Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Fix parsing of EDNS rcode

Browse source 
The EDNS rcode was incorrectly calculated. The extended rcode is formed
by taking the upper 8 bits of the extended rcode field, plus the lower 4
bits of the existing rcode.

This also adds a new trace with an extended rcode, and a testcase
parsing it.

Reported by dwhitemv25.

Fixes GH-4656
This commit is contained in:
Johanna Amann 2025-07-24 08:39:49 +01:00
parent 4399f171ae
commit 383dce9343
4 changed files with 16 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
testing/btest/Baseline/scripts.base.protocols.dns.edns-rcode/output Normal file
View file

@ -0,0 +1,2 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
16

BIN
testing/btest/Traces/dns/dns_extended_rcode.pcap Normal file
View file

Binary file not shown.

13
testing/btest/scripts/base/protocols/dns/edns-rcode.zeek Normal file
View file

@ -0,0 +1,13 @@
# @TEST-DOC: Tests that the correct extended rcode is returned for EDNS packets. Regression test for #4656.
# @TEST-EXEC: zeek -b -C -r $TRACES/dns/dns_extended_rcode.pcap %INPUT > output
# @TEST-EXEC: btest-diff output
@load base/protocols/dns
redef dns_skip_all_addl=F;
event dns_EDNS_addl(c: connection, msg: dns_msg, ans: dns_edns_additional)
{
if ( c$dns?$rcode && ans?$extended_rcode )
print ans$extended_rcode;
}