Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Add weird for unhandled opcodes in DNS analyzer

Browse source
This commit is contained in:
Tim Wojtulewicz 2024-08-20 11:53:50 -07:00
parent cd10bd3747
commit 269ca3189c
5 changed files with 39 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

16
src/analyzer/protocol/dns/DNS.cc
View file

@ -27,6 +27,7 @@ DNS_Interpreter::DNS_Interpreter(analyzer::Analyzer* arg_analyzer) {
}
void DNS_Interpreter::ParseMessage(const u_char* data, int len, int is_query) {
// Every packet for every opcode starts with same size header.
int hdr_len = sizeof(detail::DNS_RawMsgHdr);
if ( len < hdr_len ) {
@ -34,7 +35,20 @@ void DNS_Interpreter::ParseMessage(const u_char* data, int len, int is_query) {
return;
}
detail::DNS_MsgInfo msg((detail::DNS_RawMsgHdr*)data, is_query);
// The flags section may be different between the different opcodes, but the
// opcode is always in the same location. Parse out just that part of it here
// even though it will probably be reparsed later.
auto* hdr = (detail::DNS_RawMsgHdr*)data;
unsigned short flags = ntohs(hdr->flags);
int opcode = (flags & 0x7800) >> 11;
if ( opcode != DNS_OP_QUERY ) {
analyzer->Weird("DNS_unknown_opcode", util::fmt("%d", opcode));
analyzer->Conn()->CheckHistory(zeek::session::detail::HIST_UNKNOWN_PKT, 'X');
return;
}
detail::DNS_MsgInfo msg(hdr, is_query);
if ( first_message && msg.QR && is_query == 1 ) {
is_query = msg.is_query = 0;

12
testing/btest/Baseline/scripts.base.protocols.dns.dynamic-update/weird.log Normal file
View file

@ -0,0 +1,12 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path weird
#open XXXX-XX-XX-XX-XX-XX
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer source
#types time string addr port addr port string string bool string string
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.1.106 62763 192.168.1.108 53 DNS_unknown_opcode 5 F zeek DNS
XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 192.168.1.105 62763 192.168.1.108 53 DNS_unknown_opcode 5 F zeek DNS
#close XXXX-XX-XX-XX-XX-XX

6
testing/btest/Traces/README
View file

@ -21,3 +21,9 @@ Trace Index/Sources:
- ldap/ctu-sme-11-win7ad-1-ldap-tcp-50041.pcap: Harvested from CTU-SME-11
(Experiment-VM-Microsoft-Windows7AD-1) dataset, filtering on tcp port 389 and port 50041.
https://zenodo.org/records/7958259 (DOI 10.5281/zenodo.7958258).
- dns/tkey.pcap: Harvested from CTU-SME-11
(Experiment-VM-Microsoft-Windows7AD-1) dataset, filtering on tcp port 53.
https://zenodo.org/records/7958259 (DOI 10.5281/zenodo.7958258).
- dns/dynamic-update.pcap: : Harvested from CTU-SME-11
(Experiment-VM-Microsoft-Windows7AD-1) dataset, filtering on tcp port 53.
https://zenodo.org/records/7958259 (DOI 10.5281/zenodo.7958258).

BIN
testing/btest/Traces/dns/dynamic-update.pcap Normal file
View file

Binary file not shown.

6
testing/btest/scripts/base/protocols/dns/dynamic-update.zeek Normal file
View file

@ -0,0 +1,6 @@
# @TEST-DOC: Tests that a DNS dynamic update packet doesn't error but reports an unknown opcode weird
# @TEST-EXEC: zeek -b -C -r $TRACES/dns/dynamic-update.pcap %INPUT
# @TEST-EXEC: btest-diff weird.log
@load base/frameworks/notice/weird
@load base/protocols/dns