mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
597a4d6704
- policy/ renamed to scripts/ - By default BROPATH now contains: - scripts/ - scripts/policy - scripts/site - *Nearly* all tests pass. - All of scripts/base/ is loaded by main.cc - Can be disabled by setting $BRO_NO_BASE_SCRIPTS - Scripts in scripts/base/ don't use relative path loading to ease use of BRO_NO_BASE_SCRIPTS (to copy and paste that script). - The scripts in scripts/base/protocols/ only (or soon will only) do logging and state building. - The scripts in scripts/base/frameworks/ add functionality without causing any additional overhead. - All "detection" activity happens through scripts in scripts/policy/. - Communications framework modified temporarily to need an environment variable to actually enable (ENABLE_COMMUNICATION=1) - This is so the communications framework can be loaded as part of the base without causing trouble when it's not needed. - This will be removed once a resolution to ticket #540 is reached.
84 lines
No EOL
3.3 KiB
Text
84 lines
No EOL
3.3 KiB
Text
##! Types, errors, and fields for analyzing DNS data. A helper file
|
|
##! for DNS analysis scripts.
|
|
|
|
module DNS;
|
|
|
|
export {
|
|
const PTR = 12;
|
|
const EDNS = 41;
|
|
const ANY = 255;
|
|
|
|
## Mapping of DNS query type codes to human readable string representation.
|
|
const query_types = {
|
|
[1] = "A", [2] = "NS", [3] = "MD", [4] = "MF",
|
|
[5] = "CNAME", [6] = "SOA", [7] = "MB", [8] = "MG",
|
|
[9] = "MR", [10] = "NULL", [11] = "WKS", [PTR] = "PTR",
|
|
[13] = "HINFO", [14] = "MINFO", [15] = "MX", [16] = "TXT",
|
|
[17] = "RP", [18] = "AFSDB", [19] = "X25", [20] = "ISDN",
|
|
[21] = "RT", [22] = "NSAP", [23] = "NSAP-PTR", [24] = "SIG",
|
|
[25] = "KEY", [26] = "PX" , [27] = "GPOS", [28] = "AAAA",
|
|
[29] = "LOC", [30] = "EID", [31] = "NIMLOC", [32] = "NB",
|
|
[33] = "SRV", [34] = "ATMA", [35] = "NAPTR", [36] = "KX",
|
|
[37] = "CERT", [38] = "A6", [39] = "DNAME", [40] = "SINK",
|
|
[EDNS] = "EDNS", [42] = "APL", [43] = "DS", [44] = "SINK",
|
|
[45] = "SSHFP", [46] = "RRSIG", [47] = "NSEC", [48] = "DNSKEY",
|
|
[49] = "DHCID", [99] = "SPF", [100] = "DINFO", [101] = "UID",
|
|
[102] = "GID", [103] = "UNSPEC", [249] = "TKEY", [250] = "TSIG",
|
|
[251] = "IXFR", [252] = "AXFR", [253] = "MAILB", [254] = "MAILA",
|
|
[32768] = "TA", [32769] = "DLV",
|
|
[ANY] = "*",
|
|
} &default = function(n: count): string { return fmt("query-%d", n); };
|
|
|
|
const code_types = {
|
|
[0] = "X0",
|
|
[1] = "Xfmt",
|
|
[2] = "Xsrv",
|
|
[3] = "Xnam",
|
|
[4] = "Ximp",
|
|
[5] = "X[",
|
|
} &default="?";
|
|
|
|
## Errors used for non-TSIG/EDNS types.
|
|
const base_errors = {
|
|
[0] = "NOERROR", ##< No Error
|
|
[1] = "FORMERR", ##< Format Error
|
|
[2] = "SERVFAIL", ##< Server Failure
|
|
[3] = "NXDOMAIN", ##< Non-Existent Domain
|
|
[4] = "NOTIMP", ##< Not Implemented
|
|
[5] = "REFUSED", ##< Query Refused
|
|
[6] = "YXDOMAIN", ##< Name Exists when it should not
|
|
[7] = "YXRRSET", ##< RR Set Exists when it should not
|
|
[8] = "NXRRSet", ##< RR Set that should exist does not
|
|
[9] = "NOTAUTH", ##< Server Not Authoritative for zone
|
|
[10] = "NOTZONE", ##< Name not contained in zone
|
|
[11] = "unassigned-11", ##< available for assignment
|
|
[12] = "unassigned-12", ##< available for assignment
|
|
[13] = "unassigned-13", ##< available for assignment
|
|
[14] = "unassigned-14", ##< available for assignment
|
|
[15] = "unassigned-15", ##< available for assignment
|
|
[16] = "BADVERS", ##< for EDNS, collision w/ TSIG
|
|
[17] = "BADKEY", ##< Key not recognized
|
|
[18] = "BADTIME", ##< Signature out of time window
|
|
[19] = "BADMODE", ##< Bad TKEY Mode
|
|
[20] = "BADNAME", ##< Duplicate key name
|
|
[21] = "BADALG", ##< Algorithm not supported
|
|
[22] = "BADTRUNC", ##< draft-ietf-dnsext-tsig-sha-05.txt
|
|
[3842] = "BADSIG", ##< 16 <= number collision with EDNS(16);
|
|
##< this is a translation from TSIG(16)
|
|
} &default = function(n: count): string { return fmt("rcode-%d", n); };
|
|
|
|
# This deciphers EDNS Z field values.
|
|
const edns_zfield = {
|
|
[0] = "NOVALUE", # regular entry
|
|
[32768] = "DNS_SEC_OK", # accepts DNS Sec RRs
|
|
} &default="?";
|
|
|
|
const classes = {
|
|
[1] = "C_INTERNET",
|
|
[2] = "C_CSNET",
|
|
[3] = "C_CHAOS",
|
|
[4] = "C_HESOD",
|
|
[254] = "C_NONE",
|
|
[255] = "C_ANY",
|
|
} &default = function(n: count): string { return fmt("qclass-%d", n); };
|
|
} |