From bc7988819069d1e6a38b960745fc7595dd67adac Mon Sep 17 00:00:00 2001 From: Vlad Grigorescu Date: Tue, 30 Oct 2012 12:24:12 -0400 Subject: [PATCH] DNS TXT support --- src/DNS_Mgr.cc | 173 ++++++++++++++++++++++++++++++++++++++++--------- src/DNS_Mgr.h | 11 ++++ src/bro.bif | 29 +++++++++ src/nb_dns.c | 35 ++++++---- src/nb_dns.h | 2 +- 5 files changed, 206 insertions(+), 44 deletions(-) diff --git a/src/DNS_Mgr.cc b/src/DNS_Mgr.cc index 6b0f18f459..0b23700037 100644 --- a/src/DNS_Mgr.cc +++ b/src/DNS_Mgr.cc @@ -46,13 +46,14 @@ extern int select(int, fd_set *, fd_set *, fd_set *, struct timeval *); class DNS_Mgr_Request { public: - DNS_Mgr_Request(const char* h, int af) { host = copy_string(h); fam = af; } + DNS_Mgr_Request(const char* h, int af, bool isTxt) { host = copy_string(h); fam = af; qtype = isTxt ? 16 : 0; } DNS_Mgr_Request(const IPAddr& a) { addr = a; host = 0; fam = 0; } ~DNS_Mgr_Request() { delete [] host; } // Returns nil if this was an address request. const char* ReqHost() const { return host; } const IPAddr& ReqAddr() const { return addr; } + const bool ReqIsTxt() const { return qtype == 16; } int MakeRequest(nb_dns_info* nb_dns); int RequestPending() const { return request_pending; } @@ -62,6 +63,7 @@ public: protected: char* host; // if non-nil, this is a host request int fam; // address family query type for host requests + int qtype; // Query type IPAddr addr; int request_pending; }; @@ -75,7 +77,7 @@ int DNS_Mgr_Request::MakeRequest(nb_dns_info* nb_dns) char err[NB_DNS_ERRSIZE]; if ( host ) - return nb_dns_host_request2(nb_dns, host, fam, (void*) this, err) >= 0; + return nb_dns_host_request2(nb_dns, host, fam, qtype, (void*) this, err) >= 0; else { const uint32* bytes; @@ -475,8 +477,8 @@ TableVal* DNS_Mgr::LookupHost(const char* name) // Not found, or priming. switch ( mode ) { case DNS_PRIME: - requests.append(new DNS_Mgr_Request(name, AF_INET)); - requests.append(new DNS_Mgr_Request(name, AF_INET6)); + requests.append(new DNS_Mgr_Request(name, AF_INET, false)); + requests.append(new DNS_Mgr_Request(name, AF_INET6, false)); return empty_addr_set(); case DNS_FORCE: @@ -484,8 +486,8 @@ TableVal* DNS_Mgr::LookupHost(const char* name) return 0; case DNS_DEFAULT: - requests.append(new DNS_Mgr_Request(name, AF_INET)); - requests.append(new DNS_Mgr_Request(name, AF_INET6)); + requests.append(new DNS_Mgr_Request(name, AF_INET, false)); + requests.append(new DNS_Mgr_Request(name, AF_INET6, false)); Resolve(); return LookupHost(name); @@ -636,6 +638,7 @@ int DNS_Mgr::Save() Save(f, host_mappings); Save(f, addr_mappings); + Save(f, text_mappings); fclose(f); @@ -704,29 +707,35 @@ void DNS_Mgr::AddResult(DNS_Mgr_Request* dr, struct nb_dns_result* r) new_dm = new DNS_Mapping(dr->ReqHost(), h, ttl); prev_dm = 0; - HostMap::iterator it = host_mappings.find(dr->ReqHost()); - if ( it == host_mappings.end() ) + if ( dr->ReqIsTxt() ) { + TextMap::iterator it = text_mappings.find(dr->ReqHost()); + if ( it == text_mappings.end() ) + text_mappings[dr->ReqHost()] = new_dm; + } + else { + HostMap::iterator it = host_mappings.find(dr->ReqHost()); + if ( it == host_mappings.end() ) + { + host_mappings[dr->ReqHost()].first = + new_dm->Type() == AF_INET ? new_dm : 0; + host_mappings[dr->ReqHost()].second = + new_dm->Type() == AF_INET ? 0 : new_dm; + } + + else + { + if ( new_dm->Type() == AF_INET ) { - host_mappings[dr->ReqHost()].first = - new_dm->Type() == AF_INET ? new_dm : 0; - host_mappings[dr->ReqHost()].second = - new_dm->Type() == AF_INET ? 0 : new_dm; + prev_dm = it->second.first; + it->second.first = new_dm; } - - else + else { - if ( new_dm->Type() == AF_INET ) - { - prev_dm = it->second.first; - it->second.first = new_dm; - } - else - { - prev_dm = it->second.second; - it->second.second = new_dm; - } + prev_dm = it->second.second; + it->second.second = new_dm; } - + } + } if ( new_dm->Failed() && prev_dm && prev_dm->Valid() ) { // Put previous, valid entry back - CompareMappings @@ -889,6 +898,16 @@ void DNS_Mgr::Save(FILE* f, const AddrMap& m) } } +void DNS_Mgr::Save(FILE* f, const TextMap& m) + { + for ( TextMap::const_iterator it = m.begin(); it != m.end(); ++it ) + { + if ( it->second ) + it->second->Save(f); + } + } + + void DNS_Mgr::Save(FILE* f, const HostMap& m) { HostMap::const_iterator it; @@ -927,8 +946,10 @@ const char* DNS_Mgr::LookupAddrInCache(const IPAddr& addr) TableVal* DNS_Mgr::LookupNameInCache(string name) { HostMap::iterator it = dns_mgr->host_mappings.find(name); - if ( it == dns_mgr->host_mappings.end() ) + if ( it == dns_mgr->host_mappings.end() ){ + it = dns_mgr->host_mappings.begin(); return 0; + } DNS_Mapping* d4 = it->second.first; DNS_Mapping* d6 = it->second.second; @@ -951,6 +972,26 @@ TableVal* DNS_Mgr::LookupNameInCache(string name) return tv6; } +const char* DNS_Mgr::LookupTextInCache(string name) + { + TextMap::iterator it = dns_mgr->text_mappings.find(name); + if ( it == dns_mgr->text_mappings.end() ) + return 0; + + DNS_Mapping* d = it->second; + + if ( d->Expired() ) + { + dns_mgr->text_mappings.erase(it); + delete d; + return 0; + } + + // The escapes in the following strings are to avoid having it + // interpreted as a trigraph sequence. + return d->names ? d->names[0] : "<\?\?\?>"; + } + void DNS_Mgr::AsyncLookupAddr(const IPAddr& host, LookupCallback* callback) { if ( ! did_init ) @@ -976,6 +1017,7 @@ void DNS_Mgr::AsyncLookupAddr(const IPAddr& host, LookupCallback* callback) // A new one. req = new AsyncRequest; req->host = host; + req->isTxt = false; asyncs_queued.push_back(req); asyncs_addrs.insert(AsyncRequestAddrMap::value_type(host, req)); } @@ -1020,6 +1062,35 @@ void DNS_Mgr::AsyncLookupName(string name, LookupCallback* callback) IssueAsyncRequests(); } +void DNS_Mgr::AsyncLookupNameText(string name, LookupCallback* callback) + { + if ( ! did_init ) + Init(); + + // Do we already know the answer? + TableVal* addrs; + + AsyncRequest* req = 0; + + // Have we already a request waiting for this host? + AsyncRequestTextMap::iterator i = asyncs_texts.find(name); + if ( i != asyncs_texts.end() ) + req = i->second; + else + { + // A new one. + req = new AsyncRequest; + req->name = name; + req->isTxt = true; + asyncs_queued.push_back(req); + asyncs_texts.insert(AsyncRequestTextMap::value_type(name, req)); + } + + req->callbacks.push_back(callback); + + IssueAsyncRequests(); + } + void DNS_Mgr::IssueAsyncRequests() { while ( asyncs_queued.size() && asyncs_pending < MAX_PENDING_REQUESTS ) @@ -1036,8 +1107,9 @@ void DNS_Mgr::IssueAsyncRequests() dr = new DNS_Mgr_Request(req->host); else { - dr = new DNS_Mgr_Request(req->name.c_str(), AF_INET); - dr6 = new DNS_Mgr_Request(req->name.c_str(), AF_INET6); + dr = new DNS_Mgr_Request(req->name.c_str(), AF_INET, req->isTxt); + if ( !req->isTxt ) + dr6 = new DNS_Mgr_Request(req->name.c_str(), AF_INET6, req->isTxt); } if ( ! dr->MakeRequest(nb_dns) ) @@ -1143,6 +1215,40 @@ void DNS_Mgr::CheckAsyncHostRequest(const char* host, bool timeout) } } +void DNS_Mgr::CheckAsyncTextRequest(const char* host, bool timeout) + { + // Note that this code is a mirror of that for CheckAsyncAddrRequest. + + AsyncRequestTextMap::iterator i = asyncs_texts.find(host); + + if ( i != asyncs_texts.end() ) + { + const char* name = LookupTextInCache(host); + if ( name ) + { + ++successful; + i->second->Resolved(name); + } + + else if ( timeout ) + { + AsyncRequestTextMap::iterator it = asyncs_texts.begin(); + ++failed; + i->second->Timeout(); + } + + else + return; + + asyncs_texts.erase(i); + --asyncs_pending; + + // Don't delete the request. That will be done once it + // eventually times out. + } + } + + void DNS_Mgr::Flush() { DoProcess(false); @@ -1157,8 +1263,12 @@ void DNS_Mgr::Flush() for ( AddrMap::iterator it2 = addr_mappings.begin(); it2 != addr_mappings.end(); ++it2 ) delete it2->second; + for ( TextMap::iterator it3 = text_mappings.begin(); it3 != text_mappings.end(); ++it3 ) + delete it3->second; + host_mappings.clear(); addr_mappings.clear(); + text_mappings.clear(); } void DNS_Mgr::Process() @@ -1177,6 +1287,8 @@ void DNS_Mgr::DoProcess(bool flush) if ( req->IsAddrReq() ) CheckAsyncAddrRequest(req->host, true); + else if ( req->isTxt ) + CheckAsyncTextRequest(req->name.c_str(), true); else CheckAsyncHostRequest(req->name.c_str(), true); @@ -1184,7 +1296,7 @@ void DNS_Mgr::DoProcess(bool flush) delete req; } - if ( asyncs_addrs.size() == 0 && asyncs_names.size() == 0 ) + if ( asyncs_addrs.size() == 0 && asyncs_names.size() == 0 && asyncs_texts.size() == 0 ) return; if ( AnswerAvailable(0) <= 0 ) @@ -1217,6 +1329,8 @@ void DNS_Mgr::DoProcess(bool flush) if ( ! dr->ReqHost() ) CheckAsyncAddrRequest(dr->ReqAddr(), true); + else if ( dr->ReqIsTxt() ) + CheckAsyncTextRequest(dr->ReqHost(), do_host_timeout); else CheckAsyncHostRequest(dr->ReqHost(), do_host_timeout); @@ -1271,5 +1385,6 @@ void DNS_Mgr::GetStats(Stats* stats) stats->pending = asyncs_pending; stats->cached_hosts = host_mappings.size(); stats->cached_addresses = addr_mappings.size(); + stats->cached_texts = text_mappings.size(); } diff --git a/src/DNS_Mgr.h b/src/DNS_Mgr.h index 7983a91573..30348db034 100644 --- a/src/DNS_Mgr.h +++ b/src/DNS_Mgr.h @@ -63,6 +63,7 @@ public: const char* LookupAddrInCache(const IPAddr& addr); TableVal* LookupNameInCache(string name); + const char* LookupTextInCache(string name); // Support for async lookups. class LookupCallback { @@ -77,6 +78,7 @@ public: void AsyncLookupAddr(const IPAddr& host, LookupCallback* callback); void AsyncLookupName(string name, LookupCallback* callback); + void AsyncLookupNameText(string name, LookupCallback* callback); struct Stats { unsigned long requests; // These count only async requests. @@ -85,6 +87,7 @@ public: unsigned long pending; unsigned long cached_hosts; unsigned long cached_addresses; + unsigned long cached_texts; }; void GetStats(Stats* stats); @@ -106,9 +109,11 @@ protected: typedef map > HostMap; typedef map AddrMap; + typedef map TextMap; void LoadCache(FILE* f); void Save(FILE* f, const AddrMap& m); void Save(FILE* f, const HostMap& m); + void Save(FILE* f, const TextMap& m); // Selects on the fd to see if there is an answer available (timeout // is secs). Returns 0 on timeout, -1 on EINTR or other error, and 1 @@ -122,6 +127,7 @@ protected: // requested. void CheckAsyncAddrRequest(const IPAddr& addr, bool timeout); void CheckAsyncHostRequest(const char* host, bool timeout); + void CheckAsyncTextRequest(const char* host, bool timeout); // Process outstanding requests. void DoProcess(bool flush); @@ -138,6 +144,7 @@ protected: HostMap host_mappings; AddrMap addr_mappings; + TextMap text_mappings; DNS_mgr_request_list requests; @@ -165,6 +172,7 @@ protected: double time; IPAddr host; string name; + bool isTxt; CallbackList callbacks; bool IsAddrReq() const { return name.length() == 0; } @@ -210,6 +218,9 @@ protected: typedef map AsyncRequestNameMap; AsyncRequestNameMap asyncs_names; + typedef map AsyncRequestTextMap; + AsyncRequestTextMap asyncs_texts; + typedef list QueuedList; QueuedList asyncs_queued; diff --git a/src/bro.bif b/src/bro.bif index 1b1c23950d..e2ff8a63c6 100644 --- a/src/bro.bif +++ b/src/bro.bif @@ -3770,6 +3770,35 @@ function lookup_addr%(host: addr%) : string return 0; %} +## Issues an asynchronous TEXT DNS lookup and delays the function result. +## This function can therefore only be called inside a ``when`` condition, +## e.g., ``when ( local h = lookup_hostname_txt("www.bro-ids.org") ) { f(h); }``. +## +## host: The hostname to lookup. +## +## Returns: A set of DNS A and AAAA records associated with *host*. +## +## .. bro:see:: lookup_hostname +function lookup_hostname_txt%(host: string%) : addr_set + %{ + // FIXME: Is should be easy to adapt the function to synchronous + // lookups if we're reading a trace. + Trigger* trigger = frame->GetTrigger(); + + if ( ! trigger) + { + builtin_error("lookup_hostname_txt() can only be called inside a when-condition"); + return new StringVal(""); + } + + frame->SetDelayed(); + trigger->Hold(); + + dns_mgr->AsyncLookupNameText(host->CheckString(), + new LookupHostCallback(trigger, frame->GetCall(), false)); + return 0; + %} + ## Issues an asynchronous DNS lookup and delays the function result. ## This function can therefore only be called inside a ``when`` condition, ## e.g., ``when ( local h = lookup_hostname("www.bro-ids.org") ) { f(h); }``. diff --git a/src/nb_dns.c b/src/nb_dns.c index 3051be9bc2..0eb49292e3 100644 --- a/src/nb_dns.c +++ b/src/nb_dns.c @@ -307,31 +307,32 @@ nb_dns_host_request(register struct nb_dns_info *nd, register const char *name, register void *cookie, register char *errstr) { - return (nb_dns_host_request2(nd, name, AF_INET, cookie, errstr)); + return (nb_dns_host_request2(nd, name, AF_INET, 0, cookie, errstr)); } int nb_dns_host_request2(register struct nb_dns_info *nd, register const char *name, - register int af, register void *cookie, register char *errstr) + register int af, register int qtype, register void *cookie, register char *errstr) { - register int qtype; + if (qtype != 16){ - switch (af) { + switch (af) { - case AF_INET: - qtype = T_A; - break; + case AF_INET: + qtype = T_A; + break; #ifdef AF_INET6 - case AF_INET6: - qtype = T_AAAA; - break; + case AF_INET6: + qtype = T_AAAA; + break; #endif - default: - snprintf(errstr, NB_DNS_ERRSIZE, - "nb_dns_host_request2(): uknown address family %d", af); - return (-1); + default: + snprintf(errstr, NB_DNS_ERRSIZE, + "nb_dns_host_request2(): unknown address family %d", af); + return (-1); + } } return (_nb_dns_mkquery(nd, name, af, qtype, cookie, errstr)); } @@ -603,6 +604,12 @@ nb_dns_activity(struct nb_dns_info *nd, struct nb_dns_result *nr, char *errstr) nr->hostent = he; nr->ttl = rttl; return (1); + case T_TXT: + memcpy(bp, rdata, rdlen); + he->h_name = bp+1; /* First char is a control character. */ + nr->hostent = he; + nr->ttl = rttl; + return (1); } } diff --git a/src/nb_dns.h b/src/nb_dns.h index d458f61716..33e09aa226 100644 --- a/src/nb_dns.h +++ b/src/nb_dns.h @@ -22,7 +22,7 @@ void nb_dns_finish(struct nb_dns_info *); int nb_dns_fd(struct nb_dns_info *); int nb_dns_host_request(struct nb_dns_info *, const char *, void *, char *); -int nb_dns_host_request2(struct nb_dns_info *, const char *, int, +int nb_dns_host_request2(struct nb_dns_info *, const char *, int, int, void *, char *); int nb_dns_addr_request(struct nb_dns_info *, nb_uint32_t, void *, char *);