Skip to content

Comments

Dns over http2 5773 v8#10898

Closed
catenacyber wants to merge 9 commits intoOISF:masterfrom
catenacyber:dns-over-http2-5773-v8
Closed

Dns over http2 5773 v8#10898
catenacyber wants to merge 9 commits intoOISF:masterfrom
catenacyber:dns-over-http2-5773-v8

Conversation

@catenacyber
Copy link
Contributor

Link to redmine ticket:
https://redmine.openinfosecfoundation.org/issues/5773

Describe changes:

  • analyze DNS over HTTP2

SV_BRANCH=OISF/suricata-verify#1734

Draft to get feedback about approach...

#10733 with needed rebase
And also adding a commit to add a missing field in json schema for DNS cc @jasonish

TODO :

Functionnaly, in terms of output :

  • The flow will have doh2 as app_proto (and http2 as app_proto_orig)
  • There are doh2 events that have both http2 and dns fields. dns logging is done like alerts, not like dns events...
  • DNS and HTTP and HTTP2 signatures work on DOH2
  • Signatures can be DOH2 specific. These signatures can combine http, http2 and dns keywords.
  • DNS Frames do not work on DoH2

Memory management

  • a HTTP2 tx can own 2 DNS tx (one to client, one to server)
  • a HTTP2 tx stores the streamed DNS response content until it is complete before parsing it (limiting to U16_MAX bytes)

API

  • There is a new DOH2 app-layer protocol which resorts to HTTP2 for most of the things
  • HTTP2 parsing discovering DOH2 changes the app_proto to DOH2, doh2 can be enabled or disabled in suricata.yaml config
  • There are more alproto "comparison" functions
  • Every DNS keyword needs to check the flow alproto to change the transaction
  • Every DNS/HTTP keyword is automatically registered for DOH2 (hacking DetectAppLayerMpmRegister2...)

by making tx parsing and creation more easily available,
without needing a dns state.

Dns event NotResponse is now set on the right tx, and not the one
before.

Also debug log for Z-flag on request says "request" instead of
"response"

Also rustfmt dns.rs
Now a flow alproto can be changed by a call to AppLayerParserParse
when HTTP2 forces the flow to turn into DOH2.
Ticket: 5773

Handles both directions the same way for data if content type is
application/dns-message
@catenacyber catenacyber force-pushed the dns-over-http2-5773-v8 branch from 79f97b6 to bbc0a35 Compare April 18, 2024 12:44
@codecov
Copy link

codecov bot commented Apr 18, 2024

Codecov Report

Attention: Patch coverage is 89.94413% with 36 lines in your changes are missing coverage. Please review.

Project coverage is 82.73%. Comparing base (2b4e102) to head (bbc0a35).

Additional details and impacted files
@@            Coverage Diff             @@
##           master   #10898      +/-   ##
==========================================
+ Coverage   77.64%   82.73%   +5.09%     
==========================================
  Files         922      922              
  Lines      247806   248064     +258     
==========================================
+ Hits       192400   205243   +12843     
+ Misses      55406    42821   -12585     
Flag Coverage Δ
fuzzcorpus 64.26% <68.15%> (?)
suricata-verify 61.91% <82.12%> (-0.51%) ⬇️
unittests 62.17% <33.24%> (-0.03%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

@suricata-qa
Copy link

ERROR:

ERROR: QA failed on SURI_TLPW1_files_sha256.

Pipeline 20226

@catenacyber
Copy link
Contributor Author

Rebased in #10984

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants