Project

General

Profile

Actions
Copy link

Feature #5773

closed

Support DNS over HTTPS (DoH)

Added by Brandon Murphy almost 2 years ago. Updated 4 months ago.

Status:
Closed
Priority:
Normal
Assignee:
Philippe Antoine
Target version:
8.0.0-beta1
Effort:
Difficulty:
Label:
Protocol

Description

Feature request is for Suricata, when presented with, likely decrypted, pcap/traffic that includes DoH traffic, it'd be parsed and included with DNS logs.

https://datatracker.ietf.org/doc/rfc8484/

Example pcap included.

A couple of quick notes I found when looking through the RFC:
  1. "HTTP/2 [RFC7540] is the minimum RECOMMENDED version of HTTP for use with DoH."
    I suppose this doesn't mean it can't use HTTP/1.1, just that it's not RECOMMENDED.
  2. "DoH client encodes a single DNS query into an HTTP request using either the HTTP GET or POST method..."
  3. "Reuses the format of DNS once base64 decoded

Ideally all normal "dns" support would work with data that occurs via DoH, datasets, dns keywords, logging, etc.

Files

Download all files
dns_over_https.pcap (5.07 KB) dns_over_https.pcap Brandon Murphy, 01/03/2023 04:07 PM
dns_over_https_POST.pcap (20.6 KB) dns_over_https_POST.pcap Brandon Murphy, 03/24/2024 08:50 PM

Related issues 8 (6 open — 2 closed)

Related to Suricata - Task #6443: Suricon 2023 brainstormAssignedVictor JulienActions
Related to Suricata - Feature #6453: Support DNS over TLSNewOISF DevActions
Related to Suricata - Feature #5674: Support layered protocolsNewOISF DevActions
Related to Suricata - Feature #3952: mDNS protocol implementationAssignedJason IshActions
Blocked by Suricata - Bug #6281: dns: structure of query differs between "alert" and "dns" event typesClosedJason IshActions
Blocked by Suricata - Optimization #3827: clean up logging initialization codeClosedPhilippe AntoineActions
Blocks Suricata - Task #7118: tracking: add support for new protocolsAssignedVictor JulienActions
Blocks Suricata - Story #7119: protocols: protocol additionsNewVictor JulienActions
Actions
Copy link
 #1

Updated by Victor Julien over 1 year ago

  • Target version changed from TBD to 8.0.0-beta1
Actions
Copy link
 #2

Updated by Philippe Antoine about 1 year ago

  • Related to Task #6443: Suricon 2023 brainstorm added
Actions
Copy link
 #3

Updated by Philippe Antoine about 1 year ago

Also DNS over TLS (port 5353 ?) as plain DNS...?

Actions
Copy link
 #4

Updated by Philippe Antoine about 1 year ago

DNS over HTTPS seems to be HTTP2 with base64 payload in URL

Actions
Copy link
 #5

Updated by Brandon Murphy about 1 year ago

Philippe Antoine wrote in #note-4:

DNS over HTTPS seems to be HTTP2 with base64 payload in URL

the way the RFC is written, HTTP/1 is not RECOMMENDED. it does NOT say it MUST be HTTP/2.

Actions
Copy link
 #6

Updated by Philippe Antoine about 1 year ago

Actions
Copy link
 #7

Updated by Philippe Antoine about 1 year ago

Actions
Copy link
 #8

Updated by Philippe Antoine 12 months ago

  • Assignee changed from OISF Dev to Philippe Antoine
Actions
Copy link
 #9

Updated by Philippe Antoine 12 months ago

Hack could be to :
- hook into HTTP2 parsing : if headers look like DNS request : the HTTP2 state creates and owns a DNS state + we call some new function with arguments the flow and the payload (and the protocol DNS) kind of StreamTcpDetectLogFlush
- We kind of dequeue a pseudo-packet with DNS payload and run the flow worker on it. This begins by switching the DNS state into Flow's alstate and ends by reputing the HTTP2 state

Actions
Copy link
 #10

Updated by Victor Julien 12 months ago

  • Status changed from New to Assigned
Actions
Copy link
 #11

Updated by Victor Julien 12 months ago

Actions
Copy link
 #12

Updated by Philippe Antoine 12 months ago

  • Status changed from Assigned to In Progress
Actions
Copy link
 #13

Updated by Philippe Antoine 11 months ago

  • Blocked by Bug #6281: dns: structure of query differs between "alert" and "dns" event types added
Actions
Copy link
 #14

Updated by Philippe Antoine 11 months ago

  • Status changed from In Progress to In Review
Actions
Copy link
 #15

Updated by Philippe Antoine 10 months ago

Actions
Copy link
 #16

Updated by Brandon Murphy 8 months ago

I apologize for not tracking this issue very closely.

Does this also handle DoH queries are within the request body via a POST? I believe it's a different format when this happens.

https://datatracker.ietf.org/doc/html/rfc8484#section-4.1.1 has examples.

Actions
Copy link
 #17

Updated by Philippe Antoine 8 months ago

Thanks Brandon, the current draft PR does not recognize this indeed. Would you have a pcap to share ?

For info, this whole feature is waiting on #6281 to have get past the draft PR...

Actions
Copy link
 #18

Updated by Brandon Murphy 8 months ago

Attached is a pcap from a post on netresec. It contains a single TCP session with multiple DoH via POST over HTTP/2 that has been decrypted.

Actions
Copy link
 #19

Updated by Philippe Antoine 8 months ago

Thank you @Brandon Murphy

The PR https://github.com/OISF/suricata/pull/10733 has a last commit to handle this case, and your pcap is tested in the SV PR https://github.com/OISF/suricata-verify/pull/1734

Actions
Copy link
 #20

Updated by Victor Julien 5 months ago

  • Blocks Task #7118: tracking: add support for new protocols added
Actions
Copy link
 #21

Updated by Victor Julien 5 months ago

  • Blocks Story #7119: protocols: protocol additions added
Actions
Copy link
 #22

Updated by Philippe Antoine 4 months ago

  • Status changed from In Review to Closed
Actions
Copy link

Also available in: Atom PDF