Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Support for additional DNS RR Type: LOC[29], SSHFP[44], NSEC3PARAM[51], custom BIND9 signaling[65534]

Browse source
This commit is contained in:
Tim Wojtulewicz 2020-11-11 12:45:46 -07:00
parent ee31673154
commit a6a4b976ec
18 changed files with 490 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

24
scripts/base/protocols/dns/main.zeek
View file

@ -577,6 +577,11 @@ event dns_NSEC3(c: connection, msg: dns_msg, ans: dns_answer, nsec3: dns_nsec3_r
hook DNS::do_reply(c, msg, ans, "NSEC3");
}
event dns_NSEC3PARAM(c: connection, msg: dns_msg, ans: dns_answer, nsec3param: dns_nsec3param_rr) &priority=5
{
hook DNS::do_reply(c, msg, ans, "NSEC3PARAM");
}
event dns_DS(c: connection, msg: dns_msg, ans: dns_answer, ds: dns_ds_rr) &priority=5
{
local s: string;
@ -584,6 +589,25 @@ event dns_DS(c: connection, msg: dns_msg, ans: dns_answer, ds: dns_ds_rr) &prior
hook DNS::do_reply(c, msg, ans, s);
}
event dns_BINDS(c: connection, msg: dns_msg, ans: dns_answer, binds: dns_binds_rr) &priority=5
{
hook DNS::do_reply(c, msg, ans, "BIND9 signing signal");
}
event dns_SSHFP(c: connection, msg: dns_msg, ans: dns_answer, algo: count, fptype: count, fingerprint: string) &priority=5
{
local s: string;
s = fmt("SSHFP: %s", bytestring_to_hexstr(fingerprint));
hook DNS::do_reply(c, msg, ans, s);
}
event dns_LOC(c: connection, msg: dns_msg, ans: dns_answer, loc: dns_loc_rr) &priority=5
{
local s: string;
s = fmt("LOC: %d %d %d", loc$size, loc$horiz_pre, loc$vert_pre);
hook DNS::do_reply(c, msg, ans, s);
}
event dns_rejected(c: connection, msg: dns_msg, query: string, qtype: count, qclass: count) &priority=5
{
if ( c?$dns )