Skip to content

Comments

Dns over http2 5773 v5#10125

Closed
catenacyber wants to merge 7 commits intoOISF:masterfrom
catenacyber:dns-over-http2-5773-v5
Closed

Dns over http2 5773 v5#10125
catenacyber wants to merge 7 commits intoOISF:masterfrom
catenacyber:dns-over-http2-5773-v5

Conversation

@catenacyber
Copy link
Contributor

Link to redmine ticket:
https://redmine.openinfosecfoundation.org/issues/5773

Describe changes:

  • analyze DNS over HTTP2
SV_BRANCH=pr/1573

OISF/suricata-verify#1573

Draft to get feedback about approach...
Leaving comments on the code for specific questions

#10123 with clippy fixes

TODO :

Functionnaly, in terms of output :

  • The flow will have doh2 as app_proto (and http2 as app_proto_orig)
  • There are doh2 events that have both http2 and dns fields. dns logging is done like alerts, not like dns events...
  • DNS and HTTP and HTTP2 signatures work on DOH2
  • Signatures can be DOH2 specific. These signatures can combine http, http2 and dns keywords.
  • DNS Frames do not work on DoH2

Memory management

  • a HTTP2 tx can own 2 DNS tx (one to client, one to server)
  • a HTTP2 tx stores the streamed DNS response content until it is complete before parsing it (limiting to U16_MAX bytes)

API

  • There is a new DOH2 app-layer protocol which resorts to HTTP2 for most of the things
  • HTTP2 parsing discovering DOH2 changes the app_proto to DOH2, doh2 can be enabled or disabled in suricata.yaml config
  • There are more alproto "comparison" functions
  • Every DNS keyword needs to check the flow alproto to change the transaction
  • Every DNS/HTTP keyword is automatically registered for DOH2 (hacking DetectAppLayerMpmRegister2...)

by making tx parsing and creation more easily available,
without needing a dns state.

Dns event NotResponse is now set on the right tx, and not the one
before.

Also debug log for Z-flag on request says "request" instead of
"response"

Also rustfmt dns.rs
@catenacyber catenacyber force-pushed the dns-over-http2-5773-v5 branch from 5f1d4e0 to b1b1393 Compare January 5, 2024 10:56
@catenacyber
Copy link
Contributor Author

Force push to get CI greener (dtx.id = 1; to avoid rust underflow in dns logging)

@codecov
Copy link

codecov bot commented Jan 5, 2024

Codecov Report

Attention: 48 lines in your changes are missing coverage. Please review.

Comparison is base (a37fa62) 82.15% compared to head (cf63420) 82.06%.

Additional details and impacted files
@@            Coverage Diff             @@
##           master   #10125      +/-   ##
==========================================
- Coverage   82.15%   82.06%   -0.09%     
==========================================
  Files         974      975       +1     
  Lines      271925   272203     +278     
==========================================
- Hits       223394   223385       -9     
- Misses      48531    48818     +287     
Flag Coverage Δ
fuzzcorpus 62.73% <57.17%> (-0.17%) ⬇️
suricata-verify 61.44% <80.44%> (-0.01%) ⬇️
unittests 62.80% <30.19%> (-0.04%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

@suricata-qa
Copy link

Information: QA ran without warnings.

Pipeline 17358

Now a flow alproto can be changed by a call to AppLayerParserParse
when HTTP2 forces the flow to turn into DOH2.
@catenacyber catenacyber force-pushed the dns-over-http2-5773-v5 branch from 33bd2bb to cf63420 Compare January 5, 2024 13:53
@suricata-qa
Copy link

Information: QA ran without warnings.

Pipeline 17359

@suricata-qa
Copy link

Information: QA ran without warnings.

Pipeline 17360

@catenacyber
Copy link
Contributor Author

Replaced by #10174

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants