Skip to content

Comments

Dns over http2 5773 v7#10733

Closed
catenacyber wants to merge 13 commits intoOISF:masterfrom
catenacyber:dns-over-http2-5773-v7
Closed

Dns over http2 5773 v7#10733
catenacyber wants to merge 13 commits intoOISF:masterfrom
catenacyber:dns-over-http2-5773-v7

Conversation

@catenacyber
Copy link
Contributor

Link to redmine ticket:
https://redmine.openinfosecfoundation.org/issues/5773

Describe changes:

  • analyze DNS over HTTP2
SV_BRANCH=pr/1734

OISF/suricata-verify#1734

Draft to get feedback about approach...

#10174 rebased on top of #10732 and handling POST case
And also adding a commit to add a missing field in json schema for DNS cc @jasonish

TODO :

Functionnaly, in terms of output :

  • The flow will have doh2 as app_proto (and http2 as app_proto_orig)
  • There are doh2 events that have both http2 and dns fields. dns logging is done like alerts, not like dns events...
  • DNS and HTTP and HTTP2 signatures work on DOH2
  • Signatures can be DOH2 specific. These signatures can combine http, http2 and dns keywords.
  • DNS Frames do not work on DoH2

Memory management

  • a HTTP2 tx can own 2 DNS tx (one to client, one to server)
  • a HTTP2 tx stores the streamed DNS response content until it is complete before parsing it (limiting to U16_MAX bytes)

API

  • There is a new DOH2 app-layer protocol which resorts to HTTP2 for most of the things
  • HTTP2 parsing discovering DOH2 changes the app_proto to DOH2, doh2 can be enabled or disabled in suricata.yaml config
  • There are more alproto "comparison" functions
  • Every DNS keyword needs to check the flow alproto to change the transaction
  • Every DNS/HTTP keyword is automatically registered for DOH2 (hacking DetectAppLayerMpmRegister2...)

catenacyber and others added 12 commits March 28, 2024 09:07
by making tx parsing and creation more easily available,
without needing a dns state.

Dns event NotResponse is now set on the right tx, and not the one
before.

Also debug log for Z-flag on request says "request" instead of
"response"

Also rustfmt dns.rs
Now a flow alproto can be changed by a call to AppLayerParserParse
when HTTP2 forces the flow to turn into DOH2.
Ticket: 5773

Handles both directions the same way for data if content type is
application/dns-message
@suricata-qa
Copy link

Information: QA ran without warnings.

Pipeline 19872

@catenacyber
Copy link
Contributor Author

Rebased in #10898

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants