Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

dns_HINFO_reply event was never being generated.

Browse source 
On top of that, I modified the event to pass the relevant fields from the DNS message.
This commit is contained in:
Vlad Grigorescu 2021-07-15 09:56:38 -05:00
parent eeee2c41a3
commit 15b294098c
5 changed files with 36 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

32
src/analyzer/protocol/dns/DNS.cc
View file

@ -1650,15 +1650,6 @@ bool DNS_Interpreter::ParseRR_WKS(detail::DNS_MsgInfo* msg,
return true;
}
bool DNS_Interpreter::ParseRR_HINFO(detail::DNS_MsgInfo* msg,
const u_char*& data, int& len, int rdlength)
{
data += rdlength;
len -= rdlength;
return true;
}
static StringValPtr
extract_char_string(analyzer::Analyzer* analyzer,
const u_char*& data, int& len, int& rdlen)
@ -1687,6 +1678,29 @@ extract_char_string(analyzer::Analyzer* analyzer,
return rval;
}
bool DNS_Interpreter::ParseRR_HINFO(detail::DNS_MsgInfo* msg,
const u_char*& data, int& len, int rdlength)
{
if ( ! dns_HINFO_reply || msg->skip_event )
{
data += rdlength;
len -= rdlength;
return true;
}
auto cpu = extract_char_string(analyzer, data, len, rdlength);
auto os = extract_char_string(analyzer, data, len, rdlength);
if ( dns_HINFO_reply )
analyzer->EnqueueConnEvent(dns_HINFO_reply,
analyzer->ConnVal(),
msg->BuildHdrVal(),
msg->BuildAnswerVal(),
cpu, os);
return rdlength == 0;
}
bool DNS_Interpreter::ParseRR_TXT(detail::DNS_MsgInfo* msg,
const u_char*& data, int& len, int rdlength,
const u_char* msg_start)