Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-06 16:48:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Derive results of DNS lookups from from input when in BRO_DNS_FAKE mode.

Browse source 
Addresses BIT-1134.
This commit is contained in:
Jon Siwek 2014-03-14 12:01:09 -05:00
parent 8b241947d6
commit dbe5dfb3c3
3 changed files with 27 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

31
src/DNS_Mgr.cc
View file

@ -2,6 +2,7 @@
#include "config.h"
#include <openssl/md5.h>
#include <sys/types.h>
#include <sys/socket.h>
#ifdef TIME_WITH_SYS_TIME
@ -385,7 +386,6 @@ DNS_Mgr::DNS_Mgr(DNS_MgrMode arg_mode)
dns_mapping_altered = 0;
dm_rec = 0;
dns_fake_count = 0;
cache_name = dir = 0;
@ -443,19 +443,30 @@ bool DNS_Mgr::Init()
return true;
}
TableVal* DNS_Mgr::BuildFakeAddrResult()
static TableVal* fake_name_lookup_result(const char* name)
{
uint32 hash[4];
MD5(reinterpret_cast<const u_char*>(name), strlen(name),
reinterpret_cast<u_char*>(hash));
ListVal* hv = new ListVal(TYPE_ADDR);
hv->Append(new AddrVal(++dns_fake_count));
hv->Append(new AddrVal(hash));
TableVal* tv = hv->ConvertToSet();
Unref(hv);
return tv;
}
const char* DNS_Mgr::BuildFakeNameResult()
static const char* fake_text_lookup_result(const char* name)
{
static char tmp[32];
snprintf(tmp, sizeof(tmp), "fake_result_%"PRIu32, ++dns_fake_count);
static char tmp[32 + 256];
snprintf(tmp, sizeof(tmp), "fake_text_lookup_result_%s", name);
return tmp;
}
static const char* fake_addr_lookup_result(const IPAddr& addr)
{
static char tmp[128];
snprintf(tmp, sizeof(tmp), "fake_addr_lookup_result_%s",
addr.AsString().c_str());
return tmp;
}
@ -468,7 +479,7 @@ TableVal* DNS_Mgr::LookupHost(const char* name)
Init();
if ( mode == DNS_FAKE )
return BuildFakeAddrResult();
return fake_name_lookup_result(name);
if ( mode != DNS_PRIME )
{
@ -1044,7 +1055,7 @@ void DNS_Mgr::AsyncLookupAddr(const IPAddr& host, LookupCallback* callback)
if ( mode == DNS_FAKE )
{
resolve_lookup_cb(callback, BuildFakeNameResult());
resolve_lookup_cb(callback, fake_addr_lookup_result(host));
return;
}
@ -1083,7 +1094,7 @@ void DNS_Mgr::AsyncLookupName(const string& name, LookupCallback* callback)
if ( mode == DNS_FAKE )
{
resolve_lookup_cb(callback, BuildFakeAddrResult());
resolve_lookup_cb(callback, fake_name_lookup_result(name.c_str()));
return;
}
@ -1122,7 +1133,7 @@ void DNS_Mgr::AsyncLookupNameText(const string& name, LookupCallback* callback)
if ( mode == DNS_FAKE )
{
resolve_lookup_cb(callback, BuildFakeNameResult());
resolve_lookup_cb(callback, fake_text_lookup_result(name.c_str()));
return;
}

5
src/DNS_Mgr.h
View file

@ -102,9 +102,6 @@ protected:
Val* BuildMappingVal(DNS_Mapping* dm);
TableVal* BuildFakeAddrResult();
const char* BuildFakeNameResult();
void AddResult(DNS_Mgr_Request* dr, struct nb_dns_result* r);
void CompareMappings(DNS_Mapping* prev_dm, DNS_Mapping* new_dm);
ListVal* AddrListDelta(ListVal* al1, ListVal* al2);
@ -166,8 +163,6 @@ protected:
RecordType* dm_rec;
uint32 dns_fake_count; // used to generate unique fake replies
typedef list<LookupCallback*> CallbackList;
struct AsyncRequest {

12
testing/btest/Baseline/core.fake_dns/out
View file

@ -1,10 +1,10 @@
{
3.0.0.0,
2.0.0.0,
1.0.0.0
50cd:1a9a:1837:5803:9b08:41aa:738c:3f0b,
477c:8c51:4f4f:61ec:9981:1259:86b8:8987,
1d59:20f4:b44b:27a8:2bd:77c4:f053:6f5a
}
lookup_hostname_txt, fake_result_4
lookup_hostname_txt, fake_text_lookup_result_bro.wp.dg.cx
lookup_hostname, {
5.0.0.0
5aba:bd60:3b22:7803:2dd:8d83:498e:5172
}
lookup_addr, fake_result_6
lookup_addr, fake_addr_lookup_result_1.2.3.4