Suricata

On a doh2 flow, a rule on a dns response buffer never alerts as soon as the ruleset also contains an http2 rule — even one that cannot match the traffic at all. The dns response is parsed and logged normally, only the alert is missing, with no error, warning or stats counter.

Reproduced with a capture already in suricata-verify, tests/dns-over-http2/dns_over_https.pcap.

Ruleset:

alert dns any any -> any any (dns.answers.rrname; content: "www.gstatic.com"; sid:20;)
alert doh2 any any -> any any (dns.answers.rrname; content: "www.gstatic.com"; sid:21;)
alert http2 any any -> any any (http.response_header; content: "zzzz"; sid:30;)

Result on 8.0.7, suricata -k none --runmode single -S <rules> -r dns_over_https.pcap:

┌─────────────────────┬────────┬────────┐
│ ruleset │ sid 20 │ sid 21 │
├─────────────────────┼────────┼────────┤
│ sids 20 and 21 only │ 2 │ 2 │
├─────────────────────┼────────┼────────┤
│ sids 20, 21 and 30 │ 0 │ 0 │
└─────────────────────┴────────┴────────┘

sid 30 matches nothing but loading it is enough to silence the two dns/doh2 alert rules.

This looks close to https://redmine.openinfosecfoundation.org/issues/8454 but bug is there even with that fix. (testing 8.0.7).

I will open a suricata-verify MR with a test reproducing it.