Bug #9268
opendoh2: dns response rules disrupted by an http2 rule in the ruleset
Description
On a doh2 flow, a rule on a dns response buffer never alerts as soon as the ruleset also contains an http2 rule — even one that cannot match the traffic at all. The dns response is parsed and logged normally, only the alert is missing, with no error, warning or stats counter.
Reproduced with a capture already in suricata-verify, tests/dns-over-http2/dns_over_https.pcap.
Ruleset:
alert dns any any -> any any (dns.answers.rrname; content: "www.gstatic.com"; sid:20;)
alert doh2 any any -> any any (dns.answers.rrname; content: "www.gstatic.com"; sid:21;)
alert http2 any any -> any any (http.response_header; content: "zzzz"; sid:30;)
Result on 8.0.7, suricata -k none --runmode single -S <rules> -r dns_over_https.pcap:
┌─────────────────────┬────────┬────────┐
│ ruleset │ sid 20 │ sid 21 │
├─────────────────────┼────────┼────────┤
│ sids 20 and 21 only │ 2 │ 2 │
├─────────────────────┼────────┼────────┤
│ sids 20, 21 and 30 │ 0 │ 0 │
└─────────────────────┴────────┴────────┘
sid 30 matches nothing but loading it is enough to silence the two dns/doh2 alert rules.
This looks close to https://redmine.openinfosecfoundation.org/issues/8454 but bug is there even with that fix. (testing 8.0.7).
I will open a suricata-verify MR with a test reproducing it.
AB Updated by Amir Boussejra 2 days ago
https://github.com/OISF/suricata-verify/pull/3480
adds two tests, both reusing the capture of the existing dns-over-http2 test:
dns-over-http2-response-fn — the two dns response rules plus one http2 rule that cannot match the capture. Fails on 8.0.7: no alert at all for the dns rules, thus a false negative.
dns-over-http2-response-ok — the same two dns rules without the http2 rule. Passes: both alert twice.
VJ Updated by Victor Julien 2 days ago
- Related to Bug #8454: doh2: FN with rulesets combining dns rules and http2 rules added