DNS req/res does not work with "transaction" scope

[dsebalj]

Hi all,

I'm playing with the app-id custom signature to catch the DNS Rebinding. I have some experience with the custom app-ids and I do understand the difference between the "transaction" and "session" context (well, at least I thought so). The thing is... I want to base my signature based on the DNS req and res in a way they need to be "glued". For example, if I see a DNS req/res:

DNS query: abc.example.com

DNS answer: 10.10.10.10

it should match my custom app id.

In contrast, if a req/res looks like:
DNS query: abc.example.com

DNS answer: 10.10.10.11

I don't want to match on that.

Now comes the confusing part. For me, DNS req/res should be part of "transaction", i.e., Palo Alto sees a DNS req and waiting for the DNS res to match the signature. No difference than what we have with the HTTP req/res.

For some reason it seems this does not work for DNS. If I change the context to "session" based, it works. Unfortunately, there is no much, if any example on creating more complex signatures with multiple AND/OR operators and there is almost none documentation about "transaction" and "session" context, although it should be pretty clear what it is - it seems there are some intrinsic about it.

Any thoughts?

[nikoolayy1]

What about combination signature that matches 1 signature for request and 1 for response? I think maybe in some cases a transaction could be one direction also just in case see that your signature is configured to trigger in the two directions not just client to server or server to client.

 I have seen simmilar issue for HTTP req/response as I have mentioned in:

LIVEcommunity - Rate-Limiting File Uploads with Palo Alto Networks Custom Signatures. - LIVEcommunit...

[dsebalj]

Hi Nikoolayy1,

Thanks for replying!

Unfortunately, combination signature is for custom vulnerability. We don't have that option for app-id.

Anyhow, I would like to understand why it is working this way.

[nikoolayy1]

Forgot that we are talking app signatures and if Palo Alto Adds combination signature option for this as well it will be nice! Maybe open request for enhancement ? See Palo Alto New Feature Requests | Palo Alto Networks LIVEcommunity

I am wondering because DNS usually is UDP and the DNS decoder to be only in one direction for a transaction. Maybe try DNS over TCP and if you want open a case as Palo Alto Engineers may confirm if the DNS Decoder for transactions is just in one direction.