Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge branch 'dns-caa-decode' of https://github.com/marktayl/bro into merge

Browse source 
* 'dns-caa-decode' of https://github.com/marktayl/bro:
  Add DNS "CAA" RR type and event.
This commit is contained in:
Johanna Amann 2016-04-25 15:35:43 -07:00
commit cfa4fb4946
4 changed files with 73 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

49
src/analyzer/protocol/dns/DNS.cc
View file

@ -282,6 +282,10 @@ int DNS_Interpreter::ParseAnswer(DNS_MsgInfo* msg,
status = ParseRR_TXT(msg, data, len, rdlength, msg_start);
break;
case TYPE_CAA:
status = ParseRR_CAA(msg, data, len, rdlength, msg_start);
break;
case TYPE_NBS:
status = ParseRR_NBS(msg, data, len, rdlength, msg_start);
break;
@ -904,6 +908,51 @@ int DNS_Interpreter::ParseRR_TXT(DNS_MsgInfo* msg,
return rdlength == 0;
}
int DNS_Interpreter::ParseRR_CAA(DNS_MsgInfo* msg,
const u_char*& data, int& len, int rdlength,
const u_char* msg_start)
{
if ( ! dns_CAA_reply || msg->skip_event )
{
data += rdlength;
len -= rdlength;
return 1;
}
unsigned int flags = ExtractShort(data, len);
unsigned int tagLen = flags & 0xff;
flags = flags >> 8;
rdlength -= 2;
if ( (int) tagLen >= rdlength )
{
analyzer->Weird("DNS_CAA_char_str_past_rdlen");
return 0;
}
BroString* tag = new BroString(data, tagLen, 1);
len -= tagLen;
data += tagLen;
rdlength -= tagLen;
BroString* value = new BroString(data, rdlength, 0);
len -= value->Len();
data += value->Len();
rdlength -= value->Len();
val_list* vl = new val_list;
vl->append(analyzer->BuildConnVal());
vl->append(msg->BuildHdrVal());
vl->append(msg->BuildAnswerVal());
vl->append(new Val(flags, TYPE_COUNT));
vl->append(new StringVal(tag));
vl->append(new StringVal(value));
analyzer->ConnectionEvent(dns_CAA_reply, vl);
return rdlength == 0;
}
void DNS_Interpreter::SendReplyOrRejectEvent(DNS_MsgInfo* msg,
EventHandlerPtr event,
const u_char*& data, int& len,