Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-06 16:48:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Derive results of DNS lookups from from input when in BRO_DNS_FAKE mode.

Browse source 
Addresses BIT-1134.
This commit is contained in:
Jon Siwek 2014-03-14 12:01:09 -05:00
parent 8b241947d6
commit dbe5dfb3c3
3 changed files with 27 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

31
src/DNS_Mgr.cc
View file

@ -2,6 +2,7 @@
#include "config.h" #include "config.h"
#include <openssl/md5.h>
#include <sys/types.h> #include <sys/types.h>
#include <sys/socket.h> #include <sys/socket.h>
#ifdef TIME_WITH_SYS_TIME #ifdef TIME_WITH_SYS_TIME
@ -385,7 +386,6 @@ DNS_Mgr::DNS_Mgr(DNS_MgrMode arg_mode)
dns_mapping_altered = 0; dns_mapping_altered = 0;
dm_rec = 0; dm_rec = 0;
dns_fake_count = 0;
cache_name = dir = 0; cache_name = dir = 0;
@ -443,19 +443,30 @@ bool DNS_Mgr::Init()
return true; return true;
} }
TableVal* DNS_Mgr::BuildFakeAddrResult() static TableVal* fake_name_lookup_result(const char* name)
{ {
uint32 hash[4];
MD5(reinterpret_cast<const u_char*>(name), strlen(name),
reinterpret_cast<u_char*>(hash));
ListVal* hv = new ListVal(TYPE_ADDR); ListVal* hv = new ListVal(TYPE_ADDR);
hv->Append(new AddrVal(++dns_fake_count)); hv->Append(new AddrVal(hash));
TableVal* tv = hv->ConvertToSet(); TableVal* tv = hv->ConvertToSet();
Unref(hv); Unref(hv);
return tv; return tv;
} }
const char* DNS_Mgr::BuildFakeNameResult() static const char* fake_text_lookup_result(const char* name)
{ {
static char tmp[32]; static char tmp[32 + 256];
snprintf(tmp, sizeof(tmp), "fake_result_%"PRIu32, ++dns_fake_count); snprintf(tmp, sizeof(tmp), "fake_text_lookup_result_%s", name);
return tmp;
}
static const char* fake_addr_lookup_result(const IPAddr& addr)
{
static char tmp[128];
snprintf(tmp, sizeof(tmp), "fake_addr_lookup_result_%s",
addr.AsString().c_str());
return tmp; return tmp;
} }
@ -468,7 +479,7 @@ TableVal* DNS_Mgr::LookupHost(const char* name)
Init(); Init();
if ( mode == DNS_FAKE ) if ( mode == DNS_FAKE )
return BuildFakeAddrResult(); return fake_name_lookup_result(name);
if ( mode != DNS_PRIME ) if ( mode != DNS_PRIME )
{ {
@ -1044,7 +1055,7 @@ void DNS_Mgr::AsyncLookupAddr(const IPAddr& host, LookupCallback* callback)
if ( mode == DNS_FAKE ) if ( mode == DNS_FAKE )
{ {
resolve_lookup_cb(callback, BuildFakeNameResult()); resolve_lookup_cb(callback, fake_addr_lookup_result(host));
return; return;
} }
@ -1083,7 +1094,7 @@ void DNS_Mgr::AsyncLookupName(const string& name, LookupCallback* callback)
if ( mode == DNS_FAKE ) if ( mode == DNS_FAKE )
{ {
resolve_lookup_cb(callback, BuildFakeAddrResult()); resolve_lookup_cb(callback, fake_name_lookup_result(name.c_str()));
return; return;
} }
@ -1122,7 +1133,7 @@ void DNS_Mgr::AsyncLookupNameText(const string& name, LookupCallback* callback)
if ( mode == DNS_FAKE ) if ( mode == DNS_FAKE )
{ {
resolve_lookup_cb(callback, BuildFakeNameResult()); resolve_lookup_cb(callback, fake_text_lookup_result(name.c_str()));
return; return;
} }

5
src/DNS_Mgr.h
View file

@ -102,9 +102,6 @@ protected:
Val* BuildMappingVal(DNS_Mapping* dm); Val* BuildMappingVal(DNS_Mapping* dm);
TableVal* BuildFakeAddrResult();
const char* BuildFakeNameResult();
void AddResult(DNS_Mgr_Request* dr, struct nb_dns_result* r); void AddResult(DNS_Mgr_Request* dr, struct nb_dns_result* r);
void CompareMappings(DNS_Mapping* prev_dm, DNS_Mapping* new_dm); void CompareMappings(DNS_Mapping* prev_dm, DNS_Mapping* new_dm);
ListVal* AddrListDelta(ListVal* al1, ListVal* al2); ListVal* AddrListDelta(ListVal* al1, ListVal* al2);
@ -166,8 +163,6 @@ protected:
RecordType* dm_rec; RecordType* dm_rec;
uint32 dns_fake_count; // used to generate unique fake replies
typedef list<LookupCallback*> CallbackList; typedef list<LookupCallback*> CallbackList;
struct AsyncRequest { struct AsyncRequest {

12
testing/btest/Baseline/core.fake_dns/out
View file

@ -1,10 +1,10 @@
{ {
3.0.0.0, 50cd:1a9a:1837:5803:9b08:41aa:738c:3f0b,
2.0.0.0, 477c:8c51:4f4f:61ec:9981:1259:86b8:8987,
1.0.0.0 1d59:20f4:b44b:27a8:2bd:77c4:f053:6f5a
} }
lookup_hostname_txt, fake_result_4 lookup_hostname_txt, fake_text_lookup_result_bro.wp.dg.cx
lookup_hostname, { lookup_hostname, {
5.0.0.0 5aba:bd60:3b22:7803:2dd:8d83:498e:5172
} }
lookup_addr, fake_result_6 lookup_addr, fake_addr_lookup_result_1.2.3.4