From 7a83a8dc9122a730a74e5ac644413ae87f94e563 Mon Sep 17 00:00:00 2001 From: Ivan Nardi <12729895+IvanNardi@users.noreply.github.com> Date: Wed, 24 Jan 2024 09:57:28 +0100 Subject: QUIC: fix decryption with CH fragments with different Destination CID (#2278) QUIC decryption fails when the Client Hello is split into multiple UDP packets and these packets have different Destination Connection IDs (because the server told the client to switch to a different CID; see RFC 9000 7.2) ``` The Destination Connection ID field from the first Initial packet sent by a client is used to determine packet protection keys for Initial packets. [..] Upon first receiving an Initial or Retry packet from the server, the client uses the Source Connection ID supplied by the server as the Destination Connection ID for subsequent packets ``` From a logical point of view, the ciphers used for decryption should be initialized only once, with the first Initial pkt sent by the client and kept for later usage with the following packets (if any). However it seems that we can safely initialize them at each packet, if we keep using the DCID of the **first** packet sent by the client. Keep initializing the ciphers at each packet greatly simplifie this patch. This issue has been undetected for so long because: * in the vast majority of the cases we only decrypt one packet per flow; * the available traces with the Client Hello split into multiple packets (i.e. cases where we need to decrypt at least two packets per flow) were created in a simple test environment to simulate Post-Quantum handshake, and in that scenario the client sent all the packets (with the same DCID) before any reply from the server. However, in the last months all major browsers started supporting PQ key, so it is now common to have split CH in real traffic. Please note that in the attached example, the CH is split into 2 (in-order) fragments (in different UDP packets) and the second one in turn is divided into 9 (out-of-order) CRYPTO frames; the reassembler code works out-of-the-box even in this (new) scenario. --- .../default/pcap/quic_frags_different_dcid.pcapng | Bin 0 -> 4036 bytes .../result/quic_frags_different_dcid.pcapng.out | 33 +++++++++++++++++++++ 2 files changed, 33 insertions(+) create mode 100644 tests/cfgs/default/pcap/quic_frags_different_dcid.pcapng create mode 100644 tests/cfgs/default/result/quic_frags_different_dcid.pcapng.out (limited to 'tests') diff --git a/tests/cfgs/default/pcap/quic_frags_different_dcid.pcapng b/tests/cfgs/default/pcap/quic_frags_different_dcid.pcapng new file mode 100644 index 000000000..c10e6d333 Binary files /dev/null and b/tests/cfgs/default/pcap/quic_frags_different_dcid.pcapng differ diff --git a/tests/cfgs/default/result/quic_frags_different_dcid.pcapng.out b/tests/cfgs/default/result/quic_frags_different_dcid.pcapng.out new file mode 100644 index 000000000..a20efaff1 --- /dev/null +++ b/tests/cfgs/default/result/quic_frags_different_dcid.pcapng.out @@ -0,0 +1,33 @@ +DPI Packets (UDP): 3 (3.00 pkts/flow) +Confidence DPI : 1 (flows) +Num dissector calls: 1 (1.00 diss/flow) +LRU cache ookla: 0/0/0 (insert/search/found) +LRU cache bittorrent: 0/0/0 (insert/search/found) +LRU cache zoom: 0/0/0 (insert/search/found) +LRU cache stun: 0/0/0 (insert/search/found) +LRU cache tls_cert: 0/0/0 (insert/search/found) +LRU cache mining: 0/0/0 (insert/search/found) +LRU cache msteams: 0/0/0 (insert/search/found) +LRU cache stun_zoom: 0/0/0 (insert/search/found) +Automa host: 1/1 (search/found) +Automa domain: 1/0 (search/found) +Automa tls cert: 0/0 (search/found) +Automa risk mask: 0/0 (search/found) +Automa common alpns: 1/1 (search/found) +Patricia risk mask: 2/0 (search/found) +Patricia risk mask IPv6: 0/0 (search/found) +Patricia risk: 1/0 (search/found) +Patricia risk IPv6: 0/0 (search/found) +Patricia protocols: 2/0 (search/found) +Patricia protocols IPv6: 0/0 (search/found) + +Cloudflare 3 3826 1 + +Acceptable 3 3826 1 + +JA3 Host Stats: + IP Address # JA3C + 1 129.21.84.33 1 + + + 1 UDP 129.21.84.33:37229 <-> 73.185.34.172:443 [proto: 188.220/QUIC.Cloudflare][IP: 0/Unknown][Encrypted][Confidence: DPI][DPI packets: 3][cat: Media/1][2 pkts/2584 bytes <-> 1 pkts/1242 bytes][Goodput ratio: 97/97][0.26 sec][Hostname/SNI: cdnjs.cloudflare.com][(Advertised) ALPNs: h3][TLS Supported Versions: TLSv1.3][TLSv1.3][QUIC ver: V-1][JA3C: 77f2e7e7117b061992c6529845aa351c][JA4: q13d0311h][ECH: version 0xfe0d][PLAIN TEXT (27B@yd)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,33,0,66,0,0,0,0,0,0,0,0] -- cgit v1.2.3