Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Add test case to cover weird EDNS ECS parsing situations

Browse source
This commit is contained in:
Jon Siwek 2020-12-08 12:57:15 -08:00
parent abb4f0be03
commit 7c27d4c1e7
4 changed files with 21 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

15
testing/btest/Baseline/scripts.base.protocols.dns.dns-edns-ecs/weird.log Normal file
View file

@ -0,0 +1,15 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path weird
#open XXXX-XX-XX-XX-XX-XX
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer source
#types time string addr port addr port string string bool string string
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 74.125.47.13 57157 192.168.90.10 53 EDNS_ECS_invalid_addr_v4 need 32 bits, have 24 bits F zeek DNS
XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 74.125.73.76 55744 192.168.90.10 53 EDNS_ECS_invalid_addr_v4_prefix 255 bits F zeek DNS
XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 2a00:1450:4013:c03::10a 46433 2001:470:765b::a25:53 53 EDNS_ECS_invalid_addr_v6_prefix 255 bits F zeek DNS
XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 2a00:1450:4013:c06::105 63369 2001:470:765b::a25:53 53 EDNS_ECS_invalid_addr_v6 need 66 bits, have 56 bits F zeek DNS
XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 2a00:1450:400c:c00::106 54430 2001:470:765b::a25:53 53 EDNS_ECS_invalid_option_len - F zeek DNS
#close XXXX-XX-XX-XX-XX-XX

BIN
testing/btest/Traces/dns-edns-ecs-bad.pcap Normal file
View file

Binary file not shown.

BIN
testing/btest/Traces/dns-edns-ecs-weirds.pcap Normal file
View file

Binary file not shown.

6
testing/btest/scripts/base/protocols/dns/dns-edns-ecs.zeek
View file

@ -1,6 +1,12 @@
# Test-case for valid message format:
# @TEST-EXEC: zeek -b -C -r $TRACES/dns-edns-ecs.pcap %INPUT > output
# @TEST-EXEC: btest-diff output
# Test-case for malformed messages:
# @TEST-EXEC: zeek -b -C -r $TRACES/dns-edns-ecs-bad.pcap %INPUT
# @TEST-EXEC: zeek -b -C -r $TRACES/dns-edns-ecs-weirds.pcap %INPUT base/frameworks/notice/weird
# @TEST-EXEC: btest-diff weird.log
@load policy/protocols/dns/auth-addl
event dns_EDNS_ecs(c: connection, msg: dns_msg, opt: dns_edns_ecs) {