offs]; - short int res = DIGIT(vers[1], vers[2], vers[3]); - - if (*vers == 'Q') - { - // QUIC versions. '22', '28' < omitted. - switch (res) - { - case 9: case 10: case 11: case 12: case 13: case 14: - case 15: case 16: case 17: case 18: case 19: case 20: - case 21: case 23: case 24: case 25: case 26: case 27: - case 29: case 30: case 31: case 32: case 33: case 34: - NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "found QUIC.\n"); - ndpi_int_quic_add_connection(ndpi_struct, flow); - break; - default: - NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "exclude QUIC.\n"); - NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_QUIC); - } - } - } - } + NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "found QUIC.\n"); + ndpi_int_quic_add_connection(ndpi_struct, flow); } else { @@ -158,16 +122,17 @@ void ndpi_search_quic(struct ndpi_detection_module_struct *ndpi_struct, struct n NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_QUIC); } } + else + { + NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "exclude QUIC.\n"); + NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_QUIC); + } } - void init_quic_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { - ndpi_set_bitmask_protocol_detection("QUIC", ndpi_struct, detection_bitmask, *id, - NDPI_PROTOCOL_QUIC, - ndpi_search_quic, - NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD, - SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); + ndpi_set_bitmask_protocol_detection("QUIC", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_QUIC, ndpi_search_quic, + NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } -- cgit v1.2.3