Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

DNS: Add Ed25519 and Ed448 enum values to parser

Browse source 
We already had these declared in dns/const.zeek, so extend the parser
as well to avoid raising weirds and add some test pcaps:

   $ dig @8.8.8.8 DNSKEY ed448.no
   $ dig @8.8.8.8 ed448.no +dnssec

And the same for the ed25519.no domain.

Closes #3453
This commit is contained in:
Arne Welzel 2023-11-17 19:44:00 +01:00
parent b0a200a5dc
commit 81aa6b14fd
7 changed files with 38 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/analyzer/protocol/dns/DNS.cc
View file

@ -872,6 +872,8 @@ bool DNS_Interpreter::ParseRR_RRSIG(detail::DNS_MsgInfo* msg, const u_char*& dat
case detail::GOST_R_34_10_2001: break;
case detail::ECDSA_curveP256withSHA256: break;
case detail::ECDSA_curveP384withSHA384: break;
case detail::Ed25519: break;
case detail::Ed448: break;
case detail::Indirect: analyzer->Weird("DNSSEC_RRSIG_Indirect_ZoneSignAlgo", util::fmt("%d", algo)); break;
case detail::PrivateDNS: analyzer->Weird("DNSSEC_RRSIG_PrivateDNS_ZoneSignAlgo", util::fmt("%d", algo)); break;
case detail::PrivateOID: analyzer->Weird("DNSSEC_RRSIG_PrivateOID_ZoneSignAlgo", util::fmt("%d", algo)); break;
@ -945,6 +947,8 @@ bool DNS_Interpreter::ParseRR_DNSKEY(detail::DNS_MsgInfo* msg, const u_char*& da
case detail::GOST_R_34_10_2001: break;
case detail::ECDSA_curveP256withSHA256: break;
case detail::ECDSA_curveP384withSHA384: break;
case detail::Ed25519: break;
case detail::Ed448: break;
case detail::Indirect:
analyzer->Weird("DNSSEC_DNSKEY_Indirect_ZoneSignAlgo", util::fmt("%d", dalgorithm));
break;

2
src/analyzer/protocol/dns/DNS.h
View file

@ -127,6 +127,8 @@ enum DNSSEC_Algo {
GOST_R_34_10_2001 = 12,
ECDSA_curveP256withSHA256 = 13,
ECDSA_curveP384withSHA384 = 14,
Ed25519 = 15,
Ed448 = 16,
Indirect = 252, ///<
PrivateDNS = 253, ///< OPTIONAL
PrivateOID = 254, ///< OPTIONAL

4
testing/btest/Baseline/scripts.base.protocols.dns.dnssec/dns.ed25519.log Normal file
View file

@ -0,0 +1,4 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
id.orig_h id.resp_h qtype_name query answers
192.168.0.107 8.8.8.8 DNSKEY ed25519.no DNSKEY 15,Ed25519,DNSKEY 15,Ed25519
192.168.0.107 8.8.8.8 A ed25519.no 194.63.248.47,RRSIG 1 ed25519.no,Ed25519

4
testing/btest/Baseline/scripts.base.protocols.dns.dnssec/dns.ed448.log Normal file
View file

@ -0,0 +1,4 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
id.orig_h id.resp_h answers
192.168.0.107 8.8.8.8 DNSKEY 16,Ed448,DNSKEY 16,Ed448
192.168.0.107 8.8.8.8 194.63.248.47,RRSIG 1 ed448.no,Ed448

BIN
testing/btest/Traces/dnssec/ed25519.no.pcap Normal file
View file

Binary file not shown.

BIN
testing/btest/Traces/dnssec/ed448.no.pcap Normal file
View file

Binary file not shown.

24
testing/btest/scripts/base/protocols/dns/dnssec.zeek Normal file
View file

@ -0,0 +1,24 @@
# @TEST-DOC: Add the textual representation of the DNSSEC algorithm into answers and verify there's no weirds for the ed25519 and ed448 curves.
#
# @TEST-EXEC: zeek -b -r $TRACES/dnssec/ed25519.no.pcap %INPUT
# @TEST-EXEC: test ! -f weird.log
# @TEST-EXEC: zeek-cut -m id.orig_h id.resp_h qtype_name query answers < dns.log > dns.ed25519.log
#
# @TEST-EXEC: zeek -b -C -r $TRACES/dnssec/ed448.no.pcap %INPUT
# @TEST-EXEC: test ! -f weird.log
# @TEST-EXEC: zeek-cut -m id.orig_h id.resp_h questions answers < dns.log > dns.ed448.log
#
# @TEST-EXEC: btest-diff dns.ed25519.log
# @TEST-EXEC: btest-diff dns.ed448.log
@load base/protocols/dns
event dns_RRSIG(c: connection, msg: dns_msg, ans: dns_answer, rrsig: dns_rrsig_rr) &priority=4
{
c$dns$answers += DNS::algorithms[rrsig$algorithm];
}
event dns_DNSKEY(c: connection, msg: dns_msg, ans: dns_answer, dnskey: dns_dnskey_rr) &priority=4
{
c$dns$answers += DNS::algorithms[dnskey$algorithm];
}