Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge remote-tracking branch 'origin/topic/awelzel/dns-naming-authority-pointer'

Browse source 
* origin/topic/awelzel/dns-naming-authority-pointer:
  DNS: Implement NAPTR RR support
  DNS: Move extract_char_string() helper around
This commit is contained in:
Arne Welzel 2025-06-24 17:44:06 +02:00
commit fbeb3adfe6
13 changed files with 157 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

14
scripts/base/init-bare.zeek
View file

@ -3048,6 +3048,20 @@ type dns_svcb_rr: record {
target_name: string; ##< Target name, the hostname of the service endpoint.
};
## A NAPTR record.
##
## See also RFC 2915 - The Naming Authority Pointer (NAPTR) DNS Resource Record.
##
## .. zeek:see:: dns_NAPTR_reply
type dns_naptr_rr: record {
order: count; ##< Order in which to process NAPTR records.
preference: count; ##< Preference specifying processing order for *equal* :zeek:field:`dns_naptr_rr$order` fields.
flags: string; ##< Flags to control rewriting. E.g. "u", "a", "s" or "p".
service: string; ##< The services available down this rewrite path.
regexp: string; ##< Substitution expression to be applied to the original query.
replacement: string; ##< The next name to query, where the type is depending on the :zeek:field:`dns_naptr_rr$flags` field.
};
# DNS answer types.
#
# .. zeek:see:: dns_answer

21
scripts/base/protocols/dns/main.zeek
View file

@ -537,6 +537,27 @@ event dns_SRV_reply(c: connection, msg: dns_msg, ans: dns_answer, target: string
hook DNS::do_reply(c, msg, ans, target);
}
event dns_NAPTR_reply(c: connection, msg: dns_msg, ans: dns_answer, naptr: dns_naptr_rr) &priority=5
{
# Just encode all the fields for NAPTR RR in the reply string.
local tmp = "";
if ( |naptr$regexp| > 0 )
tmp += naptr$regexp;
if ( |naptr$replacement| > 0 )
{
if ( |tmp| > 0 )
tmp += " ";
tmp += naptr$replacement;
}
local r = fmt("NAPTR %s %s %s %s %s", naptr$order, naptr$preference, naptr$flags, naptr$service, tmp);
hook DNS::do_reply(c, msg, ans, r);
}
# TODO: figure out how to handle these
#event dns_EDNS(c: connection, msg: dns_msg, ans: dns_answer)
# {