Subject: Wireshark decryption support for QUIC

From: Peter Wu <[email-masked]>
Date: Thu, 29 Mar 2018 16:55:59 +0200

Hi!

In case you have not noticed, Alexis La Goutte and me have been working
on adding support for IETF QUIC to Wireshark. The stable 2.4.x version
only supports Google's QUIC variant (GQUIC), but the development version
does support IETF QUIC.

Since Wireshark v2.5.2rc0-67-g184b943fbd (soon to be released as 2.6.x),
both handshake and payload decryption are fully supported for draft -09
and Key Update should be supported (but untested). 0-RTT decryption is
not supported yet.

Payload decryption relies on the QUIC library to provide secrets.
Currently it requires the TLS (Early) Exporter secret, but if this is
impractical, we could look into taking alternative secrets (such as
client_pp_secret_0, etc.). The TLS Exporter secrets are taken from the
TLS library using the "NSS Key log format" which is specified at
https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/Key_Log_Format
It can be provided to Wireshark via the "SSL" protocol preferences,
"(Pre)-Master-Secret log filename" option.

For an example integration with ngtcp2 and OpenSSL, see
https://github.com/ngtcp2/ngtcp2/pull/67 which is also referenced from
https://github.com/quicwg/base-drafts/wiki/Tools

If you have any questions or feature requests, please contact me, Alexis
or ask in the quicdev #wireshark Slack channel. The current status can
be tracked on https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13881
-- 
Kind regards,
Peter Wu
https://lekensteyn.nl