Quantcast
Channel: Active questions tagged https - Stack Overflow
Viewing all articles
Browse latest Browse all 1519

How to decrypt a Google QUIC packet in Wireshark?

$
0
0

I am studying the QUIC protocol in depth and using Google's QUICHE library to simulate QUIC connections. In the QUICHE repository, there are two example programs: quiche/quiche/quic/tools/toy_client.cc and quiche/quiche/quic/tools/toy_server.cc, which help me simulate a QUIC client and server.

Since, QUICHE needs to be build separately, I used this example implementation of QUICHE https://github.com/bilibili/quiche.

I used these examples to generate connections between the client and server and captured the packets using a Wireshark. Since both programs run on the terminal (and not in a browser), the SSLKEYLOGFILE.log was not generated explicitly, which I need to decrypt the captured packets.

To solve this, I modified the KeylogCallback function in the quiche/gquiche/quic/core/crypto/tls_server_connection.cc QUICHE library to create a file and append the session keys.

// staticvoid TlsServerConnection::KeylogCallback(const SSL *ssl, const char *line) {    const char* filePath = "sskleylogfile.log";    std::ofstream keylogFile(filePath, std::ios::app);    if (keylogFile.is_open()) {        keylogFile << line << std::endl;        keylogFile.close();    } else {        std::cerr << "Failed to open file: " << filePath << std::endl;    }    return;}

This effectively generates a SSLKEYLOGFILE and populate it with session keys that I can use to decrypt the packets.

This approach works perfectly for IETF QUIC versions draft29 and 00000001. However, it does not work for Google QUIC versions Q043, Q046, and Q050. In case of Google QUIC, no keys are being appended to the log file and thus I cannot decrypt the packets.

I am building the QUICHE library on Ubuntu 18.04. Due to the older dependencies in this environment, I cannot update the QUICHE library to its latest version.

Could someone help me understand why this might be happening or suggest a way to make it work for Google QUIC versions Q043, Q046, and Q050?

These are the flags I am using to configure the server

./build/simple_quic_server --quic_response_cache_dir=./data/quic-root/ --certificate_file=./data/quic-cert/leaf_cert.pem --key_file=./data/quic-cert/leaf_cert.pkcs8

and for client I am explicitly mentioning the version of Q043. If I use draft29 or 00000001, then session keys are generated, but I need if for any of the Q043, Q046 or Q050 versions.

./build/simple_quic_client --disable_certificate_verification=true --host=127.0.0.1 --port=6121 "https://www.example.org/index.html" --multi_packet_chlo=true --quic_version="Q043"

Viewing all articles
Browse latest Browse all 1519

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>