Suricata

I can look into this. Here's what I'm thinking:

QUIC AppLayer

Parser: Rust
- Look at using https://github.com/cloudflare/quiche, downside is: quiche requires Rust 1.39 or later to build.
- Write a nom parser, using nom-derive
- Long and short header versions

Keyword:
- CYU (much like JA3 but for QUIC):
- Generate CYU hash and tags for the QUIC ClientHello packet
- Create a `cyu.string` and `cyu.hash` keyword

Logging:
- Anything required here?

Other resources:
Quiche parsing: https://docs.rs/quiche/0.3.0/src/quiche/packet.rs.html#173
https://www.sans.org/reading-room/whitepapers/detection/quic-dead-common-ids-ips-tools-identify-quic-traffic-39590
RFC: https://tools.ietf.org/html/draft-ietf-quic-transport-29#section-17

Are there other areas which should be looked at?

Quiche could be nice for parsing, we can then manipulate on the parsed values. It also has support for many drafts of the protocol (as it's not stabilized yet)

Latest draft: https://tools.ietf.org/html/draft-ietf-quic-transport-29#section-17

I'll implement a parser for it.

FYI GQUIC is a predecessor of QUIC IETF

The parser in the OP parses GQUIC Versions Q039-Q046.

@John Althouse, would you have specific PCAPs for testing?

Let me add in Caleb Yu here.