Feature #7446: add logic to parse QUIC CRYPTO frames and provide a keyword to access the reassembled data - Suricata - Open Information Security Foundation

Actions

Copy link

Feature #7446

open

add logic to parse QUIC CRYPTO frames and provide a keyword to access the reassembled data

Added by James Emery-Callcott 10 days ago. Updated 8 days ago.

Status:

New

Priority:

Normal

Assignee:

OISF Dev

Target version:

TBD

Effort:

Difficulty:

Label:

Description

Apologies if this is a duplicate report, I couldn't find anything else when searching.

Currently, we have no method of writing detection on a TLS record when used in QUIC (problematic for protocols such as HTTP/3). QUIC transmits TLS records via numerous 'CRYPTO' frames over multiple QUIC 'Initial' packets, these CRYPTO frames can also be out of order when initially received. Wireshark has a working and reliable (so far) protocol dissector for QUIC that also includes logic to reassemble these CRYPTO frames and provide the reassembled output (in this case, it would be something like a TLS Client Hello or TLS Server Hello).

Wireshark dissector, case where the CRYPTO frame begins getting parsed - https://gitlab.com/wireshark/wireshark/-/blob/master/epan/dissectors/packet-quic.c#L2440