<quic> Add quic packet type information for each datagram.

include/ipfixprobe/ipfix-elements.hpp

@@ -248,6 +248,7 @@ namespace ipxp {
 #define QUIC_RETRY_SCID(F)            F(8057,    898,  -1,   nullptr)
 #define QUIC_MULTIPLEXED(F)           F(8057,    899,   1,   nullptr)
 #define QUIC_ZERO_RTT(F)              F(8057,    889,   1,   nullptr)
+#define QUIC_PACKETS(F)               F(8057,    888,  -1,   nullptr)
 
 
 #define OSQUERY_PROGRAM_NAME(F)       F(8057,    852,  -1,   nullptr)
@@ -511,7 +512,8 @@ namespace ipxp {
   F(QUIC_SCID) \
   F(QUIC_RETRY_SCID) \
   F(QUIC_MULTIPLEXED) \
-  F(QUIC_ZERO_RTT)
+  F(QUIC_ZERO_RTT) \
+  F(QUIC_PACKETS)
 
 #define IPFIX_OSQUERY_TEMPLATE(F) \
    F(OSQUERY_PROGRAM_NAME) \

process/quic.cpp

@@ -200,6 +200,14 @@ int QUICPlugin::process_quic(RecordExtQUIC *quic_data, Flow &rec, const Packet &
        uint8_t packets = 0;
        process_quic.quic_get_packets(packets);
 
+
+       // Store all QUIC packet types contained in each packet
+       uint8_t pos = rec.src_packets + rec.dst_packets -1;
+       if (pos < QUIC_MAX_ELEMCOUNT) {
+            quic_data->pkt_types[pos] = packets;
+            quic_data->last_pkt_type = pos;
+       }
+
        // A 0-RTT carries the same QUIC version as the Client Initial Hello.
        // 0-RTT and compatible version negotiation is not defined.
        // We ignore those cases because it might be defined in the future

process/quic.hpp

@@ -22,12 +22,13 @@
 
 #include "quic_parser.hpp"
 #include <ipfixprobe/utils.hpp>
+#include <ipfixprobe/ipfix-basiclist.hpp>
 #include <ipfixprobe/ipfix-elements.hpp>
 #include <sstream>
 
 
 namespace ipxp {
-#define QUIC_UNIREC_TEMPLATE "QUIC_SNI,QUIC_USER_AGENT,QUIC_VERSION,QUIC_CLIENT_VERSION,QUIC_TOKEN_LENGTH,QUIC_OCCID,QUIC_OSCID,QUIC_SCID,QUIC_RETRY_SCID,QUIC_MULTIPLEXED,QUIC_ZERO_RTT"
+#define QUIC_UNIREC_TEMPLATE "QUIC_SNI,QUIC_USER_AGENT,QUIC_VERSION,QUIC_CLIENT_VERSION,QUIC_TOKEN_LENGTH,QUIC_OCCID,QUIC_OSCID,QUIC_SCID,QUIC_RETRY_SCID,QUIC_MULTIPLEXED,QUIC_ZERO_RTT,QUIC_PACKETS"
 UR_FIELDS(
    string QUIC_SNI,
    string QUIC_USER_AGENT,
@@ -39,15 +40,18 @@ UR_FIELDS(
    bytes QUIC_SCID,
    bytes QUIC_RETRY_SCID,
    uint8 QUIC_MULTIPLEXED,
-   uint8 QUIC_ZERO_RTT
+   uint8 QUIC_ZERO_RTT,
+   uint8* QUIC_PACKETS
 )
 
 /**
  * \brief Flow record extension header for storing parsed QUIC packets.
  */
+#define QUIC_MAX_ELEMCOUNT 30
 #define MAX_CID_LEN 20
 #define QUIC_DETECTED 0
 #define QUIC_NOT_DETECTED 2
+#define QUIC_PKT_FIELD_ID 888
 
 struct RecordExtQUIC : public RecordExt {
    static int REGISTERED_ID;
@@ -75,6 +79,8 @@ struct RecordExtQUIC : public RecordExt {
 
    uint8_t    quic_multiplexed;
    uint8_t    quic_zero_rtt;
+   uint8_t    pkt_types[QUIC_MAX_ELEMCOUNT];
+   uint8_t    last_pkt_type;
 
    RecordExtQUIC() : RecordExt(REGISTERED_ID)
    {
@@ -99,6 +105,8 @@ struct RecordExtQUIC : public RecordExt {
       quic_token_length = QUICParser::QUIC_CONSTANTS::QUIC_UNUSED_VARIABLE_LENGTH_INT;
       quic_multiplexed = 0;
       quic_zero_rtt = 0;
+      memset(pkt_types, 0, sizeof(pkt_types));
+      last_pkt_type = 0;
    }
 
    #ifdef WITH_NEMEA
@@ -115,6 +123,10 @@ struct RecordExtQUIC : public RecordExt {
       ur_set_var(tmplt, record, F_QUIC_RETRY_SCID, retry_scid, retry_scid_length);
       ur_set(tmplt, record, F_QUIC_MULTIPLEXED, quic_multiplexed);
       ur_set(tmplt, record, F_QUIC_ZERO_RTT, quic_zero_rtt);
+      ur_array_allocate(tmplt, record, F_QUIC_PACKETS, last_pkt_type+1);
+      for (int i = 0; i < last_pkt_type+1; i++) {
+        ur_array_set(tmplt, record, F_QUIC_PACKETS, i, pkt_types[i]);
+      }
    }
 
    const char *get_unirec_tmplt() const
@@ -126,18 +138,22 @@ struct RecordExtQUIC : public RecordExt {
 
    virtual int fill_ipfix(uint8_t *buffer, int size)
    {
+       IpfixBasicList basiclist;
+       basiclist.hdrEnterpriseNum = IpfixBasicList::CesnetPEM;
       uint16_t len_sni        = strlen(sni);
       uint16_t len_user_agent = strlen(user_agent);
       uint16_t len_version    = sizeof(quic_version);
       uint16_t len_client_version = sizeof(quic_client_version);
       uint16_t len_token_length = sizeof(quic_token_length);
       uint16_t len_multiplexed = sizeof(quic_multiplexed);
       uint16_t len_zero_rtt = sizeof(quic_zero_rtt);
-      int pos = 0;
+      uint16_t pkt_types_len = sizeof(pkt_types[0])*(last_pkt_type+1) + basiclist.HeaderSize() ;
+      uint32_t pos = 0;
 
       if ((len_sni + 3) + (len_user_agent + 3) + len_version +
             len_client_version + len_token_length + len_multiplexed + len_zero_rtt +
-            (scid_length + 3) + (occid_length + 3) + (oscid_length + 3)  + (retry_scid_length + 3) > size) {
+            (scid_length + 3) + (occid_length + 3) + (oscid_length + 3)  + (retry_scid_length + 3) +
+            pkt_types_len > size) {
          return -1;
       }
 
@@ -163,7 +179,10 @@ struct RecordExtQUIC : public RecordExt {
 
        *(uint8_t *) (buffer + pos) = quic_zero_rtt;
        pos += 1;
-      return pos;
+       // Packet types
+       pos += basiclist.FillBuffer(buffer + pos, pkt_types, (uint16_t) last_pkt_type + 1, (uint16_t) QUIC_PKT_FIELD_ID);
+
+       return pos;
    }
 
    const char **get_ipfix_tmplt() const