fix a few syntax errors

This commit is contained in:
FlyingWithJerome 2021-09-29 13:57:42 -04:00
parent 8fce51bf83
commit 0849332eb9
8 changed files with 53 additions and 11 deletions

10
conn.log Normal file
View file

@ -0,0 +1,10 @@
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path conn
#open 2021-09-29-11-39-42
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
#types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string]
1632928690.500620 CvVbVi3kNVC4LPU90f 192.168.1.99 62978 192.168.1.1 53 udp dns 0.027648 55 134 SF - - 0 Dd 1 83 1 162 -
#close 2021-09-29-11-39-42

10
dns.log Normal file
View file

@ -0,0 +1,10 @@
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path dns
#open 2021-09-29-11-39-42
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto trans_id rtt query qclass qclass_name qtype qtype_name rcode rcode_name AA TC RD RA Z answers TTLs rejected auth addl
#types time string addr port addr port enum count interval string count string count string count string bool bool bool bool count vector[string] vector[interval] bool set[string] set[string]
1632928690.500620 CvVbVi3kNVC4LPU90f 192.168.1.99 62978 192.168.1.1 53 udp 62111 - cloudflare.com 1 C_INTERNET 65 HTTPS 0 NOERROR F F T F 2 - - F - -
#close 2021-09-29-11-39-42

10
packet_filter.log Normal file
View file

@ -0,0 +1,10 @@
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path packet_filter
#open 2021-09-29-11-39-42
#fields ts node filter init success
#types time string string bool bool
1632929982.504499 zeek ip or not ip T T
#close 2021-09-29-11-39-42

View file

@ -3888,7 +3888,7 @@ type dns_svcb_rr: record {
svc_priority: count; ##< Service priority. (AliasMode? ServiceMode?)
target_name: string; ##< Target name, the hostname of the service endpoint.
svc_params: table[count] of vector of string; ##< service parameters as key-value pairs
}
};
# DNS answer types.
#

View file

@ -1709,7 +1709,7 @@ bool DNS_Interpreter::ParseRR_SVCB(detail::DNS_MsgInfo* msg, const u_char*& data
SVCB_DATA svcb_data = {
.svc_priority = svc_priority,
.target_name = new String(target_name, name_end - target_name, true),
.svc_params = nullptr,
.svc_params = Dictionary(),
};
// TODO: parse svcparams
@ -2037,7 +2037,7 @@ RecordValPtr DNS_MsgInfo::BuildSVCB_Val(SVCB_DATA* svcb)
r->Assign(1, make_intrusive<StringVal>(svcb->target_name));
// TODO: assign svcparams
return dns_svcb_rr;
return r;
}
} // namespace detail

View file

@ -287,14 +287,7 @@ struct SVCB_DATA
{
unsigned short svc_priority; // 2
String* target_name;
SVCPARAM_KV* svc_params;
}
struct SVCPARAM_KV
{
String* key;
String* value;
SVCPARAM_KV* next;
Dictionary svc_params;
};
class DNS_MsgInfo

View file

@ -0,0 +1,9 @@
# @TEST-EXEC: zeek -C -r $TRACES/dns-https.pcap %INPUT > output
# @TEST-EXEC: btest-diff output
@load policy/protocols/dns/auth-addl
event dns_HTTPS(c: connection, msg: dns_msg, ans: dns_answer, https: dns_svcb_rr)
{
print https;
}

10
weird.log Normal file
View file

@ -0,0 +1,10 @@
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path weird
#open 2021-09-29-11-39-42
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer source
#types time string addr port addr port string string bool string string
1632928690.528268 CvVbVi3kNVC4LPU90f 192.168.1.99 62978 192.168.1.1 53 DNS_truncated_RR_rdlength_lt_len - F zeek DNS
#close 2021-09-29-11-39-42