Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Quic ietf 4967 v8 #7130

Closed
wants to merge 15 commits into from
Closed

Quic ietf 4967 v8 #7130

wants to merge 15 commits into from

Commits on Mar 6, 2022

  1. quic: rustfmt

    @catenacyber
    catenacyber committed Mar 6, 2022
    Configuration menu
    Copy the full SHA
    8dbe67e View commit details
    Browse the repository at this point in the history

  2. quic: complete parsing of initial for non gquic 

    Ticket: 4967

The format of initial packet for quic ietf, ie quic v1,
is described in rfc 9000, section 17.2.2
    @catenacyber
    catenacyber committed Mar 6, 2022
    Configuration menu
    Copy the full SHA
    6d6f589 View commit details
    Browse the repository at this point in the history

  3. rdp: bump up tls-parser crate version 

    so that we can use new functions in quic parser
    @catenacyber
    catenacyber committed Mar 6, 2022
    Configuration menu
    Copy the full SHA
    9c5f217 View commit details
    Browse the repository at this point in the history

  4. quic: parse more frames 

    and logs interesting extensions from crypto frame
    @catenacyber
    catenacyber committed Mar 6, 2022
    Configuration menu
    Copy the full SHA
    6feb585 View commit details
    Browse the repository at this point in the history

  5. quic: use packet num length when decrypting 

    As it can be 4, but it can also be 1, based on the first
decrypted byte
    @catenacyber
    catenacyber committed Mar 6, 2022
    Configuration menu
    Copy the full SHA
    38c90ee View commit details
    Browse the repository at this point in the history

  6. quic: do not try to parse encrypted data 

    The way to determine if the payload is encrypted is by storing
in the state if we have seen a crypto frame in both directions...
    @catenacyber
    catenacyber committed Mar 6, 2022
    Configuration menu
    Copy the full SHA
    a6f8a2b View commit details
    Browse the repository at this point in the history

  7. quic: decrypt in its own function 

    So as to keep parse not too big
    @catenacyber
    catenacyber committed Mar 6, 2022
    Configuration menu
    Copy the full SHA
    2d77782 View commit details
    Browse the repository at this point in the history

  8. quic: use sni from crypto frame with tls 

    for detection
    @catenacyber
    catenacyber committed Mar 6, 2022
    Configuration menu
    Copy the full SHA
    5babeaa View commit details
    Browse the repository at this point in the history

  9. quic: ja3 computation and logging and detection 

    Ticket: 5143
    @catenacyber
    catenacyber committed Mar 6, 2022
    Configuration menu
    Copy the full SHA
    556a131 View commit details
    Browse the repository at this point in the history

  10. quic: function split in 2 and other style improvements

    @catenacyber
    catenacyber committed Mar 6, 2022
    Configuration menu
    Copy the full SHA
    2fcce92 View commit details
    Browse the repository at this point in the history

  11. quic: move earlier the check against header.length

    @catenacyber
    catenacyber committed Mar 6, 2022
    Configuration menu
    Copy the full SHA
    48ed785 View commit details
    Browse the repository at this point in the history

  12. quic: use Suricata's own quic_tls_extension_name

    @catenacyber
    catenacyber committed Mar 6, 2022
    Configuration menu
    Copy the full SHA
    9e0d20b View commit details
    Browse the repository at this point in the history

  13. quic: parse gquic version Q039 

    Ticket: 5166
    @catenacyber
    catenacyber committed Mar 6, 2022
    Configuration menu
    Copy the full SHA
    6bd8d80 View commit details
    Browse the repository at this point in the history

  14. quic: check against right remaining buffer

    @catenacyber
    catenacyber committed Mar 6, 2022
    Configuration menu
    Copy the full SHA
    190d858 View commit details
    Browse the repository at this point in the history

Commits on Mar 10, 2022

  1. quic: detect ja3 from server with keyword quic.ja3s 

    As the ja3 standard names it so, with an s, when it comes
from the server to the client.
    @catenacyber
    catenacyber committed Mar 10, 2022
    Configuration menu
    Copy the full SHA
    71bc1fd View commit details
    Browse the repository at this point in the history