diff --git a/nfq/protocol.c b/nfq/protocol.c index 4013ba9..cedf15d 100644 --- a/nfq/protocol.c +++ b/nfq/protocol.c @@ -525,9 +525,9 @@ bool QUICExtractHostFromInitial(const uint8_t *data, size_t data_len, char *host bool IsQUICInitial(const uint8_t *data, size_t len) { // too small packets are not likely to be initials with client hello - if (len < 256) return false; + // long header, fixed bit + if (len < 256 || (data[0] & 0xC0)!=0xC0) return false; - // this also ensures long header uint32_t ver = QUICExtractVersion(data,len); if (QUICDraftVersion(ver) < 11) return false;