Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Doh2 65k limit 7464 v2 #12305

Closed
wants to merge 2 commits into from
Closed

Doh2 65k limit 7464 v2 #12305

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4e65217
doh2: really enforce 65K dns message limit
catenacyber Dec 17, 2024
5cedd17
http2: complete json schema
catenacyber Dec 18, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions etc/schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2113,6 +2113,9 @@
"priority": {
"type": "integer"
},
"has_multiple": {
"type": "string"
},
"settings": {
"type": "array",
"minItems": 1,
Expand All @@ -2138,6 +2141,9 @@
"error_code": {
"type": "string"
},
"has_multiple": {
"type": "string"
},
"settings": {
"type": "array",
"minItems": 1,
Expand Down
2 changes: 2 additions & 0 deletions rules/http2-events.rules
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,3 +21,5 @@ alert http2 any any -> any any (msg:"SURICATA HTTP2 too many streams"; flow:esta
alert http2 any any -> any any (msg:"SURICATA HTTP2 authority host mismatch"; flow:established,to_server; app-layer-event:http2.authority_host_mismatch; classtype:protocol-command-decode; sid:2290013; rev:1;)
alert http2 any any -> any any (msg:"SURICATA HTTP2 user info in uri"; flow:established,to_server; app-layer-event:http2.userinfo_in_uri; classtype:protocol-command-decode; sid:2290014; rev:1;)
alert http2 any any -> any any (msg:"SURICATA HTTP2 reassembly limit reached"; flow:established; app-layer-event:http2.reassembly_limit_reached; classtype:protocol-command-decode; sid:2290015; rev:1;)
alert http2 any any -> any any (msg:"SURICATA HTTP2 dns request too long"; flow:established,to_server; app-layer-event:http2.dns_request_too_long; classtype:protocol-command-decode; sid:2290016; rev:1;)
alert http2 any any -> any any (msg:"SURICATA HTTP2 dns response too long"; flow:established,to_client; app-layer-event:http2.dns_response_too_long; classtype:protocol-command-decode; sid:2290017; rev:1;)
18 changes: 15 additions & 3 deletions rust/src/http2/http2.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -368,9 +368,19 @@ impl HTTP2Transaction {
if unsafe { ALPROTO_DOH2 } != ALPROTO_UNKNOWN {
// we store DNS response, and process it when complete
if let Some(doh) = &mut self.doh {
if doh.is_doh_data[dir.index()] && doh.data_buf[dir.index()].len() < 0xFFFF {
// a DNS message is U16_MAX
doh.data_buf[dir.index()].extend_from_slice(decompressed);
if doh.is_doh_data[dir.index()] {
if doh.data_buf[dir.index()].len() + decompressed.len() <= 0xFFFF {
// a DNS message is U16_MAX
doh.data_buf[dir.index()].extend_from_slice(decompressed);
} else {
// stop processing further data
doh.is_doh_data[dir.index()] = false;
if dir == Direction::ToClient {
self.set_event(HTTP2Event::DnsResponseTooLong);
} else {
self.set_event(HTTP2Event::DnsRequestTooLong);
}
}
}
}
}
Expand Down Expand Up @@ -506,6 +516,8 @@ pub enum HTTP2Event {
AuthorityHostMismatch,
UserinfoInUri,
ReassemblyLimitReached,
DnsRequestTooLong,
DnsResponseTooLong,
}

pub struct HTTP2DynTable {
Expand Down
Loading