Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update quic.c #10

Merged
merged 2 commits into from
May 22, 2015
Merged

Update quic.c #10

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
12ac636
Merge pull request #1 from ntop/dev
backer-and May 21, 2015
55f45d4
Update quic.c
backer-and May 21, 2015
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
182 changes: 88 additions & 94 deletions src/lib/protocols/quic.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,21 +23,21 @@

#include "ndpi_api.h"

#define QUIC_NO_V_RES_RSV 0xC3 // 1100 0011
#define QUIC_NO_V_RES_RSV 0xC3

#define QUIC_CID_MASK 0x0C // 0000 1100
#define QUIC_VER_MASK 0x01 // 0000 0001
#define QUIC_SEQ_MASK 0x30 // 0011 0000
#define QUIC_CID_MASK 0x0C
#define QUIC_VER_MASK 0x01
#define QUIC_SEQ_MASK 0x30

#define CID_LEN_8 0x0C // 0000 1100
#define CID_LEN_4 0x08 // 0000 1000
#define CID_LEN_1 0x04 // 0000 0100
#define CID_LEN_0 0x00 // 0000 0000
#define CID_LEN_8 0x0C
#define CID_LEN_4 0x08
#define CID_LEN_1 0x04
#define CID_LEN_0 0x00

#define SEQ_LEN_6 0x30 // 0011 0000
#define SEQ_LEN_4 0x20 // 0010 0000
#define SEQ_LEN_2 0x10 // 0001 0000
#define SEQ_LEN_1 0x00 // 0000 0000
#define SEQ_LEN_6 0x30
#define SEQ_LEN_4 0x20
#define SEQ_LEN_2 0x10
#define SEQ_LEN_1 0x00

#define SEQ_CONV(ARR) (ARR[0] | ARR[1] | ARR[2] | ARR[3] | ARR[4] | ARR[5] << 8)

Expand All @@ -46,118 +46,112 @@
static void ndpi_int_quic_add_connection(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow)
{
ndpi_int_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_QUIC, NDPI_REAL_PROTOCOL);
ndpi_int_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_QUIC, NDPI_REAL_PROTOCOL);
}

static int connect_id(const unsigned char pflags)
{
u_int cid_len;

// Check CID length.
switch (pflags & QUIC_CID_MASK)
u_int cid_len;

switch (pflags & QUIC_CID_MASK)
{
case CID_LEN_8: cid_len = 8; break;
case CID_LEN_4: cid_len = 4; break;
case CID_LEN_1: cid_len = 1; break;
case CID_LEN_0: cid_len = 0; break;
default:
return -1;
return -1;

}
// Return offset.
return cid_len + 1;

return cid_len + 1;
}

static int sequence(const unsigned char *payload)
{
unsigned char conv[6] = {0};
u_int seq_value = -1;
int seq_lens;
int cid_offs;
int i;

// Search SEQ bytes length.
switch (payload[0] & QUIC_SEQ_MASK)
unsigned char conv[6] = {0};
u_int seq_value = -1;
int seq_lens;
int cid_offs;
int i;

switch (payload[0] & QUIC_SEQ_MASK)
{
case SEQ_LEN_6: seq_lens = 6; break;
case SEQ_LEN_4: seq_lens = 4; break;
case SEQ_LEN_2: seq_lens = 2; break;
case SEQ_LEN_1: seq_lens = 1; break;
default:
return -1;
return -1;
}
// Retrieve SEQ offset.
cid_offs = connect_id(payload[0]);

if (cid_offs >= 0 && seq_lens > 0)
cid_offs = connect_id(payload[0]);

if (cid_offs != -1 && seq_lens > 0)
{
for (i = 0; i < seq_lens; i++)
conv[i] = payload[cid_offs + i];
for (i = 0; i < seq_lens; i++)
conv[i] = payload[cid_offs + i];

seq_value = SEQ_CONV(conv);
seq_value = SEQ_CONV(conv);
}
// Return SEQ dec value;
return seq_value;

return seq_value;
}

void ndpi_search_quic(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
{
struct ndpi_packet_struct *packet = &flow->packet;
int ver_offs;

if(packet->udp != NULL) {
u_int16_t sport = ntohs(packet->udp->source), dport = ntohs(packet->udp->dest);

NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "calculating quic over udp.\n");

if(((packet->payload[0] & 0xF0) != 0)
|| (!(sport == 80 || dport == 80 || sport == 443 || dport == 443)))
goto exclude_quic;

// Settings without version. First check if PUBLIC FLAGS & SEQ bytes are 0x0. SEQ must be 1 at least.
if ((packet->payload[0] == 0x00 && packet->payload[1] != 0x00) || ((packet->payload[0] & QUIC_NO_V_RES_RSV) == 0))
{
if (sequence(packet->payload) < 1)
{

NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "exclude quic.\n");
NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_QUIC);
}

NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "found quic.\n");
ndpi_int_quic_add_connection(ndpi_struct, flow);
}

// Check if version, than the CID length.
else if (packet->payload[0] & QUIC_VER_MASK)
{
// Skip CID length.
ver_offs = connect_id(packet->payload[0]);

if (ver_offs >= 0){
unsigned char vers[] = {packet->payload[ver_offs], packet->payload[ver_offs + 1],
packet->payload[ver_offs + 2], packet->payload[ver_offs + 3]};

// Version Match.
if (vers[0] == 'Q' && vers[1] == '0' &&
(vers[2] == '2' && (vers[3] == '5' || vers[3] == '4' || vers[3] == '3' || vers[3] == '2' ||
vers[3] == '1' || vers[3] == '0')) ||
(vers[2] == '1' && (vers[3] == '9' || vers[3] == '8' || vers[3] == '7' || vers[3] == '6' ||
vers[3] == '5' || vers[3] == '4' || vers[3] == '3' || vers[3] == '2' ||
vers[3] == '1' || vers[3] == '0')) ||
(vers[2] == '0' && vers[3] == '9'))

{
NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "found quic.\n");
ndpi_int_quic_add_connection(ndpi_struct, flow);
}
}
} else
{
exclude_quic:
NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "exclude quic.\n");
NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_QUIC);
}
}
struct ndpi_packet_struct *packet = &flow->packet;
unsigned char *vers;
int ver_offs;

if(packet->udp != NULL)
{
u_int16_t sport = ntohs(packet->udp->source), dport = ntohs(packet->udp->dest);

NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "calculating quic over udp.\n");

if(((packet->payload[0] & 0xC2) != 0) || (!(sport == 80 || dport == 80 || sport == 443 || dport == 443)))
goto exclude_quic;

/* Quic without version. First check if PUBLIC FLAGS & SEQ bytes are 0x0, SEQ must be greater than zero */
if (((packet->payload[0] == 0x00) && (packet->payload[1] != 0x00)) || ((packet->payload[0] & QUIC_NO_V_RES_RSV) == 0))
{
if (sequence(packet->payload) < 1)
{
NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "exclude quic.\n");
NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_QUIC);
}

NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "found quic.\n");
ndpi_int_quic_add_connection(ndpi_struct, flow);
}

else if (packet->payload[0] & QUIC_VER_MASK)
{
ver_offs = connect_id(packet->payload[0]);

if (ver_offs != -1){
vers = packet->payload + ver_offs;

if ((vers[0] == 'Q' && vers[1] == '0') &&
((vers[2] == '2' && (vers[3] == '5' || vers[3] == '4' || vers[3] == '3' || vers[3] == '2' ||
vers[3] == '1' || vers[3] == '0')) ||
(vers[2] == '1' && (vers[3] == '9' || vers[3] == '8' || vers[3] == '7' || vers[3] == '6' ||
vers[3] == '5' || vers[3] == '4' || vers[3] == '3' || vers[3] == '2' ||
vers[3] == '1' || vers[3] == '0')) ||
(vers[2] == '0' && vers[3] == '9')))

{
NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "found quic.\n");
ndpi_int_quic_add_connection(ndpi_struct, flow);
}
}
} else
{
exclude_quic:
NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "exclude quic.\n");
NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_QUIC);
}
}
}
#endif