Project

General

Profile

Actions
Copy link

Feature #5773

closed
BM PA

doh: support DNS over HTTPS (DoH)

Feature #5773: doh: support DNS over HTTPS (DoH)

Added by Brandon Murphy over 3 years ago. Updated 12 months ago.

Status:
Closed
Priority:
Normal
Assignee:
Philippe Antoine
Target version:
8.0.0-beta1
Effort:
Difficulty:
Label:
Protocol

Description

Feature request is for Suricata, when presented with, likely decrypted, pcap/traffic that includes DoH traffic, it'd be parsed and included with DNS logs.

https://datatracker.ietf.org/doc/rfc8484/

Example pcap included.

A couple of quick notes I found when looking through the RFC:
  1. "HTTP/2 [RFC7540] is the minimum RECOMMENDED version of HTTP for use with DoH."
    I suppose this doesn't mean it can't use HTTP/1.1, just that it's not RECOMMENDED.
  2. "DoH client encodes a single DNS query into an HTTP request using either the HTTP GET or POST method..."
  3. "Reuses the format of DNS once base64 decoded

Ideally all normal "dns" support would work with data that occurs via DoH, datasets, dns keywords, logging, etc.

Files

Download all files
dns_over_https.pcap (5.07 KB) dns_over_https.pcap Brandon Murphy, 01/03/2023 04:07 PM
dns_over_https_POST.pcap (20.6 KB) dns_over_https_POST.pcap Brandon Murphy, 03/24/2024 08:50 PM

Related issues 8 (4 open — 4 closed)

Related to Suricata - Task #6443: Suricon 2023 brainstormAssignedVictor JulienActions
Related to Suricata - Feature #6453: Support DNS over TLSNewOISF DevActions
Related to Suricata - Feature #5674: Support layered protocolsAssignedOISF DevActions
Related to Suricata - Feature #3952: protocols: implement mDNSClosedJason IshActions
Blocked by Suricata - Bug #6281: dns: structure of query differs between "alert" and "dns" event typesClosedJason IshActions
Blocked by Suricata - Optimization #3827: output: clean up logging initialization codeClosedPhilippe AntoineActions
Blocks Suricata - Task #7118: tracking: add support for new protocolsAssignedVictor JulienActions
Blocks Suricata - Story #7119: protocols: protocol additionsClosedVictor JulienActions

VJ Updated by Victor Julien almost 3 years ago Actions
Copy link
 #1

  • Target version changed from TBD to 8.0.0-beta1

PA Updated by Philippe Antoine over 2 years ago Actions
Copy link
 #2

  • Related to Task #6443: Suricon 2023 brainstorm added

PA Updated by Philippe Antoine over 2 years ago Actions
Copy link
 #3

Also DNS over TLS (port 5353 ?) as plain DNS...?

PA Updated by Philippe Antoine over 2 years ago Actions
Copy link
 #4

DNS over HTTPS seems to be HTTP2 with base64 payload in URL

BM Updated by Brandon Murphy over 2 years ago Actions
Copy link
 #5

Philippe Antoine wrote in #note-4:

DNS over HTTPS seems to be HTTP2 with base64 payload in URL

the way the RFC is written, HTTP/1 is not RECOMMENDED. it does NOT say it MUST be HTTP/2.

PA Updated by Philippe Antoine over 2 years ago Actions
Copy link
 #6

PA Updated by Philippe Antoine over 2 years ago Actions
Copy link
 #7

PA Updated by Philippe Antoine over 2 years ago Actions
Copy link
 #8

  • Assignee changed from OISF Dev to Philippe Antoine

PA Updated by Philippe Antoine over 2 years ago Actions
Copy link
 #9

Hack could be to :
- hook into HTTP2 parsing : if headers look like DNS request : the HTTP2 state creates and owns a DNS state + we call some new function with arguments the flow and the payload (and the protocol DNS) kind of StreamTcpDetectLogFlush
- We kind of dequeue a pseudo-packet with DNS payload and run the flow worker on it. This begins by switching the DNS state into Flow's alstate and ends by reputing the HTTP2 state

VJ Updated by Victor Julien over 2 years ago Actions
Copy link
 #10

  • Status changed from New to Assigned

VJ Updated by Victor Julien over 2 years ago Actions
Copy link
 #11

PA Updated by Philippe Antoine over 2 years ago Actions
Copy link
 #12

  • Status changed from Assigned to In Progress

PA Updated by Philippe Antoine over 2 years ago Actions
Copy link
 #13

  • Blocked by Bug #6281: dns: structure of query differs between "alert" and "dns" event types added

PA Updated by Philippe Antoine over 2 years ago Actions
Copy link
 #14

  • Status changed from In Progress to In Review

PA Updated by Philippe Antoine about 2 years ago Actions
Copy link
 #15

BM Updated by Brandon Murphy about 2 years ago Actions
Copy link
 #16

I apologize for not tracking this issue very closely.

Does this also handle DoH queries are within the request body via a POST? I believe it's a different format when this happens.

https://datatracker.ietf.org/doc/html/rfc8484#section-4.1.1 has examples.

PA Updated by Philippe Antoine about 2 years ago Actions
Copy link
 #17

Thanks Brandon, the current draft PR does not recognize this indeed. Would you have a pcap to share ?

For info, this whole feature is waiting on #6281 to have get past the draft PR...

BM Updated by Brandon Murphy about 2 years ago Actions
Copy link
 #18

Attached is a pcap from a post on netresec. It contains a single TCP session with multiple DoH via POST over HTTP/2 that has been decrypted.

PA Updated by Philippe Antoine about 2 years ago Actions
Copy link
 #19

Thank you @zoomequipd

The PR https://github.com/OISF/suricata/pull/10733 has a last commit to handle this case, and your pcap is tested in the SV PR https://github.com/OISF/suricata-verify/pull/1734

VJ Updated by Victor Julien almost 2 years ago Actions
Copy link
 #20

  • Blocks Task #7118: tracking: add support for new protocols added

VJ Updated by Victor Julien almost 2 years ago Actions
Copy link
 #21

  • Blocks Story #7119: protocols: protocol additions added

PA Updated by Philippe Antoine over 1 year ago Actions
Copy link
 #22

  • Status changed from In Review to Closed

VJ Updated by Victor Julien 12 months ago Actions
Copy link
 #23

  • Subject changed from Support DNS over HTTPS (DoH) to doh: support DNS over HTTPS (DoH)
Actions
Copy link

Also available in: PDF Atom