TSG-7298: QUIC解析层支持解析quic-ietf加密SNI

1 files changed, 1190 insertions, 0 deletions

diff --git a/src/gquic_process.cpp b/src/gquic_process.cpp
new file mode 100644
index 0000000..d68f262
--- /dev/null
+++ b/src/gquic_process.cpp
@@ -0,0 +1,1190 @@
+/*
+ * quic_process.c
+ *
+ *  Created on: 2019��4��2��
+ *      Author: root
+ */
+
+#include <stdio.h>
+#include <assert.h>
+#include <stdbool.h>
+#include <MESA/stream.h>
+#include <MESA/MESA_handle_logger.h>
+
+#include "gquic_process.h"
+#include "quic_analysis.h"
+#include "parser-quic.h"
+
+int is_iquic(enum _QUIC_VERSION quic_version)
+{
+	switch(quic_version)
+	{
+		case	IQUIC_VERSION_I001:
+		case	IQUIC_VERSION_I002:
+		case	IQUIC_VERSION_I003:
+		case	IQUIC_VERSION_I004:
+		case	IQUIC_VERSION_I005:
+		case	IQUIC_VERSION_I006:
+		case	IQUIC_VERSION_I007:
+		case	IQUIC_VERSION_I008:
+		case	IQUIC_VERSION_I009:
+		case	IQUIC_VERSION_I010:
+		case	IQUIC_VERSION_I011:
+		case	IQUIC_VERSION_I012:
+		case	IQUIC_VERSION_I013:
+		case	IQUIC_VERSION_I014:
+		case	IQUIC_VERSION_I015:
+		case	IQUIC_VERSION_I016:
+		case	IQUIC_VERSION_I017:
+		case	IQUIC_VERSION_I018:
+		case	IQUIC_VERSION_I019:
+		case	IQUIC_VERSION_I020:
+		case	IQUIC_VERSION_I021:
+		case	IQUIC_VERSION_I022:
+		case	IQUIC_VERSION_I023:
+		case	IQUIC_VERSION_I024:
+		case	IQUIC_VERSION_I025:
+		case	IQUIC_VERSION_I026:
+		case	IQUIC_VERSION_I027:
+		case	IQUIC_VERSION_I028:
+		case	IQUIC_VERSION_I029:
+		case	IQUIC_VERSION_I030:
+		case	IQUIC_VERSION_I031:
+		case	IQUIC_VERSION_I032:
+			return TRUE;
+			break;
+		default:
+				break;
+	}
+	
+	return FALSE;
+}
+
+static int get_value(unsigned char *payload, int *offset, int len)
+{
+	switch(len)
+	{
+		case	1:
+			return (int)(payload[(*offset)++]);
+			break;
+		case	2:
+			(*offset)+=len;
+			return (int)ntohs(*(unsigned short *)(payload+*offset-len));
+			break;
+		case	3:
+			(*offset)+=len;
+			return ((int)*(payload-2+*offset)<<16|
+		           (int)*(payload-1+*offset)<<8|
+		           (int)*(payload+*offset)<<0);
+			break;
+		case	4:
+			(*offset)+=len;
+			return (int)ntohl(*(unsigned int *)(payload+*offset-len));
+			break;
+		case	32:
+			(*offset)+=len;
+			return 0;
+			break;
+		default:
+			break;
+	}
+
+	return 0;
+}
+
+int quic_getLinkState(struct _quic_context *_context)
+{
+	UCHAR state = 0;
+	
+	if(0==_context->link_state)
+	{
+		state=SESSION_STATE_PENDING|SESSION_STATE_DATA;
+		_context->link_state=1;
+	}
+	else
+	{
+		state=SESSION_STATE_DATA;
+	}
+	
+	return state;
+}
+
+char quic_callPlugins(struct streaminfo *pstream, struct _quic_context *_context, void *buff, int buff_len, enum quic_interested_region region_mask, void *a_packet)
+{
+	char state=PROT_STATE_GIVEME;
+	char app_state=APP_STATE_GIVEME;
+	stSessionInfo session_info={0};
+
+	if(region_mask==QUIC_INTEREST_KEY_MASK)
+	{
+		session_info.plugid=g_quic_param.quic_plugid;
+		session_info.prot_flag=0;
+		session_info.session_state=SESSION_STATE_CLOSE;
+		session_info.app_info=NULL;
+		session_info.buf=NULL;
+		session_info.buflen=0;
+	}
+	else
+	{
+		session_info.plugid=g_quic_param.quic_plugid;
+		session_info.prot_flag=(((unsigned long long)1)<<region_mask);
+		session_info.session_state=quic_getLinkState(_context) ;
+		session_info.app_info=(void*)(&_context->quic_info);
+		session_info.buf=buff;
+		session_info.buflen=buff_len;
+	}
+	state=PROT_PROCESS(&session_info, &(_context->business_pme), pstream->threadnum, pstream, a_packet);
+
+	if(state&PROT_STATE_DROPPKT)
+	{
+		app_state=APP_STATE_DROPPKT;
+	}
+
+	return app_state;
+}
+
+
+unsigned long long get_variable_length(char *p, int offset, int v_len)
+{
+	switch(v_len)
+	{
+		case	1:
+			return (unsigned long long)(p[offset]);
+			break;
+		case	2:
+			return (unsigned long long)ntohs(*(unsigned short *)((char *)p+offset));
+			break;
+		case	3:
+			return (unsigned long long)*(p+0+offset)<<16|
+		           (unsigned long long)*(p+1+offset)<<8|
+		           (unsigned long long)*(p+2+offset)<<0;
+			break;
+		case	4:
+			return (unsigned long long)ntohl(*(unsigned int *)(p+offset));
+			break;
+		case	5:
+			return (unsigned long long)*((unsigned char *)(p)+0+offset)<<32|
+		           (unsigned long long)*((unsigned char *)(p)+1+offset)<<24|
+		           (unsigned long long)*((unsigned char *)(p)+2+offset)<<16|
+		           (unsigned long long)*((unsigned char *)(p)+3+offset)<<8|
+		           (unsigned long long)*((unsigned char *)(p)+4+offset)<<0;
+			break;
+		case	6:
+			return (unsigned long long)*((unsigned char *)(p)+0+offset)<<40|
+		           (unsigned long long)*((unsigned char *)(p)+1+offset)<<32|
+		           (unsigned long long)*((unsigned char *)(p)+2+offset)<<24|
+		           (unsigned long long)*((unsigned char *)(p)+3+offset)<<16|
+		           (unsigned long long)*((unsigned char *)(p)+4+offset)<<8|
+		           (unsigned long long)*((unsigned char *)(p)+5+offset)<<0;
+			break;
+		case	7:
+			return (unsigned long long)*((unsigned char *)(p)+0+offset)<<56|
+		           (unsigned long long)*((unsigned char *)(p)+1+offset)<<40|
+		           (unsigned long long)*((unsigned char *)(p)+2+offset)<<32|
+		           (unsigned long long)*((unsigned char *)(p)+3+offset)<<24|
+		           (unsigned long long)*((unsigned char *)(p)+4+offset)<<16|
+		           (unsigned long long)*((unsigned char *)(p)+5+offset)<<8|
+				   (unsigned long long)*((unsigned char *)(p)+6+offset)<<0;
+			break;
+		case	8:
+			return (unsigned long long)*((unsigned char *)(p)+0+offset)<<56|
+		           (unsigned long long)*((unsigned char *)(p)+1+offset)<<48|
+		           (unsigned long long)*((unsigned char *)(p)+2+offset)<<40|
+		           (unsigned long long)*((unsigned char *)(p)+3+offset)<<32|
+		           (unsigned long long)*((unsigned char *)(p)+4+offset)<<24|
+		           (unsigned long long)*((unsigned char *)(p)+5+offset)<<16|
+		           (unsigned long long)*((unsigned char *)(p)+6+offset)<<8|
+		           (unsigned long long)*((unsigned char *)(p)+7+offset)<<0;
+			break;
+		default:
+			break;
+	}
+
+	return 0;
+}
+
+long long bit_to_value(char *payload, unsigned char flags, unsigned long long *out_value, int *used_len)
+{
+	switch(flags&0x3) // packet number
+	{
+		case	0x3: // 6 bytes
+			*out_value=get_variable_length(payload, *used_len, 6);
+			*used_len+=6;
+			break;
+		case	0x2: // 4 bytes
+			*out_value=(unsigned long long)ntohl(*(unsigned int *)(payload+*used_len));
+			*used_len+=4;
+			break;
+		case	0x1: // 2bytes
+			*out_value=(unsigned long long)ntohs(*(unsigned short *)(payload+*used_len));
+			*used_len+=2;
+			break;
+		default:	// 1 byte
+			*out_value=payload[*used_len];
+			*used_len+=1;
+			break;
+	}
+
+	return 0;
+}
+
+int get_quic_tlv(char *start_pos, quic_tlv_t *tlv, int len, int type, int thread_seq)
+{
+	if(tlv->value==NULL && len>0)
+	{
+		tlv->value=(char *)dictator_malloc(thread_seq, len+1);
+		memset(tlv->value, 0, len+1);
+		tlv->length=len;
+		tlv->type=type;
+		memcpy(tlv->value, start_pos, tlv->length);
+	}
+	
+	return 0;
+}
+
+int get_stream_id(struct streaminfo *pstream, struct _quic_context* _context, char* payload, unsigned char frame_type, int *used_len)
+{
+	int stream_len=0,offset_len=0;
+
+	_context->quic_info.frame_hdr.frame_type=frame_type;
+	
+	stream_len=(frame_type&GQUIC_SPECIAL_FRAME_STREAM_ID)+1;
+	_context->quic_info.frame_hdr.stream_id=(unsigned int)get_variable_length(payload, *used_len, stream_len);
+	*used_len+=stream_len;  // stream ID length
+
+	if(frame_type&GQUIC_SPECIAL_FRAME_STREAM_DLEN)
+	{
+		_context->quic_info.frame_hdr.data_len=ntohs(*(unsigned short *)(payload+*used_len));
+		*used_len+=2;  //data length
+	}
+			
+	offset_len=(frame_type&GQUIC_SPECIAL_FRAME_STREAM_OFFSET) ? (((frame_type&GQUIC_SPECIAL_FRAME_STREAM_OFFSET))>>2)+1 : 0;
+	_context->quic_info.frame_hdr.offset=get_variable_length(payload, *used_len, offset_len);
+	*used_len+=offset_len;
+
+	MESA_handle_runtime_log(g_quic_param.logger,
+						RLOG_LV_DEBUG,
+						"QUIC_FRAME",
+						"frame_type: 0X%02X stream_id: %u data length: %u offset length: %u addr: %s",
+						frame_type,
+						_context->quic_info.frame_hdr.stream_id,
+						_context->quic_info.frame_hdr.data_len,
+						offset_len,
+						printaddr(&pstream->addr, pstream->threadnum));
+
+	return _context->quic_info.frame_hdr.stream_id;
+}
+
+unsigned long long get_packet_number(char* data, int offset, char pkn_len)
+{
+	switch(pkn_len)
+	{
+		case	1:
+			return (unsigned long long)data[offset];
+			break;
+		case	2:
+			return (unsigned long long)ntohs(*(unsigned short *)(data+offset));
+			break;
+		case	4:
+			return (unsigned long long)ntohl(*(unsigned int *)(data+offset));
+			break;
+		case	8:
+			return get_variable_length(data, offset, 8);;
+			break;
+	}
+
+	return 0;
+}
+
+// GQUIC version from 0 to 43
+static enum _QUIC_VERSION parse_q0to43_header(struct streaminfo *pstream, struct _quic_context* _context, char *payload, int payload_len, int *used_len)
+{
+	char public_flags=0;
+	
+	struct _quic_public_header *gquic_hdr=&(_context->quic_info.quic_hdr);
+
+	public_flags=payload[*used_len];
+	*used_len+=1;
+	gquic_hdr->public_flags=public_flags;
+
+	if((public_flags&GQUIC_PUBLIC_FLAG_RST) && _context->is_quic==TRUE)
+	{
+		gquic_hdr->is_reset=TRUE; //Public Reset Packet
+		return QUIC_VERSION_UNKNOWN;
+		
+	}
+
+	if(pstream->curdir==DIR_S2C && gquic_hdr->public_flags&GQUIC_PUBLIC_FLAG_VERSION)
+	{
+		return QUIC_VERSION_UNKNOWN;
+	}
+
+	//For Public Reset and Version Negotiation Packets (sent by the server) which don't have a packet number
+	if(!public_flags&GQUIC_PUBLIC_FLAG_PKT_NUM)
+	{
+		if(public_flags&GQUIC_PUBLIC_FLAG_VERSION) //Public Reset Packet
+		{
+			return QUIC_VERSION_UNKNOWN;// todo
+		}
+		else // Version Negotiation Packet
+		{
+			return QUIC_VERSION_UNKNOWN;
+		}
+	}
+
+	if(gquic_hdr->public_flags&GQUIC_PUBLIC_FLAG_CID)
+	{
+		*(unsigned long long *)gquic_hdr->server_CID=get_variable_length(payload, *used_len, sizeof(gquic_hdr->server_CID));
+		*used_len+=sizeof(unsigned long long); // CID length
+
+		_context->is_quic=TRUE;
+	}
+	
+	if(gquic_hdr->public_flags&GQUIC_PUBLIC_FLAG_VERSION && (*(unsigned char *)(payload+*used_len)==0x51))
+	{
+		gquic_hdr->quic_version=(unsigned int)ntohl(*(unsigned int *)(payload+*used_len));
+		*used_len+=sizeof(int); // skip version
+
+		_context->is_quic=TRUE;
+	}
+	
+	if(_context->is_quic==FALSE || gquic_hdr->quic_version<GQUIC_VERSION_Q001 || gquic_hdr->quic_version>GQUIC_VERSION_Q043)
+	{
+		_context->is_quic=FALSE;
+		return QUIC_VERSION_UNKNOWN;
+	}
+
+	bit_to_value(payload, gquic_hdr->public_flags>>4, &gquic_hdr->packet_number, used_len);
+			
+	if(gquic_hdr->public_flags==GQUIC_PUBLIC_FLAG_NONCE)
+	{
+		*used_len+=32; //diversification nonce
+	}
+
+	// Version 11 reduced the length of null encryption authentication tag  from 16 to 12 bytes
+	if(gquic_hdr->quic_version > GQUIC_VERSION_Q010)
+	{
+		*used_len+=12;
+	}
+	else
+	{
+		*used_len+=16;
+	}
+	
+	// Version 34 removed entropy bits from packets and ACK frames, 
+	// removed private flag from packet header and changed the ACK format to specify ranges of packets acknowledged rather than missing ranges.
+	if(gquic_hdr->quic_version < GQUIC_VERSION_Q034)
+	{
+		*used_len+=1;  //private flags
+	}
+
+	_context->is_quic=TRUE;
+	
+	MESA_handle_runtime_log(g_quic_param.logger,
+							RLOG_LV_DEBUG,
+							"QUIC_IDETIFY",
+							"pub_flags: 0X%02X conection ID:[ destination: %llu ] version: Q%03u packet number: %llu dir(1: C2S;2: S2C): %d addr: %s",
+							gquic_hdr->public_flags,
+							*(unsigned long long *)gquic_hdr->server_CID,
+							(((gquic_hdr->quic_version>>8)&0x0000000F)*10) + ((gquic_hdr->quic_version)&0x0000000F),
+							gquic_hdr->packet_number,
+							pstream->curdir,
+							printaddr(&pstream->addr, pstream->threadnum));
+
+	return (enum _QUIC_VERSION)gquic_hdr->quic_version;
+}
+
+enum _QUIC_VERSION parse_quic_header(struct streaminfo *pstream, struct _quic_context* _context, char *payload, int payload_len, int *used_len)
+{
+	int i=0,len=0;
+	char client_CID[MAX_CONNECT_ID_LEN*2]={0};
+	char server_CID[MAX_CONNECT_ID_LEN*2]={0};
+	
+	struct _quic_public_header *long_hdr=&(_context->quic_info.quic_hdr);
+
+	long_hdr->public_flags=payload[*used_len];
+	*used_len+=1; //skip public flags
+
+	if(long_hdr->public_flags&0x80)
+	{
+		long_hdr->quic_version=(unsigned int)ntohl(*(unsigned int *)(payload+*used_len));
+		*used_len+=sizeof(int); // skip version
+		
+		long_hdr->client_CID_len=(payload[*used_len]&0xF) ? (payload[*used_len]&0xF)+3 : 0;
+		long_hdr->server_CID_len=((payload[*used_len]>>4)&0xF) ? ((payload[*used_len]>>4)&0xF)+3 : 0;
+		*used_len+=sizeof(char);  // both connection_id length
+		
+		memcpy(long_hdr->server_CID, (void *)(payload+*used_len), long_hdr->server_CID_len);
+		*used_len+=long_hdr->server_CID_len;  // Destination connection_id length
+		memcpy(long_hdr->client_CID, (void *)(payload+*used_len), long_hdr->client_CID_len);
+		*used_len+=long_hdr->client_CID_len;  // source connection_id length
+	}
+	else
+	{
+	  if(pstream->curdir==DIR_C2S)// short header only  destination connection ID
+	  {
+	  	*used_len+=long_hdr->server_CID_len;   // every packet destination connection ID is same
+	  }
+	}
+	
+	len=(long_hdr->public_flags&0x03)+1;
+	long_hdr->packet_number=get_packet_number(payload, *used_len, len);
+	*used_len+=len;
+
+	*used_len+=12;  //message authentication hash
+
+	_context->is_quic=TRUE;
+
+	for(i=0,len=0;i<long_hdr->server_CID_len; i++) 
+	{
+		len+=snprintf(server_CID+len, sizeof(server_CID)-len, "%02X", long_hdr->server_CID[i]);
+	}
+
+	for(i=0,len=0;i<long_hdr->client_CID_len; i++) 
+	{
+		len+=snprintf(client_CID+len, sizeof(client_CID)-len, "%02X", long_hdr->client_CID[i]);
+	}
+
+	MESA_handle_runtime_log(g_quic_param.logger,
+							RLOG_LV_DEBUG,
+							"QUIC_IDETIFY",
+							"pub_flags: 0X%02X conection ID:[ destination: %s source: %s ] version: Q%03u packet number: %llu dir(1: C2S;2: S2C): %d addr: %s",
+							long_hdr->public_flags,
+							server_CID,
+							client_CID,
+							(((long_hdr->quic_version>>8)&0x0000000F)*10) + ((long_hdr->quic_version)&0x0000000F),
+							long_hdr->packet_number,
+							pstream->curdir,
+							printaddr(&pstream->addr, pstream->threadnum));
+	
+	return (enum _QUIC_VERSION)long_hdr->quic_version;
+}
+
+enum _QUIC_VERSION is_quic_protocol(struct streaminfo *pstream, struct _quic_context* _context, char *payload, int payload_len, int *used_len)
+{
+	enum _QUIC_VERSION quic_version=QUIC_VERSION_UNKNOWN;
+	
+	if(_context->quic_info.quic_hdr.quic_version!=QUIC_VERSION_UNKNOWN)
+	{
+		if(is_iquic((enum _QUIC_VERSION)(_context->quic_info.quic_hdr.quic_version)))
+		{
+			return (enum _QUIC_VERSION)(_context->quic_info.quic_hdr.quic_version);
+		}
+		 
+		quic_version=(enum _QUIC_VERSION)(_context->quic_info.quic_hdr.quic_version);
+	}
+	else
+	{
+		// The most significant bit (0x80) of byte 0 (the first byte) is set to 1 for long headers
+		(payload[*used_len]&0x80) ? (quic_version=(enum _QUIC_VERSION)ntohl(*(unsigned int *)(payload+(*used_len+1)))) : QUIC_VERSION_UNKNOWN;
+	}
+
+	switch(quic_version) // +1 meaning: skip public flags
+	{
+		case	GQUIC_VERSION_Q046:
+			quic_version=parse_quic_header(pstream, _context, payload, payload_len, used_len);
+			return quic_version;
+			break;
+		default:
+			if(	(quic_version==GQUIC_VERSION_Q044) ||
+				(quic_version==GQUIC_VERSION_Q045) ||
+				(quic_version==GQUIC_VERSION_Q099) ||
+				(quic_version==PICOQUIC_VERSION_30) ||
+				(quic_version==PQUIC_VERSION_PROX) ||
+				(quic_version==GQUIC_VERSION_T099) ||
+				(quic_version>=GQUIC_VERSION_Q047 && quic_version<=GQUIC_VERSION_Q050) ||
+				(quic_version>=GQUIC_VERSION_Q051 && quic_version<=GQUIC_VERSION_Q059) ||
+				(quic_version>=GQUIC_VERSION_T048&& quic_version<=GQUIC_VERSION_T049) ||
+				(quic_version>=GQUIC_VERSION_T050&& quic_version<=GQUIC_VERSION_T059) ||
+				(quic_version>=QUANT_VERSION_00 && quic_version<=QUANT_VERSION_FF) ||
+				(quic_version>=QUIC_GO_VERSION_00 && quic_version<=QUIC_GO_VERSION_FF) ||
+				(quic_version>=QUICLY_VERSION_00 && quic_version<=QUICLY_VERSION_FF) ||
+				(quic_version>=MSQUIC_VERSION_00 && quic_version<=MSQUIC_VERSION_0F) ||
+				(quic_version>=MOZQUIC_VERSION_00 && quic_version<=MOZQUIC_VERSION_0F) ||
+				(quic_version>=MVFST_VERSION_00 && quic_version<=MVFST_VERSION_0F) ||
+				(quic_version>=IQUIC_VERSION_I001 && quic_version<=IQUIC_VERSION_I032) 
+			)
+			{
+				MESA_handle_runtime_log(g_quic_param.logger, RLOG_LV_DEBUG, "QUIC", "version: 0x%x addr: %s",
+							quic_version, printaddr(&pstream->addr, pstream->threadnum));
+				
+				_context->is_quic=TRUE;
+				_context->quic_info.quic_hdr.quic_version=quic_version;
+				return quic_version;
+			}			
+			break;
+	}
+
+	// Q001~Q043: 0x80 is currently unused, and must be set to 0
+	if(payload[*used_len]>0x80)
+	{
+		return QUIC_VERSION_UNKNOWN;
+	}
+	
+	return parse_q0to43_header(pstream, _context, payload, payload_len, used_len);
+}
+
+int parse_extension_tag(struct streaminfo *pstream, struct _quic_stream **quic_stream, void *a_packet, char *payload, int payload_len, int *used_len, int tag_num)
+{
+	int tag_used_num=0;
+	int tag_type=0;
+	int total_tag_len=0,tag_len=0;
+	int tag_offset_end=0,pre_tag_offset_end=0;
+	
+	struct _quic_stream *stream=*quic_stream;
+	int tag_value_start=tag_num*4*2+(*used_len);  // skip length of type and offset, type(offset)=szieof(int)
+
+	if(stream==NULL)
+	{
+		stream=(struct _quic_stream *)dictator_malloc(pstream->threadnum, sizeof(struct _quic_stream));
+		memset(stream, 0, sizeof(struct _quic_stream));
+		stream->ext_tags=(quic_tlv_t *)dictator_malloc(pstream->threadnum, tag_num*sizeof(quic_tlv_t));
+		memset(stream->ext_tags, 0, tag_num*sizeof(quic_tlv_t));
+		*quic_stream=stream;
+	}
+	else
+	{
+		quic_release_exts(pstream->threadnum, stream->ext_tags, stream->ext_tag_num);
+		stream->ext_tags=(quic_tlv_t *)dictator_malloc(pstream->threadnum, tag_num*sizeof(quic_tlv_t));
+		memset(stream->ext_tags, 0, tag_num*sizeof(quic_tlv_t));
+		*quic_stream=stream;
+		stream->ext_tag_num=0;
+		stream->count++;
+	}
+
+	while(tag_num>tag_used_num)
+	{
+		tag_type=ntohl(*(unsigned int *)(payload+*used_len));
+		*used_len+=sizeof(int);
+		
+		tag_offset_end=*(unsigned int *)(payload+*used_len);
+		*used_len+=sizeof(int);
+		
+		tag_len=tag_offset_end-pre_tag_offset_end;
+		if(tag_len<0 || (tag_offset_end>=payload_len) || (tag_len>payload_len-tag_value_start))
+		{
+			return -1;
+		}
+
+		switch(tag_type)
+		{
+			case	TAG_PAD:
+				break;
+			case	TAG_VER:
+				stream->ver_idx=stream->ext_tag_num;
+				get_quic_tlv(payload+tag_value_start, &stream->ext_tags[stream->ext_tag_num], tag_len, tag_type, pstream->threadnum);
+				*(unsigned int *)(stream->ext_tags[stream->ext_tag_num].value)=(unsigned int)ntohl(*(unsigned int *)(stream->ext_tags[stream->ext_tag_num].value));
+				MESA_handle_runtime_log(g_quic_param.logger,
+											RLOG_LV_DEBUG,
+											"QUIC_VERSION",
+											"Quic version: 0X%X addr: %s",
+											*(unsigned int *)(stream->ext_tags[stream->ext_tag_num].value),
+											printaddr(&pstream->addr, pstream->threadnum));
+				break;
+			case	TAG_UAID:
+				stream->ua_idx=stream->ext_tag_num;
+				get_quic_tlv(payload+tag_value_start, &stream->ext_tags[stream->ext_tag_num], tag_len, tag_type, pstream->threadnum);
+				MESA_handle_runtime_log(g_quic_param.logger,
+											RLOG_LV_DEBUG,
+											"QUIC_UA",
+											"User Agent: %s addr: %s",
+											stream->ext_tags[stream->ext_tag_num].value,
+											printaddr(&pstream->addr, pstream->threadnum));
+				stream->ext_tag_num++;
+				break;
+			case	TAG_SNI:
+				stream->sni_idx=stream->ext_tag_num;
+				get_quic_tlv(payload+tag_value_start, &stream->ext_tags[stream->ext_tag_num], tag_len, tag_type, pstream->threadnum);
+				MESA_handle_runtime_log(g_quic_param.logger,
+											RLOG_LV_DEBUG,
+											"QUIC_SNI",
+											"SNI: %s addr: %s",
+											stream->ext_tags[stream->ext_tag_num].value,
+											printaddr(&pstream->addr, pstream->threadnum));
+				stream->ext_tag_num++;
+				break;
+			default:
+				get_quic_tlv(payload+tag_value_start, &stream->ext_tags[stream->ext_tag_num], tag_len, tag_type, pstream->threadnum);
+				stream->ext_tag_num++;
+				break;
+		}
+			
+		tag_used_num++;
+		tag_value_start+=tag_len;
+		total_tag_len+=tag_len;
+		pre_tag_offset_end=tag_offset_end;
+	}
+	
+	*used_len += total_tag_len;
+	
+	return 0;
+}
+
+int gquic_frame_type_ack(struct streaminfo *pstream, struct _quic_context* _context, char *payload, int payload_len, int *used_len, char frame_type, void *a_packet)
+{
+	unsigned char num_timestamp;
+	unsigned char num_blocks=0;;
+	unsigned short largest_acked_delta_time=0;
+	unsigned long long ack_block_length=0;
+	unsigned long long largest_observed_ack=0;		
+
+	bit_to_value(payload, frame_type>>2, &largest_observed_ack, used_len);  // frame_type -> LL
+	largest_acked_delta_time=ntohs(*(unsigned short *)(payload+*used_len));
+	*used_len+=sizeof(unsigned short);
+
+	if(frame_type&0x20)	// frame_type -> n
+	{
+		num_blocks=(*(unsigned char *)(payload+*used_len))-1;
+	}
+	bit_to_value(payload, frame_type>>2, &ack_block_length, used_len); // frame_type -> mm
+
+	if(num_blocks>0)
+	{
+		*used_len+=1; //gap_to_next_block
+
+		*used_len+=(num_blocks*sizeof(unsigned int)); //Ack block length
+	}
+
+	num_timestamp=*(unsigned char *)(payload+*used_len);
+	*used_len += 1;
+	
+	if(num_timestamp > 0)
+	{
+		*used_len+=sizeof(unsigned char); //Delta Largest Observed
+		*used_len+= sizeof(unsigned int); //First Timestamp
+		*used_len+=(num_timestamp-1)*(1+2); //1+2=Delta Largest Observed+Time Since Previous Timestamp
+	}
+
+	MESA_handle_runtime_log(g_quic_param.logger,
+												RLOG_LV_DEBUG,
+												"QUIC_ACK",
+												"largest_observed_ack: %llu largest_acked_delta_time: %u num_blocks: %d ack_block_length: %d num_timestamp: %d addr: %s",
+												largest_observed_ack,
+												largest_acked_delta_time,
+												num_blocks,
+												ack_block_length,
+												num_timestamp,
+												printaddr(&pstream->addr, pstream->threadnum));
+
+	return 0;
+}
+
+int gquic_frame_type_stream(struct streaminfo *pstream, struct _quic_context* _context, char *payload, int payload_len, int *used_len, void *a_packet)
+{
+	int ret=0;
+	char state=APP_STATE_GIVEME;
+	unsigned short tag_num = 0;
+	unsigned int message_tag;
+
+	message_tag=(unsigned int)ntohl(*(unsigned int *)(payload+*used_len));
+	*used_len+=4; 
+
+	tag_num=*(unsigned short *)(payload+*used_len);
+	*used_len+=2; //tag_num
+	*used_len+=2; //padding
+	
+	switch(message_tag)
+	{
+		case CHLO: //MTAG_CHLO;
+			ret=parse_extension_tag(pstream, &(_context->quic_info.client_hello), a_packet, payload, payload_len, used_len, tag_num);
+			if(ret>=0 && _context->call_business)
+			{
+				state=quic_callPlugins(pstream, _context, (void *)(_context->quic_info.client_hello), sizeof(void *), QUIC_CLIENT_HELLO_MASK, a_packet);
+			}
+			break;
+		case SHLO:  //MTAG_SHLO;
+			ret=parse_extension_tag(pstream, &(_context->quic_info.server_hello), a_packet, payload, payload_len, used_len, tag_num);
+			if(ret>=0 && _context->call_business)
+			{
+				state=quic_callPlugins(pstream, _context, (void *)(_context->quic_info.server_hello), sizeof(void *), QUIC_SERVER_HELLO_MASK, a_packet);
+			}
+			break;
+		case REJ: //MTAG_REJ;
+			ret=parse_extension_tag(pstream, &(_context->quic_info.rejection), a_packet, payload, payload_len, used_len, tag_num);
+			if(ret>=0 && _context->call_business)
+			{
+				state=quic_callPlugins(pstream, _context, (void *)(_context->quic_info.rejection), sizeof(void *), QUIC_REJECTION_MASK, a_packet);
+			}
+			break;
+		default:
+			break;
+	}
+
+	return state;
+}
+
+//frame type->stream->offset->data length
+int gquic_proc_unencrypt(struct streaminfo *pstream, struct _quic_context* _context, void *a_packet, char * payload, int payload_len, int *used_len)
+{
+	unsigned int ret=0;
+	unsigned char frame_type=0;
+	unsigned int stream_id=0;
+	unsigned int error_code=0;
+	unsigned short reason_phrase_length=0;
+	unsigned long long byte_offset=0;
+	unsigned long long least_unacked_delta=0;
+				
+	while(*used_len<payload_len)
+	{	 
+		frame_type=payload[*used_len];
+		*used_len+=1;  //skip frame_type
+		
+		switch(frame_type)
+		{
+			case	GQUIC_REGULAR_FRAME_PADDING:
+				return APP_STATE_GIVEME; // PADDING frame
+				break;
+			case	GQUIC_REGULAR_FRAME_RST_STREAM:
+				stream_id=(unsigned int)get_variable_length(payload, *used_len, sizeof(unsigned int));
+				*used_len+=sizeof(unsigned int);
+
+				byte_offset=get_variable_length(payload, *used_len, sizeof(unsigned long long));
+				*used_len+=sizeof(unsigned long long);
+
+				error_code=(unsigned int)get_variable_length(payload, *used_len, sizeof(unsigned int));
+				*used_len+=sizeof(unsigned int);
+
+				MESA_handle_runtime_log(g_quic_param.logger,
+										RLOG_LV_DEBUG,
+										"QUIC_RST_STREAM",
+										"stream_id: %u byte_offset: %llu error_code: %u addr: %s",
+										stream_id,
+										byte_offset,
+										error_code,
+										printaddr(&pstream->addr, pstream->threadnum));
+
+				return quic_callPlugins(pstream, _context, NULL, 0, QUIC_INTEREST_KEY_MASK, a_packet);
+				break;
+			case	GQUIC_REGULAR_FRAME_CONNECTION_CLOSE:
+				error_code=(unsigned int)get_variable_length(payload, *used_len, sizeof(unsigned int));
+				*used_len+=sizeof(unsigned int);
+
+				reason_phrase_length=(unsigned short)get_variable_length(payload, *used_len, sizeof(unsigned short));
+				*used_len+=sizeof(unsigned short);
+
+				*used_len+=reason_phrase_length; // skip Reason Phrase
+
+				MESA_handle_runtime_log(g_quic_param.logger,
+										RLOG_LV_DEBUG,
+										"QUIC_CONNECTION_CLOSE",
+										"error_code: %u reason_phrase_length: %d addr: %s",
+										error_code,
+										reason_phrase_length,
+										printaddr(&pstream->addr, pstream->threadnum));
+
+				return quic_callPlugins(pstream, _context, NULL, 0, QUIC_INTEREST_KEY_MASK, a_packet);
+				break;
+			case	GQUIC_REGULAR_FRAME_GOAWAY:
+				error_code=(unsigned int)get_variable_length(payload, *used_len, sizeof(unsigned int));
+				*used_len+=sizeof(unsigned int);
+
+				//Last Good Stream ID
+				stream_id=(unsigned int)get_variable_length(payload, *used_len, sizeof(unsigned int));
+				*used_len+=sizeof(unsigned int);
+
+				reason_phrase_length=(unsigned short)get_variable_length(payload, *used_len, sizeof(unsigned short));
+				*used_len+=sizeof(unsigned short);
+
+				*used_len+=reason_phrase_length; // skip Reason Phrase
+
+				MESA_handle_runtime_log(g_quic_param.logger,
+										RLOG_LV_DEBUG,
+										"QUIC_GOAWAY",
+										"error_code: %u Last Good Stream ID: %u reason_phrase_length: %d addr: %s",
+										error_code,
+										stream_id,
+										reason_phrase_length,
+										printaddr(&pstream->addr, pstream->threadnum));
+				break;
+			case	GQUIC_REGULAR_FRAME_WINDOW_UPDATE:
+				stream_id=(unsigned int)get_variable_length(payload, *used_len, sizeof(unsigned int));
+				*used_len+=sizeof(unsigned int);
+
+				byte_offset=get_variable_length(payload, *used_len, sizeof(unsigned long long));
+				*used_len+=sizeof(unsigned long long);
+
+				MESA_handle_runtime_log(g_quic_param.logger,
+										RLOG_LV_DEBUG,
+										"QUIC_WINDOW_UPDATE",
+										"stream_id: %u byte_offset: %llu addr: %s",
+										stream_id,
+										byte_offset,
+										printaddr(&pstream->addr, pstream->threadnum));
+				break;
+			case	GQUIC_REGULAR_FRAME_BLOCKED:
+				stream_id=(unsigned int)get_variable_length(payload, *used_len, sizeof(unsigned int));
+				*used_len+=sizeof(unsigned int);
+
+				MESA_handle_runtime_log(g_quic_param.logger,
+										RLOG_LV_DEBUG,
+										"QUIC_STOP_WAITING",
+										"stream_id: %u addr: %s",
+										stream_id,
+										printaddr(&pstream->addr, pstream->threadnum));
+				break;
+			case	GQUIC_REGULAR_FRAME_STOP_WAITING:
+				bit_to_value(payload, _context->quic_info.quic_hdr.public_flags>>4, &least_unacked_delta, used_len);
+
+				MESA_handle_runtime_log(g_quic_param.logger,
+										RLOG_LV_DEBUG,
+										"QUIC_STOP_WAITING",
+										"least_unacked_delta: %llu addr: %s",
+										least_unacked_delta,
+										printaddr(&pstream->addr, pstream->threadnum));
+				break;
+			case	GQUIC_REGULAR_FRAME_PING:
+				 //The PING frame contains no payload. 
+				 //The receiver of a PING frame simply needs to ACK the packet containing this frame
+				break;
+			default: //Regular Frame Types
+				if(frame_type&GQUIC_SPECIAL_FRAME_STREAM)
+				{					
+					stream_id=get_stream_id(pstream, _context, payload, frame_type, used_len);
+					ret=gquic_frame_type_stream(pstream, _context, payload, payload_len, used_len, a_packet);
+				}
+				else if((frame_type&0xC0)==GQUIC_SPECIAL_FRAME_ACK) // high bit set 0; (frame_type: 01nullmmB)
+				{			
+					stream_id=get_stream_id(pstream, _context, payload, frame_type, used_len);
+					ret=gquic_frame_type_stream(pstream, _context, payload, payload_len, used_len, a_packet);
+				}
+				else if((frame_type&0xE0)==GQUIC_SPECIAL_FRAME_CONGEST_FB)  // high two bits set 0; (frame_type: 01nullmmB)
+				{
+					//not used
+				}
+				else
+				{
+					return APP_STATE_GIVEME;
+				}
+				break;
+		}
+
+		if(ret&APP_STATE_DROPME || ret&APP_STATE_DROPPKT)
+		{
+			return ret;
+		}
+	}
+	
+	return APP_STATE_GIVEME;
+}
+
+
+//QUIC_DATA:is quic data pcap;QUIC_TRUE:is handshake pcap;QUIC_RETURN_DROPME:not quic protocol;
+int parse_gquic_Q046(struct streaminfo *pstream, struct _quic_context* _context, void *a_packet, char * payload, int payload_len, int *used_len)
+{
+	int ret=APP_STATE_GIVEME;
+	unsigned char frame_type;
+		
+	while(*used_len < payload_len)
+	{
+		frame_type=payload[*used_len];
+		*used_len+=1;  //skip frame_type
+		
+		if(frame_type&IQUIC_FRAME_STREAM_HEX08)
+		{			
+			get_stream_id(pstream, _context, payload, frame_type, used_len);
+			ret=gquic_frame_type_stream(pstream, _context, payload, payload_len, used_len, a_packet);
+		}
+		else
+		{
+			return APP_STATE_GIVEME; //todo
+		}
+
+		if(ret&APP_STATE_DROPME || ret&APP_STATE_DROPPKT)
+		{
+			return ret;
+		}
+	}
+	
+	return APP_STATE_GIVEME;
+}
+
+int parse_encrypt_parameter(struct _quic_stream *quic_stream, unsigned char *payload, int payload_len, int thread_seq)
+{
+	int used_len=0,length=0;
+	while(payload_len>used_len)
+	{
+		if(payload[used_len]> 0x00 && payload[used_len]<=0x20)
+		{
+			get_value(payload, &used_len, 1);  //type=1
+			length=get_value(payload, &used_len, 1); // length=1
+			used_len+=length; 
+
+			continue;
+		}
+
+		if((*(unsigned short *)(payload+used_len)) == htons(EXT_QUIC_PARAM_USER_AGENT))
+		{
+			quic_stream->ua_idx=quic_stream->ext_tag_num++;
+			get_value(payload, &used_len, 2);  //type=2
+			length=get_value(payload, &used_len, 1); // length=1
+			get_quic_tlv((char *)payload+used_len, &(quic_stream->ext_tags[quic_stream->ua_idx]), length, EXT_QUIC_PARAM_USER_AGENT, thread_seq);
+			used_len+=length;
+
+			continue;
+		}
+
+		if(*(unsigned int *)(payload+used_len) == htonl(EXT_QUIC_PARAM_QUIC_VERSION))
+		{
+			quic_stream->ver_idx=quic_stream->ext_tag_num++;
+			get_value(payload, &used_len, 4);  //type=4
+			length=get_value(payload, &used_len, 1); // length=1
+			get_quic_tlv((char *)payload+used_len, &(quic_stream->ext_tags[quic_stream->ver_idx]), length, EXT_QUIC_PARAM_QUIC_VERSION, thread_seq);
+			*(unsigned int *)quic_stream->ext_tags[quic_stream->ver_idx].value=(unsigned int)htonl(*(unsigned int *)quic_stream->ext_tags[quic_stream->ver_idx].value);
+			used_len+=length;
+
+			continue;
+		}
+
+		if((*(unsigned int *)(payload+used_len))== htonl(EXT_QUIC_PARAM_GREASE_HIGH4) && (*(unsigned int *)(payload+used_len+4))== htonl(EXT_QUIC_PARAM_GREASE_LOW4))
+		{
+			used_len+=8;  //type=8
+			length=get_value(payload, &used_len, 1); // length=1
+			used_len+=length;
+
+			continue;
+		}
+
+		break;
+	}
+
+	return 0;
+}
+int parse_encrypt_server_name(struct _quic_stream *quic_stream, unsigned char *payload, int payload_len, int thread_seq)
+{
+	int ext_len=0,used_len=0;
+	
+	quic_stream->sni_idx=quic_stream->ext_tag_num++;
+	get_value(payload, &used_len, 2);  //Server Name List length
+	if(get_value(payload, &used_len, 1)==0)  //Server Name type
+	{
+		ext_len=get_value(payload, &used_len, 2);  //Server Name length
+		get_quic_tlv((char *)payload+used_len, &(quic_stream->ext_tags[quic_stream->sni_idx]), ext_len, EXTENSION_SERVER_NAME, thread_seq);
+	}
+
+	return 1;
+}
+
+int parse_encrypt_client_hello(struct streaminfo *pstream, struct _quic_stream *quic_stream, void *a_packet, unsigned char *payload, int payload_len)
+{
+	int skip_len=0;
+	int used_len=0;
+	int flags=0;
+	int ext_type=0, extension_total_len=0;
+
+	get_value(payload, &used_len, 1);  //handshake type
+	get_value(payload, &used_len, 3); //client hello length
+	get_value(payload, &used_len, 2); //ssl_version
+
+	get_value(payload, &used_len, 32);  //Random
+
+	skip_len=(int)get_value(payload, &used_len, 1);  //Session ID length
+	used_len+=skip_len;
+
+	skip_len=(int)get_value(payload, &used_len, 2);  //Ciper Suites length
+	used_len+=skip_len;
+
+	skip_len=(int)get_value(payload, &used_len, 1);  //Compression Methods
+	used_len+=skip_len;
+
+	extension_total_len=(int)get_value(payload, &used_len, 2);  //Extension length
+
+	quic_stream->ext_tags=(quic_tlv_t *)dictator_malloc(pstream->threadnum, sizeof(quic_tlv_t)*3);
+	memset(quic_stream->ext_tags, 0, sizeof(quic_tlv_t)*3);
+	
+	while(extension_total_len>used_len)
+	{
+		ext_type=get_value(payload, &used_len, 2);  //Extension type		
+		skip_len=get_value(payload, &used_len, 2);	//length
+		switch(ext_type)
+		{
+			case	EXTENSION_SERVER_NAME:
+				parse_encrypt_server_name(quic_stream, payload+used_len, skip_len, pstream->threadnum);
+				flags=1;
+				break;
+			case	EXTENSION_QUIC_PARAM:
+				parse_encrypt_parameter(quic_stream, payload+used_len, skip_len, pstream->threadnum);
+				break;
+			case	EXTENSION_SUPPORT_GROUP:
+			case	EXTENSION_APP_PROT_NEGO:
+			case	EXTENSION_SIG_ALGORITHM:
+			case	EXTENSION_KEY_SHARE:
+			case	EXTENSION_PSK_EXCHANGE:
+			case	EXTENSION_SUPP_SSL_VER:
+			case	EXTENSION_COMPRESS_CERT:
+				break;
+			default:
+				break;
+		}
+		
+		used_len+=skip_len;
+	}
+	
+	return flags;
+}
+
+int parse_decrypt_quic(struct streaminfo *pstream, struct _quic_context* _context, void *a_packet, unsigned char * payload, int payload_len, int *used_len)
+{
+	int ret=0,state=APP_STATE_GIVEME;
+	unsigned int quic_version=_context->quic_info.quic_hdr.quic_version;
+	
+	get_value(payload, used_len, 4);	//Frame Type=1, offset=1, length=2
+
+	if( (quic_version>=MVFST_VERSION_00 && quic_version<=MVFST_VERSION_0F)		||
+		(quic_version>=GQUIC_VERSION_T050 && quic_version<=GQUIC_VERSION_T059)	||
+		(quic_version>=IQUIC_VERSION_I022 && quic_version<=IQUIC_VERSION_I029)
+		)
+	{
+		if(payload[*used_len] == 0x01)
+		{
+			if(_context->quic_info.client_hello==NULL)
+			{
+				_context->quic_info.client_hello=(struct _quic_stream *)dictator_malloc(pstream->threadnum, sizeof(struct _quic_stream));
+				memset(_context->quic_info.client_hello, 0, sizeof(struct _quic_stream));
+			}
+			ret=parse_encrypt_client_hello(pstream, _context->quic_info.client_hello, a_packet, payload+*used_len, payload_len); //Frame Type=1, offset=1, length=2
+			if(ret>0 && _context->call_business)
+			{
+				state=quic_callPlugins(pstream, _context, (void *)(_context->quic_info.client_hello), sizeof(void *), QUIC_CLIENT_HELLO_MASK, a_packet);
+			}
+		}
+	}
+	else if( (quic_version>=GQUIC_VERSION_Q047 && quic_version<=GQUIC_VERSION_Q059))
+	{		
+		state=gquic_frame_type_stream(pstream, _context, (char *)payload, payload_len, used_len, a_packet);
+	}
+	else
+	{
+		state=APP_STATE_DROPME;
+	}
+
+	return state;
+}
+
+//cid->version->nounce->pkt num->ahn hash(12)
+int quic_process(struct streaminfo *pstream, struct _quic_context* _context, int thread_seq, void* a_packet)
+{
+	int used_len=0;
+	int ret=APP_STATE_GIVEME;
+	unsigned char decrypt_payload[1500]={0};
+	unsigned int decrypt_payload_len=sizeof(decrypt_payload);
+
+	enum _QUIC_VERSION is_gquic=QUIC_VERSION_UNKNOWN;
+	struct udpdetail *udp_detail=pstream->pudpdetail;
+	
+	if(udp_detail->pdata==NULL || udp_detail->datalen<=0)
+	{
+		return APP_STATE_GIVEME;
+	}
+
+	is_gquic=is_quic_protocol(pstream, _context, (char *)udp_detail->pdata, udp_detail->datalen, &used_len);
+	if(!_context->call_business)
+	{
+		return APP_STATE_GIVEME;
+	}
+	
+	if(is_gquic!=QUIC_VERSION_UNKNOWN)
+	{
+		if(_context->cb_version==0)
+		{
+			_context->cb_version=1;
+			ret=quic_callPlugins(pstream, _context, &(_context->quic_info.quic_hdr.quic_version), sizeof(_context->quic_info.quic_hdr.quic_version), QUIC_USEING_VERSION_MASK, a_packet);
+			if((ret&APP_STATE_DROPME) || (ret&APP_STATE_DROPPKT))
+			{
+				return ret;
+			}
+		}
+		
+		switch(is_gquic)
+		{
+			case	GQUIC_VERSION_Q043:
+				ret=gquic_proc_unencrypt(pstream, _context, a_packet, (char *)udp_detail->pdata, udp_detail->datalen, &used_len);
+				break;
+			case	GQUIC_VERSION_Q046:
+				ret=parse_gquic_Q046(pstream, _context, a_packet, (char *)udp_detail->pdata, udp_detail->datalen, &used_len);
+				break;
+			default:
+				if(	((is_gquic>=MVFST_VERSION_00 && is_gquic<=MVFST_VERSION_0F)		||
+						(is_gquic>=GQUIC_VERSION_Q047 && is_gquic<=GQUIC_VERSION_Q059)	||
+						(is_gquic>=GQUIC_VERSION_T050 && is_gquic<=GQUIC_VERSION_T059)	||
+						(is_gquic>=GQUIC_VERSION_T050 && is_gquic<=GQUIC_VERSION_T059)	||
+						(is_gquic>=IQUIC_VERSION_I022 && is_gquic<=IQUIC_VERSION_I029)
+						)
+					&& _context->is_decrypt==0
+					)
+				{
+					_context->is_decrypt=1;
+					ret=dissect_quic((char *)udp_detail->pdata, udp_detail->datalen, decrypt_payload, &decrypt_payload_len);
+					if(ret!=1)
+					{
+						return APP_STATE_DROPME;
+					}
+					ret=parse_decrypt_quic(pstream, _context, a_packet, decrypt_payload, decrypt_payload_len, &used_len);
+					break;
+				}
+				
+				ret=quic_callPlugins(pstream, _context, (char *)udp_detail->pdata, udp_detail->datalen, QUIC_APPLICATION_DATA_MASK, a_packet);
+				if((ret&APP_STATE_DROPME) || (ret&APP_STATE_DROPPKT))
+				{
+					return ret;
+				}
+				break;
+		}
+
+		if((ret&APP_STATE_DROPME) || (ret&APP_STATE_DROPPKT))
+		{
+			return ret;
+		}
+	}
+
+	if(_context->is_quic==TRUE)
+	{
+		if(_context->quic_info.quic_hdr.is_reset)
+		{
+			return quic_callPlugins(pstream, _context, NULL, 0, QUIC_INTEREST_KEY_MASK, a_packet);			
+		}
+		
+		if(_context->quic_info.quic_hdr.is_version_negotiation)
+		{
+			return quic_callPlugins(pstream, _context, NULL, 0, QUIC_NEGOTIATION_VERSION_MASK, a_packet);
+		}
+		return APP_STATE_GIVEME;
+	}
+	
+	return APP_STATE_DROPME;;
+}
+
+
+int quic_protocol_identify(struct streaminfo *a_stream, void *a_packet, char *out_sni, int out_sni_len)
+{
+	int ret=APP_STATE_GIVEME;
+	int sni_len=0,len=-1;
+	void *pme=NULL;
+	char *sni=NULL;
+	struct _quic_context *_context=NULL;
+	
+	quic_init_stream(&pme, a_stream->threadnum);
+	_context=(struct _quic_context *)pme;
+	
+	ret=quic_process(a_stream, _context, a_stream->threadnum, a_packet);
+	if(ret!=PROT_STATE_DROPME && _context->is_quic!=QUIC_VERSION_UNKNOWN)
+	{
+		if(_context->quic_info.client_hello!=NULL)
+		{
+			sni=(char *)(_context->quic_info.client_hello->ext_tags[_context->quic_info.client_hello->sni_idx].value);
+			sni_len=_context->quic_info.client_hello->ext_tags[_context->quic_info.client_hello->sni_idx].length;
+			len= sni_len>(out_sni_len-1) ? (out_sni_len-1) : sni_len;
+			memcpy(out_sni, sni, len);
+		}
+		else
+		{
+			if(_context->is_quic==TRUE)
+			{
+				len=0;
+			}
+		}
+	}
+
+	quic_release_stream(&pme, a_stream->threadnum);
+
+	return len;
+}