analyzer: make http3/quic handling more reliable

analyzer/udp/internal/quic/payload.go

@@ -51,15 +51,27 @@ func ReadCryptoFrames(packet []byte) ([]CryptoFrame, error) {
 	if int64(len(packet)) < offset+hdr.Length {
 		return nil, fmt.Errorf("packet is too short: %d < %d", len(packet), offset+hdr.Length)
 	}
-	unProtectedPayload, err := pp.UnProtect(packet[:offset+hdr.Length], offset, 2)
-	if err != nil {
-		return nil, err
+	packetView := packet[:offset+hdr.Length]
+	pnMaxGuesses := []int64{0, 1, 2, 3, 4, 8, 16}
+	var lastErr error
+	for _, pnMax := range pnMaxGuesses {
+		packetCopy := append([]byte(nil), packetView...)
+		unProtectedPayload, err := pp.UnProtect(packetCopy, offset, pnMax)
+		if err != nil {
+			lastErr = err
+			continue
+		}
+		frs, err := extractCryptoFrames(bytes.NewReader(unProtectedPayload))
+		if err != nil {
+			lastErr = err
+			continue
+		}
+		return frs, nil
 	}
-	frs, err := extractCryptoFrames(bytes.NewReader(unProtectedPayload))
-	if err != nil {
-		return nil, err
+	if lastErr != nil {
+		return nil, lastErr
 	}
-	return frs, nil
+	return nil, errors.New("unable to decrypt initial packet")
 }
 
 const (