Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

add testcases

Browse source
This commit is contained in:
FlyingWithJerome 2020-08-15 10:49:43 -04:00
parent 7dcf974daf
commit 84d609b333
4 changed files with 42 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

9
src/analyzer/protocol/dns/DNS.cc
View file

@ -713,7 +713,7 @@ bool DNS_Interpreter::ParseRR_EDNS(DNS_MsgInfo* msg,
uint16_t option_code = ExtractShort(data, len);
int option_len = ExtractShort(data, len);
// check for invalid option length
if ( (option_len > len) || (0 == option_len) ) {
if ( (option_len > len) ) {
break;
}
len -= option_len;
@ -789,7 +789,6 @@ bool DNS_Interpreter::ParseRR_EDNS(DNS_MsgInfo* msg,
EDNS_TCP_KEEPALIVE edns_tcp_keepalive{
.keepalive_timeout_omitted = true,
.keepalive_timeout = 0
};
if ( option_len == 0 || option_len == 2)
{
@ -801,12 +800,10 @@ bool DNS_Interpreter::ParseRR_EDNS(DNS_MsgInfo* msg,
if (analyzer->Conn()->ConnTransport() == TRANSPORT_UDP) {
/*
* Based on RFC 7828, clients and servers MUST NOT negotiate
* TCP Keepalive timeout in DNS-over-UDP.
* Record in Weird and proceed to the next EDNS option
* Based on RFC 7828 (3.2.1/3.2.2), clients and servers MUST NOT
* negotiate TCP Keepalive timeout in DNS-over-UDP.
*/
analyzer->Weird("EDNS_TCP_Keepalive_Record_In_UDP");
break;
}
analyzer->EnqueueConnEvent(dns_EDNS_tcp_keepalive,
analyzer->ConnVal(),

4
testing/btest/Baseline/scripts.base.protocols.dns.dns-edns-tcp-keepalive/output Normal file
View file

@ -0,0 +1,4 @@
[keepalive_timeout_omitted=F, keepalive_timeout=10]
[keepalive_timeout_omitted=F, keepalive_timeout=370]
[keepalive_timeout_omitted=T, keepalive_timeout=0]
[keepalive_timeout_omitted=F, keepalive_timeout=370]

BIN
testing/btest/Traces/dns-edns-tcp-keepalive.pcap Normal file
View file

Binary file not shown.

8
testing/btest/scripts/base/protocols/dns/dns-edns-tcp-keepalive.zeek Normal file
View file

@ -0,0 +1,8 @@
# @TEST-EXEC: zeek -C -r $TRACES/dns-edns-tcp-keepalive.pcap %INPUT > output
# @TEST-EXEC: btest-diff output
@load policy/protocols/dns/auth-addl
event dns_EDNS_tcp_keepalive(c: connection, msg: dns_msg, opt: dns_edns_tcp_keepalive)
{
print opt;
}