Minimal example for extracting QUIC SNI from the array of bytes

[m-peko]

Hi there,

As the title says, I would like to extract QUIC SNI field from the array of bytes. Can anyone show me minimal example of this?

Thanks

[nibanks]

@m-peko which "array of bytes" are you referring to? This? https://github.com/microsoft/msquic/blob/main/src/inc/msquic.h#L329? The ServerName field is the SNI (not null terminated) of length ServerNameLength.

[nibanks]

I assume you're trying to make this for some middlebox? While it is possible to do with QUIC v1 as it stands today, there are several things in the works to make this impossible for an untrusted party going forward.

With v1, you have to decrypt the client initial packet with the v1 static secret, parse out the CRYPTO frame, and then decode the SNI from the CH TLS message. All the code for this is in MsQuic, but not in one place. All that being said, you must assume at some (possibly very soon) future date, the client's packet is actually encrypted with a secret you do not possess, making this impossible.

[nibanks]

FYI https://datatracker.ietf.org/doc/html/draft-ietf-quic-manageability#section-3.4 is something worth reading on this topic.

[m-peko]

Yes, I am aware that this is possible for v1 only. Can you show me an example of how to do these steps you mentioned with MsQuic?

Much appreciated!

[nibanks]

This might help. Other than this, I can't go and piece together all the code necessary to process the QUIC parts. https://github.com/microsoft/msquic/blob/main/src/core/crypto_tls.c#L605

[m-peko]

Ok, thanks for support