mirror of
https://github.com/zeek/zeek.git
synced 2025-10-04 07:38:19 +00:00
7e9d48f532
The broxygen-generated files now live in the git repo, have tests that check that they are up-to-date, and a script to re-generate them on-demand.
264 lines
7.6 KiB
ReStructuredText
264 lines
7.6 KiB
ReStructuredText
:tocdepth: 3
|
|
|
|
base/protocols/dns/consts.bro
|
|
=============================
|
|
.. bro:namespace:: DNS
|
|
|
|
Types, errors, and fields for analyzing DNS data. A helper file
|
|
for DNS analysis scripts.
|
|
|
|
:Namespace: DNS
|
|
|
|
Summary
|
|
~~~~~~~
|
|
Constants
|
|
#########
|
|
=============================================================================================================== ======================================================================
|
|
:bro:id:`DNS::ANY`: :bro:type:`count` A QTYPE value describing a request for all records.
|
|
:bro:id:`DNS::EDNS`: :bro:type:`count` An OPT RR TYPE value described by EDNS.
|
|
:bro:id:`DNS::PTR`: :bro:type:`count` RR TYPE value for a domain name pointer.
|
|
:bro:id:`DNS::algorithms`: :bro:type:`table` :bro:attr:`&default` = :bro:type:`function` :bro:attr:`&optional` Possible values of the algorithms used in DNSKEY, DS and RRSIG records
|
|
:bro:id:`DNS::base_errors`: :bro:type:`table` :bro:attr:`&default` = :bro:type:`function` :bro:attr:`&optional` Errors used for non-TSIG/EDNS types.
|
|
:bro:id:`DNS::classes`: :bro:type:`table` :bro:attr:`&default` = :bro:type:`function` :bro:attr:`&optional` Possible values of the CLASS field in resource records or QCLASS
|
|
field in query messages.
|
|
:bro:id:`DNS::digests`: :bro:type:`table` :bro:attr:`&default` = :bro:type:`function` :bro:attr:`&optional` Possible digest types used in DNSSEC.
|
|
:bro:id:`DNS::edns_zfield`: :bro:type:`table` :bro:attr:`&default` = ``"?"`` :bro:attr:`&optional` This deciphers EDNS Z field values.
|
|
:bro:id:`DNS::query_types`: :bro:type:`table` :bro:attr:`&default` = :bro:type:`function` :bro:attr:`&optional` Mapping of DNS query type codes to human readable string
|
|
representation.
|
|
=============================================================================================================== ======================================================================
|
|
|
|
|
|
Detailed Interface
|
|
~~~~~~~~~~~~~~~~~~
|
|
Constants
|
|
#########
|
|
.. bro:id:: DNS::ANY
|
|
|
|
:Type: :bro:type:`count`
|
|
:Default: ``255``
|
|
|
|
A QTYPE value describing a request for all records.
|
|
|
|
.. bro:id:: DNS::EDNS
|
|
|
|
:Type: :bro:type:`count`
|
|
:Default: ``41``
|
|
|
|
An OPT RR TYPE value described by EDNS.
|
|
|
|
.. bro:id:: DNS::PTR
|
|
|
|
:Type: :bro:type:`count`
|
|
:Default: ``12``
|
|
|
|
RR TYPE value for a domain name pointer.
|
|
|
|
.. bro:id:: DNS::algorithms
|
|
|
|
:Type: :bro:type:`table` [:bro:type:`count`] of :bro:type:`string`
|
|
:Attributes: :bro:attr:`&default` = :bro:type:`function` :bro:attr:`&optional`
|
|
:Default:
|
|
|
|
::
|
|
|
|
{
|
|
[2] = "Diffie_Hellman",
|
|
[6] = "DSA_NSEC3_SHA1",
|
|
[14] = "ECDSA_curveP384withSHA384",
|
|
[4] = "Elliptic_Curve",
|
|
[1] = "RSA_MD5",
|
|
[8] = "RSA_SHA256",
|
|
[7] = "RSA_SHA1_NSEC3_SHA1",
|
|
[15] = "Ed25519",
|
|
[252] = "Indirect",
|
|
[254] = "PrivateOID",
|
|
[255] = "reserved255",
|
|
[5] = "RSA_SHA1",
|
|
[10] = "RSA_SHA512",
|
|
[253] = "PrivateDNS",
|
|
[0] = "reserved0",
|
|
[3] = "DSA_SHA1",
|
|
[12] = "GOST_R_34_10_2001",
|
|
[13] = "ECDSA_curveP256withSHA256",
|
|
[16] = "Ed448"
|
|
}
|
|
|
|
Possible values of the algorithms used in DNSKEY, DS and RRSIG records
|
|
|
|
.. bro:id:: DNS::base_errors
|
|
|
|
:Type: :bro:type:`table` [:bro:type:`count`] of :bro:type:`string`
|
|
:Attributes: :bro:attr:`&default` = :bro:type:`function` :bro:attr:`&optional`
|
|
:Default:
|
|
|
|
::
|
|
|
|
{
|
|
[2] = "SERVFAIL",
|
|
[9] = "NOTAUTH",
|
|
[17] = "BADKEY",
|
|
[6] = "YXDOMAIN",
|
|
[11] = "unassigned-11",
|
|
[14] = "unassigned-14",
|
|
[4] = "NOTIMP",
|
|
[22] = "BADTRUNC",
|
|
[1] = "FORMERR",
|
|
[8] = "NXRRSet",
|
|
[3842] = "BADSIG",
|
|
[7] = "YXRRSET",
|
|
[15] = "unassigned-15",
|
|
[5] = "REFUSED",
|
|
[19] = "BADMODE",
|
|
[10] = "NOTZONE",
|
|
[0] = "NOERROR",
|
|
[3] = "NXDOMAIN",
|
|
[12] = "unassigned-12",
|
|
[13] = "unassigned-13",
|
|
[18] = "BADTIME",
|
|
[21] = "BADALG",
|
|
[16] = "BADVERS",
|
|
[20] = "BADNAME"
|
|
}
|
|
|
|
Errors used for non-TSIG/EDNS types.
|
|
|
|
.. bro:id:: DNS::classes
|
|
|
|
:Type: :bro:type:`table` [:bro:type:`count`] of :bro:type:`string`
|
|
:Attributes: :bro:attr:`&default` = :bro:type:`function` :bro:attr:`&optional`
|
|
:Default:
|
|
|
|
::
|
|
|
|
{
|
|
[2] = "C_CSNET",
|
|
[4] = "C_HESOD",
|
|
[1] = "C_INTERNET",
|
|
[254] = "C_NONE",
|
|
[255] = "C_ANY",
|
|
[3] = "C_CHAOS"
|
|
}
|
|
|
|
Possible values of the CLASS field in resource records or QCLASS
|
|
field in query messages.
|
|
|
|
.. bro:id:: DNS::digests
|
|
|
|
:Type: :bro:type:`table` [:bro:type:`count`] of :bro:type:`string`
|
|
:Attributes: :bro:attr:`&default` = :bro:type:`function` :bro:attr:`&optional`
|
|
:Default:
|
|
|
|
::
|
|
|
|
{
|
|
[2] = "SHA256",
|
|
[4] = "SHA384",
|
|
[1] = "SHA1",
|
|
[0] = "reserved0",
|
|
[3] = "GOST_R_34_11_94"
|
|
}
|
|
|
|
Possible digest types used in DNSSEC.
|
|
|
|
.. bro:id:: DNS::edns_zfield
|
|
|
|
:Type: :bro:type:`table` [:bro:type:`count`] of :bro:type:`string`
|
|
:Attributes: :bro:attr:`&default` = ``"?"`` :bro:attr:`&optional`
|
|
:Default:
|
|
|
|
::
|
|
|
|
{
|
|
[32768] = "DNS_SEC_OK",
|
|
[0] = "NOVALUE"
|
|
}
|
|
|
|
This deciphers EDNS Z field values.
|
|
|
|
.. bro:id:: DNS::query_types
|
|
|
|
:Type: :bro:type:`table` [:bro:type:`count`] of :bro:type:`string`
|
|
:Attributes: :bro:attr:`&default` = :bro:type:`function` :bro:attr:`&optional`
|
|
:Default:
|
|
|
|
::
|
|
|
|
{
|
|
[19] = "X25",
|
|
[10] = "NULL",
|
|
[3] = "MD",
|
|
[254] = "MAILA",
|
|
[43] = "DS",
|
|
[50] = "NSEC3",
|
|
[99] = "SPF",
|
|
[47] = "NSEC",
|
|
[251] = "IXFR",
|
|
[32768] = "TA",
|
|
[27] = "GPOS",
|
|
[6] = "SOA",
|
|
[20] = "ISDN",
|
|
[51] = "NSEC3PARAM",
|
|
[25] = "KEY",
|
|
[37] = "CERT",
|
|
[31] = "NIMLOC",
|
|
[28] = "AAAA",
|
|
[9] = "MR",
|
|
[32769] = "DLV",
|
|
[11] = "WKS",
|
|
[40] = "SINK",
|
|
[41] = "OPT",
|
|
[59] = "CDS",
|
|
[252] = "AXFR",
|
|
[46] = "RRSIG",
|
|
[5] = "CNAME",
|
|
[49] = "DHCID",
|
|
[103] = "UNSPEC",
|
|
[253] = "MAILB",
|
|
[45] = "IPSECKEY",
|
|
[8] = "MG",
|
|
[17] = "RP",
|
|
[48] = "DNSKEY",
|
|
[257] = "CAA",
|
|
[33] = "SRV",
|
|
[100] = "UINFO",
|
|
[24] = "SIG",
|
|
[23] = "NSAP-PTR",
|
|
[26] = "PX",
|
|
[101] = "UID",
|
|
[39] = "DNAME",
|
|
[16] = "TXT",
|
|
[34] = "ATMA",
|
|
[38] = "A6",
|
|
[18] = "AFSDB",
|
|
[35] = "NAPTR",
|
|
[42] = "APL",
|
|
[7] = "MB",
|
|
[15] = "MX",
|
|
[249] = "TKEY",
|
|
[36] = "KX",
|
|
[4] = "MF",
|
|
[44] = "SSHFP",
|
|
[52] = "TLSA",
|
|
[1] = "A",
|
|
[22] = "NSAP",
|
|
[250] = "TSIG",
|
|
[14] = "MINFO",
|
|
[102] = "GID",
|
|
[255] = "*",
|
|
[256] = "URI",
|
|
[21] = "RT",
|
|
[29] = "LOC",
|
|
[13] = "HINFO",
|
|
[30] = "EID",
|
|
[55] = "HIP",
|
|
[2] = "NS",
|
|
[32] = "NB",
|
|
[60] = "CDNSKEY",
|
|
[12] = "PTR",
|
|
[61] = "OPENPGPKEY"
|
|
}
|
|
|
|
Mapping of DNS query type codes to human readable string
|
|
representation.
|
|
|
|
|