mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
1172 lines
41 KiB
Rust
1172 lines
41 KiB
Rust
/* Copyright (C) 2017 Open Information Security Foundation
|
|
*
|
|
* You can copy, redistribute or modify this Program under the terms of
|
|
* the GNU General Public License version 2 as published by the Free
|
|
* Software Foundation.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* version 2 along with this program; if not, write to the Free Software
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
|
* 02110-1301, USA.
|
|
*/
|
|
|
|
//! Nom parsers for DNS.
|
|
|
|
use crate::dns::dns::*;
|
|
use crate::detect::EnumString;
|
|
use nom7::combinator::{complete, rest};
|
|
use nom7::error::ErrorKind;
|
|
use nom7::multi::{count, length_data, many_m_n};
|
|
use nom7::number::streaming::{be_u16, be_u32, be_u8};
|
|
use nom7::{error_position, Err, IResult};
|
|
|
|
// Set a maximum assembled hostname length of 1025, this value was
|
|
// chosen as its what DNSMasq uses, a popular DNS server, even if most
|
|
// tooling limits names to 256 chars without special options.
|
|
static MAX_NAME_LEN: usize = 1025;
|
|
|
|
/// Parse a DNS name.
|
|
///
|
|
/// Names are parsed with the following restrictions:
|
|
///
|
|
/// - Only 255 segments will be processed, if more the parser may
|
|
/// error out. This is also our safeguard against an infinite loop. If
|
|
/// a pointer had been followed a truncated name will be
|
|
/// returned. However if pointer has been processed we error out as we
|
|
/// don't know where the next data point starts without more
|
|
/// iterations.
|
|
///
|
|
/// - The maximum name parsed in representation format is MAX_NAME_LEN
|
|
/// characters. Once larger, the truncated name will be returned with
|
|
/// a flag specifying the name was truncated. Note that parsing
|
|
/// continues if no pointer has been used as we still need to find the
|
|
/// start of the next protocol unit.
|
|
///
|
|
/// As some error in parsing the name are recoverable, a DNSName
|
|
/// object is returned with flags signifying a recoverable
|
|
/// error. These errors include:
|
|
///
|
|
/// - infinite loop: as we know the end of the name in the input
|
|
/// stream, we can return what we've parsed with the remain data.
|
|
///
|
|
/// - maximum number of segments/labels parsed
|
|
///
|
|
/// - truncation of name when too long
|
|
///
|
|
/// Parameters:
|
|
/// start: the start of the name
|
|
/// message: the complete message that start is a part of with the DNS header
|
|
fn dns_parse_name<'b>(
|
|
start: &'b [u8], message: &'b [u8], parse_flags: &mut DNSNameFlags,
|
|
) -> IResult<&'b [u8], DNSName> {
|
|
let mut pos = start;
|
|
let mut pivot = start;
|
|
let mut name: Vec<u8> = Vec::with_capacity(32);
|
|
let mut count = 0;
|
|
let mut flags = DNSNameFlags::default();
|
|
|
|
loop {
|
|
if pos.is_empty() {
|
|
break;
|
|
}
|
|
|
|
let len = pos[0];
|
|
|
|
if len == 0x00 {
|
|
pos = &pos[1..];
|
|
break;
|
|
} else if len & 0b1100_0000 == 0 {
|
|
let (rem, label) = length_data(be_u8)(pos)?;
|
|
if !flags.contains(DNSNameFlags::TRUNCATED) {
|
|
if !name.is_empty() {
|
|
name.push(b'.');
|
|
}
|
|
name.extend(label);
|
|
}
|
|
pos = rem;
|
|
} else if len & 0b1100_0000 == 0b1100_0000 {
|
|
let (rem, leader) = be_u16(pos)?;
|
|
let offset = usize::from(leader) & 0x3fff;
|
|
if offset > message.len() {
|
|
return Err(Err::Error(error_position!(pos, ErrorKind::OctDigit)));
|
|
}
|
|
|
|
if &message[offset..] == pos {
|
|
// Self reference, immedate infinite loop.
|
|
flags.insert(DNSNameFlags::INFINITE_LOOP);
|
|
|
|
// If we have followed a pointer, we can just break as
|
|
// we've already found the end of the input. But if we
|
|
// have not followed a pointer yet return a parse
|
|
// error.
|
|
if pivot != start {
|
|
break;
|
|
}
|
|
return Err(Err::Error(error_position!(pos, ErrorKind::OctDigit)));
|
|
}
|
|
|
|
pos = &message[offset..];
|
|
if pivot == start {
|
|
pivot = rem;
|
|
}
|
|
} else {
|
|
return Err(Err::Error(error_position!(pos, ErrorKind::OctDigit)));
|
|
}
|
|
|
|
// Return error if we've looped a certain number of times.
|
|
count += 1;
|
|
|
|
if count > 255 {
|
|
flags.insert(DNSNameFlags::LABEL_LIMIT);
|
|
|
|
// Our segment limit has been reached, if we have hit a
|
|
// pointer we can just return the truncated name. If we
|
|
// have not hit a pointer, we need to bail with an error.
|
|
if pivot != start {
|
|
flags.insert(DNSNameFlags::TRUNCATED);
|
|
break;
|
|
}
|
|
return Err(Err::Error(error_position!(pos, ErrorKind::OctDigit)));
|
|
}
|
|
|
|
if name.len() > MAX_NAME_LEN {
|
|
name.truncate(MAX_NAME_LEN);
|
|
flags.insert(DNSNameFlags::TRUNCATED);
|
|
|
|
// If we have pivoted due to a pointer we know where the
|
|
// end of the data is, so we can break early. Otherwise
|
|
// we'll keep parsing in hopes to find the end of the name
|
|
// so parsing can continue.
|
|
if pivot != start {
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
|
|
parse_flags.insert(flags);
|
|
|
|
// If we followed a pointer we return the position after the first
|
|
// pointer followed. Is there a better way to see if these slices
|
|
// diverged from each other? A straight up comparison would
|
|
// actually check the contents.
|
|
if pivot != start {
|
|
Ok((pivot, DNSName { value: name, flags }))
|
|
} else {
|
|
Ok((pos, DNSName { value: name, flags }))
|
|
}
|
|
}
|
|
|
|
/// Parse answer entries.
|
|
///
|
|
/// In keeping with the C implementation, answer values that can
|
|
/// contain multiple answers get expanded into their own answer
|
|
/// records. An example of this is a TXT record with multiple strings
|
|
/// in it - each string will be expanded to its own answer record.
|
|
///
|
|
/// This function could be a made a whole lot simpler if we logged a
|
|
/// multi-string TXT entry as a single quote string, similar to the
|
|
/// output of dig. Something to consider for a future version.
|
|
fn dns_parse_answer<'a>(
|
|
slice: &'a [u8], message: &'a [u8], count: usize, flags: &mut DNSNameFlags,
|
|
) -> IResult<&'a [u8], Vec<DNSAnswerEntry>> {
|
|
let mut answers = Vec::new();
|
|
let mut input = slice;
|
|
|
|
struct Answer<'a> {
|
|
name: DNSName,
|
|
rrtype: u16,
|
|
rrclass: u16,
|
|
ttl: u32,
|
|
data: &'a [u8],
|
|
}
|
|
|
|
fn subparser<'a>(
|
|
i: &'a [u8], message: &'a [u8], flags: &mut DNSNameFlags,
|
|
) -> IResult<&'a [u8], Answer<'a>> {
|
|
let (i, name) = dns_parse_name(i, message, flags)?;
|
|
let (i, rrtype) = be_u16(i)?;
|
|
let (i, rrclass) = be_u16(i)?;
|
|
let (i, ttl) = be_u32(i)?;
|
|
let (i, data) = length_data(be_u16)(i)?;
|
|
let answer = Answer {
|
|
name,
|
|
rrtype,
|
|
rrclass,
|
|
ttl,
|
|
data,
|
|
};
|
|
Ok((i, answer))
|
|
}
|
|
|
|
for _ in 0..count {
|
|
match subparser(input, message, flags) {
|
|
Ok((rem, val)) => {
|
|
let n = if val.rrtype == DNSRecordType::TXT as u16 {
|
|
// For TXT records we need to run the parser
|
|
// multiple times. Set n high, to the maximum
|
|
// value based on a max txt side of 65535, but
|
|
// taking into considering that strings need
|
|
// to be quoted, so half that.
|
|
32767
|
|
} else {
|
|
// For all other types we only want to run the
|
|
// parser once, so set n to 1.
|
|
1
|
|
};
|
|
// edge case for additional section of type=OPT
|
|
// with empty data (data length = 0x0000)
|
|
if val.data.is_empty() && val.rrtype == DNSRecordType::OPT as u16 {
|
|
answers.push(DNSAnswerEntry {
|
|
name: val.name.clone(),
|
|
rrtype: val.rrtype,
|
|
rrclass: val.rrclass,
|
|
ttl: val.ttl,
|
|
data: DNSRData::OPT(Vec::new()),
|
|
});
|
|
input = rem;
|
|
continue;
|
|
}
|
|
let result: IResult<&'a [u8], Vec<DNSRData>> = many_m_n(
|
|
1,
|
|
n,
|
|
complete(|b| dns_parse_rdata(b, message, val.rrtype, flags)),
|
|
)(val.data);
|
|
match result {
|
|
Ok((_, rdatas)) => {
|
|
for rdata in rdatas {
|
|
answers.push(DNSAnswerEntry {
|
|
name: val.name.clone(),
|
|
rrtype: val.rrtype,
|
|
rrclass: val.rrclass,
|
|
ttl: val.ttl,
|
|
data: rdata,
|
|
});
|
|
}
|
|
}
|
|
Err(e) => {
|
|
return Err(e);
|
|
}
|
|
}
|
|
input = rem;
|
|
}
|
|
Err(e) => {
|
|
return Err(e);
|
|
}
|
|
}
|
|
}
|
|
|
|
return Ok((input, answers));
|
|
}
|
|
|
|
/// Parse a single DNS query.
|
|
///
|
|
/// Arguments are suitable for using with call!:
|
|
///
|
|
/// call!(complete_dns_message_buffer)
|
|
fn dns_parse_query<'a>(
|
|
input: &'a [u8], message: &'a [u8], flags: &mut DNSNameFlags,
|
|
) -> IResult<&'a [u8], DNSQueryEntry> {
|
|
let i = input;
|
|
let (i, name) = dns_parse_name(i, message, flags)?;
|
|
let (i, rrtype) = be_u16(i)?;
|
|
let (i, rrclass) = be_u16(i)?;
|
|
Ok((
|
|
i,
|
|
DNSQueryEntry {
|
|
name,
|
|
rrtype,
|
|
rrclass,
|
|
},
|
|
))
|
|
}
|
|
|
|
fn dns_parse_rdata_a(input: &[u8]) -> IResult<&[u8], DNSRData> {
|
|
rest(input).map(|(input, data)| (input, DNSRData::A(data.to_vec())))
|
|
}
|
|
|
|
fn dns_parse_rdata_aaaa(input: &[u8]) -> IResult<&[u8], DNSRData> {
|
|
rest(input).map(|(input, data)| (input, DNSRData::AAAA(data.to_vec())))
|
|
}
|
|
|
|
fn dns_parse_rdata_cname<'a>(
|
|
input: &'a [u8], message: &'a [u8], flags: &mut DNSNameFlags,
|
|
) -> IResult<&'a [u8], DNSRData> {
|
|
dns_parse_name(input, message, flags).map(|(input, name)| (input, DNSRData::CNAME(name)))
|
|
}
|
|
|
|
fn dns_parse_rdata_ns<'a>(
|
|
input: &'a [u8], message: &'a [u8], flags: &mut DNSNameFlags,
|
|
) -> IResult<&'a [u8], DNSRData> {
|
|
dns_parse_name(input, message, flags).map(|(input, name)| (input, DNSRData::NS(name)))
|
|
}
|
|
|
|
fn dns_parse_rdata_ptr<'a>(
|
|
input: &'a [u8], message: &'a [u8], flags: &mut DNSNameFlags,
|
|
) -> IResult<&'a [u8], DNSRData> {
|
|
dns_parse_name(input, message, flags).map(|(input, name)| (input, DNSRData::PTR(name)))
|
|
}
|
|
|
|
fn dns_parse_rdata_soa<'a>(
|
|
input: &'a [u8], message: &'a [u8], flags: &mut DNSNameFlags,
|
|
) -> IResult<&'a [u8], DNSRData> {
|
|
let i = input;
|
|
let (i, mname) = dns_parse_name(i, message, flags)?;
|
|
let (i, rname) = dns_parse_name(i, message, flags)?;
|
|
let (i, serial) = be_u32(i)?;
|
|
let (i, refresh) = be_u32(i)?;
|
|
let (i, retry) = be_u32(i)?;
|
|
let (i, expire) = be_u32(i)?;
|
|
let (i, minimum) = be_u32(i)?;
|
|
Ok((
|
|
i,
|
|
DNSRData::SOA(DNSRDataSOA {
|
|
mname,
|
|
rname,
|
|
serial,
|
|
refresh,
|
|
retry,
|
|
expire,
|
|
minimum,
|
|
}),
|
|
))
|
|
}
|
|
|
|
fn dns_parse_rdata_mx<'a>(
|
|
input: &'a [u8], message: &'a [u8], flags: &mut DNSNameFlags,
|
|
) -> IResult<&'a [u8], DNSRData> {
|
|
// For MX we skip over the preference field before
|
|
// parsing out the name.
|
|
let (i, _) = be_u16(input)?;
|
|
let (i, name) = dns_parse_name(i, message, flags)?;
|
|
Ok((i, DNSRData::MX(name)))
|
|
}
|
|
|
|
fn dns_parse_rdata_srv<'a>(
|
|
input: &'a [u8], message: &'a [u8], flags: &mut DNSNameFlags,
|
|
) -> IResult<&'a [u8], DNSRData> {
|
|
let i = input;
|
|
let (i, priority) = be_u16(i)?;
|
|
let (i, weight) = be_u16(i)?;
|
|
let (i, port) = be_u16(i)?;
|
|
let (i, target) = dns_parse_name(i, message, flags)?;
|
|
Ok((
|
|
i,
|
|
DNSRData::SRV(DNSRDataSRV {
|
|
priority,
|
|
weight,
|
|
port,
|
|
target,
|
|
}),
|
|
))
|
|
}
|
|
|
|
fn dns_parse_rdata_txt(input: &[u8]) -> IResult<&[u8], DNSRData> {
|
|
let (i, txt) = length_data(be_u8)(input)?;
|
|
Ok((i, DNSRData::TXT(txt.to_vec())))
|
|
}
|
|
|
|
fn dns_parse_rdata_null(input: &[u8]) -> IResult<&[u8], DNSRData> {
|
|
rest(input).map(|(input, data)| (input, DNSRData::NULL(data.to_vec())))
|
|
}
|
|
|
|
fn dns_parse_rdata_sshfp(input: &[u8]) -> IResult<&[u8], DNSRData> {
|
|
let i = input;
|
|
let (i, algo) = be_u8(i)?;
|
|
let (i, fp_type) = be_u8(i)?;
|
|
let fingerprint = i;
|
|
Ok((
|
|
&[],
|
|
DNSRData::SSHFP(DNSRDataSSHFP {
|
|
algo,
|
|
fp_type,
|
|
fingerprint: fingerprint.to_vec(),
|
|
}),
|
|
))
|
|
}
|
|
|
|
fn dns_parse_rdata_opt(input: &[u8]) -> IResult<&[u8], DNSRData> {
|
|
let mut dns_rdata_opt_vec = Vec::new();
|
|
let mut i = input;
|
|
|
|
while !i.is_empty() {
|
|
let (j, code) = be_u16(i)?;
|
|
let (j, data) = length_data(be_u16)(j)?;
|
|
i = j;
|
|
dns_rdata_opt_vec.push(DNSRDataOPT {
|
|
code,
|
|
data: data.to_vec(),
|
|
});
|
|
}
|
|
Ok((i, DNSRData::OPT(dns_rdata_opt_vec)))
|
|
}
|
|
|
|
fn dns_parse_rdata_unknown(input: &[u8]) -> IResult<&[u8], DNSRData> {
|
|
rest(input).map(|(input, data)| (input, DNSRData::Unknown(data.to_vec())))
|
|
}
|
|
|
|
fn dns_parse_rdata<'a>(
|
|
input: &'a [u8], message: &'a [u8], rrtype: u16, flags: &mut DNSNameFlags,
|
|
) -> IResult<&'a [u8], DNSRData> {
|
|
match DNSRecordType::from_u(rrtype) {
|
|
Some(DNSRecordType::A) => dns_parse_rdata_a(input),
|
|
Some(DNSRecordType::AAAA) => dns_parse_rdata_aaaa(input),
|
|
Some(DNSRecordType::CNAME) => dns_parse_rdata_cname(input, message, flags),
|
|
Some(DNSRecordType::PTR) => dns_parse_rdata_ptr(input, message, flags),
|
|
Some(DNSRecordType::SOA) => dns_parse_rdata_soa(input, message, flags),
|
|
Some(DNSRecordType::MX) => dns_parse_rdata_mx(input, message, flags),
|
|
Some(DNSRecordType::NS) => dns_parse_rdata_ns(input, message, flags),
|
|
Some(DNSRecordType::TXT) => dns_parse_rdata_txt(input),
|
|
Some(DNSRecordType::NULL) => dns_parse_rdata_null(input),
|
|
Some(DNSRecordType::SSHFP) => dns_parse_rdata_sshfp(input),
|
|
Some(DNSRecordType::SRV) => dns_parse_rdata_srv(input, message, flags),
|
|
Some(DNSRecordType::OPT) => dns_parse_rdata_opt(input),
|
|
_ => dns_parse_rdata_unknown(input),
|
|
}
|
|
}
|
|
|
|
// Parse a DNS header.
|
|
pub fn dns_parse_header(i: &[u8]) -> IResult<&[u8], DNSHeader> {
|
|
let (i, tx_id) = be_u16(i)?;
|
|
let (i, flags) = be_u16(i)?;
|
|
let (i, questions) = be_u16(i)?;
|
|
let (i, answer_rr) = be_u16(i)?;
|
|
let (i, authority_rr) = be_u16(i)?;
|
|
let (i, additional_rr) = be_u16(i)?;
|
|
Ok((
|
|
i,
|
|
DNSHeader {
|
|
tx_id,
|
|
flags,
|
|
questions,
|
|
answer_rr,
|
|
authority_rr,
|
|
additional_rr,
|
|
},
|
|
))
|
|
}
|
|
|
|
pub fn dns_parse_body<'a>(
|
|
i: &'a [u8], message: &'a [u8], header: DNSHeader,
|
|
) -> IResult<&'a [u8], (DNSMessage, DNSNameFlags)> {
|
|
let mut flags = DNSNameFlags::default();
|
|
let (i, queries) = count(
|
|
|b| dns_parse_query(b, message, &mut flags),
|
|
header.questions as usize,
|
|
)(i)?;
|
|
let (i, answers) = dns_parse_answer(i, message, header.answer_rr as usize, &mut flags)?;
|
|
|
|
let mut invalid_authorities = false;
|
|
let mut authorities = Vec::new();
|
|
let mut i_next = i;
|
|
let authorities_parsed = dns_parse_answer(i, message, header.authority_rr as usize, &mut flags);
|
|
if let Ok((i, authorities_ok)) = authorities_parsed {
|
|
authorities = authorities_ok;
|
|
i_next = i;
|
|
} else {
|
|
invalid_authorities = true;
|
|
}
|
|
|
|
let mut invalid_additionals = false;
|
|
let mut additionals = Vec::new();
|
|
if !invalid_authorities {
|
|
let additionals_parsed = dns_parse_answer(i_next, message, header.additional_rr as usize, &mut flags);
|
|
if let Ok((i, additionals_ok)) = additionals_parsed {
|
|
additionals = additionals_ok;
|
|
i_next = i;
|
|
} else {
|
|
invalid_additionals = true;
|
|
}
|
|
}
|
|
Ok((
|
|
i_next,
|
|
(
|
|
DNSMessage {
|
|
header,
|
|
queries,
|
|
answers,
|
|
authorities,
|
|
invalid_authorities,
|
|
additionals,
|
|
invalid_additionals,
|
|
},
|
|
flags,
|
|
),
|
|
))
|
|
}
|
|
|
|
#[cfg(test)]
|
|
mod tests {
|
|
|
|
use crate::dns::dns::{DNSAnswerEntry, DNSHeader};
|
|
use crate::dns::parser::*;
|
|
|
|
/// Parse a simple name with no pointers.
|
|
#[test]
|
|
fn test_dns_parse_name() {
|
|
let buf: &[u8] = &[
|
|
0x09, 0x63, /* .......c */
|
|
0x6c, 0x69, 0x65, 0x6e, 0x74, 0x2d, 0x63, 0x66, /* lient-cf */
|
|
0x07, 0x64, 0x72, 0x6f, 0x70, 0x62, 0x6f, 0x78, /* .dropbox */
|
|
0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x01, 0x00, /* .com.... */
|
|
];
|
|
let expected_remainder: &[u8] = &[0x00, 0x01, 0x00];
|
|
let mut flags = DNSNameFlags::default();
|
|
let (remainder, name) = dns_parse_name(buf, buf, &mut flags).unwrap();
|
|
assert_eq!("client-cf.dropbox.com".as_bytes(), &name.value[..]);
|
|
assert_eq!(remainder, expected_remainder);
|
|
}
|
|
|
|
/// Test parsing a name with pointers.
|
|
#[test]
|
|
fn test_dns_parse_name_with_pointer() {
|
|
let buf: &[u8] = &[
|
|
0xd8, 0xcb, 0x8a, 0xed, 0xa1, 0x46, 0x00, 0x15, /* 0 - .....F.. */
|
|
0x17, 0x0d, 0x06, 0xf7, 0x08, 0x00, 0x45, 0x00, /* 8 - ......E. */
|
|
0x00, 0x7b, 0x71, 0x6e, 0x00, 0x00, 0x39, 0x11, /* 16 - .{qn..9. */
|
|
0xf4, 0xd9, 0x08, 0x08, 0x08, 0x08, 0x0a, 0x10, /* 24 - ........ */
|
|
0x01, 0x0b, 0x00, 0x35, 0xe1, 0x8e, 0x00, 0x67, /* 32 - ...5...g */
|
|
0x60, 0x00, 0xef, 0x08, 0x81, 0x80, 0x00, 0x01, /* 40 - `....... */
|
|
0x00, 0x03, 0x00, 0x00, 0x00, 0x01, 0x03, 0x77, /* 48 - .......w */
|
|
0x77, 0x77, 0x0c, 0x73, 0x75, 0x72, 0x69, 0x63, /* 56 - ww.suric */
|
|
0x61, 0x74, 0x61, 0x2d, 0x69, 0x64, 0x73, 0x03, /* 64 - ata-ids. */
|
|
0x6f, 0x72, 0x67, 0x00, 0x00, 0x01, 0x00, 0x01, /* 72 - org..... */
|
|
0xc0, 0x0c, 0x00, 0x05, 0x00, 0x01, 0x00, 0x00, /* 80 - ........ */
|
|
0x0e, 0x0f, 0x00, 0x02, 0xc0, 0x10, 0xc0, 0x10, /* 88 - ........ */
|
|
0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x01, 0x2b, /* 96 - .......+ */
|
|
0x00, 0x04, 0xc0, 0x00, 0x4e, 0x19, 0xc0, 0x10, /* 104 - ....N... */
|
|
0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x01, 0x2b, /* 112 - .......+ */
|
|
0x00, 0x04, 0xc0, 0x00, 0x4e, 0x18, 0x00, 0x00, /* 120 - ....N... */
|
|
0x29, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 128 - )....... */
|
|
0x00, /* 136 - . */
|
|
];
|
|
|
|
// The DNS payload starts at offset 42.
|
|
let message = &buf[42..];
|
|
|
|
// The name at offset 54 is the complete name.
|
|
let start1 = &buf[54..];
|
|
let mut flags = DNSNameFlags::default();
|
|
let res1 = dns_parse_name(start1, message, &mut flags);
|
|
assert_eq!(
|
|
res1,
|
|
Ok((
|
|
&start1[22..],
|
|
DNSName {
|
|
value: "www.suricata-ids.org".as_bytes().to_vec(),
|
|
flags: DNSNameFlags::default(),
|
|
}
|
|
))
|
|
);
|
|
|
|
// The second name starts at offset 80, but is just a pointer
|
|
// to the first.
|
|
let start2 = &buf[80..];
|
|
let mut flags = DNSNameFlags::default();
|
|
let res2 = dns_parse_name(start2, message, &mut flags);
|
|
assert_eq!(
|
|
res2,
|
|
Ok((
|
|
&start2[2..],
|
|
DNSName {
|
|
value: "www.suricata-ids.org".as_bytes().to_vec(),
|
|
flags: DNSNameFlags::default()
|
|
}
|
|
))
|
|
);
|
|
|
|
// The third name starts at offset 94, but is a pointer to a
|
|
// portion of the first.
|
|
let start3 = &buf[94..];
|
|
let mut flags = DNSNameFlags::default();
|
|
let res3 = dns_parse_name(start3, message, &mut flags);
|
|
assert_eq!(
|
|
res3,
|
|
Ok((
|
|
&start3[2..],
|
|
DNSName {
|
|
value: "suricata-ids.org".as_bytes().to_vec(),
|
|
flags: DNSNameFlags::default()
|
|
}
|
|
))
|
|
);
|
|
|
|
// The fourth name starts at offset 110, but is a pointer to a
|
|
// portion of the first.
|
|
let start4 = &buf[110..];
|
|
let mut flags = DNSNameFlags::default();
|
|
let res4 = dns_parse_name(start4, message, &mut flags);
|
|
assert_eq!(
|
|
res4,
|
|
Ok((
|
|
&start4[2..],
|
|
DNSName {
|
|
value: "suricata-ids.org".as_bytes().to_vec(),
|
|
flags: DNSNameFlags::default()
|
|
}
|
|
))
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn test_dns_parse_name_double_pointer() {
|
|
let buf: &[u8] = &[
|
|
0xd8, 0xcb, 0x8a, 0xed, 0xa1, 0x46, 0x00, 0x15, /* 0: .....F.. */
|
|
0x17, 0x0d, 0x06, 0xf7, 0x08, 0x00, 0x45, 0x00, /* 8: ......E. */
|
|
0x00, 0x66, 0x5e, 0x20, 0x40, 0x00, 0x40, 0x11, /* 16: .f^ @.@. */
|
|
0xc6, 0x3b, 0x0a, 0x10, 0x01, 0x01, 0x0a, 0x10, /* 24: .;...... */
|
|
0x01, 0x0b, 0x00, 0x35, 0xc2, 0x21, 0x00, 0x52, /* 32: ...5.!.R */
|
|
0x35, 0xc5, 0x0d, 0x4f, 0x81, 0x80, 0x00, 0x01, /* 40: 5..O.... */
|
|
0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x05, 0x62, /* 48: .......b */
|
|
0x6c, 0x6f, 0x63, 0x6b, 0x07, 0x64, 0x72, 0x6f, /* 56: lock.dro */
|
|
0x70, 0x62, 0x6f, 0x78, 0x03, 0x63, 0x6f, 0x6d, /* 64: pbox.com */
|
|
0x00, 0x00, 0x01, 0x00, 0x01, 0xc0, 0x0c, 0x00, /* 72: ........ */
|
|
0x05, 0x00, 0x01, 0x00, 0x00, 0x00, 0x09, 0x00, /* 80: ........ */
|
|
0x0b, 0x05, 0x62, 0x6c, 0x6f, 0x63, 0x6b, 0x02, /* 88: ..block. */
|
|
0x67, 0x31, 0xc0, 0x12, 0xc0, 0x2f, 0x00, 0x01, /* 96: g1.../.. */
|
|
0x00, 0x01, 0x00, 0x00, 0x00, 0x08, 0x00, 0x04, /* 104: ........ */
|
|
0x2d, 0x3a, 0x46, 0x21, /* 112: -:F! */
|
|
];
|
|
|
|
// The start of the DNS message in the above packet.
|
|
let message: &[u8] = &buf[42..];
|
|
|
|
// The start of the name we want to parse, 0xc0 0x2f, a
|
|
// pointer to offset 47 in the message (or 89 in the full
|
|
// packet).
|
|
let start: &[u8] = &buf[100..];
|
|
|
|
let mut flags = DNSNameFlags::default();
|
|
let res = dns_parse_name(start, message, &mut flags);
|
|
assert_eq!(
|
|
res,
|
|
Ok((
|
|
&start[2..],
|
|
DNSName {
|
|
value: "block.g1.dropbox.com".as_bytes().to_vec(),
|
|
flags: DNSNameFlags::default()
|
|
}
|
|
))
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn test_dns_parse_request() {
|
|
// DNS request from dig-a-www.suricata-ids.org.pcap.
|
|
let pkt: &[u8] = &[
|
|
0x8d, 0x32, 0x01, 0x20, 0x00, 0x01, /* ...2. .. */
|
|
0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x03, 0x77, /* .......w */
|
|
0x77, 0x77, 0x0c, 0x73, 0x75, 0x72, 0x69, 0x63, /* ww.suric */
|
|
0x61, 0x74, 0x61, 0x2d, 0x69, 0x64, 0x73, 0x03, /* ata-ids. */
|
|
0x6f, 0x72, 0x67, 0x00, 0x00, 0x01, 0x00, 0x01, /* org..... */
|
|
0x00, 0x00, 0x29, 0x10, 0x00, 0x00, 0x00, 0x00, /* ..)..... */
|
|
0x00, 0x00, 0x00, /* ... */
|
|
];
|
|
|
|
let (body, header) = dns_parse_header(pkt).unwrap();
|
|
let res = dns_parse_body(body, pkt, header);
|
|
let (rem, (request, _flags)) = res.unwrap();
|
|
// The request should be fully parsed.
|
|
assert!(rem.is_empty());
|
|
|
|
assert_eq!(
|
|
request.header,
|
|
DNSHeader {
|
|
tx_id: 0x8d32,
|
|
flags: 0x0120,
|
|
questions: 1,
|
|
answer_rr: 0,
|
|
authority_rr: 0,
|
|
additional_rr: 1,
|
|
}
|
|
);
|
|
|
|
assert_eq!(request.queries.len(), 1);
|
|
|
|
let query = &request.queries[0];
|
|
assert_eq!(query.name.value, "www.suricata-ids.org".as_bytes().to_vec());
|
|
assert_eq!(query.rrtype, 1);
|
|
assert_eq!(query.rrclass, 1);
|
|
|
|
// verify additional section
|
|
assert_eq!(request.additionals.len(), 1);
|
|
|
|
let additional = &request.additionals[0];
|
|
assert_eq!(
|
|
additional,
|
|
&DNSAnswerEntry {
|
|
name: DNSName {
|
|
value: vec![],
|
|
flags: DNSNameFlags::default()
|
|
},
|
|
rrtype: DNSRecordType::OPT as u16,
|
|
rrclass: 0x1000, // for OPT this is UDP payload size
|
|
ttl: 0, // for OPT this is extended RCODE and flags
|
|
data: DNSRData::OPT(vec![]), // empty rdata
|
|
}
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn test_dns_parse_request_multi_opt() {
|
|
let pkt: &[u8] = &[
|
|
0x8d, 0x32, 0x01, 0x20, 0x00, 0x01, /* ...2. .. */
|
|
0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x03, 0x77, /* .......w */
|
|
0x77, 0x77, 0x0c, 0x73, 0x75, 0x72, 0x69, 0x63, /* ww.suric */
|
|
0x61, 0x74, 0x61, 0x2d, 0x69, 0x64, 0x73, 0x03, /* ata-ids. */
|
|
0x6f, 0x72, 0x67, 0x00, 0x00, 0x01, 0x00, 0x01, /* org..... */
|
|
0x00, 0x00, 0x29, 0x10, 0x00, 0x00, 0x00, 0x00, /* ..)..... */
|
|
0x00, 0x00, 0x10, /* total rdata len: 16 */
|
|
/* Option Cookie */
|
|
0x00, 0x0a, /* Code: 10 */
|
|
0x00, 0x08, /* Option len: 8 */
|
|
0x7f, 0x86, 0xcf, 0x8b, 0x81, 0xf6, 0xf9, 0x55, /* Option NSID */
|
|
0x00, 0x03, /* Code: 3 */
|
|
0x00, 0x00, /* option len: 0 */
|
|
];
|
|
|
|
let (body, header) = dns_parse_header(pkt).unwrap();
|
|
let res = dns_parse_body(body, pkt, header);
|
|
let (rem, (request, _flags)) = res.unwrap();
|
|
|
|
assert!(rem.is_empty());
|
|
assert_eq!(
|
|
request.header,
|
|
DNSHeader {
|
|
tx_id: 0x8d32,
|
|
flags: 0x0120,
|
|
questions: 1,
|
|
answer_rr: 0,
|
|
authority_rr: 0,
|
|
additional_rr: 1,
|
|
}
|
|
);
|
|
|
|
assert_eq!(request.queries.len(), 1);
|
|
|
|
let query = &request.queries[0];
|
|
assert_eq!(query.name.value, "www.suricata-ids.org".as_bytes().to_vec());
|
|
assert_eq!(query.rrtype, 1);
|
|
assert_eq!(query.rrclass, 1);
|
|
|
|
// verify additional section
|
|
assert_eq!(request.additionals.len(), 1);
|
|
|
|
let additional = &request.additionals[0];
|
|
assert_eq!(
|
|
additional,
|
|
&DNSAnswerEntry {
|
|
name: DNSName {
|
|
value: vec![],
|
|
flags: DNSNameFlags::default()
|
|
},
|
|
rrtype: DNSRecordType::OPT as u16,
|
|
rrclass: 0x1000, // for OPT this is requestor's UDP payload size
|
|
ttl: 0, // for OPT this is extended RCODE and flags
|
|
// verify two options
|
|
data: DNSRData::OPT(vec![
|
|
DNSRDataOPT {
|
|
code: 0x000a,
|
|
data: vec![0x7f, 0x86, 0xcf, 0x8b, 0x81, 0xf6, 0xf9, 0x55]
|
|
},
|
|
DNSRDataOPT {
|
|
code: 0x0003,
|
|
data: vec![]
|
|
},
|
|
])
|
|
}
|
|
);
|
|
}
|
|
|
|
/// Parse a DNS response.
|
|
fn dns_parse_response(message: &[u8]) -> IResult<&[u8], (DNSMessage, DNSNameFlags)> {
|
|
let i = message;
|
|
let (i, header) = dns_parse_header(i)?;
|
|
dns_parse_body(i, message, header)
|
|
}
|
|
|
|
#[test]
|
|
fn test_dns_parse_response() {
|
|
// DNS response from dig-a-www.suricata-ids.org.pcap.
|
|
let pkt: &[u8] = &[
|
|
0x8d, 0x32, 0x81, 0xa0, 0x00, 0x01, /* ...2.... */
|
|
0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x03, 0x77, /* .......w */
|
|
0x77, 0x77, 0x0c, 0x73, 0x75, 0x72, 0x69, 0x63, /* ww.suric */
|
|
0x61, 0x74, 0x61, 0x2d, 0x69, 0x64, 0x73, 0x03, /* ata-ids. */
|
|
0x6f, 0x72, 0x67, 0x00, 0x00, 0x01, 0x00, 0x01, /* org..... */
|
|
0xc0, 0x0c, 0x00, 0x05, 0x00, 0x01, 0x00, 0x00, /* ........ */
|
|
0x0d, 0xd8, 0x00, 0x12, 0x0c, 0x73, 0x75, 0x72, /* .....sur */
|
|
0x69, 0x63, 0x61, 0x74, 0x61, 0x2d, 0x69, 0x64, /* icata-id */
|
|
0x73, 0x03, 0x6f, 0x72, 0x67, 0x00, 0xc0, 0x32, /* s.org..2 */
|
|
0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0xf4, /* ........ */
|
|
0x00, 0x04, 0xc0, 0x00, 0x4e, 0x18, 0xc0, 0x32, /* ....N..2 */
|
|
0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0xf4, /* ........ */
|
|
0x00, 0x04, 0xc0, 0x00, 0x4e, 0x19, /* ....N. */
|
|
];
|
|
|
|
let (rem, (response, _flags)) = dns_parse_response(pkt).unwrap();
|
|
// The response should be full parsed.
|
|
assert_eq!(rem.len(), 0);
|
|
|
|
assert_eq!(
|
|
response.header,
|
|
DNSHeader {
|
|
tx_id: 0x8d32,
|
|
flags: 0x81a0,
|
|
questions: 1,
|
|
answer_rr: 3,
|
|
authority_rr: 0,
|
|
additional_rr: 0,
|
|
}
|
|
);
|
|
|
|
assert_eq!(response.answers.len(), 3);
|
|
|
|
let answer1 = &response.answers[0];
|
|
assert_eq!(
|
|
answer1.name.value,
|
|
"www.suricata-ids.org".as_bytes().to_vec()
|
|
);
|
|
assert_eq!(answer1.rrtype, 5);
|
|
assert_eq!(answer1.rrclass, 1);
|
|
assert_eq!(answer1.ttl, 3544);
|
|
assert_eq!(
|
|
answer1.data,
|
|
DNSRData::CNAME(DNSName {
|
|
value: "suricata-ids.org".as_bytes().to_vec(),
|
|
flags: DNSNameFlags::default()
|
|
})
|
|
);
|
|
|
|
let answer2 = &response.answers[1];
|
|
assert_eq!(
|
|
answer2,
|
|
&DNSAnswerEntry {
|
|
name: DNSName {
|
|
value: "suricata-ids.org".as_bytes().to_vec(),
|
|
flags: DNSNameFlags::default()
|
|
},
|
|
rrtype: 1,
|
|
rrclass: 1,
|
|
ttl: 244,
|
|
data: DNSRData::A([192, 0, 78, 24].to_vec()),
|
|
}
|
|
);
|
|
|
|
let answer3 = &response.answers[2];
|
|
assert_eq!(
|
|
answer3,
|
|
&DNSAnswerEntry {
|
|
name: DNSName {
|
|
value: "suricata-ids.org".as_bytes().to_vec(),
|
|
flags: DNSNameFlags::default()
|
|
},
|
|
rrtype: 1,
|
|
rrclass: 1,
|
|
ttl: 244,
|
|
data: DNSRData::A([192, 0, 78, 25].to_vec()),
|
|
}
|
|
)
|
|
}
|
|
|
|
#[test]
|
|
fn test_dns_parse_response_nxdomain_soa() {
|
|
// DNS response with an SOA authority record from
|
|
// dns-udp-nxdomain-soa.pcap.
|
|
let pkt: &[u8] = &[
|
|
0x82, 0x95, 0x81, 0x83, 0x00, 0x01, /* j....... */
|
|
0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x03, 0x64, /* .......d */
|
|
0x6e, 0x65, 0x04, 0x6f, 0x69, 0x73, 0x66, 0x03, /* ne.oisf. */
|
|
0x6e, 0x65, 0x74, 0x00, 0x00, 0x01, 0x00, 0x01, /* net..... */
|
|
0xc0, 0x10, 0x00, 0x06, 0x00, 0x01, 0x00, 0x00, /* ........ */
|
|
0x03, 0x83, 0x00, 0x45, 0x06, 0x6e, 0x73, 0x2d, /* ...E.ns- */
|
|
0x31, 0x31, 0x30, 0x09, 0x61, 0x77, 0x73, 0x64, /* 110.awsd */
|
|
0x6e, 0x73, 0x2d, 0x31, 0x33, 0x03, 0x63, 0x6f, /* ns-13.co */
|
|
0x6d, 0x00, 0x11, 0x61, 0x77, 0x73, 0x64, 0x6e, /* m..awsdn */
|
|
0x73, 0x2d, 0x68, 0x6f, 0x73, 0x74, 0x6d, 0x61, /* s-hostma */
|
|
0x73, 0x74, 0x65, 0x72, 0x06, 0x61, 0x6d, 0x61, /* ster.ama */
|
|
0x7a, 0x6f, 0x6e, 0xc0, 0x3b, 0x00, 0x00, 0x00, /* zon.;... */
|
|
0x01, 0x00, 0x00, 0x1c, 0x20, 0x00, 0x00, 0x03, /* .... ... */
|
|
0x84, 0x00, 0x12, 0x75, 0x00, 0x00, 0x01, 0x51, /* ...u...Q */
|
|
0x80, 0x00, 0x00, 0x29, 0x02, 0x00, 0x00, 0x00, /* ...).... */
|
|
0x00, 0x00, 0x00, 0x00, /* .... */
|
|
];
|
|
|
|
let (rem, (response, _flags)) = dns_parse_response(pkt).unwrap();
|
|
// The response should be fully parsed.
|
|
assert!(rem.is_empty());
|
|
|
|
assert_eq!(
|
|
response.header,
|
|
DNSHeader {
|
|
tx_id: 0x8295,
|
|
flags: 0x8183,
|
|
questions: 1,
|
|
answer_rr: 0,
|
|
authority_rr: 1,
|
|
additional_rr: 1,
|
|
}
|
|
);
|
|
|
|
assert_eq!(response.authorities.len(), 1);
|
|
|
|
let authority = &response.authorities[0];
|
|
assert_eq!(authority.name.value, "oisf.net".as_bytes().to_vec());
|
|
assert_eq!(authority.rrtype, 6);
|
|
assert_eq!(authority.rrclass, 1);
|
|
assert_eq!(authority.ttl, 899);
|
|
assert_eq!(
|
|
authority.data,
|
|
DNSRData::SOA(DNSRDataSOA {
|
|
mname: DNSName {
|
|
value: "ns-110.awsdns-13.com".as_bytes().to_vec(),
|
|
flags: DNSNameFlags::default()
|
|
},
|
|
rname: DNSName {
|
|
value: "awsdns-hostmaster.amazon.com".as_bytes().to_vec(),
|
|
flags: DNSNameFlags::default()
|
|
},
|
|
serial: 1,
|
|
refresh: 7200,
|
|
retry: 900,
|
|
expire: 1209600,
|
|
minimum: 86400,
|
|
})
|
|
);
|
|
|
|
// verify additional section
|
|
assert_eq!(response.additionals.len(), 1);
|
|
|
|
let additional = &response.additionals[0];
|
|
assert_eq!(
|
|
additional,
|
|
&DNSAnswerEntry {
|
|
name: DNSName {
|
|
value: vec![],
|
|
flags: DNSNameFlags::default()
|
|
},
|
|
rrtype: DNSRecordType::OPT as u16,
|
|
rrclass: 0x0200, // for OPT this is UDP payload size
|
|
ttl: 0, // for OPT this is extended RCODE and flags
|
|
data: DNSRData::OPT(vec![]), // no rdata
|
|
}
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn test_dns_parse_response_null() {
|
|
// DNS response with a NULL record from
|
|
// https://redmine.openinfosecfoundation.org/attachments/2062
|
|
|
|
let pkt: &[u8] = &[
|
|
0x12, 0xb0, 0x84, 0x00, 0x00, 0x01, 0x00, 0x01, /* ........ */
|
|
0x00, 0x00, 0x00, 0x00, 0x0b, 0x76, 0x61, 0x61, /* .....vaa */
|
|
0x61, 0x61, 0x6b, 0x61, 0x72, 0x64, 0x6c, 0x69, /* aakardli */
|
|
0x06, 0x70, 0x69, 0x72, 0x61, 0x74, 0x65, 0x03, /* .pirate. */
|
|
0x73, 0x65, 0x61, 0x00, 0x00, 0x0a, 0x00, 0x01, /* sea..... */
|
|
0xc0, 0x0c, 0x00, 0x0a, 0x00, 0x01, 0x00, 0x00, /* ........ */
|
|
0x00, 0x00, 0x00, 0x09, 0x56, 0x41, 0x43, 0x4b, /* ....VACK */
|
|
0x44, 0x03, 0xc5, 0xe9, 0x01, /* D.... */
|
|
];
|
|
|
|
let (rem, (response, _flags)) = dns_parse_response(pkt).unwrap();
|
|
// The response should be fully parsed.
|
|
assert_eq!(rem.len(), 0);
|
|
|
|
assert_eq!(
|
|
response.header,
|
|
DNSHeader {
|
|
tx_id: 0x12b0,
|
|
flags: 0x8400,
|
|
questions: 1,
|
|
answer_rr: 1,
|
|
authority_rr: 0,
|
|
additional_rr: 0,
|
|
}
|
|
);
|
|
|
|
assert_eq!(response.queries.len(), 1);
|
|
let query = &response.queries[0];
|
|
assert_eq!(
|
|
query.name.value,
|
|
"vaaaakardli.pirate.sea".as_bytes().to_vec()
|
|
);
|
|
assert_eq!(query.rrtype, DNSRecordType::NULL as u16);
|
|
assert_eq!(query.rrclass, 1);
|
|
|
|
assert_eq!(response.answers.len(), 1);
|
|
|
|
let answer = &response.answers[0];
|
|
assert_eq!(
|
|
answer.name.value,
|
|
"vaaaakardli.pirate.sea".as_bytes().to_vec()
|
|
);
|
|
assert_eq!(answer.rrtype, DNSRecordType::NULL as u16);
|
|
assert_eq!(answer.rrclass, 1);
|
|
assert_eq!(answer.ttl, 0);
|
|
assert_eq!(
|
|
answer.data,
|
|
DNSRData::NULL(vec![
|
|
0x56, 0x41, 0x43, 0x4b, /* VACK */
|
|
0x44, 0x03, 0xc5, 0xe9, 0x01, /* D.... */
|
|
])
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn test_dns_parse_rdata_sshfp() {
|
|
// Dummy data since we don't have a pcap sample.
|
|
let data: &[u8] = &[
|
|
// algo: DSS
|
|
0x02, // fp_type: SHA-1
|
|
0x01, // fingerprint: 123456789abcdef67890123456789abcdef67890
|
|
0x12, 0x34, 0x56, 0x78, 0x9a, 0xbc, 0xde, 0xf6, 0x78, 0x90, 0x12, 0x34, 0x56, 0x78,
|
|
0x9a, 0xbc, 0xde, 0xf6, 0x78, 0x90,
|
|
];
|
|
|
|
let (rem, rdata) = dns_parse_rdata_sshfp(data).unwrap();
|
|
// The data should be fully parsed.
|
|
assert_eq!(rem.len(), 0);
|
|
|
|
if let DNSRData::SSHFP(sshfp) = rdata {
|
|
assert_eq!(sshfp.algo, 2);
|
|
assert_eq!(sshfp.fp_type, 1);
|
|
assert_eq!(sshfp.fingerprint, &data[2..]);
|
|
} else {
|
|
panic!("Expected DNSRData::SSHFP");
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn test_dns_parse_rdata_srv() {
|
|
/* ; <<>> DiG 9.11.5-P4-5.1+deb10u2-Debian <<>> _sip._udp.sip.voice.google.com SRV
|
|
;; global options: +cmd
|
|
;; Got answer:
|
|
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1524
|
|
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 3
|
|
|
|
[...]
|
|
|
|
;; ANSWER SECTION:
|
|
_sip._udp.sip.voice.google.com. 300 IN SRV 10 1 5060 sip-anycast-1.voice.google.com.
|
|
_sip._udp.sip.voice.google.com. 300 IN SRV 20 1 5060 sip-anycast-2.voice.google.com.
|
|
|
|
[...]
|
|
|
|
;; Query time: 72 msec
|
|
;; MSG SIZE rcvd: 191 */
|
|
|
|
let pkt: &[u8] = &[
|
|
0xeb, 0x56, 0x81, 0x80, 0x00, 0x01, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5f,
|
|
0x73, 0x69, 0x70, 0x04, 0x5f, 0x75, 0x64, 0x70, 0x03, 0x73, 0x69, 0x70, 0x05, 0x76,
|
|
0x6f, 0x69, 0x63, 0x65, 0x06, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x03, 0x63, 0x6f,
|
|
0x6d, 0x00, 0x00, 0x21, 0x00, 0x01, 0xc0, 0x0c, 0x00, 0x21, 0x00, 0x01, 0x00, 0x00,
|
|
0x01, 0x13, 0x00, 0x26, 0x00, 0x14, 0x00, 0x01, 0x13, 0xc4, 0x0d, 0x73, 0x69, 0x70,
|
|
0x2d, 0x61, 0x6e, 0x79, 0x63, 0x61, 0x73, 0x74, 0x2d, 0x32, 0x05, 0x76, 0x6f, 0x69,
|
|
0x63, 0x65, 0x06, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x03, 0x63, 0x6f, 0x6d, 0x00,
|
|
0xc0, 0x0c, 0x00, 0x21, 0x00, 0x01, 0x00, 0x00, 0x01, 0x13, 0x00, 0x26, 0x00, 0x0a,
|
|
0x00, 0x01, 0x13, 0xc4, 0x0d, 0x73, 0x69, 0x70, 0x2d, 0x61, 0x6e, 0x79, 0x63, 0x61,
|
|
0x73, 0x74, 0x2d, 0x31, 0x05, 0x76, 0x6f, 0x69, 0x63, 0x65, 0x06, 0x67, 0x6f, 0x6f,
|
|
0x67, 0x6c, 0x65, 0x03, 0x63, 0x6f, 0x6d, 0x00,
|
|
];
|
|
|
|
let (rem, (response, _flags)) = dns_parse_response(pkt).unwrap();
|
|
// The data should be fully parsed.
|
|
assert_eq!(rem.len(), 0);
|
|
|
|
assert_eq!(response.answers.len(), 2);
|
|
|
|
let answer1 = &response.answers[0];
|
|
if let DNSRData::SRV(srv) = &answer1.data {
|
|
assert_eq!(srv.priority, 20);
|
|
assert_eq!(srv.weight, 1);
|
|
assert_eq!(srv.port, 5060);
|
|
assert_eq!(
|
|
srv.target.value,
|
|
"sip-anycast-2.voice.google.com".as_bytes().to_vec()
|
|
);
|
|
} else {
|
|
panic!("Expected DNSRData::SRV");
|
|
}
|
|
let answer2 = &response.answers[1];
|
|
if let DNSRData::SRV(srv) = &answer2.data {
|
|
assert_eq!(srv.priority, 10);
|
|
assert_eq!(srv.weight, 1);
|
|
assert_eq!(srv.port, 5060);
|
|
assert_eq!(
|
|
srv.target.value,
|
|
"sip-anycast-1.voice.google.com".as_bytes().to_vec()
|
|
);
|
|
} else {
|
|
panic!("Expected DNSRData::SRV");
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn test_dns_parse_name_truncated() {
|
|
// Generate a non-compressed hostname over our maximum of 1024.
|
|
let mut buf: Vec<u8> = vec![];
|
|
|
|
for i in 1..18 {
|
|
buf.push(0b0011_1111);
|
|
buf.resize(i * 64, b'a');
|
|
}
|
|
|
|
let mut flags = DNSNameFlags::default();
|
|
let (rem, name) = dns_parse_name(&buf, &buf, &mut flags).unwrap();
|
|
assert_eq!(name.value.len(), MAX_NAME_LEN);
|
|
assert!(name.flags.contains(DNSNameFlags::TRUNCATED));
|
|
assert!(rem.is_empty());
|
|
}
|
|
|
|
#[test]
|
|
fn test_dns_parse_name_truncated_max_segments_no_pointer() {
|
|
let mut buf: Vec<u8> = vec![];
|
|
for _ in 0..256 {
|
|
buf.push(0b0000_0001);
|
|
buf.push(b'a');
|
|
}
|
|
|
|
// This should fail as we've hit the segment limit without a
|
|
// pointer, we'd need to keep parsing more segments to figure
|
|
// out where the next data point lies.
|
|
let mut flags = DNSNameFlags::default();
|
|
assert!(dns_parse_name(&buf, &buf, &mut flags).is_err());
|
|
}
|
|
|
|
#[test]
|
|
fn test_dns_parse_name_truncated_max_segments_with_pointer() {
|
|
#[rustfmt::skip]
|
|
let buf: Vec<u8> = vec![
|
|
// "a" at the beginning of the buffer.
|
|
0b0000_0001,
|
|
b'a',
|
|
|
|
// Followed by a pointer back to the beginning.
|
|
0b1100_0000,
|
|
0b0000_0000,
|
|
|
|
// The start of the name, which is pointer to the beginning of
|
|
// the buffer.
|
|
0b1100_0000,
|
|
0b000_0000
|
|
];
|
|
|
|
let mut flags = DNSNameFlags::default();
|
|
let (_rem, name) = dns_parse_name(&buf[4..], &buf, &mut flags).unwrap();
|
|
assert_eq!(name.value.len(), 255);
|
|
assert!(name.flags.contains(DNSNameFlags::TRUNCATED));
|
|
}
|
|
|
|
#[test]
|
|
fn test_dns_parse_name_self_reference() {
|
|
let buf = vec![0b1100_0000, 0b0000_0000];
|
|
let mut flags = DNSNameFlags::default();
|
|
assert!(dns_parse_name(&buf, &buf, &mut flags).is_err());
|
|
}
|
|
}
|