mirror of
https://github.com/zeek/zeek.git
synced 2025-10-03 15:18:20 +00:00
383dce9343
The EDNS rcode was incorrectly calculated. The extended rcode is formed by taking the upper 8 bits of the extended rcode field, plus the lower 4 bits of the existing rcode. This also adds a new trace with an extended rcode, and a testcase parsing it. Reported by dwhitemv25. Fixes GH-4656
13 lines
428 B
Text
13 lines
428 B
Text
# @TEST-DOC: Tests that the correct extended rcode is returned for EDNS packets. Regression test for #4656.
|
|
# @TEST-EXEC: zeek -b -C -r $TRACES/dns/dns_extended_rcode.pcap %INPUT > output
|
|
# @TEST-EXEC: btest-diff output
|
|
|
|
@load base/protocols/dns
|
|
|
|
redef dns_skip_all_addl=F;
|
|
|
|
event dns_EDNS_addl(c: connection, msg: dns_msg, ans: dns_edns_additional)
|
|
{
|
|
if ( c$dns?$rcode && ans?$extended_rcode )
|
|
print ans$extended_rcode;
|
|
}
|