Suricata

Also DNS over TLS (port 5353 ?) as plain DNS...?

DNS over HTTPS seems to be HTTP2 with base64 payload in URL

Philippe Antoine wrote in #note-4:

DNS over HTTPS seems to be HTTP2 with base64 payload in URL

the way the RFC is written, HTTP/1 is not RECOMMENDED. it does NOT say it MUST be HTTP/2.

Hack could be to :
- hook into HTTP2 parsing : if headers look like DNS request : the HTTP2 state creates and owns a DNS state + we call some new function with arguments the flow and the payload (and the protocol DNS) kind of StreamTcpDetectLogFlush
- We kind of dequeue a pseudo-packet with DNS payload and run the flow worker on it. This begins by switching the DNS state into Flow's alstate and ends by reputing the HTTP2 state

I apologize for not tracking this issue very closely.

Does this also handle DoH queries are within the request body via a POST? I believe it's a different format when this happens.

https://datatracker.ietf.org/doc/html/rfc8484#section-4.1.1 has examples.

Thanks Brandon, the current draft PR does not recognize this indeed. Would you have a pcap to share ?

For info, this whole feature is waiting on #6281 to have get past the draft PR...

Thank you @Brandon Murphy

The PR https://github.com/OISF/suricata/pull/10733 has a last commit to handle this case, and your pcap is tested in the SV PR https://github.com/OISF/suricata-verify/pull/1734