Project

General

Profile

Actions
Copy link

Feature #7446

open

add logic to parse QUIC CRYPTO frames and provide a keyword to access the reassembled data

Added by James Emery-Callcott 10 days ago. Updated 8 days ago.

Status:
New
Priority:
Normal
Assignee:
OISF Dev
Target version:
TBD
Effort:
Difficulty:
Label:

Description

Apologies if this is a duplicate report, I couldn't find anything else when searching.

Currently, we have no method of writing detection on a TLS record when used in QUIC (problematic for protocols such as HTTP/3). QUIC transmits TLS records via numerous 'CRYPTO' frames over multiple QUIC 'Initial' packets, these CRYPTO frames can also be out of order when initially received. Wireshark has a working and reliable (so far) protocol dissector for QUIC that also includes logic to reassemble these CRYPTO frames and provide the reassembled output (in this case, it would be something like a TLS Client Hello or TLS Server Hello).

Wireshark dissector, case where the CRYPTO frame begins getting parsed - https://gitlab.com/wireshark/wireshark/-/blob/master/epan/dissectors/packet-quic.c#L2440

Actions
Copy link

Also available in: Atom PDF