Skip to content

Commit 8086f61

Browse files
IvanNardiIvanNardi
committed
DNS: fix parsing of hostname for empty response messages
1 parent 7dc5890 commit 8086f61

File tree

3 files changed

+18
-13
lines changed

3 files changed

+18
-13
lines changed

‎src/lib/protocols/dns.c‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -706,13 +706,18 @@ static int search_dns_again(struct ndpi_detection_module_struct *ndpi_struct, st
706706

707707
static int process_hostname(struct ndpi_detection_module_struct *ndpi_struct,
708708
struct ndpi_flow_struct *flow,
709+
struct ndpi_dns_packet_header *dns_header,
709710
ndpi_master_app_protocol *proto) {
710711
struct ndpi_packet_struct *packet = &ndpi_struct->packet;
711712
char *dot;
712713
u_int len, is_mdns, off = sizeof(struct ndpi_dns_packet_header) + (packet->tcp ? 2 : 0);
713714
char _hostname[256];
714715
u_int8_t hostname_is_valid;
715716

717+
/* We try to get hostname only from "standard" query/answer */
718+
if(dns_header->num_queries == 0 && dns_header->num_answers == 0)
719+
return -1;
720+
716721
proto->master_protocol = checkDNSSubprotocol(ntohs(flow->c_port), ntohs(flow->s_port));
717722
proto->app_protocol = NDPI_PROTOCOL_UNKNOWN;
718723

@@ -803,7 +808,7 @@ static void search_dns(struct ndpi_detection_module_struct *ndpi_struct, struct
803808
return;
804809
}
805810

806-
process_hostname(ndpi_struct, flow, &proto);
811+
process_hostname(ndpi_struct, flow, &dns_header, &proto);
807812

808813
off = sizeof(struct ndpi_dns_packet_header) + payload_offset;
809814

‎tests/cfgs/default/result/dns_invert_query.pcapng.out‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,4 +24,4 @@ DNS 2 134 1
2424

2525
Acceptable 2 134 1
2626

27-
1 UDP 173.147.108.174:18427 <-> 244.187.95.1:53 [proto: 5/DNS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 5/DNS, Confidence: DPI][DPI packets: 2][cat: Network/14][1 pkts/78 bytes <-> 1 pkts/56 bytes][Goodput ratio: 46/21][0.00 sec][0.0.0.0][DNS Id: 0x77fc][Risk: ** Error Code **][Risk Score: 10][Risk Info: DNS Error Code NOTIMP][Plen Bins: 50,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
27+
1 UDP 173.147.108.174:18427 <-> 244.187.95.1:53 [proto: 5/DNS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 5/DNS, Confidence: DPI][DPI packets: 2][cat: Network/14][1 pkts/78 bytes <-> 1 pkts/56 bytes][Goodput ratio: 46/21][0.00 sec][Hostname/SNI: 216.58.202.4][0.0.0.0][DNS Id: 0x77fc][Risk: ** Error Code **][Risk Score: 10][Risk Info: DNS Error Code NOTIMP][Plen Bins: 50,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]

‎tests/cfgs/default/result/fuzz-2006-06-26-2594.pcap.out‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,23 @@
1-
Guessed flow protos: 33
1+
Guessed flow protos: 34
22

33
DPI Packets (TCP): 45 (2.14 pkts/flow)
44
DPI Packets (UDP): 356 (1.62 pkts/flow)
55
DPI Packets (other): 5 (1.00 pkts/flow)
66
Confidence Unknown : 33 (flows)
7-
Confidence Match by port : 33 (flows)
8-
Confidence DPI : 180 (flows)
9-
Num dissector calls: 8413 (34.20 diss/flow)
7+
Confidence Match by port : 34 (flows)
8+
Confidence DPI : 179 (flows)
9+
Num dissector calls: 8559 (34.79 diss/flow)
1010
LRU cache ookla: 0/0/0 (insert/search/found)
11-
LRU cache bittorrent: 0/198/0 (insert/search/found)
11+
LRU cache bittorrent: 0/201/0 (insert/search/found)
1212
LRU cache stun: 0/0/0 (insert/search/found)
1313
LRU cache tls_cert: 0/0/0 (insert/search/found)
14-
LRU cache mining: 0/66/0 (insert/search/found)
14+
LRU cache mining: 0/67/0 (insert/search/found)
1515
LRU cache msteams: 0/0/0 (insert/search/found)
16-
LRU cache fpc_dns: 0/66/0 (insert/search/found)
17-
Automa host: 238/0 (search/found)
18-
Automa domain: 231/0 (search/found)
16+
LRU cache fpc_dns: 0/67/0 (insert/search/found)
17+
Automa host: 237/0 (search/found)
18+
Automa domain: 230/0 (search/found)
1919
Automa tls cert: 0/0 (search/found)
20-
Automa risk mask: 125/0 (search/found)
20+
Automa risk mask: 124/0 (search/found)
2121
Automa common alpns: 0/0 (search/found)
2222
Patricia risk mask: 372/0 (search/found)
2323
Patricia risk mask IPv6: 0/0 (search/found)
@@ -211,7 +211,7 @@ Unrated 33 4066 33
211211
168 UDP 192.168.1.53:2791 -> 192.168.1.1:53 [proto: 5/DNS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 5/DNS, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/86 bytes -> 0 pkts/0 bytes][Goodput ratio: 51/0][< 1 sec][Hostname/SNI: _sip._udp.sip.cybercity.dk][0.0.0.0][DNS Id: 0x82eb][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (cybercity)][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
212212
169 UDP 192.168.1.110:2713 -> 192.168.1.1:53 [proto: 5/DNS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 5/DNS, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/86 bytes -> 0 pkts/0 bytes][Goodput ratio: 51/0][< 1 sec][0.0.0.0][DNS Id: 0x4cd2][Risk: ** Malformed Packet **** Unidirectional Traffic **][Risk Score: 20][Risk Info: No server to client traffic / Invalid DNS Query Lenght][PLAIN TEXT (cybercity)][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
213213
170 UDP 192.168.1.172:2766 -> 192.168.1.1:53 [proto: 5/DNS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 5/DNS, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/86 bytes -> 0 pkts/0 bytes][Goodput ratio: 51/0][< 1 sec][Hostname/SNI: _sip._udp.sip.cybercity.dk][0.0.0.0][DNS Id: 0x7bfd][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (cybercity)][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
214-
171 UDP 192.168.9.2:2774 -> 192.168.1.1:53 [proto: 5/DNS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 5/DNS, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/86 bytes -> 0 pkts/0 bytes][Goodput ratio: 51/0][< 1 sec][Hostname/SNI: _sip._udp.sip.cybercity.dk][0.0.0.0][DNS Id: 0xdae2][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (cybercity)][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
214+
171 UDP 192.168.9.2:2774 -> 192.168.1.1:53 [proto: 5/DNS][IP: 0/Unknown][ClearText][Confidence: Match by port][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 1][cat: Network/14][1 pkts/86 bytes -> 0 pkts/0 bytes][Goodput ratio: 51/0][< 1 sec][0.0.0.0][DNS Id: 0xdae2][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (cybercity)][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
215215
172 UDP 192.168.37.115:2758 -> 128.168.1.1:53 [proto: 5/DNS][IP: 0/Unknown][ClearText][Confidence: Match by port][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 1][cat: Network/14][1 pkts/86 bytes -> 0 pkts/0 bytes][Goodput ratio: 51/0][< 1 sec][0.0.0.0][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (cybercity)][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
216216
173 UDP 192.168.54.2:2829 -> 192.168.1.1:53 [proto: 5/DNS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 5/DNS, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/86 bytes -> 0 pkts/0 bytes][Goodput ratio: 51/0][< 1 sec][0.0.0.0][DNS Id: 0xd033][Risk: ** Malformed Packet **** Unidirectional Traffic **][Risk Score: 20][Risk Info: No server to client traffic / Invalid DNS Query Lenght][PLAIN TEXT (cibercity)][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
217217
174 UDP 192.168.79.2:2791 -> 192.168.1.1:53 [proto: 5/DNS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 5/DNS, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/86 bytes -> 0 pkts/0 bytes][Goodput ratio: 51/0][< 1 sec][Hostname/SNI: _sip._udp.sip.cybercity.dk][0.0.0.0][DNS Id: 0x82eb][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (cybercity)][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]

0 commit comments

Comments
 (0)