Dns over http2 5773 v10

[catenacyber]

Link to redmine ticket:
https://redmine.openinfosecfoundation.org/issues/5773

Describe changes:

• analyze DNS over HTTP2

SV_BRANCH=OISF/suricata-verify#1734

Draft to get feedback about approach...

#10984 with needed rebase

@jasonish would you like to already take in the first 2 commits (json schema and remove unneeded mut) ?

TODO :

• Fix dns json schema and logging first (that is https://redmine.openinfosecfoundation.org/issues/6281 )
• Use config for dns logging...

Functionnaly, in terms of output :

• The flow will have doh2 as app_proto (and http2 as app_proto_orig)
• There are doh2 events that have both http2 and dns fields. dns logging is done like alerts, not like dns events...
• DNS and HTTP and HTTP2 signatures work on DOH2
• Signatures can be DOH2 specific. These signatures can combine http, http2 and dns keywords.
• DNS Frames do not work on DoH2

Memory management

• a HTTP2 tx can own 2 DNS tx (one to client, one to server)
• a HTTP2 tx stores the streamed DNS response content until it is complete before parsing it (limiting to U16_MAX bytes)

API

• There is a new DOH2 app-layer protocol which resorts to HTTP2 for most of the things
• HTTP2 parsing discovering DOH2 changes the app_proto to DOH2, doh2 can be enabled or disabled in suricata.yaml config
• There are more alproto "comparison" functions
• Every DNS keyword needs to check the flow alproto to change the transaction
• Every DNS/HTTP keyword is automatically registered for DOH2 (hacking DetectAppLayerMpmRegister2...

[suricata-qa]

ERROR:

ERROR: QA failed on ASAN_TLPR1_cfg.

Pipeline 20889

[codecov]

Codecov Report

Attention: Patch coverage is 91.37931% with 30 lines in your changes are missing coverage. Please review.

Project coverage is 82.97%. Comparing base (10a367b) to head (decd292).

Additional details and impacted files

@@           Coverage Diff            @@
##           master   #11196    +/-   ##
========================================
  Coverage   82.96%   82.97%            
========================================
  Files         942      942            
  Lines      250569   250781   +212     
========================================
+ Hits       207876   208074   +198     
- Misses      42693    42707    +14     

Flag	Coverage Δ
fuzzcorpus	61.29% <69.82%> (-0.01%)	⬇️
livemode	18.69% <6.32%> (-0.02%)	⬇️
pcap	44.59% <76.14%> (+0.09%)	⬆️
suricata-verify	61.64% <83.04%> (+0.02%)	⬆️
unittests	60.61% <33.90%> (-0.03%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

[suricata-qa]

Information: QA ran without warnings.

Pipeline 20897

[jasonish]

@jasonish would you like to already take in the first 2 commits (json schema and remove unneeded mut) ?

Yes.

[catenacyber]

jasonish would you like to already take in the first 2 commits (json schema and remove unneeded mut) ?

Yes.

#11226

[catenacyber]

Rebased in #11242