From 1e32100fed2eac8639453739c376dc070befc9c0 Mon Sep 17 00:00:00 2001 From: Seth Hall Date: Thu, 18 Jul 2013 09:24:22 -0400 Subject: [PATCH] Fixing a dns reporter message in master. --- scripts/base/protocols/dns/main.bro | 5 +++++ .../dns.log | 11 +++++++++++ .../weird.log | 11 +++++++++++ testing/btest/Traces/dns-two-responses.trace | Bin 0 -> 1006 bytes .../base/protocols/dns/duplicate-reponses.bro | 5 +++++ 5 files changed, 32 insertions(+) create mode 100644 testing/btest/Baseline/scripts.base.protocols.dns.duplicate-reponses/dns.log create mode 100644 testing/btest/Baseline/scripts.base.protocols.dns.duplicate-reponses/weird.log create mode 100644 testing/btest/Traces/dns-two-responses.trace create mode 100644 testing/btest/scripts/base/protocols/dns/duplicate-reponses.bro diff --git a/scripts/base/protocols/dns/main.bro b/scripts/base/protocols/dns/main.bro index ea3ec016de..bf47519cd8 100644 --- a/scripts/base/protocols/dns/main.bro +++ b/scripts/base/protocols/dns/main.bro @@ -207,6 +207,11 @@ event DNS::do_reply(c: connection, msg: dns_msg, ans: dns_answer, reply: string) { if ( ans$answer_type == DNS_ANS ) { + if ( ! c?$dns ) + { + event conn_weird("dns_unmatched_reply", c, ""); + hook set_session(c, msg, F); + } c$dns$AA = msg$AA; c$dns$RA = msg$RA; diff --git a/testing/btest/Baseline/scripts.base.protocols.dns.duplicate-reponses/dns.log b/testing/btest/Baseline/scripts.base.protocols.dns.duplicate-reponses/dns.log new file mode 100644 index 0000000000..ca071ee8ef --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.dns.duplicate-reponses/dns.log @@ -0,0 +1,11 @@ +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path dns +#open 2013-07-18-13-21-52 +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto trans_id query qclass qclass_name qtype qtype_name rcode rcode_name AA TC RD RA Z answers TTLs rejected +#types time string addr port addr port enum count string count string count string count string bool bool bool bool count vector[string] vector[interval] bool +1363716396.798072 UWkUyAuUGXf 55.247.223.174 27285 222.195.43.124 53 udp 21140 www.cmu.edu 1 C_INTERNET 1 A 0 NOERROR T F F F 1 www-cmu.andrew.cmu.edu,www-cmu-2.andrew.cmu.edu,128.2.10.163,www-cmu.andrew.cmu.edu 86400.000000,5.000000,21600.000000,86400.000000 F +1363716396.798374 UWkUyAuUGXf 55.247.223.174 27285 222.195.43.124 53 udp 21140 - - - - - 0 NOERROR T F F F 0 www-cmu-2.andrew.cmu.edu,128.2.10.163 5.000000,21600.000000 F +#close 2013-07-18-13-21-52 diff --git a/testing/btest/Baseline/scripts.base.protocols.dns.duplicate-reponses/weird.log b/testing/btest/Baseline/scripts.base.protocols.dns.duplicate-reponses/weird.log new file mode 100644 index 0000000000..c7de92f894 --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.dns.duplicate-reponses/weird.log @@ -0,0 +1,11 @@ +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path weird +#open 2013-07-18-13-21-52 +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer +#types time string addr port addr port string string bool string +1363716396.798286 UWkUyAuUGXf 55.247.223.174 27285 222.195.43.124 53 DNS_RR_unknown_type - F bro +1363716396.798374 UWkUyAuUGXf 55.247.223.174 27285 222.195.43.124 53 dns_unmatched_reply - F bro +#close 2013-07-18-13-21-52 diff --git a/testing/btest/Traces/dns-two-responses.trace b/testing/btest/Traces/dns-two-responses.trace new file mode 100644 index 0000000000000000000000000000000000000000..627b0d2ebe091fcec6ffbbcbe8c96019235d718b GIT binary patch literal 1006 zcmca|c+)~A1{MYw`2U}Qff2~jS?Lj2q07S%1Z0CSgWArB$9EYdN*v}ea4@(sFt{8u zVPG&6T-a~^{r7O<@oK8v!(kxxBobIXSnKIW?seWG>KTO#z@` z4L}UC!B3BeVHHpigdt`_>;c)pI7dvGfx$u0(Gz4k$QB0Etf`D0FD3*{X#v^5!T@wQ zh7AXJ7+66z1vW4UvWJI<>pJ^}vN`&>1i6ME5CBT*K_zE1u(C6Qlm*6YiVifDsFGHO zyEMB*YExpCz3~R!=||*l#~<*%XH>z~zW2P!4u#%zr2&tl#auLguaxB}dLF)<_q4?% z-vV8hr4whT+p@C7sj%&|o_X5qrt6X1P%e$Pdk&s{cH8jyj#RD`jWxfv=+v2VaV*~8gd{4Nrnq5V{}mVpeR^BC~ScG899J_ i8K`~%HTK^cz({}rmV^38YTr&-ffjSiMq_RW#vA~4#T8xv literal 0 HcmV?d00001 diff --git a/testing/btest/scripts/base/protocols/dns/duplicate-reponses.bro b/testing/btest/scripts/base/protocols/dns/duplicate-reponses.bro new file mode 100644 index 0000000000..a16235b9a5 --- /dev/null +++ b/testing/btest/scripts/base/protocols/dns/duplicate-reponses.bro @@ -0,0 +1,5 @@ +# This tests the case where the DNS server responded with zero RRs. +# +# @TEST-EXEC: bro -r $TRACES/dns-two-responses.trace +# @TEST-EXEC: btest-diff dns.log +# @TEST-EXEC: btest-diff weird.log \ No newline at end of file