From 81aa6b14fdabe330299c4fd73d764bf235ca4cff Mon Sep 17 00:00:00 2001 From: Arne Welzel Date: Fri, 17 Nov 2023 19:44:00 +0100 Subject: [PATCH] DNS: Add Ed25519 and Ed448 enum values to parser We already had these declared in dns/const.zeek, so extend the parser as well to avoid raising weirds and add some test pcaps: $ dig @8.8.8.8 DNSKEY ed448.no $ dig @8.8.8.8 ed448.no +dnssec And the same for the ed25519.no domain. Closes #3453 --- src/analyzer/protocol/dns/DNS.cc | 4 +++ src/analyzer/protocol/dns/DNS.h | 2 ++ .../dns.ed25519.log | 4 +++ .../dns.ed448.log | 4 +++ testing/btest/Traces/dnssec/ed25519.no.pcap | Bin 0 -> 654 bytes testing/btest/Traces/dnssec/ed448.no.pcap | Bin 0 -> 744 bytes .../scripts/base/protocols/dns/dnssec.zeek | 24 ++++++++++++++++++ 7 files changed, 38 insertions(+) create mode 100644 testing/btest/Baseline/scripts.base.protocols.dns.dnssec/dns.ed25519.log create mode 100644 testing/btest/Baseline/scripts.base.protocols.dns.dnssec/dns.ed448.log create mode 100644 testing/btest/Traces/dnssec/ed25519.no.pcap create mode 100644 testing/btest/Traces/dnssec/ed448.no.pcap create mode 100644 testing/btest/scripts/base/protocols/dns/dnssec.zeek diff --git a/src/analyzer/protocol/dns/DNS.cc b/src/analyzer/protocol/dns/DNS.cc index 6e0d416bee..304893f121 100644 --- a/src/analyzer/protocol/dns/DNS.cc +++ b/src/analyzer/protocol/dns/DNS.cc @@ -872,6 +872,8 @@ bool DNS_Interpreter::ParseRR_RRSIG(detail::DNS_MsgInfo* msg, const u_char*& dat case detail::GOST_R_34_10_2001: break; case detail::ECDSA_curveP256withSHA256: break; case detail::ECDSA_curveP384withSHA384: break; + case detail::Ed25519: break; + case detail::Ed448: break; case detail::Indirect: analyzer->Weird("DNSSEC_RRSIG_Indirect_ZoneSignAlgo", util::fmt("%d", algo)); break; case detail::PrivateDNS: analyzer->Weird("DNSSEC_RRSIG_PrivateDNS_ZoneSignAlgo", util::fmt("%d", algo)); break; case detail::PrivateOID: analyzer->Weird("DNSSEC_RRSIG_PrivateOID_ZoneSignAlgo", util::fmt("%d", algo)); break; @@ -945,6 +947,8 @@ bool DNS_Interpreter::ParseRR_DNSKEY(detail::DNS_MsgInfo* msg, const u_char*& da case detail::GOST_R_34_10_2001: break; case detail::ECDSA_curveP256withSHA256: break; case detail::ECDSA_curveP384withSHA384: break; + case detail::Ed25519: break; + case detail::Ed448: break; case detail::Indirect: analyzer->Weird("DNSSEC_DNSKEY_Indirect_ZoneSignAlgo", util::fmt("%d", dalgorithm)); break; diff --git a/src/analyzer/protocol/dns/DNS.h b/src/analyzer/protocol/dns/DNS.h index f70c6cfc4e..3b361bc937 100644 --- a/src/analyzer/protocol/dns/DNS.h +++ b/src/analyzer/protocol/dns/DNS.h @@ -127,6 +127,8 @@ enum DNSSEC_Algo { GOST_R_34_10_2001 = 12, ECDSA_curveP256withSHA256 = 13, ECDSA_curveP384withSHA384 = 14, + Ed25519 = 15, + Ed448 = 16, Indirect = 252, ///< PrivateDNS = 253, ///< OPTIONAL PrivateOID = 254, ///< OPTIONAL diff --git a/testing/btest/Baseline/scripts.base.protocols.dns.dnssec/dns.ed25519.log b/testing/btest/Baseline/scripts.base.protocols.dns.dnssec/dns.ed25519.log new file mode 100644 index 0000000000..8b918e980d --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.dns.dnssec/dns.ed25519.log @@ -0,0 +1,4 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +id.orig_h id.resp_h qtype_name query answers +192.168.0.107 8.8.8.8 DNSKEY ed25519.no DNSKEY 15,Ed25519,DNSKEY 15,Ed25519 +192.168.0.107 8.8.8.8 A ed25519.no 194.63.248.47,RRSIG 1 ed25519.no,Ed25519 diff --git a/testing/btest/Baseline/scripts.base.protocols.dns.dnssec/dns.ed448.log b/testing/btest/Baseline/scripts.base.protocols.dns.dnssec/dns.ed448.log new file mode 100644 index 0000000000..5267c46854 --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.dns.dnssec/dns.ed448.log @@ -0,0 +1,4 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +id.orig_h id.resp_h answers +192.168.0.107 8.8.8.8 DNSKEY 16,Ed448,DNSKEY 16,Ed448 +192.168.0.107 8.8.8.8 194.63.248.47,RRSIG 1 ed448.no,Ed448 diff --git a/testing/btest/Traces/dnssec/ed25519.no.pcap b/testing/btest/Traces/dnssec/ed25519.no.pcap new file mode 100644 index 0000000000000000000000000000000000000000..07cefd411a99331e050ac558c2920d92a8e4e2c8 GIT binary patch literal 654 zcmca|c+)~A1{MYw`2U}Qff2|t*c6_6fRm9S7RUx+3+LJs6@3A(3*GM@;b3rOVDML3 z%)sCv*mmQ<3WjVBAb9eP!IZ(eNX+axqXO6nph4`ZDMqHIhL%iu`9LEjiPA;($j_W=^&w%U&0VALX z?2EYYgchGND70orz(Q+VIw-W1eh4KpVh=4wcxW|1Lrat~ws89+@rfYIIJvnQP6I6l zVT{n)JHHqdS{G&_LJMf!${AmU5^;nU&@!O!!B+A%F|Zu6|Dg}$>w%mAOq15;`k&dRB+a^UDv|mPl*+U*j|8cb}4JqObhW^k%Gx$qc4$ o@4JaXcGd5!8?UBWZCa{uW=FrZ)9)G%SC&5wK$F4Y2=pcc04I;HqW}N^ literal 0 HcmV?d00001 diff --git a/testing/btest/Traces/dnssec/ed448.no.pcap b/testing/btest/Traces/dnssec/ed448.no.pcap new file mode 100644 index 0000000000000000000000000000000000000000..ee5b321b7f3522b979faac98203f7f8a01970c22 GIT binary patch literal 744 zcmca|c+)~A1{MYw`2U}Qff2~j+8CbdIERxV8psA=3+LJs6@3A(3*GM@;b3rOVDMF* zz`)=j*!uRs3WjVBAn3ZvV9H?GZL`IWQ2}fO&>+^-6cZB*ro4Ox1_O|oCd&n&Squz3 z3|tHx^%K)NHauQp2eQiiJQu@5pacj*EP+@Ew(9a_a|VV=!8!Xu)_|;IFa=t+|DNd< zyT%5fu}nZsXjUEIfmp~Vz+lVBz$|cN-$keE$N&A>Wbtk%&!PJU9b(R%Vg;>h+%GO` z;&l(4TYTsALZ7X-ICi|ry~3^~{?LnAQSd~L1y=)#L5$1-s%PGux@@Xe#w~pLvZGk% zt)R^ZpRO!*J^y(6g>y;^E+3DszqjZ3eCKyJKPH+!R*YTqGN1p@qP4|VKqqQ~+zA4P zKo4i1hlDHku-!BV6t>?Uz`}O&Qc&0)yS1l;5nI?Y!o#)!8n(Gs0^yELZMQ*ICGj&d z`~+GH!Wd!udgU!p*dAj+ge}mr>#Vc)lwb{8pjE&i0b9uXn1SVx{SSR0Uk~H}Ais}+ zQ2^*mK7rIiwfa=gne|@Ih$OH@W4+zIzu)4*3#0cN&G-J26>PPB!{(jao=Ecu&RWC4 zBvI*}U8lL}vBXBd&9(7$mgd_<4{uxCTGAk@mma>R|HqEt=Z4`w+hT)crdRs;7|ywP u(5i{o>+7w+i5pDr{}A<;60@AM?BbE>8Haa!^)PaaSp)qG4s&3jFaQ7vMC{4{ literal 0 HcmV?d00001 diff --git a/testing/btest/scripts/base/protocols/dns/dnssec.zeek b/testing/btest/scripts/base/protocols/dns/dnssec.zeek new file mode 100644 index 0000000000..5342fcc00d --- /dev/null +++ b/testing/btest/scripts/base/protocols/dns/dnssec.zeek @@ -0,0 +1,24 @@ +# @TEST-DOC: Add the textual representation of the DNSSEC algorithm into answers and verify there's no weirds for the ed25519 and ed448 curves. +# +# @TEST-EXEC: zeek -b -r $TRACES/dnssec/ed25519.no.pcap %INPUT +# @TEST-EXEC: test ! -f weird.log +# @TEST-EXEC: zeek-cut -m id.orig_h id.resp_h qtype_name query answers < dns.log > dns.ed25519.log +# +# @TEST-EXEC: zeek -b -C -r $TRACES/dnssec/ed448.no.pcap %INPUT +# @TEST-EXEC: test ! -f weird.log +# @TEST-EXEC: zeek-cut -m id.orig_h id.resp_h questions answers < dns.log > dns.ed448.log +# +# @TEST-EXEC: btest-diff dns.ed25519.log +# @TEST-EXEC: btest-diff dns.ed448.log + +@load base/protocols/dns + +event dns_RRSIG(c: connection, msg: dns_msg, ans: dns_answer, rrsig: dns_rrsig_rr) &priority=4 + { + c$dns$answers += DNS::algorithms[rrsig$algorithm]; + } + +event dns_DNSKEY(c: connection, msg: dns_msg, ans: dns_answer, dnskey: dns_dnskey_rr) &priority=4 + { + c$dns$answers += DNS::algorithms[dnskey$algorithm]; + }