Websockets 2695 v15

[catenacyber]

Link to redmine ticket:
https://redmine.openinfosecfoundation.org/issues/2695

Describe changes:

• app-layer: websockets protocol support
• enip: register on default port 44818 also for TCP (as is done on UDP)
• http2: add newer settings, including the one for websocket over HTTP/2 cf https://www.rfc-editor.org/rfc/rfc8441#section-3
• on top of Detect integers 6644 v8 #10175 + Output alert applayer v19.1 #10166

SV_BRANCH=pr/1571

OISF/suricata-verify#1571

#10173 with rebase on top of #10175 (to get green CI for check rust)

I think this is good enough for a first version even if there may be improvements (that should happen in later tickets) :

• using latest HTTP/1 transaction in a single rule, instead of splitting rule and using flowbits. Should the Websocket state own the last HTTP1 transaction ? And if so, need to see with DOH2 as well the mechanism to get the right transaction for each keyword...
• support websockets over HTTP/2 : need more design
  This is a big one as websockets over HTTP/2 only use a single HTTP/2 stream and not the whole TCP connection which keeps having newer regular HTTP/2 streams (or other websocket ones). That means a HTTP2 transactions will own a Websocket State + some streaming buffer as TCP...

[suricata-qa]

WARNING:

field	baseline	test	%
	build_asan

Pipeline 17539

[catenacyber]

CI should be red/SV is failing because OISF/suricata-verify#1571 is missing to use OISF/suricata-verify#1490

[suricata-qa]

WARNING:

field	baseline	test	%
	SURI_TLPR1_stats_chk
.tcp.pseudo	2810	3014	107.26%

Pipeline 17554

[zoomequipd]

Question based on the changes to the docs:

does this mean that we need to rewrite our use of integer-keywords (dsize, bsize, urilen, etc)?

based on the examples

 bsize:10; --> bsize:integer 10;

is that right or am i misunderstanding?

[catenacyber]

Question based on the changes to the docs:

does this mean that we need to rewrite our use of integer-keywords (dsize, bsize, urilen, etc)?

based on the examples

 bsize:10; --> bsize:integer 10;

is that right or am i misunderstanding?

#10179 is the PR for integer keywords.

You do not need to rewrite anything bsize:10; works
bsize:integer 10; does not work.

So, the doc looks unclear. How would you spell it ?

[zoomequipd]

#10179 is the PR for integer keywords.

sorry, I was looking through this PR and noticed it, would you prefer this convo to occur on #10179?

[catenacyber]

#10179 is the PR for integer keywords.

sorry, I was looking through this PR and noticed it, would you prefer this convo to occur on #10179?

Ideally yes but we can keep it here no big deal...

[zoomequipd]

support websockets over HTTP/2 : need pcap

was the pcap I shared via redmine not sufficient or do you just want another ticket for that feature?

[catenacyber]

support websockets over HTTP/2 : need pcap

was the pcap I shared via redmine not sufficient or do you just want another ticket for that feature?

@zoomequipd thanks for the pcap, it is enough for now, this was just a bad copy/paste from old data, my mistake.

This is a big one as websockets over HTTP/2 only use a single HTTP/2 stream and not the whole TCP connection which keeps having newer regular HTTP/2 streams (or other websocket ones). That means a HTTP2 transactions will own a Websocket State + some streaming buffer as TCP...

This still stands...

[catenacyber]

Rebased in #10375