Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Dns over http2 5773 v11 #11242

Closed
wants to merge 7 commits into from

Conversation

catenacyber
Copy link
Contributor

Link to redmine ticket:
https://redmine.openinfosecfoundation.org/issues/5773

Describe changes:

  • analyze DNS over HTTP2

SV_BRANCH=OISF/suricata-verify#1734

Draft to get feedback about approach...

#11196 with needed rebase

TODO :

Functionnaly, in terms of output :

  • The flow will have doh2 as app_proto (and http2 as app_proto_orig)
  • There are doh2 events that have both http2 and dns fields. dns logging is done like alerts, not like dns events...
  • DNS and HTTP and HTTP2 signatures work on DOH2
  • Signatures can be DOH2 specific. These signatures can combine http, http2 and dns keywords.
  • DNS Frames do not work on DoH2

Memory management

  • a HTTP2 tx can own 2 DNS tx (one to client, one to server)
  • a HTTP2 tx stores the streamed DNS response content until it is complete before parsing it (limiting to U16_MAX bytes)

API

  • There is a new DOH2 app-layer protocol which resorts to HTTP2 for most of the things
  • HTTP2 parsing discovering DOH2 changes the app_proto to DOH2, doh2 can be enabled or disabled in suricata.yaml config
  • There are more alproto "comparison" functions
  • Every DNS keyword needs to check the flow alproto to change the transaction
  • Every DNS/HTTP keyword is automatically registered for DOH2 (hacking DetectAppLayerMpmRegister2...

by making tx parsing and creation more easily available,
without needing a dns state.

Dns event NotResponse is now set on the right tx, and not the one
before.

Also debug log for Z-flag on request says "request" instead of
"response"

Also rustfmt dns.rs
Now a flow alproto can be changed by a call to AppLayerParserParse
when HTTP2 forces the flow to turn into DOH2.
Ticket: 5773

Handles both directions the same way for data if content type is
application/dns-message
@catenacyber catenacyber requested review from jasonish, victorjulien and a team as code owners June 5, 2024 08:38
@catenacyber catenacyber marked this pull request as draft June 5, 2024 08:38
Copy link

codecov bot commented Jun 5, 2024

Codecov Report

Attention: Patch coverage is 91.32948% with 30 lines in your changes missing coverage. Please review.

Project coverage is 83.00%. Comparing base (8781e93) to head (d8807f1).

Additional details and impacted files
@@            Coverage Diff             @@
##           master   #11242      +/-   ##
==========================================
+ Coverage   82.99%   83.00%   +0.01%     
==========================================
  Files         942      942              
  Lines      249358   249570     +212     
==========================================
+ Hits       206951   207159     +208     
- Misses      42407    42411       +4     
Flag Coverage Δ
fuzzcorpus 61.10% <69.65%> (-0.01%) ⬇️
livemode 18.78% <6.35%> (-0.06%) ⬇️
pcap 44.36% <76.01%> (+0.05%) ⬆️
suricata-verify 61.77% <82.94%> (+0.09%) ⬆️
unittests 60.47% <34.10%> (-0.03%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

@suricata-qa
Copy link

Information: QA ran without warnings.

Pipeline 20975

@victorjulien victorjulien self-assigned this Jun 7, 2024
@catenacyber
Copy link
Contributor Author

Rebased in #11292

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

3 participants