Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Fix DNS SRV responses and a small issue with NBNS queries and label length.

Browse source 
- DNS SRV responses never had the code written to actually
   generate the dns_SRV_reply event.  Adding this required
   extending the event a bit to add extra information.  SRV responses
   now appear in the dns.log file correctly.

 - Fixed an issue where some Microsoft NetBIOS Name Service lookups
   would exceed the max label length for DNS and cause an incorrect
   "DNS_label_too_long" weird.
This commit is contained in:
Seth Hall 2014-03-05 16:11:06 -05:00
parent d6d26a3ea7
commit 9743959995
3 changed files with 28 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

4
scripts/base/protocols/dns/main.bro
View file

@ -421,9 +421,9 @@ event dns_WKS_reply(c: connection, msg: dns_msg, ans: dns_answer) &priority=5
hook DNS::do_reply(c, msg, ans, ""); hook DNS::do_reply(c, msg, ans, "");
} }
event dns_SRV_reply(c: connection, msg: dns_msg, ans: dns_answer) &priority=5 event dns_SRV_reply(c: connection, msg: dns_msg, ans: dns_answer, target: string, priority: count, weight: count, p: count) &priority=5
{ {
hook DNS::do_reply(c, msg, ans, ""); hook DNS::do_reply(c, msg, ans, target);
} }
# TODO: figure out how to handle these # TODO: figure out how to handle these

25
src/analyzer/protocol/dns/DNS.cc
View file

@ -208,6 +208,7 @@ int DNS_Interpreter::ParseAnswer(DNS_MsgInfo* msg,
int name_len = sizeof(name) - 1; int name_len = sizeof(name) - 1;
u_char* name_end = ExtractName(data, len, name, name_len, msg_start); u_char* name_end = ExtractName(data, len, name, name_len, msg_start);
if ( ! name_end ) if ( ! name_end )
return 0; return 0;
@ -400,7 +401,10 @@ int DNS_Interpreter::ExtractLabel(const u_char*& data, int& len,
return 0; return 0;
} }
if ( label_len > 63 ) if ( label_len > 63 &&
// NetBIOS name service look ups can use
// longer labels
ntohs(analyzer->Conn()->RespPort()) != 137 )
{ {
analyzer->Weird("DNS_label_too_long"); analyzer->Weird("DNS_label_too_long");
return 0; return 0;
@ -633,15 +637,24 @@ int DNS_Interpreter::ParseRR_SRV(DNS_MsgInfo* msg,
u_char* name_end = ExtractName(data, len, name, name_len, msg_start); u_char* name_end = ExtractName(data, len, name, name_len, msg_start);
if ( ! name_end ) if ( ! name_end )
return 0; return 0;
*name_end = 0; // terminate name so we can use it in snprintf()
if ( data - data_start != rdlength ) if ( data - data_start != rdlength )
analyzer->Weird("DNS_RR_length_mismatch"); analyzer->Weird("DNS_RR_length_mismatch");
// The following is just a placeholder. if ( dns_SRV_reply && ! msg->skip_event )
char buf[2048]; {
safe_snprintf(buf, sizeof(buf), "SRV %s priority=%d weight=%d port=%d", val_list* vl = new val_list;
name, priority, weight, port); vl->append(analyzer->BuildConnVal());
vl->append(msg->BuildHdrVal());
vl->append(msg->BuildAnswerVal());
vl->append(new StringVal(new BroString(name, name_end - name, 1)));
vl->append(new Val(priority, TYPE_COUNT));
vl->append(new Val(weight, TYPE_COUNT));
vl->append(new Val(port, TYPE_COUNT));
analyzer->ConnectionEvent(dns_SRV_reply, vl);
}
return 1; return 1;
} }

8
src/analyzer/protocol/dns/events.bif
View file

@ -392,6 +392,12 @@ event dns_TXT_reply%(c: connection, msg: dns_msg, ans: dns_answer, str: string%)
## ##
## ans: The type-independent part of the parsed answer record. ## ans: The type-independent part of the parsed answer record.
## ##
## priority: Priority of the SRV response.
##
## weight: Weight of the SRV response.
##
## p: Port of the SRV response.
##
## .. bro:see:: dns_AAAA_reply dns_A_reply dns_CNAME_reply dns_EDNS_addl ## .. bro:see:: dns_AAAA_reply dns_A_reply dns_CNAME_reply dns_EDNS_addl
## dns_HINFO_reply dns_MX_reply dns_NS_reply dns_PTR_reply dns_SOA_reply ## dns_HINFO_reply dns_MX_reply dns_NS_reply dns_PTR_reply dns_SOA_reply
## dns_TSIG_addl dns_TXT_reply dns_WKS_reply dns_end dns_full_request ## dns_TSIG_addl dns_TXT_reply dns_WKS_reply dns_end dns_full_request
@ -399,7 +405,7 @@ event dns_TXT_reply%(c: connection, msg: dns_msg, ans: dns_answer, str: string%)
## dns_mapping_unverified dns_mapping_valid dns_message dns_query_reply ## dns_mapping_unverified dns_mapping_valid dns_message dns_query_reply
## dns_rejected dns_request non_dns_request dns_max_queries dns_session_timeout ## dns_rejected dns_request non_dns_request dns_max_queries dns_session_timeout
## dns_skip_addl dns_skip_all_addl dns_skip_all_auth dns_skip_auth ## dns_skip_addl dns_skip_all_addl dns_skip_all_auth dns_skip_auth
event dns_SRV_reply%(c: connection, msg: dns_msg, ans: dns_answer%); event dns_SRV_reply%(c: connection, msg: dns_msg, ans: dns_answer, target: string, priority: count, weight: count, p: count%);
## Generated on DNS reply resource records when the type of record is not one ## Generated on DNS reply resource records when the type of record is not one
## that Bro knows how to parse and generate another more specific specific ## that Bro knows how to parse and generate another more specific specific