Add --udp-filter-quic=parse

This will enable QUIC decryption and parsing.
This commit is contained in:
Vadim Vetrov
2025-01-03 15:52:53 +03:00
parent 91e6825cb2
commit 0280fe383f
4 changed files with 27 additions and 7 deletions

View File

@@ -368,7 +368,7 @@ void print_usage(const char *argv0) {
printf("\t--udp-fake-len=<size of upd fake>\n");
printf("\t--udp-faking-strategy={checksum|ttl|none}\n");
printf("\t--udp-dport-filter=<5,6,200-500>\n");
printf("\t--udp-filter-quic={disabled|all}\n");
printf("\t--udp-filter-quic={disabled|all|parsed}\n");
printf("\t--threads=<threads number>\n");
printf("\t--packet-mark=<mark>\n");
printf("\t--connbytes-limit=<pkts>\n");
@@ -764,6 +764,8 @@ int yparse_args(int argc, char *argv[]) {
sect_config->udp_filter_quic = UDP_FILTER_QUIC_DISABLED;
} else if (strcmp(optarg, "all") == 0) {
sect_config->udp_filter_quic = UDP_FILTER_QUIC_ALL;
} else if (strcmp(optarg, "parsed") == 0) {
sect_config->udp_filter_quic = UDP_FILTER_QUIC_PARSED;
} else {
goto invalid_opt;
}
@@ -930,6 +932,9 @@ static size_t print_config_section(const struct section_config_t *section, char
case UDP_FILTER_QUIC_DISABLED:
print_cnf_buf("--udp-filter-quic=disabled");
break;
case UDP_FILTER_QUIC_PARSED:
print_cnf_buf("--udp-filter-quic=parsed");
break;
}
if (section->udp_dport_range_len != 0) {

View File

@@ -218,6 +218,7 @@ enum {
enum {
UDP_FILTER_QUIC_DISABLED,
UDP_FILTER_QUIC_ALL,
UDP_FILTER_QUIC_PARSED,
};
#define default_section_config { \

View File

@@ -404,7 +404,7 @@ int detect_udp_filtered(const struct section_config_t *section,
goto skip;
}
if (section->udp_filter_quic) {
if (section->udp_filter_quic != UDP_FILTER_QUIC_DISABLED) {
const struct quic_lhdr *qch;
uint32_t qch_len;
struct quic_cids qci;
@@ -430,6 +430,12 @@ int detect_udp_filtered(const struct section_config_t *section,
goto match_port;
}
if (section->udp_filter_quic == UDP_FILTER_QUIC_ALL ||
section->all_domains) {
lgtrace_addp("QUIC early approve");
goto approve;
}
uint8_t *decrypted_payload;
uint32_t decrypted_payload_len;
const uint8_t *decrypted_message;
@@ -452,7 +458,7 @@ int detect_udp_filtered(const struct section_config_t *section,
);
if (tlsv.sni_len != 0) {
lgdebugmsg("QUIC SNI detected: %.*s", tlsv.sni_len, tlsv.sni_ptr);
lgtrace_addp("QUIC SNI detected: %.*s", tlsv.sni_len, tlsv.sni_ptr);
}
if (tlsv.target_sni) {