forked from osmocom/wireshark
![Guy Harris](/assets/img/avatar_default.png)
Cast away some implicit 64-bit-to-32-bit conversion errors due to use of sizeof. Cast away some implicit 64-bit-to-32-bit conversion errors due to use of strtol() and strtoul(). Change some data types to avoid those implicit conversion warnings. When assigning a constant to a float, make sure the constant isn't a double, by appending "f" to the constant. Constify a bunch of variables, parameters, and return values to eliminate warnings due to strings being given const qualifiers. Cast away those warnings in some cases where an API we don't control forces us to do so. Enable a bunch of additional warnings by default. Note why at least some of the other warnings aren't enabled. randpkt.c and text2pcap.c are used to build programs, so they don't need to be in EXTRA_DIST. If the user specifies --enable-warnings-as-errors, add -Werror *even if the user specified --enable-extra-gcc-flags; assume they know what they're doing and are willing to have the compile fail due to the extra GCC warnings being treated as errors. svn path=/trunk/; revision=46748
4590 lines
150 KiB
C
4590 lines
150 KiB
C
/* packet-dns.c
|
|
* Routines for DNS packet disassembly
|
|
* Copyright 2004, Nicolas DICHTEL - 6WIND - <nicolas.dichtel@6wind.com>
|
|
*
|
|
* $Id$
|
|
*
|
|
* Wireshark - Network traffic analyzer
|
|
* By Gerald Combs <gerald@wireshark.org>
|
|
* Copyright 1998 Gerald Combs
|
|
*
|
|
* This program is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU General Public License
|
|
* as published by the Free Software Foundation; either version 2
|
|
* of the License, or (at your option) any later version.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this program; if not, write to the Free Software
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
|
|
*/
|
|
|
|
/*
|
|
* RFC 1034, RFC 1035
|
|
* RFC 2136 for dynamic DNS
|
|
* http://datatracker.ietf.org/doc/draft-cheshire-dnsext-multicastdns/
|
|
* for multicast DNS
|
|
* RFC 4795 for link-local multicast name resolution (LLMNR)
|
|
*/
|
|
|
|
#include "config.h"
|
|
|
|
#include <string.h>
|
|
#include <memory.h>
|
|
|
|
#include <glib.h>
|
|
#include <epan/packet.h>
|
|
#include <epan/conversation.h>
|
|
#include <epan/emem.h>
|
|
#include <epan/ipproto.h>
|
|
#include <epan/addr_resolv.h>
|
|
#include "packet-dns.h"
|
|
#include "packet-tcp.h"
|
|
#include <epan/prefs.h>
|
|
#include <epan/strutil.h>
|
|
#include <epan/expert.h>
|
|
#include <epan/afn.h>
|
|
|
|
static int proto_dns = -1;
|
|
static int hf_dns_length = -1;
|
|
static int hf_dns_flags = -1;
|
|
static int hf_dns_flags_response = -1;
|
|
static int hf_dns_flags_opcode = -1;
|
|
static int hf_dns_flags_authoritative = -1;
|
|
static int hf_dns_flags_conflict_query = -1;
|
|
static int hf_dns_flags_conflict_response = -1;
|
|
static int hf_dns_flags_truncated = -1;
|
|
static int hf_dns_flags_recdesired = -1;
|
|
static int hf_dns_flags_tentative = -1;
|
|
static int hf_dns_flags_recavail = -1;
|
|
static int hf_dns_flags_z = -1;
|
|
static int hf_dns_flags_authenticated = -1;
|
|
static int hf_dns_flags_ad = -1;
|
|
static int hf_dns_flags_checkdisable = -1;
|
|
static int hf_dns_flags_rcode = -1;
|
|
static int hf_dns_transaction_id = -1;
|
|
static int hf_dns_count_questions = -1;
|
|
static int hf_dns_count_zones = -1;
|
|
static int hf_dns_count_answers = -1;
|
|
static int hf_dns_count_prerequisites = -1;
|
|
static int hf_dns_count_updates = -1;
|
|
static int hf_dns_count_auth_rr = -1;
|
|
static int hf_dns_count_add_rr = -1;
|
|
static int hf_dns_qry_name = -1;
|
|
static int hf_dns_qry_type = -1;
|
|
static int hf_dns_qry_class = -1;
|
|
static int hf_dns_qry_class_mdns = -1;
|
|
static int hf_dns_qry_qu = -1;
|
|
static int hf_dns_srv_service = -1;
|
|
static int hf_dns_srv_proto = -1;
|
|
static int hf_dns_srv_name = -1;
|
|
static int hf_dns_srv_priority = -1;
|
|
static int hf_dns_srv_weight = -1;
|
|
static int hf_dns_srv_port = -1;
|
|
static int hf_dns_srv_target = -1;
|
|
static int hf_dns_rr_name = -1;
|
|
static int hf_dns_rr_type = -1;
|
|
static int hf_dns_rr_class = -1;
|
|
static int hf_dns_rr_class_mdns = -1;
|
|
static int hf_dns_rr_cache_flush = -1;
|
|
static int hf_dns_rr_ttl = -1;
|
|
static int hf_dns_rr_len = -1;
|
|
static int hf_dns_rr_addr = -1;
|
|
static int hf_dns_rr_primaryname = -1;
|
|
static int hf_dns_rr_udp_payload_size = -1;
|
|
static int hf_dns_soa_mname = -1;
|
|
static int hf_dns_soa_rname = -1;
|
|
static int hf_dns_soa_serial_number = -1;
|
|
static int hf_dns_soa_refresh_interval = -1;
|
|
static int hf_dns_soa_retry_interval = -1;
|
|
static int hf_dns_soa_expire_limit = -1;
|
|
static int hf_dns_soa_minimum_ttl = -1;
|
|
static int hf_dns_ptr_domain_name = -1;
|
|
static int hf_dns_wks_address = -1;
|
|
static int hf_dns_wks_protocol = -1;
|
|
static int hf_dns_wks_bits = -1;
|
|
static int hf_dns_hinfo_cpu_length = -1;
|
|
static int hf_dns_hinfo_cpu = -1;
|
|
static int hf_dns_hinfo_os_length = -1;
|
|
static int hf_dns_hinfo_os = -1;
|
|
static int hf_dns_mx_preference = -1;
|
|
static int hf_dns_mx_mail_exchange = -1;
|
|
static int hf_dns_txt_length = -1;
|
|
static int hf_dns_txt = -1;
|
|
static int hf_dns_spf_length = -1;
|
|
static int hf_dns_spf = -1;
|
|
static int hf_dns_rrsig_type_covered = -1;
|
|
static int hf_dns_rrsig_algorithm = -1;
|
|
static int hf_dns_rrsig_labels = -1;
|
|
static int hf_dns_rrsig_original_ttl = -1;
|
|
static int hf_dns_rrsig_signature_expiration = -1;
|
|
static int hf_dns_rrsig_signature_inception = -1;
|
|
static int hf_dns_rrsig_key_tag = -1;
|
|
static int hf_dns_rrsig_signers_name = -1;
|
|
static int hf_dns_rrsig_signature = -1;
|
|
static int hf_dns_dnskey_flags = -1;
|
|
static int hf_dns_dnskey_flags_zone_key = -1;
|
|
static int hf_dns_dnskey_flags_key_revoked = -1;
|
|
static int hf_dns_dnskey_flags_secure_entry_point = -1;
|
|
static int hf_dns_dnskey_flags_reserved = -1;
|
|
static int hf_dns_dnskey_protocol = -1;
|
|
static int hf_dns_dnskey_algorithm = -1;
|
|
static int hf_dns_dnskey_key_id = -1;
|
|
static int hf_dns_dnskey_public_key = -1;
|
|
static int hf_dns_t_key_flags = -1;
|
|
static int hf_dns_t_key_flags_authentication = -1;
|
|
static int hf_dns_t_key_flags_confidentiality = -1;
|
|
static int hf_dns_t_key_flags_key_required = -1;
|
|
static int hf_dns_t_key_flags_associated_user = -1;
|
|
static int hf_dns_t_key_flags_associated_named_entity = -1;
|
|
static int hf_dns_t_key_flags_ipsec = -1;
|
|
static int hf_dns_t_key_flags_mime = -1;
|
|
static int hf_dns_t_key_flags_signatory = -1;
|
|
static int hf_dns_rr_ns = -1;
|
|
static int hf_dns_rr_opt = -1;
|
|
static int hf_dns_rr_opt_code = -1;
|
|
static int hf_dns_rr_opt_len = -1;
|
|
static int hf_dns_rr_opt_data = -1;
|
|
static int hf_dns_rr_opt_client_family = -1;
|
|
static int hf_dns_rr_opt_client_netmask = -1;
|
|
static int hf_dns_rr_opt_client_scope = -1;
|
|
static int hf_dns_rr_opt_client_addr = -1;
|
|
static int hf_dns_rr_opt_client_addr4 = -1;
|
|
static int hf_dns_rr_opt_client_addr6 = -1;
|
|
static int hf_dns_nsec3_algo = -1;
|
|
static int hf_dns_nsec3_flags = -1;
|
|
static int hf_dns_nsec3_flag_optout = -1;
|
|
static int hf_dns_nsec3_iterations = -1;
|
|
static int hf_dns_nsec3_salt_length = -1;
|
|
static int hf_dns_nsec3_salt_value = -1;
|
|
static int hf_dns_nsec3_hash_length = -1;
|
|
static int hf_dns_nsec3_hash_value = -1;
|
|
static int hf_dns_tlsa_certificate_usage = -1;
|
|
static int hf_dns_tlsa_selector = -1;
|
|
static int hf_dns_tlsa_matching_type = -1;
|
|
static int hf_dns_tlsa_certificate_association_data = -1;
|
|
static int hf_dns_tsig_error = -1;
|
|
static int hf_dns_tsig_fudge = -1;
|
|
static int hf_dns_tsig_mac_size = -1;
|
|
static int hf_dns_tsig_mac = -1;
|
|
static int hf_dns_tsig_original_id = -1;
|
|
static int hf_dns_tsig_algorithm_name = -1;
|
|
static int hf_dns_tsig_other_len = -1;
|
|
static int hf_dns_tsig_other_data = -1;
|
|
static int hf_dns_response_in = -1;
|
|
static int hf_dns_response_to = -1;
|
|
static int hf_dns_time = -1;
|
|
static int hf_dns_sshfp_fingerprint = -1;
|
|
static int hf_dns_hip_hit = -1;
|
|
static int hf_dns_hip_pk = -1;
|
|
static int hf_dns_dhcid_rdata = -1;
|
|
static int hf_dns_apl_coded_prefix = -1;
|
|
static int hf_dns_apl_negation = -1;
|
|
static int hf_dns_apl_afdlength = -1;
|
|
static int hf_dns_nsap_rdata = -1;
|
|
|
|
static gint ett_dns = -1;
|
|
static gint ett_dns_qd = -1;
|
|
static gint ett_dns_rr = -1;
|
|
static gint ett_dns_qry = -1;
|
|
static gint ett_dns_ans = -1;
|
|
static gint ett_dns_flags = -1;
|
|
static gint ett_dns_opts = -1;
|
|
static gint ett_nsec3_flags = -1;
|
|
static gint ett_t_key_flags = -1;
|
|
static gint ett_t_key = -1;
|
|
static gint ett_dns_mac = -1;
|
|
|
|
static dissector_table_t dns_tsig_dissector_table=NULL;
|
|
|
|
/* Added to be able to configure DNS ports. */
|
|
static dissector_handle_t dns_tcp_handle;
|
|
static dissector_handle_t dns_udp_handle;
|
|
|
|
static range_t *global_dns_tcp_port_range;
|
|
static range_t *global_dns_udp_port_range;
|
|
|
|
/* desegmentation of DNS over TCP */
|
|
static gboolean dns_desegment = TRUE;
|
|
|
|
/* Dissector handle for GSSAPI */
|
|
static dissector_handle_t gssapi_handle;
|
|
static dissector_handle_t ntlmssp_handle;
|
|
|
|
/* Structure containing transaction specific information */
|
|
typedef struct _dns_transaction_t {
|
|
guint32 req_frame;
|
|
guint32 rep_frame;
|
|
nstime_t req_time;
|
|
} dns_transaction_t;
|
|
|
|
/* Structure containing conversation specific information */
|
|
typedef struct _dns_conv_info_t {
|
|
emem_tree_t *pdus;
|
|
} dns_conv_info_t;
|
|
|
|
/* DNS structs and definitions */
|
|
|
|
/* Ports used for DNS. */
|
|
#define DEFAULT_DNS_PORT_RANGE "53"
|
|
#define SCTP_PORT_DNS 53
|
|
#define UDP_PORT_MDNS 5353
|
|
#define TCP_PORT_MDNS 5353
|
|
#define UDP_PORT_LLMNR 5355
|
|
#if 0
|
|
/* PPID used for DNS/SCTP (will be changed when IANA assigned) */
|
|
#define DNS_PAYLOAD_PROTOCOL_ID 1000
|
|
#endif
|
|
|
|
/* Offsets of fields in the DNS header. */
|
|
#define DNS_ID 0
|
|
#define DNS_FLAGS 2
|
|
#define DNS_QUEST 4
|
|
#define DNS_ANS 6
|
|
#define DNS_AUTH 8
|
|
#define DNS_ADD 10
|
|
|
|
/* Length of DNS header. */
|
|
#define DNS_HDRLEN 12
|
|
|
|
/* type values */
|
|
#define T_A 1 /* host address */
|
|
#define T_NS 2 /* authoritative name server */
|
|
#define T_MD 3 /* mail destination (obsolete) */
|
|
#define T_MF 4 /* mail forwarder (obsolete) */
|
|
#define T_CNAME 5 /* canonical name */
|
|
#define T_SOA 6 /* start of authority zone */
|
|
#define T_MB 7 /* mailbox domain name (experimental) */
|
|
#define T_MG 8 /* mail group member (experimental) */
|
|
#define T_MR 9 /* mail rename domain name (experimental) */
|
|
#define T_NULL 10 /* null RR (experimental) */
|
|
#define T_WKS 11 /* well known service */
|
|
#define T_PTR 12 /* domain name pointer */
|
|
#define T_HINFO 13 /* host information */
|
|
#define T_MINFO 14 /* mailbox or mail list information */
|
|
#define T_MX 15 /* mail routing information */
|
|
#define T_TXT 16 /* text strings */
|
|
#define T_RP 17 /* responsible person (RFC 1183) */
|
|
#define T_AFSDB 18 /* AFS data base location (RFC 1183) */
|
|
#define T_X25 19 /* X.25 address (RFC 1183) */
|
|
#define T_ISDN 20 /* ISDN address (RFC 1183) */
|
|
#define T_RT 21 /* route-through (RFC 1183) */
|
|
#define T_NSAP 22 /* OSI NSAP (RFC 1706) */
|
|
#define T_NSAP_PTR 23 /* PTR equivalent for OSI NSAP (RFC 1348 - obsolete) */
|
|
#define T_SIG 24 /* digital signature (RFC 2535) */
|
|
#define T_KEY 25 /* public key (RFC 2535) */
|
|
#define T_PX 26 /* pointer to X.400/RFC822 mapping info (RFC 1664) */
|
|
#define T_GPOS 27 /* geographical position (RFC 1712) */
|
|
#define T_AAAA 28 /* IPv6 address (RFC 1886) */
|
|
#define T_LOC 29 /* geographical location (RFC 1876) */
|
|
#define T_NXT 30 /* "next" name (RFC 2535) */
|
|
#define T_EID 31 /* Endpoint Identifier */
|
|
#define T_NIMLOC 32 /* Nimrod Locator */
|
|
#define T_SRV 33 /* service location (RFC 2052) */
|
|
#define T_ATMA 34 /* ATM Address */
|
|
#define T_NAPTR 35 /* naming authority pointer (RFC 3403) */
|
|
#define T_KX 36 /* Key Exchange (RFC 2230) */
|
|
#define T_CERT 37 /* Certificate (RFC 4398) */
|
|
#define T_A6 38 /* IPv6 address with indirection (RFC 2874 - obsolete) */
|
|
#define T_DNAME 39 /* Non-terminal DNS name redirection (RFC 2672) */
|
|
#define T_SINK 40 /* SINK */
|
|
#define T_OPT 41 /* OPT pseudo-RR (RFC 2671) */
|
|
#define T_APL 42 /* Lists of Address Prefixes (APL RR) (RFC 3123) */
|
|
#define T_DS 43 /* Delegation Signature(RFC 3658) */
|
|
#define T_SSHFP 44 /* Using DNS to Securely Publish SSH Key Fingerprints (RFC 4255) */
|
|
#define T_IPSECKEY 45 /* RFC 4025 */
|
|
#define T_RRSIG 46 /* RFC 4034 */
|
|
#define T_NSEC 47 /* RFC 4034 */
|
|
#define T_DNSKEY 48 /* RFC 4034 */
|
|
#define T_DHCID 49 /* DHCID RR (RFC 4701) */
|
|
#define T_NSEC3 50 /* Next secure hash (RFC 5155) */
|
|
#define T_NSEC3PARAM 51 /* NSEC3 parameters (RFC 5155) */
|
|
#define T_TLSA 52 /* TLSA (RFC 6698) */
|
|
#define T_HIP 55 /* Host Identity Protocol (HIP) RR (RFC 5205) */
|
|
#define T_NINFO 56 /* NINFO */
|
|
#define T_RKEY 57 /* RKEY */
|
|
#define T_TALINK 58 /* Trust Anchor LINK */
|
|
#define T_CDS 59 /* Child DS */
|
|
#define T_SPF 99 /* SPF RR (RFC 4408) section 3 */
|
|
#define T_TKEY 249 /* Transaction Key (RFC 2930) */
|
|
#define T_TSIG 250 /* Transaction Signature (RFC 2845) */
|
|
#define T_IXFR 251 /* incremental transfer (RFC 1995) */
|
|
#define T_AXFR 252 /* transfer of an entire zone (RFC 5936) */
|
|
#define T_MAILB 253 /* mailbox-related RRs (MB, MG or MR) (RFC 1035) */
|
|
#define T_MAILA 254 /* mail agent RRs (OBSOLETE - see MX) (RFC 1035) */
|
|
#define T_ANY 255 /* A request for all records (RFC 1035) */
|
|
#define T_DLV 32769 /* DNSSEC Lookaside Validation (DLV) DNS Resource Record (RFC 4431) */
|
|
#define T_WINS 65281 /* Microsoft's WINS RR */
|
|
#define T_WINS_R 65282 /* Microsoft's WINS-R RR */
|
|
|
|
/* Class values */
|
|
#define C_IN 1 /* the Internet */
|
|
#define C_CS 2 /* CSNET (obsolete) */
|
|
#define C_CH 3 /* CHAOS */
|
|
#define C_HS 4 /* Hesiod */
|
|
#define C_NONE 254 /* none */
|
|
#define C_ANY 255 /* any */
|
|
|
|
#define C_QU (1<<15) /* High bit is set in queries for unicast queries */
|
|
#define C_FLUSH (1<<15) /* High bit is set for MDNS cache flush */
|
|
|
|
/* Bit fields in the flags */
|
|
#define F_RESPONSE (1<<15) /* packet is response */
|
|
#define F_OPCODE (0xF<<11) /* query opcode */
|
|
#define OPCODE_SHIFT 11
|
|
#define F_AUTHORITATIVE (1<<10) /* response is authoritative */
|
|
#define F_CONFLICT (1<<10) /* conflict detected */
|
|
#define F_TRUNCATED (1<<9) /* response is truncated */
|
|
#define F_RECDESIRED (1<<8) /* recursion desired */
|
|
#define F_TENTATIVE (1<<8) /* response is tentative */
|
|
#define F_RECAVAIL (1<<7) /* recursion available */
|
|
#define F_Z (1<<6) /* Z */
|
|
#define F_AUTHENTIC (1<<5) /* authentic data (RFC2535) */
|
|
#define F_CHECKDISABLE (1<<4) /* checking disabled (RFC2535) */
|
|
#define F_RCODE (0xF<<0) /* reply code */
|
|
|
|
/* Optcode values for EDNS0 options (RFC 2671) */
|
|
#define O_LLQ 1 /* Long-lived query (on-hold, draft-sekar-dns-llq) */
|
|
#define O_UL 2 /* Update lease (on-hold, draft-sekar-dns-ul) */
|
|
#define O_NSID 3 /* Name Server Identifier (RFC 5001) */
|
|
#define O_OWNER 4 /* Owner, reserved (draft-cheshire-edns0-owner-option) */
|
|
#define O_CLIENT_SUBNET 0x50fa /* Client subnet (placeholder value, draft-vandergaast-edns-client-subnet) */
|
|
|
|
static const true_false_string tfs_flags_response = {
|
|
"Message is a response",
|
|
"Message is a query"
|
|
};
|
|
|
|
static const true_false_string tfs_flags_authoritative = {
|
|
"Server is an authority for domain",
|
|
"Server is not an authority for domain"
|
|
};
|
|
|
|
static const true_false_string tfs_flags_conflict_query = {
|
|
"The sender received multiple responses",
|
|
"None"
|
|
};
|
|
|
|
static const true_false_string tfs_flags_conflict_response = {
|
|
"The name is not considered unique",
|
|
"The name is considered unique"
|
|
};
|
|
|
|
static const true_false_string tfs_flags_truncated = {
|
|
"Message is truncated",
|
|
"Message is not truncated"
|
|
};
|
|
|
|
static const true_false_string tfs_flags_recdesired = {
|
|
"Do query recursively",
|
|
"Don't do query recursively"
|
|
};
|
|
|
|
static const true_false_string tfs_flags_tentative = {
|
|
"Tentative",
|
|
"Not tentative"
|
|
};
|
|
|
|
static const true_false_string tfs_flags_recavail = {
|
|
"Server can do recursive queries",
|
|
"Server can't do recursive queries"
|
|
};
|
|
|
|
static const true_false_string tfs_flags_z = {
|
|
"reserved - incorrect!",
|
|
"reserved (0)"
|
|
};
|
|
|
|
static const true_false_string tfs_flags_authenticated = {
|
|
"Answer/authority portion was authenticated by the server",
|
|
"Answer/authority portion was not authenticated by the server"
|
|
};
|
|
|
|
static const true_false_string tfs_flags_checkdisable = {
|
|
"Acceptable",
|
|
"Unacceptable"
|
|
};
|
|
|
|
/* Opcodes */
|
|
#define OPCODE_QUERY 0 /* standard query */
|
|
#define OPCODE_IQUERY 1 /* inverse query */
|
|
#define OPCODE_STATUS 2 /* server status request */
|
|
#define OPCODE_NOTIFY 4 /* zone change notification */
|
|
#define OPCODE_UPDATE 5 /* dynamic update */
|
|
|
|
static const value_string opcode_vals[] = {
|
|
{ OPCODE_QUERY, "Standard query" },
|
|
{ OPCODE_IQUERY, "Inverse query" },
|
|
{ OPCODE_STATUS, "Server status request" },
|
|
{ OPCODE_NOTIFY, "Zone change notification" },
|
|
{ OPCODE_UPDATE, "Dynamic update" },
|
|
{ 0, NULL } };
|
|
|
|
/* Reply codes */
|
|
#define RCODE_NOERROR 0
|
|
#define RCODE_FORMERR 1
|
|
#define RCODE_SERVFAIL 2
|
|
#define RCODE_NXDOMAIN 3
|
|
#define RCODE_NOTIMPL 4
|
|
#define RCODE_REFUSED 5
|
|
#define RCODE_YXDOMAIN 6
|
|
#define RCODE_YXRRSET 7
|
|
#define RCODE_NXRRSET 8
|
|
#define RCODE_NOTAUTH 9
|
|
#define RCODE_NOTZONE 10
|
|
|
|
static const value_string rcode_vals[] = {
|
|
{ RCODE_NOERROR, "No error" },
|
|
{ RCODE_FORMERR, "Format error" },
|
|
{ RCODE_SERVFAIL, "Server failure" },
|
|
{ RCODE_NXDOMAIN, "No such name" },
|
|
{ RCODE_NOTIMPL, "Not implemented" },
|
|
{ RCODE_REFUSED, "Refused" },
|
|
{ RCODE_YXDOMAIN, "Name exists" },
|
|
{ RCODE_YXRRSET, "RRset exists" },
|
|
{ RCODE_NXRRSET, "RRset does not exist" },
|
|
{ RCODE_NOTAUTH, "Not authoritative" },
|
|
{ RCODE_NOTZONE, "Name out of zone" },
|
|
{ 0, NULL } };
|
|
|
|
#define NSEC3_HASH_RESERVED 0
|
|
#define NSEC3_HASH_SHA1 1
|
|
|
|
#define NSEC3_FLAG_OPTOUT 1
|
|
|
|
static const value_string hash_algorithms[] = {
|
|
{ NSEC3_HASH_RESERVED, "Reserved" },
|
|
{ NSEC3_HASH_SHA1, "SHA-1" },
|
|
{ 0, NULL } };
|
|
|
|
static const true_false_string tfs_flags_nsec3_optout = {
|
|
"Additional insecure delegations allowed",
|
|
"Additional insecure delegations forbidden"
|
|
};
|
|
static const true_false_string tfs_required_experimental = { "Experimental or optional", "Required" };
|
|
|
|
/* TSIG/TKEY extended errors */
|
|
#define TSIGERROR_BADSIG (16)
|
|
#define TSIGERROR_BADKEY (17)
|
|
#define TSIGERROR_BADTIME (18)
|
|
#define TSIGERROR_BADMODE (19)
|
|
#define TSIGERROR_BADNAME (20)
|
|
#define TSIGERROR_BADALG (21)
|
|
|
|
static const value_string tsigerror_vals[] = {
|
|
{ TSIGERROR_BADSIG, "Bad signature" },
|
|
{ TSIGERROR_BADKEY, "Bad key" },
|
|
{ TSIGERROR_BADTIME, "Bad time failure" },
|
|
{ TSIGERROR_BADMODE, "Bad mode such name" },
|
|
{ TSIGERROR_BADNAME, "Bad name implemented" },
|
|
{ TSIGERROR_BADALG, "Bad algorithm" },
|
|
{ 0, NULL } };
|
|
|
|
#define TKEYMODE_SERVERASSIGNED (1)
|
|
#define TKEYMODE_DIFFIEHELLMAN (2)
|
|
#define TKEYMODE_GSSAPI (3)
|
|
#define TKEYMODE_RESOLVERASSIGNED (4)
|
|
#define TKEYMODE_DELETE (5)
|
|
|
|
#define TDSDIGEST_RESERVED (0)
|
|
#define TDSDIGEST_SHA1 (1)
|
|
#define TDSDIGEST_SHA256 (2)
|
|
#define TDSDIGEST_GOST (3)
|
|
#define TDSDIGEST_SHA384 (4)
|
|
/*
|
|
* SSHFP (RFC 4255) algorithm number and fingerprint types
|
|
*/
|
|
#define TSSHFP_ALGO_RESERVED (0)
|
|
#define TSSHFP_ALGO_RSA (1)
|
|
#define TSSHFP_ALGO_DSA (2)
|
|
#define TSSHFP_FTYPE_RESERVED (0)
|
|
#define TSSHFP_FTYPE_SHA1 (1)
|
|
|
|
/* HIP PK ALGO RFC 5205 */
|
|
#define THIP_ALGO_DSA (1)
|
|
#define THIP_ALGO_RSA (2)
|
|
#define THIP_ALGO_RESERVED (0)
|
|
|
|
/* RFC 3123 */
|
|
#define TAPL_ADDR_FAMILY_IPV4 (AFNUM_INET)
|
|
#define TAPL_ADDR_FAMILY_IPV6 (AFNUM_INET6)
|
|
#define DNS_APL_NEGATION (1<<7)
|
|
#define DNS_APL_AFDLENGTH (0x7F<<0)
|
|
|
|
static const true_false_string tfs_dns_apl_negation = {
|
|
"Yes (!)",
|
|
"No (0)"
|
|
};
|
|
|
|
static const value_string afamily_vals[] = {
|
|
{ AFNUM_INET, "IPv4" },
|
|
{ AFNUM_INET6, "IPv6" },
|
|
{ 0, NULL }
|
|
};
|
|
|
|
/* See RFC 1035 for all RR types for which no RFC is listed, except for
|
|
the ones with "???", and for the Microsoft WINS and WINS-R RRs, for
|
|
which one should look at
|
|
|
|
http://www.windows.com/windows2000/en/server/help/sag_DNS_imp_UsingWinsLookup.htm
|
|
|
|
and
|
|
|
|
http://www.microsoft.com/windows2000/library/resources/reskit/samplechapters/cncf/cncf_imp_wwaw.asp
|
|
|
|
which discuss them to some extent. */
|
|
/* http://www.iana.org/assignments/dns-parameters */
|
|
|
|
static const value_string dns_types[] = {
|
|
{ 0, "Unused" },
|
|
{ T_A, "A" },
|
|
{ T_NS, "NS" },
|
|
{ T_MD, "MD" },
|
|
{ T_MF, "MF" },
|
|
{ T_CNAME, "CNAME" },
|
|
{ T_SOA, "SOA" },
|
|
{ T_MB, "MB" },
|
|
{ T_MG, "MG" },
|
|
{ T_MR, "MR" },
|
|
{ T_NULL, "NULL" },
|
|
{ T_WKS, "WKS" },
|
|
{ T_PTR, "PTR" },
|
|
{ T_HINFO, "HINFO" },
|
|
{ T_MINFO, "MINFO" },
|
|
{ T_MX, "MX" },
|
|
{ T_TXT, "TXT" },
|
|
{ T_RP, "RP" }, /* RFC 1183 */
|
|
{ T_AFSDB, "AFSDB" }, /* RFC 1183 */
|
|
{ T_X25, "X25" }, /* RFC 1183 */
|
|
{ T_ISDN, "ISDN" }, /* RFC 1183 */
|
|
{ T_RT, "RT" }, /* RFC 1183 */
|
|
{ T_NSAP, "NSAP" }, /* RFC 1706 */
|
|
{ T_NSAP_PTR, "NSAP-PTR" }, /* RFC 1348 */
|
|
{ T_SIG, "SIG" }, /* RFC 2535 */
|
|
{ T_KEY, "KEY" }, /* RFC 2535 */
|
|
{ T_PX, "PX" }, /* RFC 1664 */
|
|
{ T_GPOS, "GPOS" }, /* RFC 1712 */
|
|
{ T_AAAA, "AAAA" }, /* RFC 1886 */
|
|
{ T_LOC, "LOC" }, /* RFC 1886 */
|
|
{ T_NXT, "NXT" }, /* RFC 1876 */
|
|
{ T_EID, "EID" },
|
|
{ T_NIMLOC, "NIMLOC" },
|
|
{ T_SRV, "SRV" }, /* RFC 2052 */
|
|
{ T_ATMA, "ATMA" },
|
|
{ T_NAPTR, "NAPTR" }, /* RFC 3403 */
|
|
{ T_KX, "KX" }, /* RFC 2230 */
|
|
{ T_CERT, "CERT" }, /* RFC 4398 */
|
|
{ T_A6, "A6" }, /* RFC 2874 */
|
|
{ T_DNAME, "DNAME" }, /* RFC 2672 */
|
|
{ T_SINK, "SINK" },
|
|
{ T_OPT, "OPT" }, /* RFC 2671 */
|
|
{ T_APL, "APL" }, /* RFC 3123 */
|
|
{ T_DS, "DS" }, /* RFC 3658 */
|
|
{ T_SSHFP, "SSHFP" }, /* RFC 4255 */
|
|
{ T_IPSECKEY, "IPSECKEY" }, /* RFC 4025 */
|
|
{ T_RRSIG, "RRSIG" }, /* RFC 4034 */
|
|
{ T_NSEC, "NSEC" }, /* RFC 4034 */
|
|
{ T_DNSKEY, "DNSKEY" }, /* RFC 4034 */
|
|
{ T_DHCID, "DHCID" }, /* RFC 4701 */
|
|
{ T_NSEC3, "NSEC3" }, /* RFC 5155 */
|
|
{ T_NSEC3PARAM, "NSEC3PARAM" }, /* RFC 5155 */
|
|
{ T_TLSA, "TLSA" },
|
|
{ T_HIP, "HIP" }, /* RFC 5205 */
|
|
{ T_RKEY, "RKEY" },
|
|
{ T_TALINK, "TALINK" },
|
|
{ T_CDS, "CDS" },
|
|
{ T_SPF, "SPF" }, /* RFC 4408 */
|
|
{ 100, "UINFO" }, /* IANA reserved */
|
|
{ 101, "UID" }, /* IANA reserved */
|
|
{ 102, "GID" }, /* IANA reserved */
|
|
{ 103, "UNSPEC" }, /* IANA reserved */
|
|
|
|
{ T_TKEY, "TKEY" },
|
|
{ T_TSIG, "TSIG" },
|
|
{ T_IXFR, "IXFR" },
|
|
{ T_AXFR, "AXFR" },
|
|
{ T_MAILA, "MAILB" },
|
|
{ T_MAILB, "MAILA" },
|
|
{ T_ANY, "ANY" },
|
|
|
|
{ T_DLV, "DLV" }, /* RFC 4431 */
|
|
|
|
{ T_WINS, "WINS" },
|
|
{ T_WINS_R, "WINS-R" },
|
|
|
|
{0, NULL}
|
|
};
|
|
|
|
static const char *
|
|
dns_type_name (guint type)
|
|
{
|
|
return val_to_str(type, dns_types, "Unknown (%u)");
|
|
}
|
|
|
|
static const char *
|
|
dns_type_description (guint type)
|
|
{
|
|
static const char *type_names[] = {
|
|
"unused",
|
|
"Host address",
|
|
"Authoritative name server",
|
|
"Mail destination",
|
|
"Mail forwarder",
|
|
"Canonical name for an alias",
|
|
"Start of zone of authority",
|
|
"Mailbox domain name",
|
|
"Mail group member",
|
|
"Mail rename domain name",
|
|
"Null resource record",
|
|
"Well-known service description",
|
|
"Domain name pointer",
|
|
"Host information",
|
|
"Mailbox or mail list information",
|
|
"Mail exchange",
|
|
"Text strings",
|
|
"Responsible person", /* RFC 1183 */
|
|
"AFS data base location", /* RFC 1183 */
|
|
"X.25 address", /* RFC 1183 */
|
|
"ISDN number", /* RFC 1183 */
|
|
"Route through", /* RFC 1183 */
|
|
"OSI NSAP", /* RFC 1706 */
|
|
"OSI NSAP name pointer", /* RFC 1348 */
|
|
"Signature", /* RFC 2535 */
|
|
"Public key", /* RFC 2535 */
|
|
"Pointer to X.400/RFC822 mapping info", /* RFC 1664 */
|
|
"Geographical position", /* RFC 1712 */
|
|
"IPv6 address", /* RFC 1886 */
|
|
"Location", /* RFC 1876 */
|
|
"Next", /* RFC 2535 */
|
|
"Endpoint identifier",
|
|
"Nimrod locator",
|
|
"Service location", /* RFC 2052 */
|
|
"ATM address",
|
|
"Naming authority pointer", /* RFC 2168 */
|
|
"Key Exchange", /* RFC 2230 */
|
|
"Certificate", /* RFC 4398 */
|
|
"IPv6 address with indirection", /* RFC 2874 */
|
|
"Non-terminal DNS name redirection", /* RFC 2672 */
|
|
"SINK",
|
|
"EDNS0 option", /* RFC 2671 */
|
|
"Lists of Address Prefixes", /* RFC 3123 */
|
|
"Delegation Signer", /* RFC 3658 */
|
|
"SSH public host key fingerprint", /* RFC 4255 */
|
|
"Key to use with IPSEC", /* draft-ietf-ipseckey-rr */
|
|
"RR signature", /* future RFC 2535bis */
|
|
"Next secured", /* future RFC 2535bis */
|
|
"DNS public key", /* future RFC 2535bis */
|
|
"DHCP Information", /* RFC 4701 */
|
|
"Next secured hash", /* RFC 5155 */
|
|
"NSEC3 parameters", /* RFC 5155 */
|
|
"TLSA", /* RFC 6698 */
|
|
NULL,
|
|
NULL,
|
|
"Host Identity Protocol", /* RFC 5205 */
|
|
"NINFO",
|
|
"RKEY",
|
|
"Trust Anchor LINK",
|
|
"Child DS"
|
|
};
|
|
const char *short_name;
|
|
const char *long_name;
|
|
|
|
short_name = dns_type_name(type);
|
|
if (short_name == NULL) {
|
|
return ep_strdup_printf("Unknown (%u)", type);
|
|
}
|
|
if (type < array_length(type_names)) {
|
|
long_name = type_names[type];
|
|
} else {
|
|
/* special cases */
|
|
switch (type) {
|
|
/* meta */
|
|
case T_TKEY:
|
|
long_name = "Transaction Key";
|
|
break;
|
|
case T_TSIG:
|
|
long_name = "Transaction Signature";
|
|
break;
|
|
|
|
/* queries */
|
|
case T_IXFR:
|
|
long_name = "Request for incremental zone transfer"; /* RFC 1995 */
|
|
break;
|
|
case T_AXFR:
|
|
long_name = "Request for full zone transfer";
|
|
break;
|
|
case T_MAILB:
|
|
long_name = "Request for mailbox-related records";
|
|
break;
|
|
case T_MAILA:
|
|
long_name = "Request for mail agent resource records";
|
|
break;
|
|
case T_ANY:
|
|
long_name = "Request for all records";
|
|
break;
|
|
default:
|
|
long_name = NULL;
|
|
break;
|
|
}
|
|
}
|
|
|
|
if (long_name != NULL) {
|
|
return ep_strdup_printf("%s (%s)", short_name, long_name);
|
|
} else {
|
|
return ep_strdup(short_name);
|
|
}
|
|
}
|
|
|
|
static const value_string edns0_opt_code_vals[] = {
|
|
{0, "Reserved"},
|
|
{O_LLQ, "LLQ - Long-lived query"},
|
|
{O_UL, "UL - Update lease"},
|
|
{O_NSID, "NSID - Name Server Identifier"},
|
|
{O_OWNER, "Owner (reserved)"},
|
|
{O_CLIENT_SUBNET, "Experimental - CSUBNET - Client subnet" },
|
|
{0, NULL}
|
|
};
|
|
/* DNS-Based Authentication of Named Entities (DANE) Parameters
|
|
http://www.iana.org/assignments/dane-parameters (last updated 2012-08-14)
|
|
*/
|
|
/* TLSA Certificate Usages */
|
|
#define TLSA_CU_CA 0
|
|
#define TLSA_CU_SC 1
|
|
#define TLSA_CU_TA 2
|
|
#define TLSA_CU_DI 3
|
|
|
|
static const value_string tlsa_certificate_usage_vals[] = {
|
|
{TLSA_CU_CA, "CA constraint"},
|
|
{TLSA_CU_SC, "Service certificate constraint"},
|
|
{TLSA_CU_TA, "Trust anchor assertion"},
|
|
{TLSA_CU_DI, "Domain-issued certificate"},
|
|
{0, NULL}
|
|
};
|
|
|
|
/* TLSA Selectors */
|
|
#define TLSA_S_FC 0
|
|
#define TLSA_S_SPKI 1
|
|
|
|
static const value_string tlsa_selector_vals[] = {
|
|
{TLSA_S_FC, "Full certificate"},
|
|
{TLSA_S_SPKI, "SubjectPublicKeyInfo"},
|
|
{0, NULL}
|
|
};
|
|
|
|
/* TLSA Matching Types */
|
|
#define TLSA_MT_NHU 0
|
|
#define TLSA_MT_S256 1
|
|
#define TLSA_MT_S512 2
|
|
|
|
static const value_string tlsa_matching_type_vals[] = {
|
|
{TLSA_MT_NHU, "No Hash Used"},
|
|
{TLSA_MT_S256, "SHA-256"},
|
|
{TLSA_MT_S512, "SHA-512"},
|
|
{0, NULL}
|
|
};
|
|
|
|
static const value_string dns_classes[] = {
|
|
{C_IN, "IN"},
|
|
{C_CS, "CS"},
|
|
{C_CH, "CH"},
|
|
{C_HS, "HS"},
|
|
{C_NONE, "NONE"},
|
|
{C_ANY, "ANY"},
|
|
{0,NULL}
|
|
};
|
|
|
|
const char *
|
|
dns_class_name(int dns_class)
|
|
{
|
|
return val_to_str(dns_class, dns_classes, "Unknown (%u)");
|
|
}
|
|
|
|
/* This function returns the number of bytes consumed and the expanded string
|
|
* in *name.
|
|
* The string is allocated with ep scope and does not need to be free()d.
|
|
* it will be automatically free()d when the packet has been dissected.
|
|
*/
|
|
int
|
|
expand_dns_name(tvbuff_t *tvb, int offset, int max_len, int dns_data_offset,
|
|
const guchar **name)
|
|
{
|
|
int start_offset = offset;
|
|
guchar *np;
|
|
int len = -1;
|
|
int chars_processed = 0;
|
|
int data_size = tvb_reported_length_remaining(tvb, dns_data_offset);
|
|
int component_len;
|
|
int indir_offset;
|
|
int maxname;
|
|
|
|
const int min_len = 1; /* Minimum length of encoded name (for root) */
|
|
/* If we're about to return a value (probably negative) which is less
|
|
* than the minimum length, we're looking at bad data and we're liable
|
|
* to put the dissector into a loop. Instead we throw an exception */
|
|
|
|
maxname=MAXDNAME;
|
|
np=ep_alloc(maxname);
|
|
*name=np;
|
|
|
|
maxname--; /* reserve space for the trailing '\0' */
|
|
for (;;) {
|
|
if (max_len && offset - start_offset > max_len - 1) {
|
|
break;
|
|
}
|
|
component_len = tvb_get_guint8(tvb, offset);
|
|
offset++;
|
|
if (component_len == 0) {
|
|
break;
|
|
}
|
|
chars_processed++;
|
|
switch (component_len & 0xc0) {
|
|
|
|
case 0x00:
|
|
/* Label */
|
|
if (np != *name) {
|
|
/* Not the first component - put in a '.'. */
|
|
if (maxname > 0) {
|
|
*np++ = '.';
|
|
maxname--;
|
|
}
|
|
}
|
|
while (component_len > 0) {
|
|
if (max_len && offset - start_offset > max_len - 1) {
|
|
THROW(ReportedBoundsError);
|
|
}
|
|
if (maxname > 0) {
|
|
*np++ = tvb_get_guint8(tvb, offset);
|
|
maxname--;
|
|
}
|
|
component_len--;
|
|
offset++;
|
|
chars_processed++;
|
|
}
|
|
break;
|
|
|
|
case 0x40:
|
|
/* Extended label (RFC 2673) */
|
|
switch (component_len & 0x3f) {
|
|
|
|
case 0x01:
|
|
/* Bitstring label */
|
|
{
|
|
int bit_count;
|
|
int label_len;
|
|
int print_len;
|
|
|
|
bit_count = tvb_get_guint8(tvb, offset);
|
|
offset++;
|
|
label_len = (bit_count - 1) / 8 + 1;
|
|
|
|
if (maxname > 0) {
|
|
print_len = g_snprintf(np, maxname + 1, "\\[x");
|
|
if (print_len != -1 && print_len <= maxname) {
|
|
/* Some versions of g_snprintf return -1 if they'd truncate
|
|
the output. Others return <buf_size> or greater. */
|
|
np += print_len;
|
|
maxname -= print_len;
|
|
} else {
|
|
/* Nothing printed, as there's no room.
|
|
Suppress all subsequent printing. */
|
|
maxname = 0;
|
|
}
|
|
}
|
|
while (label_len--) {
|
|
if (maxname > 0) {
|
|
print_len = g_snprintf(np, maxname + 1, "%02x",
|
|
tvb_get_guint8(tvb, offset));
|
|
if (print_len != -1 && print_len <= maxname) {
|
|
/* Some versions of g_snprintf return -1 if they'd truncate
|
|
the output. Others return <buf_size> or greater. */
|
|
np += print_len;
|
|
maxname -= print_len;
|
|
} else {
|
|
/* Nothing printed, as there's no room.
|
|
Suppress all subsequent printing. */
|
|
maxname = 0;
|
|
}
|
|
}
|
|
offset++;
|
|
}
|
|
if (maxname > 0) {
|
|
print_len = g_snprintf(np, maxname + 1, "/%d]", bit_count);
|
|
if (print_len != -1 && print_len <= maxname) {
|
|
/* Some versions of g_snprintf return -1 if they'd truncate
|
|
the output. Others return <buf_size> or greater. */
|
|
np += print_len;
|
|
maxname -= print_len;
|
|
} else {
|
|
/* Nothing printed, as there's no room.
|
|
Suppress all subsequent printing. */
|
|
maxname = 0;
|
|
}
|
|
}
|
|
}
|
|
break;
|
|
|
|
default:
|
|
*name="<Unknown extended label>";
|
|
/* Parsing will probably fail from here on, since the */
|
|
/* label length is unknown... */
|
|
len = offset - start_offset;
|
|
if (len < min_len) {
|
|
THROW(ReportedBoundsError);
|
|
}
|
|
return len;
|
|
}
|
|
break;
|
|
|
|
case 0x80:
|
|
THROW(ReportedBoundsError);
|
|
|
|
case 0xc0:
|
|
/* Pointer. */
|
|
indir_offset = dns_data_offset +
|
|
(((component_len & ~0xc0) << 8) | tvb_get_guint8(tvb, offset));
|
|
offset++;
|
|
chars_processed++;
|
|
|
|
/* If "len" is negative, we are still working on the original name,
|
|
not something pointed to by a pointer, and so we should set "len"
|
|
to the length of the original name. */
|
|
if (len < 0) {
|
|
len = offset - start_offset;
|
|
}
|
|
/* If we've looked at every character in the message, this pointer
|
|
will make us look at some character again, which means we're
|
|
looping. */
|
|
if (chars_processed >= data_size) {
|
|
*name="<Name contains a pointer that loops>";
|
|
if (len < min_len) {
|
|
THROW(ReportedBoundsError);
|
|
}
|
|
return len;
|
|
}
|
|
|
|
offset = indir_offset;
|
|
break; /* now continue processing from there */
|
|
}
|
|
}
|
|
|
|
*np = '\0';
|
|
/* If "len" is negative, we haven't seen a pointer, and thus haven't
|
|
set the length, so set it. */
|
|
if (len < 0) {
|
|
len = offset - start_offset;
|
|
}
|
|
if (len < min_len) {
|
|
THROW(ReportedBoundsError);
|
|
}
|
|
return len;
|
|
}
|
|
|
|
int
|
|
get_dns_name(tvbuff_t *tvb, int offset, int max_len, int dns_data_offset,
|
|
const guchar **name)
|
|
{
|
|
int len;
|
|
|
|
len = expand_dns_name(tvb, offset, max_len, dns_data_offset, name);
|
|
|
|
/* Zero-length name means "root server" */
|
|
if (**name == '\0') {
|
|
*name="<Root>";
|
|
}
|
|
|
|
return len;
|
|
}
|
|
|
|
static int
|
|
get_dns_name_type_class(tvbuff_t *tvb, int offset, int dns_data_offset,
|
|
const guchar **name_ret, int *name_len_ret, int *type_ret, int *class_ret)
|
|
{
|
|
int len;
|
|
int name_len;
|
|
int type;
|
|
int dns_class;
|
|
int start_offset = offset;
|
|
|
|
/* XXX Fix data length */
|
|
name_len = get_dns_name(tvb, offset, 0, dns_data_offset, name_ret);
|
|
offset += name_len;
|
|
|
|
type = tvb_get_ntohs(tvb, offset);
|
|
offset += 2;
|
|
|
|
dns_class = tvb_get_ntohs(tvb, offset);
|
|
offset += 2;
|
|
|
|
*type_ret = type;
|
|
*class_ret = dns_class;
|
|
*name_len_ret = name_len;
|
|
|
|
len = offset - start_offset;
|
|
return len;
|
|
}
|
|
|
|
static double
|
|
rfc1867_size(tvbuff_t *tvb, int offset)
|
|
{
|
|
guint8 val;
|
|
double size;
|
|
guint32 exponent;
|
|
|
|
val = tvb_get_guint8(tvb, offset);
|
|
size = (val & 0xF0) >> 4;
|
|
exponent = (val & 0x0F);
|
|
while (exponent != 0) {
|
|
size *= 10;
|
|
exponent--;
|
|
}
|
|
return size / 100; /* return size in meters, not cm */
|
|
}
|
|
|
|
static char *
|
|
rfc1867_angle(tvbuff_t *tvb, int offset, const char *nsew)
|
|
{
|
|
guint32 angle;
|
|
char direction;
|
|
guint32 degrees, minutes, secs, tsecs;
|
|
/* "%u deg %u min %u.%03u sec %c" */
|
|
static char buf[10+1+3+1 + 2+1+3+1 + 2+1+3+1+3+1 + 1 + 1];
|
|
|
|
angle = tvb_get_ntohl(tvb, offset);
|
|
|
|
if (angle < 0x80000000U) {
|
|
angle = 0x80000000U - angle;
|
|
direction = nsew[1];
|
|
} else {
|
|
angle = angle - 0x80000000U;
|
|
direction = nsew[0];
|
|
}
|
|
tsecs = angle % 1000;
|
|
angle = angle / 1000;
|
|
secs = angle % 60;
|
|
angle = angle / 60;
|
|
minutes = angle % 60;
|
|
degrees = angle / 60;
|
|
g_snprintf(buf, sizeof(buf), "%u deg %u min %u.%03u sec %c", degrees, minutes, secs,
|
|
tsecs, direction);
|
|
return buf;
|
|
}
|
|
|
|
static int
|
|
dissect_dns_query(tvbuff_t *tvb, int offset, int dns_data_offset,
|
|
column_info *cinfo, proto_tree *dns_tree, gboolean is_mdns)
|
|
{
|
|
int len;
|
|
const guchar *name;
|
|
gchar *name_out;
|
|
int name_len;
|
|
int type;
|
|
int dns_class;
|
|
int qu;
|
|
const char *type_name;
|
|
int data_start;
|
|
proto_tree *q_tree;
|
|
proto_item *tq;
|
|
|
|
data_start = offset;
|
|
|
|
len = get_dns_name_type_class(tvb, offset, dns_data_offset, &name, &name_len,
|
|
&type, &dns_class);
|
|
if (is_mdns) {
|
|
/* Split the QU flag and the class */
|
|
qu = dns_class & C_QU;
|
|
dns_class &= ~C_QU;
|
|
} else {
|
|
qu = 0;
|
|
}
|
|
|
|
type_name = dns_type_name(type);
|
|
|
|
/*
|
|
* The name might contain octets that aren't printable characters,
|
|
* format it for display.
|
|
*/
|
|
name_out = format_text(name, strlen(name));
|
|
|
|
if (cinfo != NULL) {
|
|
col_append_fstr(cinfo, COL_INFO, " %s %s", type_name, name_out);
|
|
if (is_mdns) {
|
|
col_append_fstr(cinfo, COL_INFO, ", \"%s\" question", qu ? "QU" : "QM");
|
|
}
|
|
}
|
|
if (dns_tree != NULL) {
|
|
tq = proto_tree_add_text(dns_tree, tvb, offset, len, "%s: type %s, class %s",
|
|
name_out, type_name, dns_class_name(dns_class));
|
|
if (is_mdns) {
|
|
proto_item_append_text(tq, ", \"%s\" question", qu ? "QU" : "QM");
|
|
}
|
|
q_tree = proto_item_add_subtree(tq, ett_dns_qd);
|
|
|
|
proto_tree_add_string(q_tree, hf_dns_qry_name, tvb, offset, name_len, name);
|
|
offset += name_len;
|
|
|
|
proto_tree_add_uint_format(q_tree, hf_dns_qry_type, tvb, offset, 2, type,
|
|
"Type: %s", dns_type_description(type));
|
|
offset += 2;
|
|
|
|
if (is_mdns) {
|
|
proto_tree_add_uint(q_tree, hf_dns_qry_class_mdns, tvb, offset, 2, dns_class);
|
|
proto_tree_add_boolean(q_tree, hf_dns_qry_qu, tvb, offset, 2, qu);
|
|
} else {
|
|
proto_tree_add_uint(q_tree, hf_dns_qry_class, tvb, offset, 2, dns_class);
|
|
}
|
|
|
|
offset += 2;
|
|
}
|
|
|
|
if (data_start + len != offset) {
|
|
/* Add expert info ? (about incorrect len...)*/
|
|
}
|
|
return len;
|
|
}
|
|
|
|
|
|
static proto_tree *
|
|
add_rr_to_tree(proto_item *trr, int rr_type, tvbuff_t *tvb, int offset,
|
|
const guchar *name, int namelen, int type, int dns_class, int flush,
|
|
guint ttl, gushort data_len, gboolean is_mdns)
|
|
{
|
|
proto_tree *rr_tree;
|
|
gchar **srv_rr_info;
|
|
|
|
rr_tree = proto_item_add_subtree(trr, rr_type);
|
|
|
|
if (type == T_SRV) {
|
|
srv_rr_info = g_strsplit(name, ".", 3);
|
|
|
|
/* The + 1 on the strings is to skip the leading '_' */
|
|
|
|
proto_tree_add_string(rr_tree, hf_dns_srv_service, tvb, offset,
|
|
namelen, srv_rr_info[0]);
|
|
|
|
if (srv_rr_info[1]) {
|
|
proto_tree_add_string(rr_tree, hf_dns_srv_proto, tvb, offset,
|
|
namelen, srv_rr_info[1]);
|
|
|
|
if (srv_rr_info[2]) {
|
|
proto_tree_add_string(rr_tree, hf_dns_srv_name, tvb, offset,
|
|
namelen, srv_rr_info[2]);
|
|
}
|
|
}
|
|
|
|
g_strfreev(srv_rr_info);
|
|
} else {
|
|
proto_tree_add_string(rr_tree, hf_dns_rr_name, tvb, offset, namelen, name);
|
|
}
|
|
|
|
offset += namelen;
|
|
|
|
proto_tree_add_uint_format(rr_tree, hf_dns_rr_type, tvb, offset, 2, type,
|
|
"Type: %s", dns_type_description(type));
|
|
offset += 2;
|
|
if (is_mdns) {
|
|
proto_tree_add_uint(rr_tree, hf_dns_rr_class_mdns, tvb, offset, 2, dns_class);
|
|
proto_tree_add_boolean(rr_tree, hf_dns_rr_cache_flush, tvb, offset, 2, flush);
|
|
} else {
|
|
proto_tree_add_uint(rr_tree, hf_dns_rr_class, tvb, offset, 2, dns_class);
|
|
}
|
|
offset += 2;
|
|
proto_tree_add_uint_format(rr_tree, hf_dns_rr_ttl, tvb, offset, 4, ttl,
|
|
"Time to live: %s", time_secs_to_str(ttl));
|
|
offset += 4;
|
|
proto_tree_add_uint(rr_tree, hf_dns_rr_len, tvb, offset, 2, data_len);
|
|
return rr_tree;
|
|
}
|
|
|
|
|
|
static proto_tree *
|
|
add_opt_rr_to_tree(proto_item *trr, int rr_type, tvbuff_t *tvb, int offset,
|
|
const char *name, int namelen, int type, int dns_class, int flush,
|
|
guint ttl, gushort data_len, gboolean is_mdns)
|
|
{
|
|
proto_tree *rr_tree, *Z_tree;
|
|
proto_item *Z_item = NULL;
|
|
|
|
rr_tree = proto_item_add_subtree(trr, rr_type);
|
|
proto_tree_add_string(rr_tree, hf_dns_rr_name, tvb, offset, namelen, name);
|
|
offset += namelen;
|
|
proto_tree_add_uint_format(rr_tree, hf_dns_rr_type, tvb, offset, 2, type,
|
|
"Type: %s", dns_type_description(type));
|
|
offset += 2;
|
|
if (is_mdns) {
|
|
proto_tree_add_uint(rr_tree, hf_dns_rr_udp_payload_size, tvb, offset, 2, dns_class);
|
|
proto_tree_add_boolean(rr_tree, hf_dns_rr_cache_flush, tvb, offset, 2,
|
|
flush);
|
|
} else {
|
|
proto_tree_add_text(rr_tree, tvb, offset, 2, "UDP payload size: %u", dns_class & 0xffff);
|
|
}
|
|
offset += 2;
|
|
proto_tree_add_text(rr_tree, tvb, offset, 1, "Higher bits in extended RCODE: 0x%x",
|
|
(ttl >> 24) & 0xff0);
|
|
offset++;
|
|
proto_tree_add_text(rr_tree, tvb, offset, 1, "EDNS0 version: %u",
|
|
(ttl >> 16) & 0xff);
|
|
offset++;
|
|
Z_item = proto_tree_add_text(rr_tree, tvb, offset, 2, "Z: 0x%x", ttl & 0xffff);
|
|
if (ttl & 0x8000) {
|
|
Z_tree = proto_item_add_subtree(Z_item, rr_type);
|
|
proto_tree_add_text(Z_tree, tvb, offset, 2, "Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs)");
|
|
proto_tree_add_text(Z_tree, tvb, offset, 2, "Bits 1-15: 0x%x (reserved)", ttl & 0x7fff);
|
|
}
|
|
offset += 2;
|
|
proto_tree_add_uint(rr_tree, hf_dns_rr_len, tvb, offset, 2, data_len);
|
|
return rr_tree;
|
|
}
|
|
|
|
static int
|
|
dissect_type_bitmap(proto_tree *rr_tree, tvbuff_t *tvb, int cur_offset, int rr_len)
|
|
{
|
|
int mask, blockbase, blocksize;
|
|
int i, initial_offset, rr_type;
|
|
guint8 bits;
|
|
|
|
initial_offset = cur_offset;
|
|
while (rr_len != 0) {
|
|
blockbase = tvb_get_guint8(tvb, cur_offset);
|
|
blocksize = tvb_get_guint8(tvb, cur_offset + 1);
|
|
cur_offset += 2;
|
|
rr_len -= 2;
|
|
rr_type = blockbase * 256;
|
|
for( ; blocksize; blocksize-- ) {
|
|
bits = tvb_get_guint8(tvb, cur_offset);
|
|
mask = 1<<7;
|
|
for (i = 0; i < 8; i++) {
|
|
if (bits & mask) {
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 1,
|
|
"RR type in bit map: %s",
|
|
dns_type_description(rr_type));
|
|
}
|
|
mask >>= 1;
|
|
rr_type++;
|
|
}
|
|
cur_offset += 1;
|
|
rr_len -= 1;
|
|
}
|
|
}
|
|
return(initial_offset - cur_offset);
|
|
}
|
|
|
|
/*
|
|
* SIG, KEY, and CERT RR algorithms.
|
|
* http://www.iana.org/assignments/dns-sec-alg-numbers/dns-sec-alg-numbers.txt (last updated 2012-04-13)
|
|
*/
|
|
#define DNS_ALGO_RSAMD5 1 /* RSA/MD5 */
|
|
#define DNS_ALGO_DH 2 /* Diffie-Hellman */
|
|
#define DNS_ALGO_DSA 3 /* DSA */
|
|
#define DNS_ALGO_ECC 4 /* Elliptic curve crypto */
|
|
#define DNS_ALGO_RSASHA1 5 /* RSA/SHA1 */
|
|
#define DNS_ALGO_DSA_NSEC3_SHA1 6 /* DSA + NSEC3/SHA1 */
|
|
#define DNS_ALGO_RSASHA1_NSEC3_SHA1 7 /* RSA/SHA1 + NSEC3/SHA1 */
|
|
#define DNS_ALGO_RSASHA256 8 /* RSA/SHA-256 */
|
|
#define DNS_ALGO_RSASHA512 10 /* RSA/SHA-512 */
|
|
#define DNS_ALGO_ECCGOST 12 /* GOST R 34.10-2001 */
|
|
#define DNS_ALGO_ECDSAP256SHA256 13 /* ECDSA Curve P-256 with SHA-256 */
|
|
#define DNS_ALGO_ECDSAP386SHA386 14 /* ECDSA Curve P-386 with SHA-386 */
|
|
#define DNS_ALGO_HMACMD5 157 /* HMAC/MD5 */
|
|
#define DNS_ALGO_INDIRECT 252 /* Indirect key */
|
|
#define DNS_ALGO_PRIVATEDNS 253 /* Private, domain name */
|
|
#define DNS_ALGO_PRIVATEOID 254 /* Private, OID */
|
|
|
|
static const value_string dnssec_algo_vals[] = {
|
|
{ DNS_ALGO_RSAMD5, "RSA/MD5" },
|
|
{ DNS_ALGO_DH, "Diffie-Hellman" },
|
|
{ DNS_ALGO_DSA, "DSA" },
|
|
{ DNS_ALGO_ECC, "Elliptic curve crypto" },
|
|
{ DNS_ALGO_RSASHA1, "RSA/SHA1" },
|
|
{ DNS_ALGO_DSA_NSEC3_SHA1, "DSA + NSEC3/SHA1" },
|
|
{ DNS_ALGO_RSASHA1_NSEC3_SHA1,"RSA/SHA1 + NSEC3/SHA1" },
|
|
{ DNS_ALGO_RSASHA256, "RSA/SHA-256" },
|
|
{ DNS_ALGO_RSASHA512, "RSA/SHA-512" },
|
|
{ DNS_ALGO_ECCGOST, "GOST R 34.10-2001" },
|
|
{ DNS_ALGO_ECDSAP256SHA256, "ECDSA Curve P-256 with SHA-256" },
|
|
{ DNS_ALGO_ECDSAP386SHA386, "ECDSA Curve P-386 with SHA-386" },
|
|
{ DNS_ALGO_HMACMD5, "HMAC/MD5" },
|
|
{ DNS_ALGO_INDIRECT, "Indirect key" },
|
|
{ DNS_ALGO_PRIVATEDNS, "Private, domain name" },
|
|
{ DNS_ALGO_PRIVATEOID, "Private, OID" },
|
|
{ 0, NULL }
|
|
};
|
|
|
|
/* DNSKEY : RFC4034 */
|
|
#define DNSKEY_FLAGS_ZK 0x0100
|
|
#define DNSKEY_FLAGS_KR 0x0080
|
|
#define DNSKEY_FLAGS_SEP 0x0001
|
|
#define DNSKEY_FLAGS_RSV 0xFE7E
|
|
|
|
static const true_false_string dns_dnskey_zone_key_tfs = { "This is the zone key for specified zone", "This it not a zone key" };
|
|
|
|
/* See RFC 4398 */
|
|
#define DNS_CERT_PKIX 1 /* X509 certificate */
|
|
#define DNS_CERT_SPKI 2 /* Simple public key certificate */
|
|
#define DNS_CERT_PGP 3 /* OpenPGP packet */
|
|
#define DNS_CERT_IPKIX 4 /* Indirect PKIX */
|
|
#define DNS_CERT_ISPKI 5 /* Indirect SPKI */
|
|
#define DNS_CERT_IPGP 6 /* Indirect PGP */
|
|
#define DNS_CERT_ACPKIX 7 /* Attribute certificate */
|
|
#define DNS_CERT_IACPKIX 8 /* Indirect ACPKIX */
|
|
#define DNS_CERT_PRIVATEURI 253 /* Private, URI */
|
|
#define DNS_CERT_PRIVATEOID 254 /* Private, OID */
|
|
|
|
static const value_string cert_vals[] = {
|
|
{ DNS_CERT_PKIX, "PKIX" },
|
|
{ DNS_CERT_SPKI, "SPKI" },
|
|
{ DNS_CERT_PGP, "PGP" },
|
|
{ DNS_CERT_IPKIX, "IPKIX" },
|
|
{ DNS_CERT_ISPKI, "ISPKI" },
|
|
{ DNS_CERT_IPGP, "IPGP" },
|
|
{ DNS_CERT_ACPKIX, "ACPKIX" },
|
|
{ DNS_CERT_IACPKIX, "IACPKIX" },
|
|
{ DNS_CERT_PRIVATEURI, "Private, URI" },
|
|
{ DNS_CERT_PRIVATEOID, "Private, OID" },
|
|
{ 0, NULL }
|
|
};
|
|
|
|
/**
|
|
* Compute the key id of a KEY RR depending of the algorithm used.
|
|
*/
|
|
static guint16
|
|
compute_key_id(tvbuff_t *tvb, int offset, int size, guint8 algo)
|
|
{
|
|
guint32 ac;
|
|
guint8 c1, c2;
|
|
|
|
DISSECTOR_ASSERT(size >= 4);
|
|
|
|
switch( algo ) {
|
|
case DNS_ALGO_RSAMD5:
|
|
return (guint16)(tvb_get_guint8(tvb, offset + size - 3) << 8) + tvb_get_guint8( tvb, offset + size - 2 );
|
|
default:
|
|
for (ac = 0; size > 1; size -= 2, offset += 2) {
|
|
c1 = tvb_get_guint8( tvb, offset );
|
|
c2 = tvb_get_guint8( tvb, offset + 1 );
|
|
ac += (c1 << 8) + c2 ;
|
|
}
|
|
if (size > 0) {
|
|
c1 = tvb_get_guint8( tvb, offset );
|
|
ac += c1 << 8;
|
|
}
|
|
ac += (ac >> 16) & 0xffff;
|
|
return (guint16)(ac & 0xffff);
|
|
}
|
|
}
|
|
|
|
|
|
static int
|
|
dissect_dns_answer(tvbuff_t *tvb, int offsetx, int dns_data_offset,
|
|
column_info *cinfo, proto_tree *dns_tree, packet_info *pinfo,
|
|
gboolean is_mdns)
|
|
{
|
|
int len;
|
|
const guchar *name;
|
|
gchar *name_out;
|
|
int name_len;
|
|
int type;
|
|
int dns_class;
|
|
int flush;
|
|
const char *class_name;
|
|
const char *type_name;
|
|
int data_offset;
|
|
int cur_offset;
|
|
int data_start;
|
|
guint ttl;
|
|
gushort data_len;
|
|
proto_tree *rr_tree = NULL;
|
|
proto_item *trr = NULL;
|
|
|
|
data_start = data_offset = offsetx;
|
|
cur_offset = offsetx;
|
|
|
|
len = get_dns_name_type_class(tvb, offsetx, dns_data_offset, &name, &name_len,
|
|
&type, &dns_class);
|
|
data_offset += len;
|
|
cur_offset += len;
|
|
if (is_mdns) {
|
|
/* Split the FLUSH flag and the class */
|
|
flush = dns_class & C_FLUSH;
|
|
dns_class &= ~C_FLUSH;
|
|
} else {
|
|
flush = 0;
|
|
}
|
|
type_name = dns_type_name(type);
|
|
class_name = dns_class_name(dns_class);
|
|
|
|
ttl = tvb_get_ntohl(tvb, data_offset);
|
|
data_offset += 4;
|
|
cur_offset += 4;
|
|
|
|
data_len = tvb_get_ntohs(tvb, data_offset);
|
|
data_offset += 2;
|
|
cur_offset += 2;
|
|
|
|
if (cinfo != NULL) {
|
|
col_append_fstr(cinfo, COL_INFO, " %s", type_name);
|
|
if (is_mdns && flush) {
|
|
col_append_str(cinfo, COL_INFO, ", cache flush");
|
|
}
|
|
}
|
|
if (dns_tree != NULL) {
|
|
/*
|
|
* The name might contain octets that aren't printable characters,
|
|
* format it for display.
|
|
*/
|
|
name_out = format_text(name, strlen(name));
|
|
if (type != T_OPT) {
|
|
trr = proto_tree_add_text(dns_tree, tvb, offsetx,
|
|
(data_offset - data_start) + data_len,
|
|
"%s: type %s, class %s",
|
|
name_out, type_name, class_name);
|
|
rr_tree = add_rr_to_tree(trr, ett_dns_rr, tvb, offsetx, name, name_len,
|
|
type, dns_class, flush, ttl, data_len, is_mdns);
|
|
} else {
|
|
trr = proto_tree_add_text(dns_tree, tvb, offsetx,
|
|
(data_offset - data_start) + data_len,
|
|
"%s: type %s", name_out, type_name);
|
|
rr_tree = add_opt_rr_to_tree(trr, ett_dns_rr, tvb, offsetx, name, name_len,
|
|
type, dns_class, flush, ttl, data_len, is_mdns);
|
|
}
|
|
if (is_mdns && flush) {
|
|
proto_item_append_text(trr, ", cache flush");
|
|
}
|
|
}
|
|
|
|
if (data_len == 0) {
|
|
return data_offset - data_start;
|
|
}
|
|
|
|
switch (type) {
|
|
|
|
case T_A:
|
|
{
|
|
const char *addr;
|
|
guint32 addr_int;
|
|
|
|
addr = tvb_ip_to_str(tvb, cur_offset);
|
|
if (cinfo != NULL) {
|
|
col_append_fstr(cinfo, COL_INFO, " %s", addr);
|
|
}
|
|
|
|
proto_item_append_text(trr, ", addr %s", addr);
|
|
proto_tree_add_item(rr_tree, hf_dns_rr_addr, tvb, cur_offset, 4, ENC_BIG_ENDIAN);
|
|
|
|
if ((dns_class & 0x7f) == C_IN) {
|
|
tvb_memcpy(tvb, &addr_int, cur_offset, sizeof(addr_int));
|
|
add_ipv4_name(addr_int, name);
|
|
}
|
|
}
|
|
break;
|
|
|
|
case T_NS:
|
|
{
|
|
const guchar *ns_name;
|
|
int ns_name_len;
|
|
|
|
ns_name_len = get_dns_name(tvb, cur_offset, 0, dns_data_offset, &ns_name);
|
|
name_out = format_text(ns_name, strlen(ns_name));
|
|
if (cinfo != NULL) {
|
|
col_append_fstr(cinfo, COL_INFO, " %s", name_out);
|
|
}
|
|
proto_item_append_text(trr, ", ns %s", name_out);
|
|
proto_tree_add_string(rr_tree, hf_dns_rr_ns, tvb, cur_offset, ns_name_len, name_out);
|
|
|
|
}
|
|
break;
|
|
|
|
case T_CNAME:
|
|
{
|
|
const guchar *cname;
|
|
int cname_len;
|
|
|
|
cname_len = get_dns_name(tvb, cur_offset, 0, dns_data_offset, &cname);
|
|
name_out = format_text(cname, strlen(cname));
|
|
if (cinfo != NULL) {
|
|
col_append_fstr(cinfo, COL_INFO, " %s", name_out);
|
|
}
|
|
proto_item_append_text(trr, ", cname %s", name_out);
|
|
proto_tree_add_string(rr_tree, hf_dns_rr_primaryname, tvb, cur_offset, cname_len, name_out);
|
|
|
|
}
|
|
break;
|
|
|
|
case T_SOA: /* Start Of Authority zone (6) */
|
|
{
|
|
const guchar *mname;
|
|
int mname_len;
|
|
const guchar *rname;
|
|
int rname_len;
|
|
proto_item *ti_soa;
|
|
|
|
/* XXX Fix data length */
|
|
mname_len = get_dns_name(tvb, cur_offset, 0, dns_data_offset, &mname);
|
|
name_out = format_text(mname, strlen(mname));
|
|
if (cinfo != NULL) {
|
|
col_append_fstr(cinfo, COL_INFO, " %s", name_out);
|
|
}
|
|
proto_item_append_text(trr, ", mname %s", name_out);
|
|
proto_tree_add_string(rr_tree, hf_dns_soa_mname, tvb, cur_offset, mname_len, name_out);
|
|
cur_offset += mname_len;
|
|
|
|
/* XXX Fix data length */
|
|
rname_len = get_dns_name(tvb, cur_offset, 0, dns_data_offset, &rname);
|
|
name_out = format_text(rname, strlen(rname));
|
|
proto_tree_add_string(rr_tree, hf_dns_soa_rname, tvb, cur_offset, rname_len, name_out);
|
|
cur_offset += rname_len;
|
|
|
|
proto_tree_add_item(rr_tree, hf_dns_soa_serial_number, tvb, cur_offset, 4, ENC_BIG_ENDIAN);
|
|
cur_offset += 4;
|
|
|
|
ti_soa = proto_tree_add_item(rr_tree, hf_dns_soa_refresh_interval, tvb, cur_offset, 4, ENC_BIG_ENDIAN);
|
|
proto_item_append_text(ti_soa, " (%s)", time_secs_to_str(tvb_get_ntohl(tvb, cur_offset)));
|
|
cur_offset += 4;
|
|
|
|
ti_soa = proto_tree_add_item(rr_tree, hf_dns_soa_retry_interval, tvb, cur_offset, 4, ENC_BIG_ENDIAN);
|
|
proto_item_append_text(ti_soa, " (%s)", time_secs_to_str(tvb_get_ntohl(tvb, cur_offset)));
|
|
cur_offset += 4;
|
|
|
|
ti_soa = proto_tree_add_item(rr_tree, hf_dns_soa_expire_limit, tvb, cur_offset, 4, ENC_BIG_ENDIAN);
|
|
proto_item_append_text(ti_soa, " (%s)", time_secs_to_str(tvb_get_ntohl(tvb, cur_offset)));
|
|
cur_offset += 4;
|
|
|
|
ti_soa = proto_tree_add_item(rr_tree, hf_dns_soa_minimum_ttl, tvb, cur_offset, 4, ENC_BIG_ENDIAN);
|
|
proto_item_append_text(ti_soa, " (%s)", time_secs_to_str(tvb_get_ntohl(tvb, cur_offset)));
|
|
|
|
}
|
|
break;
|
|
|
|
case T_PTR: /* Domain Name Pointer (12) */
|
|
{
|
|
const guchar *pname;
|
|
int pname_len;
|
|
|
|
/* XXX Fix data length */
|
|
pname_len = get_dns_name(tvb, cur_offset, 0, dns_data_offset, &pname);
|
|
name_out = format_text(pname, strlen(pname));
|
|
if (cinfo != NULL) {
|
|
col_append_fstr(cinfo, COL_INFO, " %s", name_out);
|
|
}
|
|
proto_item_append_text(trr, ", %s", name_out);
|
|
proto_tree_add_string(rr_tree, hf_dns_ptr_domain_name, tvb, cur_offset, pname_len, name_out);
|
|
|
|
}
|
|
break;
|
|
|
|
case T_WKS: /* well known service (11) */
|
|
{
|
|
int rr_len = data_len;
|
|
const char *wks_addr;
|
|
guint8 protocol;
|
|
guint8 bits;
|
|
int mask;
|
|
int port_num;
|
|
int i;
|
|
proto_item *ti_wks;
|
|
emem_strbuf_t *bitnames = ep_strbuf_new_label(NULL);
|
|
|
|
if (rr_len < 4) {
|
|
goto bad_rr;
|
|
}
|
|
wks_addr = tvb_ip_to_str(tvb, cur_offset);
|
|
if (cinfo != NULL) {
|
|
col_append_fstr(cinfo, COL_INFO, " %s", wks_addr);
|
|
}
|
|
proto_item_append_text(trr, ", addr %s", wks_addr);
|
|
proto_tree_add_item(rr_tree, hf_dns_wks_address, tvb, cur_offset, 4, ENC_BIG_ENDIAN);
|
|
cur_offset += 4;
|
|
rr_len -= 4;
|
|
|
|
if (rr_len < 1) {
|
|
goto bad_rr;
|
|
}
|
|
proto_tree_add_item(rr_tree, hf_dns_wks_protocol, tvb, cur_offset, 4, ENC_BIG_ENDIAN);
|
|
protocol = tvb_get_guint8(tvb, cur_offset);
|
|
cur_offset += 1;
|
|
rr_len -= 1;
|
|
|
|
port_num = 0;
|
|
while (rr_len != 0) {
|
|
bits = tvb_get_guint8(tvb, cur_offset);
|
|
if (bits != 0) {
|
|
mask = 1<<7;
|
|
ep_strbuf_truncate(bitnames, 0);
|
|
for (i = 0; i < 8; i++) {
|
|
if (bits & mask) {
|
|
if (bitnames->len > 0) {
|
|
ep_strbuf_append(bitnames, ", ");
|
|
}
|
|
switch (protocol) {
|
|
|
|
case IP_PROTO_TCP:
|
|
ep_strbuf_append(bitnames, get_tcp_port(port_num));
|
|
break;
|
|
|
|
case IP_PROTO_UDP:
|
|
ep_strbuf_append(bitnames, get_udp_port(port_num));
|
|
break;
|
|
|
|
default:
|
|
ep_strbuf_append_printf(bitnames, "%u", port_num);
|
|
break;
|
|
}
|
|
}
|
|
mask >>= 1;
|
|
port_num++;
|
|
}
|
|
|
|
ti_wks = proto_tree_add_item(rr_tree, hf_dns_wks_bits, tvb, cur_offset, 1, ENC_BIG_ENDIAN);
|
|
proto_item_append_text(ti_wks, " (%s)", bitnames->str);
|
|
} else {
|
|
port_num += 8;
|
|
}
|
|
cur_offset += 1;
|
|
rr_len -= 1;
|
|
}
|
|
|
|
}
|
|
break;
|
|
|
|
case T_HINFO: /* Host Information (13) */
|
|
{
|
|
int cpu_offset;
|
|
int cpu_len;
|
|
const char *cpu;
|
|
int os_offset;
|
|
int os_len;
|
|
const char *os;
|
|
|
|
cpu_offset = cur_offset;
|
|
cpu_len = tvb_get_guint8(tvb, cpu_offset);
|
|
cpu = tvb_get_ephemeral_string(tvb, cpu_offset + 1, cpu_len);
|
|
os_offset = cpu_offset + 1 + cpu_len;
|
|
os_len = tvb_get_guint8(tvb, os_offset);
|
|
os = tvb_get_ephemeral_string(tvb, os_offset + 1, os_len);
|
|
if (cinfo != NULL) {
|
|
col_append_fstr(cinfo, COL_INFO, " %.*s %.*s", cpu_len, cpu,
|
|
os_len, os);
|
|
}
|
|
proto_item_append_text(trr, ", CPU %.*s, OS %.*s",
|
|
cpu_len, cpu, os_len, os);
|
|
|
|
proto_tree_add_item(rr_tree, hf_dns_hinfo_cpu_length, tvb, cur_offset, 1, ENC_BIG_ENDIAN);
|
|
cur_offset += 1;
|
|
proto_tree_add_item(rr_tree, hf_dns_hinfo_cpu, tvb, cur_offset, cpu_len, ENC_BIG_ENDIAN);
|
|
cur_offset += cpu_len;
|
|
|
|
proto_tree_add_item(rr_tree, hf_dns_hinfo_os_length, tvb, cur_offset, 1, ENC_BIG_ENDIAN);
|
|
cur_offset += 1;
|
|
proto_tree_add_item(rr_tree, hf_dns_hinfo_os, tvb, cur_offset, os_len, ENC_BIG_ENDIAN);
|
|
/* cur_offset += os_len;*/
|
|
|
|
|
|
}
|
|
break;
|
|
|
|
case T_MX: /* Mail Exchange (15) */
|
|
{
|
|
guint16 preference = 0;
|
|
const guchar *mx_name;
|
|
int mx_name_len;
|
|
|
|
preference = tvb_get_ntohs(tvb, cur_offset);
|
|
/* XXX Fix data length */
|
|
mx_name_len = get_dns_name(tvb, cur_offset + 2, 0, dns_data_offset, &mx_name);
|
|
name_out = format_text(mx_name, strlen(mx_name));
|
|
if (cinfo != NULL) {
|
|
col_append_fstr(cinfo, COL_INFO, " %u %s", preference, name_out);
|
|
}
|
|
proto_item_append_text(trr, ", preference %u, mx %s",
|
|
preference, name_out);
|
|
proto_tree_add_item(rr_tree, hf_dns_mx_preference, tvb, cur_offset, 2, ENC_BIG_ENDIAN);
|
|
cur_offset += 2;
|
|
proto_tree_add_string(rr_tree, hf_dns_mx_mail_exchange, tvb, cur_offset, mx_name_len, name_out);
|
|
/* cur_offset += mx_name_len; */
|
|
|
|
}
|
|
break;
|
|
|
|
case T_TXT: /* Text Strings (16) */
|
|
{
|
|
int rr_len = data_len;
|
|
int txt_offset;
|
|
int txt_len;
|
|
|
|
|
|
txt_offset = cur_offset;
|
|
while (rr_len != 0) {
|
|
txt_len = tvb_get_guint8(tvb, txt_offset);
|
|
proto_tree_add_item(rr_tree, hf_dns_txt_length, tvb, txt_offset, 1, ENC_BIG_ENDIAN);
|
|
txt_offset += 1;
|
|
rr_len -= 1;
|
|
proto_tree_add_item(rr_tree, hf_dns_txt, tvb, txt_offset, txt_len, ENC_BIG_ENDIAN);
|
|
txt_offset += txt_len;
|
|
rr_len -= txt_len;
|
|
}
|
|
|
|
}
|
|
break;
|
|
|
|
case T_SPF: /* Sender Policy Framework (99) */
|
|
{
|
|
int rr_len = data_len;
|
|
int spf_offset;
|
|
int spf_len;
|
|
|
|
|
|
spf_offset = cur_offset;
|
|
while (rr_len != 0) {
|
|
spf_len = tvb_get_guint8(tvb, spf_offset);
|
|
proto_tree_add_item(rr_tree, hf_dns_spf_length, tvb, spf_offset, 1, ENC_BIG_ENDIAN);
|
|
spf_offset += 1;
|
|
rr_len -= 1;
|
|
proto_tree_add_item(rr_tree, hf_dns_spf, tvb, spf_offset, spf_len, ENC_BIG_ENDIAN);
|
|
spf_offset += spf_len;
|
|
rr_len -= spf_len;
|
|
}
|
|
|
|
}
|
|
break;
|
|
|
|
case T_RRSIG: /* RRSIG (46) */
|
|
case T_SIG: /* Security Signature (24) */
|
|
{
|
|
int rr_len = data_len;
|
|
const guchar *signer_name;
|
|
int signer_name_len;
|
|
proto_item *ti;
|
|
|
|
if (rr_len < 2) {
|
|
goto bad_rr;
|
|
}
|
|
ti = proto_tree_add_item(rr_tree, hf_dns_rrsig_type_covered, tvb, cur_offset, 2, ENC_BIG_ENDIAN);
|
|
/* Fix me : need to remove dns_type_description and replace by value_string */
|
|
proto_item_append_text(ti, " (%s)", dns_type_description(tvb_get_ntohs(tvb, cur_offset)));
|
|
cur_offset += 2;
|
|
rr_len -= 2;
|
|
|
|
proto_tree_add_item(rr_tree, hf_dns_rrsig_algorithm, tvb, cur_offset, 1, ENC_BIG_ENDIAN);
|
|
cur_offset += 1;
|
|
rr_len -= 1;
|
|
|
|
if (rr_len < 1) {
|
|
goto bad_rr;
|
|
}
|
|
proto_tree_add_item(rr_tree, hf_dns_rrsig_labels, tvb, cur_offset, 1, ENC_BIG_ENDIAN);
|
|
cur_offset += 1;
|
|
rr_len -= 1;
|
|
|
|
if (rr_len < 4) {
|
|
goto bad_rr;
|
|
}
|
|
ti = proto_tree_add_item(rr_tree, hf_dns_rrsig_original_ttl, tvb, cur_offset, 4, ENC_BIG_ENDIAN);
|
|
proto_item_append_text(ti, " (%s)", time_secs_to_str(tvb_get_ntohl(tvb, cur_offset)));
|
|
cur_offset += 4;
|
|
rr_len -= 4;
|
|
|
|
if (rr_len < 4) {
|
|
goto bad_rr;
|
|
}
|
|
proto_tree_add_item(rr_tree, hf_dns_rrsig_signature_expiration, tvb, cur_offset, 4, ENC_BIG_ENDIAN);
|
|
cur_offset += 4;
|
|
rr_len -= 4;
|
|
|
|
if (rr_len < 4) {
|
|
goto bad_rr;
|
|
}
|
|
proto_tree_add_item(rr_tree, hf_dns_rrsig_signature_inception, tvb, cur_offset, 4, ENC_BIG_ENDIAN);
|
|
cur_offset += 4;
|
|
rr_len -= 4;
|
|
|
|
if (rr_len < 2) {
|
|
goto bad_rr;
|
|
}
|
|
proto_tree_add_item(rr_tree, hf_dns_rrsig_key_tag, tvb, cur_offset, 2, ENC_BIG_ENDIAN);
|
|
cur_offset += 2;
|
|
rr_len -= 2;
|
|
|
|
/* XXX Fix data length */
|
|
signer_name_len = get_dns_name(tvb, cur_offset, 0, dns_data_offset, &signer_name);
|
|
proto_tree_add_string(rr_tree, hf_dns_rrsig_signers_name, tvb, cur_offset, signer_name_len, signer_name);
|
|
cur_offset += signer_name_len;
|
|
rr_len -= signer_name_len;
|
|
|
|
if (rr_len != 0) {
|
|
proto_tree_add_item(rr_tree, hf_dns_rrsig_signature, tvb, cur_offset, rr_len, ENC_BIG_ENDIAN);
|
|
}
|
|
}
|
|
break;
|
|
|
|
case T_DNSKEY: /* DNSKEY (48) */
|
|
{
|
|
int rr_len = data_len;
|
|
proto_item *tf, *ti_gen;
|
|
proto_tree *flags_tree;
|
|
guint16 key_id;
|
|
guint8 algo;
|
|
|
|
|
|
if (rr_len < 2) {
|
|
goto bad_rr;
|
|
}
|
|
|
|
|
|
tf = proto_tree_add_item(rr_tree, hf_dns_dnskey_flags, tvb, cur_offset, 2, ENC_BIG_ENDIAN);
|
|
flags_tree = proto_item_add_subtree(tf, ett_t_key_flags);
|
|
proto_tree_add_item(flags_tree, hf_dns_dnskey_flags_zone_key, tvb, cur_offset, 2, ENC_BIG_ENDIAN);
|
|
proto_tree_add_item(flags_tree, hf_dns_dnskey_flags_key_revoked, tvb, cur_offset, 2, ENC_BIG_ENDIAN);
|
|
proto_tree_add_item(flags_tree, hf_dns_dnskey_flags_secure_entry_point, tvb, cur_offset, 2, ENC_BIG_ENDIAN);
|
|
proto_tree_add_item(flags_tree, hf_dns_dnskey_flags_reserved, tvb, cur_offset, 2, ENC_BIG_ENDIAN);
|
|
|
|
cur_offset += 2;
|
|
rr_len -= 2;
|
|
|
|
if (rr_len < 1) {
|
|
goto bad_rr;
|
|
}
|
|
/* Must have value 3, Add check ? */
|
|
proto_tree_add_item(flags_tree, hf_dns_dnskey_protocol, tvb, cur_offset, 1, ENC_BIG_ENDIAN);
|
|
cur_offset += 1;
|
|
rr_len -= 1;
|
|
|
|
if (rr_len < 1) {
|
|
goto bad_rr;
|
|
}
|
|
proto_tree_add_item(flags_tree, hf_dns_dnskey_algorithm, tvb, cur_offset, 1, ENC_BIG_ENDIAN);
|
|
algo = tvb_get_guint8(tvb, cur_offset);
|
|
|
|
cur_offset += 1;
|
|
rr_len -= 1;
|
|
|
|
key_id = compute_key_id(tvb, cur_offset-4, rr_len+4, algo);
|
|
ti_gen = proto_tree_add_uint(rr_tree, hf_dns_dnskey_key_id, tvb, 0, 0, key_id);
|
|
PROTO_ITEM_SET_GENERATED(ti_gen);
|
|
|
|
proto_tree_add_item(rr_tree, hf_dns_dnskey_public_key, tvb, cur_offset, rr_len, ENC_BIG_ENDIAN);
|
|
|
|
}
|
|
break;
|
|
|
|
case T_KEY:
|
|
{
|
|
int rr_len = data_len;
|
|
guint16 flags;
|
|
proto_item *tf, *ti_gen;
|
|
proto_tree *flags_tree;
|
|
guint8 algo;
|
|
guint16 key_id;
|
|
|
|
|
|
if (rr_len < 2) {
|
|
goto bad_rr;
|
|
}
|
|
flags = tvb_get_ntohs(tvb, cur_offset);
|
|
tf = proto_tree_add_item(rr_tree, hf_dns_t_key_flags, tvb, cur_offset, 2, ENC_BIG_ENDIAN);
|
|
flags_tree = proto_item_add_subtree(tf, ett_t_key_flags);
|
|
proto_tree_add_item(flags_tree, hf_dns_t_key_flags_authentication, tvb, cur_offset, 2, ENC_BIG_ENDIAN);
|
|
proto_tree_add_item(flags_tree, hf_dns_t_key_flags_confidentiality, tvb, cur_offset, 2, ENC_BIG_ENDIAN);
|
|
if ((flags & 0xC000) != 0xC000) {
|
|
/* We have a key */
|
|
proto_tree_add_item(flags_tree, hf_dns_t_key_flags_key_required, tvb, cur_offset, 2, ENC_BIG_ENDIAN);
|
|
proto_tree_add_item(flags_tree, hf_dns_t_key_flags_associated_user, tvb, cur_offset, 2, ENC_BIG_ENDIAN);
|
|
proto_tree_add_item(flags_tree, hf_dns_t_key_flags_associated_named_entity, tvb, cur_offset, 2, ENC_BIG_ENDIAN);
|
|
proto_tree_add_item(flags_tree, hf_dns_t_key_flags_ipsec, tvb, cur_offset, 2, ENC_BIG_ENDIAN);
|
|
proto_tree_add_item(flags_tree, hf_dns_t_key_flags_mime, tvb, cur_offset, 2, ENC_BIG_ENDIAN);
|
|
proto_tree_add_item(flags_tree, hf_dns_t_key_flags_signatory, tvb, cur_offset, 2, ENC_BIG_ENDIAN);
|
|
}
|
|
cur_offset += 2;
|
|
rr_len -= 2;
|
|
|
|
if (rr_len < 1) {
|
|
goto bad_rr;
|
|
}
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 1, "Protocol: %u",
|
|
tvb_get_guint8(tvb, cur_offset));
|
|
cur_offset += 1;
|
|
rr_len -= 1;
|
|
|
|
if (rr_len < 1) {
|
|
goto bad_rr;
|
|
}
|
|
algo = tvb_get_guint8(tvb, cur_offset);
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 1, "Algorithm: %s",
|
|
val_to_str(algo, dnssec_algo_vals, "Unknown (0x%02X)"));
|
|
cur_offset += 1;
|
|
rr_len -= 1;
|
|
|
|
key_id = compute_key_id(tvb, cur_offset-4, rr_len+4, algo);
|
|
ti_gen = proto_tree_add_text(rr_tree, tvb, 0, 0, "Key id: %u", key_id);
|
|
PROTO_ITEM_SET_GENERATED(ti_gen);
|
|
|
|
if (rr_len != 0) {
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, rr_len, "Public key");
|
|
}
|
|
|
|
}
|
|
break;
|
|
case T_IPSECKEY:
|
|
{
|
|
int rr_len = data_len;
|
|
guint8 gw_type, algo;
|
|
const guchar *gw;
|
|
int gw_name_len;
|
|
|
|
static const value_string gw_algo[] = {
|
|
{ 1, "DSA" },
|
|
{ 2, "RSA" },
|
|
{ 0, NULL }
|
|
};
|
|
|
|
|
|
|
|
if (rr_len < 3) {
|
|
goto bad_rr;
|
|
}
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 1, "Gateway precedence: %u",
|
|
tvb_get_guint8(tvb, cur_offset));
|
|
cur_offset += 1;
|
|
rr_len -= 1;
|
|
|
|
gw_type = tvb_get_guint8(tvb, cur_offset);
|
|
cur_offset += 1;
|
|
rr_len -= 1;
|
|
|
|
algo = tvb_get_guint8(tvb, cur_offset);
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 1, "Algorithm: %s",
|
|
val_to_str(algo, gw_algo, "Unknown (0x%02X)"));
|
|
cur_offset += 1;
|
|
rr_len -= 1;
|
|
switch( gw_type ) {
|
|
case 0:
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 0, "Gateway: no gateway");
|
|
break;
|
|
case 1:
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 4, "Gateway: %s",
|
|
tvb_ip_to_str(tvb, cur_offset) );
|
|
|
|
cur_offset += 4;
|
|
rr_len -= 4;
|
|
break;
|
|
case 2:
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 16, "Gateway: %s",
|
|
tvb_ip6_to_str(tvb, cur_offset));
|
|
|
|
cur_offset += 16;
|
|
rr_len -= 16;
|
|
break;
|
|
case 3:
|
|
/* XXX Fix data length */
|
|
gw_name_len = get_dns_name(tvb, cur_offset, 0, dns_data_offset, &gw);
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, gw_name_len,
|
|
"Gateway: %s", format_text(gw, strlen(gw)));
|
|
|
|
cur_offset += gw_name_len;
|
|
rr_len -= gw_name_len;
|
|
break;
|
|
default:
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 0, "Gateway: Unknown gateway type(%u)", gw_type);
|
|
break;
|
|
}
|
|
if (rr_len != 0) {
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, rr_len, "Public key");
|
|
}
|
|
}
|
|
break;
|
|
|
|
case T_AAAA:
|
|
{
|
|
const char *addr6;
|
|
struct e_in6_addr addr_in6;
|
|
|
|
addr6 = tvb_ip6_to_str(tvb, cur_offset);
|
|
if (cinfo != NULL) {
|
|
col_append_fstr(cinfo, COL_INFO, " %s", addr6);
|
|
}
|
|
|
|
proto_item_append_text(trr, ", addr %s", addr6);
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 16, "Addr: %s", addr6);
|
|
|
|
if ((dns_class & 0x7f) == C_IN) {
|
|
tvb_memcpy(tvb, &addr_in6, cur_offset, sizeof(addr_in6));
|
|
add_ipv6_name(&addr_in6, name);
|
|
}
|
|
}
|
|
break;
|
|
|
|
case T_A6:
|
|
{
|
|
unsigned short pre_len;
|
|
unsigned short suf_len;
|
|
unsigned short suf_octet_count;
|
|
const guchar *pname;
|
|
int pname_len;
|
|
int a6_offset;
|
|
int suf_offset;
|
|
struct e_in6_addr suffix;
|
|
|
|
a6_offset = cur_offset;
|
|
pre_len = tvb_get_guint8(tvb, cur_offset);
|
|
cur_offset++;
|
|
suf_len = 128 - pre_len;
|
|
suf_octet_count = suf_len ? (suf_len - 1) / 8 + 1 : 0;
|
|
/* Pad prefix */
|
|
for (suf_offset = 0; suf_offset < 16 - suf_octet_count; suf_offset++) {
|
|
suffix.bytes[suf_offset] = 0;
|
|
}
|
|
for (; suf_offset < 16; suf_offset++) {
|
|
suffix.bytes[suf_offset] = tvb_get_guint8(tvb, cur_offset);
|
|
cur_offset++;
|
|
}
|
|
|
|
if (pre_len > 0) {
|
|
/* XXX Fix data length */
|
|
pname_len = get_dns_name(tvb, cur_offset, 0, dns_data_offset,
|
|
&pname);
|
|
} else {
|
|
pname="";
|
|
pname_len = 0;
|
|
}
|
|
name_out = format_text(pname, strlen(pname));
|
|
|
|
if (cinfo != NULL) {
|
|
col_append_fstr(cinfo, COL_INFO, " %d %s %s",
|
|
pre_len,
|
|
ip6_to_str(&suffix),
|
|
name_out);
|
|
}
|
|
|
|
proto_tree_add_text(rr_tree, tvb, a6_offset, 1,
|
|
"Prefix len: %u", pre_len);
|
|
a6_offset++;
|
|
if (suf_len) {
|
|
proto_tree_add_text(rr_tree, tvb, a6_offset, suf_octet_count,
|
|
"Address suffix: %s",
|
|
ip6_to_str(&suffix));
|
|
a6_offset += suf_octet_count;
|
|
}
|
|
if (pre_len > 0) {
|
|
proto_tree_add_text(rr_tree, tvb, a6_offset, pname_len,
|
|
"Prefix name: %s", name_out);
|
|
}
|
|
proto_item_append_text(trr, ", addr %d %s %s",
|
|
pre_len,
|
|
ip6_to_str(&suffix),
|
|
name_out);
|
|
|
|
}
|
|
break;
|
|
|
|
case T_DNAME:
|
|
{
|
|
const guchar *dname;
|
|
int dname_len;
|
|
|
|
/* XXX Fix data length */
|
|
dname_len = get_dns_name(tvb, cur_offset, 0, dns_data_offset,
|
|
&dname);
|
|
name_out = format_text(dname, strlen(dname));
|
|
if (cinfo != NULL) {
|
|
col_append_fstr(cinfo, COL_INFO, " %s", name_out);
|
|
}
|
|
proto_item_append_text(trr, ", dname %s", name_out);
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset,
|
|
dname_len, "Target name: %s", name_out);
|
|
|
|
}
|
|
break;
|
|
|
|
case T_LOC:
|
|
{
|
|
guint8 version;
|
|
|
|
|
|
version = tvb_get_guint8(tvb, cur_offset);
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 1, "Version: %u", version);
|
|
if (version == 0) {
|
|
/* Version 0, the only version RFC 1876 discusses. */
|
|
cur_offset++;
|
|
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 1, "Size: %g m",
|
|
rfc1867_size(tvb, cur_offset));
|
|
cur_offset++;
|
|
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 1, "Horizontal precision: %g m",
|
|
rfc1867_size(tvb, cur_offset));
|
|
cur_offset++;
|
|
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 1, "Vertical precision: %g m",
|
|
rfc1867_size(tvb, cur_offset));
|
|
cur_offset++;
|
|
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 4, "Latitude: %s",
|
|
rfc1867_angle(tvb, cur_offset, "NS"));
|
|
cur_offset += 4;
|
|
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 4, "Longitude: %s",
|
|
rfc1867_angle(tvb, cur_offset, "EW"));
|
|
cur_offset += 4;
|
|
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 4, "Altitude: %g m",
|
|
((gint32)tvb_get_ntohl(tvb, cur_offset) - 10000000)/100.0);
|
|
} else {
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, data_len, "Data");
|
|
}
|
|
}
|
|
break;
|
|
|
|
case T_NSEC:
|
|
{
|
|
int rr_len = data_len;
|
|
const guchar *next_domain_name;
|
|
int next_domain_name_len;
|
|
|
|
/* XXX Fix data length */
|
|
next_domain_name_len = get_dns_name(tvb, cur_offset, 0, dns_data_offset,
|
|
&next_domain_name);
|
|
name_out = format_text(next_domain_name, strlen(next_domain_name));
|
|
if (cinfo != NULL) {
|
|
col_append_fstr(cinfo, COL_INFO, " %s", name_out);
|
|
}
|
|
proto_item_append_text(trr, ", next domain name %s", name_out);
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, next_domain_name_len,
|
|
"Next domain name: %s", name_out);
|
|
cur_offset += next_domain_name_len;
|
|
rr_len -= next_domain_name_len;
|
|
dissect_type_bitmap(rr_tree, tvb, cur_offset, rr_len);
|
|
|
|
}
|
|
break;
|
|
|
|
case T_NSEC3:
|
|
{
|
|
int rr_len, initial_offset = cur_offset;
|
|
guint8 salt_len, hash_len;
|
|
proto_item *flags_item;
|
|
proto_tree *flags_tree;
|
|
|
|
|
|
proto_tree_add_item(rr_tree, hf_dns_nsec3_algo, tvb, cur_offset++, 1, ENC_BIG_ENDIAN);
|
|
flags_item = proto_tree_add_item(rr_tree, hf_dns_nsec3_flags, tvb, cur_offset, 1, ENC_BIG_ENDIAN);
|
|
flags_tree = proto_item_add_subtree(flags_item, ett_nsec3_flags);
|
|
proto_tree_add_item(flags_tree, hf_dns_nsec3_flag_optout, tvb, cur_offset, 1, ENC_BIG_ENDIAN);
|
|
cur_offset++;
|
|
proto_tree_add_item(rr_tree, hf_dns_nsec3_iterations, tvb, cur_offset, 2, ENC_BIG_ENDIAN);
|
|
cur_offset += 2;
|
|
salt_len = tvb_get_guint8(tvb, cur_offset);
|
|
proto_tree_add_item(rr_tree, hf_dns_nsec3_salt_length, tvb, cur_offset++, 1, ENC_BIG_ENDIAN);
|
|
proto_tree_add_item(rr_tree, hf_dns_nsec3_salt_value, tvb, cur_offset, salt_len, ENC_NA);
|
|
cur_offset += salt_len;
|
|
hash_len = tvb_get_guint8(tvb, cur_offset);
|
|
proto_tree_add_item(rr_tree, hf_dns_nsec3_hash_length, tvb, cur_offset++, 1, ENC_BIG_ENDIAN);
|
|
proto_tree_add_item(rr_tree, hf_dns_nsec3_hash_value, tvb, cur_offset, hash_len, ENC_NA);
|
|
cur_offset += hash_len;
|
|
rr_len = data_len - (cur_offset - initial_offset);
|
|
dissect_type_bitmap(rr_tree, tvb, cur_offset, rr_len);
|
|
|
|
}
|
|
break;
|
|
|
|
case T_NSEC3PARAM:
|
|
{
|
|
int salt_len;
|
|
if (cinfo != NULL) {
|
|
col_append_fstr(cinfo, COL_INFO, " %s", name);
|
|
}
|
|
|
|
proto_tree_add_item(rr_tree, hf_dns_nsec3_algo, tvb, cur_offset, 1, ENC_BIG_ENDIAN);
|
|
cur_offset ++;
|
|
proto_tree_add_item(rr_tree, hf_dns_nsec3_flags, tvb, cur_offset, 1, ENC_BIG_ENDIAN);
|
|
cur_offset ++;
|
|
proto_tree_add_item(rr_tree, hf_dns_nsec3_iterations, tvb, cur_offset, 2, ENC_BIG_ENDIAN);
|
|
cur_offset += 2;
|
|
salt_len = tvb_get_guint8(tvb, cur_offset);
|
|
proto_tree_add_item(rr_tree, hf_dns_nsec3_salt_length, tvb, cur_offset, 1, ENC_BIG_ENDIAN);
|
|
cur_offset ++;
|
|
proto_tree_add_item(rr_tree, hf_dns_nsec3_salt_value, tvb, cur_offset, salt_len, ENC_NA);
|
|
|
|
}
|
|
break;
|
|
|
|
case T_TLSA: /* DNS-Based Authentication of Named Entities (52) */
|
|
{
|
|
int rr_len = data_len;
|
|
if (cinfo != NULL) {
|
|
col_append_fstr(cinfo, COL_INFO, " %s", name);
|
|
}
|
|
|
|
proto_tree_add_item(rr_tree, hf_dns_tlsa_certificate_usage, tvb, cur_offset, 1, ENC_BIG_ENDIAN);
|
|
cur_offset ++;
|
|
rr_len --;
|
|
proto_tree_add_item(rr_tree, hf_dns_tlsa_selector, tvb, cur_offset, 1, ENC_BIG_ENDIAN);
|
|
cur_offset ++;
|
|
rr_len --;
|
|
proto_tree_add_item(rr_tree, hf_dns_tlsa_matching_type, tvb, cur_offset, 1, ENC_BIG_ENDIAN);
|
|
cur_offset ++;
|
|
rr_len --;
|
|
proto_tree_add_item(rr_tree, hf_dns_tlsa_certificate_association_data, tvb, cur_offset, rr_len, ENC_BIG_ENDIAN);
|
|
|
|
}
|
|
break;
|
|
|
|
case T_NXT:
|
|
{
|
|
int rr_len = data_len;
|
|
const guchar *next_domain_name;
|
|
int next_domain_name_len;
|
|
int rr_type;
|
|
guint8 bits;
|
|
int mask;
|
|
int i;
|
|
|
|
/* XXX Fix data length */
|
|
next_domain_name_len = get_dns_name(tvb, cur_offset, 0, dns_data_offset,
|
|
&next_domain_name);
|
|
name_out = format_text(next_domain_name, strlen(next_domain_name));
|
|
if (cinfo != NULL) {
|
|
col_append_fstr(cinfo, COL_INFO, " %s", name_out);
|
|
}
|
|
proto_item_append_text(trr, ", next domain name %s", name_out);
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, next_domain_name_len,
|
|
"Next domain name: %s", name_out);
|
|
cur_offset += next_domain_name_len;
|
|
rr_len -= next_domain_name_len;
|
|
rr_type = 0;
|
|
while (rr_len != 0) {
|
|
bits = tvb_get_guint8(tvb, cur_offset);
|
|
mask = 1<<7;
|
|
for (i = 0; i < 8; i++) {
|
|
if (bits & mask) {
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 1,
|
|
"RR type in bit map: %s",
|
|
dns_type_description(rr_type));
|
|
}
|
|
mask >>= 1;
|
|
rr_type++;
|
|
}
|
|
cur_offset += 1;
|
|
rr_len -= 1;
|
|
}
|
|
|
|
}
|
|
break;
|
|
|
|
case T_KX:
|
|
{
|
|
guint16 preference = 0;
|
|
const guchar *kx_name;
|
|
int kx_name_len;
|
|
|
|
/* XXX Fix data length */
|
|
kx_name_len = get_dns_name(tvb, cur_offset + 2, 0, dns_data_offset, &kx_name);
|
|
name_out = format_text(kx_name, strlen(kx_name));
|
|
if (cinfo != NULL) {
|
|
col_append_fstr(cinfo, COL_INFO, " %u %s", preference, name_out);
|
|
}
|
|
proto_item_append_text(trr, ", preference %u, kx %s",
|
|
preference, name_out);
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 2, "Preference: %u", preference);
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset + 2, kx_name_len, "Key exchange: %s",
|
|
name_out);
|
|
|
|
}
|
|
break;
|
|
|
|
case T_CERT:
|
|
{
|
|
guint16 cert_type, cert_keytag;
|
|
guint8 cert_keyalg;
|
|
int rr_len = data_len;
|
|
|
|
|
|
if (rr_len < 2) {
|
|
goto bad_rr;
|
|
}
|
|
cert_type = tvb_get_ntohs(tvb, cur_offset);
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 2, "Type: %s",
|
|
val_to_str(cert_type, cert_vals,
|
|
"Unknown (0x%02X)"));
|
|
cur_offset += 2;
|
|
rr_len -= 2;
|
|
|
|
if (rr_len < 2) {
|
|
goto bad_rr;
|
|
}
|
|
cert_keytag = tvb_get_ntohs(tvb, cur_offset);
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 2, "Key tag: 0x%04x",
|
|
cert_keytag);
|
|
cur_offset += 2;
|
|
rr_len -= 2;
|
|
|
|
if (rr_len < 1) {
|
|
goto bad_rr;
|
|
}
|
|
cert_keyalg = tvb_get_guint8(tvb, cur_offset);
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 1, "Algorithm: %s",
|
|
val_to_str(cert_keyalg, dnssec_algo_vals,
|
|
"Unknown (0x%02X)"));
|
|
cur_offset += 1;
|
|
rr_len -= 1;
|
|
|
|
if (rr_len != 0) {
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, rr_len, "Certificate or CRL");
|
|
}
|
|
}
|
|
|
|
break;
|
|
|
|
case T_OPT:
|
|
{
|
|
int rropt_len = data_len;
|
|
guint16 optcode, optlen;
|
|
proto_item *rropt;
|
|
proto_tree *rropt_tree;
|
|
|
|
while (rropt_len > 0) {
|
|
if (rropt_len < 2) {
|
|
goto bad_rr;
|
|
}
|
|
optcode = tvb_get_ntohs(tvb, cur_offset);
|
|
rropt_len -= 2;
|
|
|
|
if (rropt_len < 2) {
|
|
goto bad_rr;
|
|
}
|
|
optlen = tvb_get_ntohs(tvb, cur_offset + 2);
|
|
rropt_len -= 2;
|
|
|
|
if (rropt_len < optlen) {
|
|
goto bad_rr;
|
|
}
|
|
|
|
rropt = proto_tree_add_item(rr_tree, hf_dns_rr_opt, tvb, cur_offset, 4 + optlen, ENC_NA);
|
|
proto_item_append_text(rropt, ": %s", val_to_str(optcode, edns0_opt_code_vals, "Unknown (%d)"));
|
|
rropt_tree = proto_item_add_subtree(rropt, ett_dns_opts);
|
|
proto_tree_add_item(rropt_tree, hf_dns_rr_opt_code, tvb, cur_offset, 2, ENC_BIG_ENDIAN);
|
|
cur_offset += 2;
|
|
rropt = proto_tree_add_item(rropt_tree, hf_dns_rr_opt_len, tvb, cur_offset, 2, ENC_BIG_ENDIAN);
|
|
cur_offset += 2;
|
|
|
|
proto_tree_add_item(rropt_tree, hf_dns_rr_opt_data, tvb, cur_offset, optlen, ENC_NA);
|
|
switch(optcode) {
|
|
case O_CLIENT_SUBNET:{
|
|
guint16 family;
|
|
union {
|
|
guint32 addr;
|
|
guint8 bytes[16];
|
|
} ip_addr = {0};
|
|
|
|
family = tvb_get_ntohs(tvb, cur_offset);
|
|
proto_tree_add_item(rropt_tree, hf_dns_rr_opt_client_family, tvb, cur_offset, 2, ENC_BIG_ENDIAN);
|
|
cur_offset += 2;
|
|
proto_tree_add_item(rropt_tree, hf_dns_rr_opt_client_netmask, tvb, cur_offset, 1, ENC_BIG_ENDIAN);
|
|
cur_offset += 1;
|
|
proto_tree_add_item(rropt_tree, hf_dns_rr_opt_client_scope, tvb, cur_offset, 1, ENC_BIG_ENDIAN);
|
|
cur_offset += 1;
|
|
|
|
if (optlen-4 > 16) {
|
|
expert_add_info_format(pinfo, rropt, PI_MALFORMED, PI_ERROR,
|
|
"Length too long for any type of IP address.");
|
|
/* Avoid stack-smashing which occurs otherwise with the
|
|
* following tvb_memcpy. */
|
|
optlen = 20;
|
|
}
|
|
tvb_memcpy(tvb, ip_addr.bytes, cur_offset, (optlen - 4));
|
|
switch(family) {
|
|
case AFNUM_INET:
|
|
proto_tree_add_ipv4(rropt_tree, hf_dns_rr_opt_client_addr4, tvb,
|
|
cur_offset, (optlen - 4), ip_addr.addr);
|
|
break;
|
|
case AFNUM_INET6:
|
|
proto_tree_add_ipv6(rropt_tree, hf_dns_rr_opt_client_addr6, tvb,
|
|
cur_offset, (optlen - 4), ip_addr.bytes);
|
|
break;
|
|
default:
|
|
proto_tree_add_item(rropt_tree, hf_dns_rr_opt_client_addr, tvb, cur_offset, (optlen - 4),
|
|
ENC_NA);
|
|
|
|
break;
|
|
}
|
|
cur_offset += (optlen - 4);
|
|
rropt_len -= optlen;
|
|
}
|
|
break;
|
|
default:
|
|
cur_offset += optlen;
|
|
rropt_len -= optlen;
|
|
break;
|
|
}
|
|
|
|
}
|
|
}
|
|
break;
|
|
|
|
case T_DS:
|
|
case T_DLV:
|
|
{
|
|
guint16 keytag, digest_data_size;
|
|
guint8 ds_algorithm, ds_digest;
|
|
int rr_len = data_len;
|
|
|
|
static const value_string tds_digests[] = {
|
|
{ TDSDIGEST_RESERVED, "Reserved digest" },
|
|
{ TDSDIGEST_SHA1, "SHA-1" },
|
|
{ TDSDIGEST_SHA256, "SHA-256" },
|
|
{ TDSDIGEST_GOST, "GOST R 34.11-94" },
|
|
{ TDSDIGEST_SHA384, "SHA-384" },
|
|
{ 0, NULL }
|
|
};
|
|
|
|
|
|
if (rr_len < 2) {
|
|
goto bad_rr;
|
|
}
|
|
keytag = tvb_get_ntohs(tvb, cur_offset);
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 2, "Key id: %04u", keytag);
|
|
cur_offset += 2;
|
|
rr_len -= 2;
|
|
|
|
if (rr_len < 1) {
|
|
goto bad_rr;
|
|
}
|
|
ds_algorithm = tvb_get_guint8(tvb, cur_offset);
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 1,
|
|
"Algorithm: %s", val_to_str(ds_algorithm, dnssec_algo_vals,"Unknown (0x%02X)") );
|
|
cur_offset += 1;
|
|
rr_len -= 1;
|
|
|
|
if (rr_len < 1) {
|
|
goto bad_rr;
|
|
}
|
|
ds_digest = tvb_get_guint8(tvb, cur_offset);
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 1,
|
|
"Digest type: %s", val_to_str(ds_digest, tds_digests, "Unknown (0x%02X)"));
|
|
cur_offset += 1;
|
|
rr_len -= 1;
|
|
|
|
if (ds_digest == TDSDIGEST_SHA1) {
|
|
digest_data_size = 20; /* SHA1 key is always 20 bytes long */
|
|
if (rr_len < digest_data_size) {
|
|
goto bad_rr;
|
|
}
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, digest_data_size, "Public key");
|
|
}
|
|
|
|
if (ds_digest == TDSDIGEST_SHA256) {
|
|
digest_data_size = 32; /* SHA256 key is always 32 bytes long */
|
|
if (rr_len < digest_data_size) {
|
|
goto bad_rr;
|
|
}
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, digest_data_size, "Public key");
|
|
}
|
|
|
|
if (ds_digest == TDSDIGEST_GOST) {
|
|
digest_data_size = 64; /* GOST key is always 64 bytes long */
|
|
if (rr_len < digest_data_size) {
|
|
goto bad_rr;
|
|
}
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, digest_data_size, "Public key");
|
|
}
|
|
|
|
if (ds_digest == TDSDIGEST_SHA384) {
|
|
digest_data_size = 48; /* SHA384 key is always 48 bytes long */
|
|
if (rr_len < digest_data_size) {
|
|
goto bad_rr;
|
|
}
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, digest_data_size, "Public key");
|
|
}
|
|
}
|
|
break;
|
|
|
|
case T_TKEY:
|
|
{
|
|
const guchar *tkey_algname;
|
|
int tkey_algname_len;
|
|
guint16 tkey_mode, tkey_error, tkey_keylen, tkey_otherlen;
|
|
int rr_len = data_len;
|
|
nstime_t nstime;
|
|
|
|
static const value_string tkey_modes[] = {
|
|
{ TKEYMODE_SERVERASSIGNED, "Server assigned" },
|
|
{ TKEYMODE_DIFFIEHELLMAN, "Diffie Hellman" },
|
|
{ TKEYMODE_GSSAPI, "GSSAPI" },
|
|
{ TKEYMODE_RESOLVERASSIGNED, "Resolver assigned" },
|
|
{ TKEYMODE_DELETE, "Delete" },
|
|
{ 0, NULL } };
|
|
|
|
|
|
proto_tree *key_tree;
|
|
proto_item *key_item;
|
|
|
|
/* XXX Fix data length */
|
|
tkey_algname_len = get_dns_name(tvb, cur_offset, 0, dns_data_offset, &tkey_algname);
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, tkey_algname_len,
|
|
"Algorithm name: %s",
|
|
format_text(tkey_algname, strlen(tkey_algname)));
|
|
cur_offset += tkey_algname_len;
|
|
rr_len -= tkey_algname_len;
|
|
|
|
if (rr_len < 4) {
|
|
goto bad_rr;
|
|
}
|
|
nstime.secs = tvb_get_ntohl(tvb, cur_offset);
|
|
nstime.nsecs = 0;
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 4, "Signature inception: %s",
|
|
abs_time_to_str(&nstime, ABSOLUTE_TIME_LOCAL, TRUE));
|
|
cur_offset += 4;
|
|
rr_len -= 4;
|
|
|
|
if (rr_len < 4) {
|
|
goto bad_rr;
|
|
}
|
|
nstime.secs = tvb_get_ntohl(tvb, cur_offset);
|
|
nstime.nsecs = 0;
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 4, "Signature expiration: %s",
|
|
abs_time_to_str(&nstime, ABSOLUTE_TIME_LOCAL, TRUE));
|
|
cur_offset += 4;
|
|
rr_len -= 4;
|
|
|
|
if (rr_len < 2) {
|
|
goto bad_rr;
|
|
}
|
|
tkey_mode = tvb_get_ntohs(tvb, cur_offset);
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 2, "Mode: %s",
|
|
val_to_str(tkey_mode, tkey_modes,
|
|
"Unknown (0x%04X)"));
|
|
cur_offset += 2;
|
|
rr_len -= 2;
|
|
|
|
if (rr_len < 2) {
|
|
goto bad_rr;
|
|
}
|
|
tkey_error = tvb_get_ntohs(tvb, cur_offset);
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 2, "Error: %s",
|
|
val_to_str(tkey_error, rcode_vals,
|
|
val_to_str(tkey_error, tsigerror_vals, "Unknown error (%x)")));
|
|
cur_offset += 2;
|
|
rr_len -= 2;
|
|
|
|
tkey_keylen = tvb_get_ntohs(tvb, cur_offset);
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 2, "Key Size: %u",
|
|
tkey_keylen);
|
|
cur_offset += 2;
|
|
rr_len -= 2;
|
|
|
|
if (tkey_keylen != 0) {
|
|
key_item = proto_tree_add_text(
|
|
rr_tree, tvb, cur_offset, tkey_keylen, "Key Data");
|
|
|
|
key_tree = proto_item_add_subtree(key_item, ett_t_key);
|
|
|
|
switch(tkey_mode) {
|
|
case TKEYMODE_GSSAPI: {
|
|
tvbuff_t *gssapi_tvb;
|
|
|
|
/*
|
|
* XXX - in at least one capture, this appears to
|
|
* be an NTLMSSP blob, with no ASN.1 in it, in
|
|
* a query.
|
|
*
|
|
* See RFC 3645 which might indicate what's going
|
|
* on here. (The key is an output_token from
|
|
* GSS_Init_sec_context.)
|
|
*
|
|
* How the heck do we know what method is being
|
|
* used, so we know how to decode the key? Do we
|
|
* have to look at the algorithm name, e.g.
|
|
* "gss.microsoft.com"? We currently do as the
|
|
* the SMB dissector does in some cases, and check
|
|
* whether the security blob begins with "NTLMSSP".
|
|
*/
|
|
gssapi_tvb = tvb_new_subset(
|
|
tvb, cur_offset, tkey_keylen, tkey_keylen);
|
|
if (tvb_strneql(gssapi_tvb, 0, "NTLMSSP", 7) == 0) {
|
|
call_dissector(ntlmssp_handle, gssapi_tvb, pinfo, key_tree);
|
|
} else {
|
|
call_dissector(gssapi_handle, gssapi_tvb, pinfo, key_tree);
|
|
}
|
|
break;
|
|
}
|
|
default:
|
|
|
|
/* No dissector for this key mode */
|
|
|
|
break;
|
|
}
|
|
|
|
cur_offset += tkey_keylen;
|
|
rr_len -= tkey_keylen;
|
|
}
|
|
|
|
if (rr_len < 2) {
|
|
goto bad_rr;
|
|
}
|
|
tkey_otherlen = tvb_get_ntohs(tvb, cur_offset);
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 2, "Other Size: %u",
|
|
tkey_otherlen);
|
|
cur_offset += 2;
|
|
rr_len -= 2;
|
|
|
|
if (tkey_otherlen != 0) {
|
|
if (rr_len < tkey_otherlen) {
|
|
goto bad_rr;
|
|
}
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, tkey_otherlen, "Other Data");
|
|
}
|
|
|
|
}
|
|
break;
|
|
|
|
case T_TSIG:
|
|
{
|
|
guint16 tsig_error, tsig_timehi, tsig_siglen, tsig_otherlen;
|
|
guint32 tsig_timelo;
|
|
const guchar *tsig_raw_algname;
|
|
char *tsig_algname;
|
|
int tsig_algname_len;
|
|
nstime_t nstime;
|
|
int rr_len = data_len;
|
|
|
|
/* XXX Fix data length */
|
|
tsig_algname_len = get_dns_name(tvb, cur_offset, 0, dns_data_offset, &tsig_raw_algname);
|
|
tsig_algname=format_text(tsig_raw_algname, strlen(tsig_raw_algname));
|
|
proto_tree_add_string(rr_tree, hf_dns_tsig_algorithm_name, tvb, cur_offset, tsig_algname_len, tsig_algname);
|
|
cur_offset += tsig_algname_len;
|
|
rr_len -= tsig_algname_len;
|
|
|
|
if (rr_len < 6) {
|
|
goto bad_rr;
|
|
}
|
|
tsig_timehi = tvb_get_ntohs(tvb, cur_offset);
|
|
tsig_timelo = tvb_get_ntohl(tvb, cur_offset + 2);
|
|
nstime.secs = tsig_timelo;
|
|
nstime.nsecs = 0;
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 6, "Time signed: %s%s",
|
|
abs_time_to_str(&nstime, ABSOLUTE_TIME_LOCAL, TRUE),
|
|
tsig_timehi == 0 ? "" : "(high bits set)");
|
|
cur_offset += 6;
|
|
rr_len -= 6;
|
|
|
|
if (rr_len < 2) {
|
|
goto bad_rr;
|
|
}
|
|
proto_tree_add_item(rr_tree, hf_dns_tsig_fudge, tvb, cur_offset, 2, ENC_BIG_ENDIAN);
|
|
cur_offset += 2;
|
|
rr_len -= 2;
|
|
|
|
if (rr_len < 2) {
|
|
goto bad_rr;
|
|
}
|
|
tsig_siglen = tvb_get_ntohs(tvb, cur_offset);
|
|
proto_tree_add_item(rr_tree, hf_dns_tsig_mac_size, tvb, cur_offset, 2, ENC_BIG_ENDIAN);
|
|
cur_offset += 2;
|
|
rr_len -= 2;
|
|
|
|
if (tsig_siglen != 0) {
|
|
proto_item *mac_item;
|
|
proto_tree *mac_tree;
|
|
tvbuff_t *sub_tvb;
|
|
|
|
if (rr_len < tsig_siglen) {
|
|
goto bad_rr;
|
|
}
|
|
mac_item = proto_tree_add_item(rr_tree, hf_dns_tsig_mac, tvb, cur_offset, tsig_siglen, ENC_NA);
|
|
mac_tree = proto_item_add_subtree(mac_item, ett_dns_mac);
|
|
|
|
sub_tvb=tvb_new_subset(tvb, cur_offset, tsig_siglen, tsig_siglen);
|
|
|
|
if (!dissector_try_string(dns_tsig_dissector_table, tsig_algname, sub_tvb, pinfo, mac_tree)) {
|
|
proto_tree_add_text(mac_tree, sub_tvb, 0, tvb_length(sub_tvb),
|
|
"No dissector for algorithm:%s", tsig_algname);
|
|
}
|
|
|
|
cur_offset += tsig_siglen;
|
|
rr_len -= tsig_siglen;
|
|
}
|
|
|
|
if (rr_len < 2) {
|
|
goto bad_rr;
|
|
}
|
|
proto_tree_add_item(rr_tree, hf_dns_tsig_original_id, tvb, cur_offset, 2, ENC_BIG_ENDIAN);
|
|
cur_offset += 2;
|
|
rr_len -= 2;
|
|
|
|
if (rr_len < 2) {
|
|
goto bad_rr;
|
|
}
|
|
tsig_error = tvb_get_ntohs(tvb, cur_offset);
|
|
proto_tree_add_uint_format(rr_tree, hf_dns_tsig_error, tvb, cur_offset, 2, tsig_error, "Error: %s (%d)",
|
|
val_to_str_const(tsig_error, rcode_vals,
|
|
val_to_str_const(tsig_error, tsigerror_vals, "Unknown error")),
|
|
tsig_error);
|
|
cur_offset += 2;
|
|
rr_len -= 2;
|
|
|
|
if (rr_len < 2) {
|
|
goto bad_rr;
|
|
}
|
|
tsig_otherlen = tvb_get_ntohs(tvb, cur_offset);
|
|
proto_tree_add_item(rr_tree, hf_dns_tsig_other_len, tvb, cur_offset, 2, ENC_BIG_ENDIAN);
|
|
cur_offset += 2;
|
|
rr_len -= 2;
|
|
|
|
if (tsig_otherlen != 0) {
|
|
if (rr_len < tsig_otherlen) {
|
|
goto bad_rr;
|
|
}
|
|
proto_tree_add_item(rr_tree, hf_dns_tsig_other_data, tvb, cur_offset, tsig_otherlen, ENC_NA);
|
|
}
|
|
|
|
}
|
|
break;
|
|
|
|
case T_WINS:
|
|
{
|
|
int rr_len = data_len;
|
|
guint32 local_flag;
|
|
guint32 lookup_timeout;
|
|
guint32 cache_timeout;
|
|
guint32 nservers;
|
|
|
|
|
|
if (rr_len < 4) {
|
|
goto bad_rr;
|
|
}
|
|
local_flag = tvb_get_ntohl(tvb, cur_offset);
|
|
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 4, "Local flag: %s",
|
|
local_flag ? "true" : "false");
|
|
|
|
cur_offset += 4;
|
|
rr_len -= 4;
|
|
|
|
if (rr_len < 4) {
|
|
goto bad_rr;
|
|
}
|
|
lookup_timeout = tvb_get_ntohl(tvb, cur_offset);
|
|
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 4, "Lookup timeout: %u seconds",
|
|
lookup_timeout);
|
|
|
|
cur_offset += 4;
|
|
rr_len -= 4;
|
|
|
|
if (rr_len < 4) {
|
|
goto bad_rr;
|
|
}
|
|
cache_timeout = tvb_get_ntohl(tvb, cur_offset);
|
|
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 4, "Cache timeout: %u seconds",
|
|
cache_timeout);
|
|
|
|
cur_offset += 4;
|
|
rr_len -= 4;
|
|
|
|
if (rr_len < 4) {
|
|
goto bad_rr;
|
|
}
|
|
nservers = tvb_get_ntohl(tvb, cur_offset);
|
|
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 4, "Number of WINS servers: %u",
|
|
nservers);
|
|
|
|
cur_offset += 4;
|
|
rr_len -= 4;
|
|
|
|
while (rr_len != 0 && nservers != 0) {
|
|
if (rr_len < 4) {
|
|
goto bad_rr;
|
|
}
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 4, "WINS server address: %s",
|
|
tvb_ip_to_str(tvb, cur_offset));
|
|
|
|
cur_offset += 4;
|
|
rr_len -= 4;
|
|
nservers--;
|
|
}
|
|
|
|
}
|
|
break;
|
|
|
|
case T_WINS_R:
|
|
{
|
|
int rr_len = data_len;
|
|
guint32 local_flag;
|
|
guint32 lookup_timeout;
|
|
guint32 cache_timeout;
|
|
const guchar *dname;
|
|
int dname_len;
|
|
|
|
if (rr_len < 4) {
|
|
goto bad_rr;
|
|
}
|
|
local_flag = tvb_get_ntohl(tvb, cur_offset);
|
|
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 4, "Local flag: %s",
|
|
local_flag ? "true" : "false");
|
|
|
|
cur_offset += 4;
|
|
rr_len -= 4;
|
|
|
|
if (rr_len < 4) {
|
|
goto bad_rr;
|
|
}
|
|
lookup_timeout = tvb_get_ntohl(tvb, cur_offset);
|
|
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 4, "Lookup timeout: %u seconds",
|
|
lookup_timeout);
|
|
|
|
cur_offset += 4;
|
|
rr_len -= 4;
|
|
|
|
if (rr_len < 4) {
|
|
goto bad_rr;
|
|
}
|
|
cache_timeout = tvb_get_ntohl(tvb, cur_offset);
|
|
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 4, "Cache timeout: %u seconds",
|
|
cache_timeout);
|
|
|
|
cur_offset += 4;
|
|
/* rr_len -= 4; */
|
|
|
|
/* XXX Fix data length */
|
|
dname_len = get_dns_name(tvb, cur_offset, 0, dns_data_offset, &dname);
|
|
name_out = format_text(dname, strlen(dname));
|
|
if (cinfo != NULL) {
|
|
col_append_fstr(cinfo, COL_INFO, " %s", name_out);
|
|
}
|
|
proto_item_append_text(trr, ", name result domain %s", name_out);
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, dname_len, "Name result domain: %s",
|
|
name_out);
|
|
}
|
|
break;
|
|
|
|
case T_SRV:
|
|
{
|
|
guint16 priority = 0;
|
|
guint16 weight = 0;
|
|
guint16 port = 0;
|
|
const guchar *target;
|
|
int target_len;
|
|
|
|
priority = tvb_get_ntohs(tvb, cur_offset);
|
|
weight = tvb_get_ntohs(tvb, cur_offset+2);
|
|
port = tvb_get_ntohs(tvb, cur_offset+4);
|
|
|
|
/* XXX Fix data length */
|
|
target_len = get_dns_name(tvb, cur_offset + 6, 0, dns_data_offset, &target);
|
|
name_out = format_text(target, strlen(target));
|
|
if (cinfo != NULL) {
|
|
col_append_fstr(cinfo, COL_INFO, " %u %u %u %s", priority, weight, port, name_out);
|
|
}
|
|
proto_item_append_text(trr,
|
|
", priority %u, weight %u, port %u, target %s",
|
|
priority, weight, port, name_out);
|
|
proto_tree_add_uint(rr_tree, hf_dns_srv_priority, tvb, cur_offset, 2, priority);
|
|
proto_tree_add_uint(rr_tree, hf_dns_srv_weight, tvb, cur_offset + 2, 2, weight);
|
|
proto_tree_add_uint(rr_tree, hf_dns_srv_port, tvb, cur_offset + 4, 2, port);
|
|
proto_tree_add_string(rr_tree, hf_dns_srv_target, tvb, cur_offset + 6, target_len, name_out);
|
|
}
|
|
break;
|
|
|
|
case T_NAPTR:
|
|
{
|
|
int offset = cur_offset;
|
|
guint16 order;
|
|
guint16 preference;
|
|
gchar *flags;
|
|
guint8 flags_len;
|
|
guchar *service;
|
|
guint8 service_len;
|
|
guchar *regex;
|
|
guint8 regex_len;
|
|
const guchar *replacement;
|
|
int replacement_len;
|
|
|
|
order = tvb_get_ntohs(tvb, offset);
|
|
offset += 2;
|
|
preference = tvb_get_ntohs(tvb, offset);
|
|
offset += 2;
|
|
flags_len = tvb_get_guint8(tvb, offset);
|
|
offset++;
|
|
flags = tvb_get_ephemeral_string(tvb, offset, flags_len);
|
|
offset += flags_len;
|
|
service_len = tvb_get_guint8(tvb, offset);
|
|
offset++;
|
|
service = tvb_get_ephemeral_string(tvb, offset, service_len);
|
|
offset += service_len;
|
|
regex_len = tvb_get_guint8(tvb, offset);
|
|
offset++;
|
|
regex = tvb_get_ephemeral_string(tvb, offset, regex_len);
|
|
offset += regex_len;
|
|
replacement_len = get_dns_name(tvb, offset, 0, dns_data_offset, &replacement);
|
|
name_out = format_text(replacement, strlen(replacement));
|
|
|
|
if (cinfo != NULL) {
|
|
col_append_fstr(cinfo, COL_INFO, " %u %u %s", order, preference, flags);
|
|
}
|
|
|
|
proto_item_append_text(trr, ", order %u, preference %u, flags %s",
|
|
order, preference, flags);
|
|
offset = cur_offset;
|
|
proto_tree_add_text(rr_tree, tvb, offset, 2, "Order: %u", order);
|
|
offset += 2;
|
|
proto_tree_add_text(rr_tree, tvb, offset, 2, "Preference: %u", preference);
|
|
offset += 2;
|
|
proto_tree_add_text(rr_tree, tvb, offset, 1, "Flags length: %u", flags_len);
|
|
offset++;
|
|
proto_tree_add_text(rr_tree, tvb, offset, flags_len, "Flags: \"%s\"", flags);
|
|
offset += flags_len;
|
|
proto_tree_add_text(rr_tree, tvb, offset, 1, "Service length: %u", service_len);
|
|
offset++;
|
|
proto_tree_add_text(rr_tree, tvb, offset, service_len, "Service: \"%s\"", service);
|
|
offset += service_len;
|
|
proto_tree_add_text(rr_tree, tvb, offset, 1, "Regex length: %u", regex_len);
|
|
offset++;
|
|
proto_tree_add_text(rr_tree, tvb, offset, regex_len, "Regex: \"%s\"", regex);
|
|
offset += regex_len;
|
|
proto_tree_add_text(rr_tree, tvb, offset, 1, "Replacement length: %u", replacement_len);
|
|
offset++;
|
|
proto_tree_add_text(rr_tree, tvb, offset, replacement_len, "Replacement: %s", name_out);
|
|
|
|
}
|
|
break;
|
|
|
|
case T_SSHFP:
|
|
{
|
|
guint8 sshfp_algorithm, sshfp_type;
|
|
int rr_len = data_len;
|
|
|
|
static const value_string sshfp_algo[] = {
|
|
{ TSSHFP_ALGO_RESERVED, "Reserved" },
|
|
{ TSSHFP_ALGO_RSA, "RSA" },
|
|
{ TSSHFP_ALGO_DSA, "DSA" },
|
|
{ 0, NULL }
|
|
};
|
|
|
|
static const value_string sshfp_fingertype[] = {
|
|
{ TSSHFP_FTYPE_RESERVED, "Reserved" },
|
|
{ TSSHFP_FTYPE_SHA1, "SHA1" },
|
|
{ 0, NULL }
|
|
};
|
|
|
|
|
|
if (rr_len < 1) {
|
|
goto bad_rr;
|
|
}
|
|
sshfp_algorithm = tvb_get_guint8(tvb, cur_offset);
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 1,
|
|
"Algorithm: %s", val_to_str(sshfp_algorithm, sshfp_algo, "Unknown (0x%02X)"));
|
|
cur_offset += 1;
|
|
rr_len -= 1;
|
|
|
|
if (rr_len < 1) {
|
|
goto bad_rr;
|
|
}
|
|
sshfp_type = tvb_get_guint8(tvb, cur_offset);
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 1,
|
|
"Fingerprint type: %s", val_to_str(sshfp_type, sshfp_fingertype, "Unknown (0x%02X)"));
|
|
cur_offset += 1;
|
|
rr_len -= 1;
|
|
|
|
if (rr_len < 1) {
|
|
goto bad_rr;
|
|
}
|
|
if (rr_len != 0) {
|
|
proto_tree_add_item(rr_tree, hf_dns_sshfp_fingerprint, tvb, cur_offset, rr_len, ENC_NA);
|
|
}
|
|
}
|
|
break;
|
|
|
|
case T_HIP:
|
|
{
|
|
guint8 hit_len, algo;
|
|
guint16 pk_len;
|
|
int rr_len = data_len;
|
|
int rendezvous_len;
|
|
const guchar *rend_server_dns_name;
|
|
|
|
static const value_string hip_algo_vals[] = {
|
|
{ THIP_ALGO_DSA, "DSA" },
|
|
{ THIP_ALGO_RSA, "RSA" },
|
|
{ THIP_ALGO_RESERVED, "Reserved" },
|
|
{ 0, NULL }
|
|
};
|
|
|
|
if (cinfo != NULL) {
|
|
col_append_fstr(cinfo, COL_INFO, " %s", name);
|
|
}
|
|
|
|
if (rr_len < 1) {
|
|
goto bad_rr;
|
|
}
|
|
hit_len = tvb_get_guint8(tvb, cur_offset);
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 1, "HIT length: %u", hit_len);
|
|
cur_offset += 1;
|
|
rr_len -= 1;
|
|
|
|
if (rr_len < 1) {
|
|
goto bad_rr;
|
|
}
|
|
algo = tvb_get_guint8(tvb, cur_offset);
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 1,
|
|
"PK algorithm: %s", val_to_str(algo, hip_algo_vals, "Unknown (0x%02X)"));
|
|
cur_offset += 1;
|
|
rr_len -= 1;
|
|
|
|
if (rr_len < 1) {
|
|
goto bad_rr;
|
|
}
|
|
pk_len = tvb_get_ntohs(tvb, cur_offset);
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 2, "PK length: %u", pk_len);
|
|
cur_offset += 2;
|
|
rr_len -= 2;
|
|
|
|
if (rr_len < 1) {
|
|
goto bad_rr;
|
|
}
|
|
proto_tree_add_item(rr_tree, hf_dns_hip_hit, tvb, cur_offset, hit_len, ENC_NA);
|
|
cur_offset += hit_len;
|
|
rr_len -= hit_len;
|
|
|
|
if (rr_len < 1) {
|
|
goto bad_rr;
|
|
}
|
|
proto_tree_add_item(rr_tree, hf_dns_hip_pk, tvb, cur_offset, pk_len, ENC_NA);
|
|
cur_offset += pk_len;
|
|
rr_len -= pk_len;
|
|
|
|
if (rr_len < 1) {
|
|
goto bad_rr;
|
|
}
|
|
while (rr_len > 1) {
|
|
rendezvous_len = get_dns_name(tvb, cur_offset, 0, dns_data_offset, &rend_server_dns_name);
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, rendezvous_len, "Rendezvous Server: %s",
|
|
format_text(rend_server_dns_name, strlen(rend_server_dns_name)));
|
|
cur_offset += rendezvous_len;
|
|
rr_len -= rendezvous_len;
|
|
}
|
|
|
|
}
|
|
break;
|
|
|
|
case T_DHCID:
|
|
{
|
|
if (cinfo != NULL) {
|
|
col_append_fstr(cinfo, COL_INFO, " %s", name);
|
|
}
|
|
|
|
if (data_len < 1) {
|
|
goto bad_rr;
|
|
}
|
|
proto_tree_add_item(rr_tree, hf_dns_dhcid_rdata, tvb, cur_offset, data_len, ENC_NA);
|
|
|
|
|
|
}
|
|
break;
|
|
|
|
case T_APL:
|
|
{
|
|
int rr_len = data_len;
|
|
guint16 afamily;
|
|
guint8 afdpart_len;
|
|
guint8 *addr_copy;
|
|
|
|
|
|
if (cinfo != NULL) {
|
|
col_append_fstr(cinfo, COL_INFO, " %s", name);
|
|
}
|
|
|
|
while (rr_len > 1) {
|
|
|
|
if (rr_len < 1) {
|
|
goto bad_rr;
|
|
}
|
|
afamily = tvb_get_ntohs(tvb, cur_offset);
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 2,
|
|
"Address Family: %s", val_to_str(afamily, afamily_vals, "Unknown (0x%02X)"));
|
|
cur_offset += 2;
|
|
rr_len -= 2;
|
|
|
|
if (rr_len < 1) {
|
|
goto bad_rr;
|
|
}
|
|
proto_tree_add_item(rr_tree, hf_dns_apl_coded_prefix, tvb, cur_offset, 1, ENC_BIG_ENDIAN);
|
|
cur_offset += 1;
|
|
rr_len -= 1;
|
|
|
|
if (rr_len < 1) {
|
|
goto bad_rr;
|
|
}
|
|
afdpart_len = tvb_get_guint8(tvb, cur_offset) & DNS_APL_AFDLENGTH;
|
|
proto_tree_add_item(rr_tree, hf_dns_apl_negation, tvb, cur_offset, 1, ENC_BIG_ENDIAN);
|
|
proto_tree_add_item(rr_tree, hf_dns_apl_afdlength, tvb, cur_offset, 1, ENC_BIG_ENDIAN);
|
|
cur_offset += 1;
|
|
rr_len -= 1;
|
|
|
|
if (rr_len < 1) {
|
|
goto bad_rr;
|
|
}
|
|
if (afamily == 1 && afdpart_len <= 4) {
|
|
addr_copy = se_alloc0(4);
|
|
} else if (afamily == 2 && afdpart_len <= 16) {
|
|
addr_copy = se_alloc0(16);
|
|
} else {
|
|
goto bad_rr;
|
|
}
|
|
tvb_memcpy(tvb, (guint8 *)addr_copy, cur_offset, afdpart_len);
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, afdpart_len,
|
|
"%s address: %s", val_to_str_const(afamily, afamily_vals, "Unknown"),
|
|
(afamily == 0x02) ? ip6_to_str((const struct e_in6_addr *)addr_copy)
|
|
: ip_to_str(addr_copy) );
|
|
cur_offset += afdpart_len;
|
|
rr_len -= afdpart_len;
|
|
}
|
|
}
|
|
break;
|
|
|
|
case T_GPOS:
|
|
{
|
|
guint8 long_len, lat_len, alt_len;
|
|
|
|
if (cinfo != NULL) {
|
|
col_append_fstr(cinfo, COL_INFO, " %s", name);
|
|
}
|
|
if (data_len < 1) {
|
|
goto bad_rr;
|
|
}
|
|
long_len = tvb_get_guint8(tvb, cur_offset);
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset + 1, long_len,
|
|
"Longitude: %.*s", long_len, tvb_get_ephemeral_string(tvb, cur_offset +1 , long_len));
|
|
cur_offset += 1 + long_len;
|
|
|
|
lat_len = tvb_get_guint8(tvb, cur_offset);
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset + 1, lat_len,
|
|
"Latitude: %.*s", lat_len, tvb_get_ephemeral_string(tvb, cur_offset + 1, lat_len));
|
|
cur_offset += 1 + lat_len;
|
|
|
|
alt_len = tvb_get_guint8(tvb, cur_offset);
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset + 1, alt_len,
|
|
"Altitude: %.*s", alt_len, tvb_get_ephemeral_string(tvb, cur_offset + 1, alt_len));
|
|
}
|
|
break;
|
|
|
|
case T_RP:
|
|
{
|
|
int mbox_dname_len, txt_dname_len;
|
|
const guchar *mbox_dname, *txt_dname;
|
|
|
|
if (cinfo != NULL) {
|
|
col_append_fstr(cinfo, COL_INFO, " %s", name);
|
|
}
|
|
if (data_len < 1) {
|
|
goto bad_rr;
|
|
}
|
|
mbox_dname_len = get_dns_name(tvb, cur_offset, 0, dns_data_offset, &mbox_dname);
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, mbox_dname_len,
|
|
"Mailbox: %s", format_text(mbox_dname, strlen(mbox_dname)));
|
|
cur_offset += mbox_dname_len;
|
|
txt_dname_len = get_dns_name(tvb, cur_offset, 0, dns_data_offset, &txt_dname);
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, txt_dname_len,
|
|
"TXT RR: %s", format_text(txt_dname, strlen(txt_dname)));
|
|
}
|
|
break;
|
|
|
|
case T_AFSDB:
|
|
case T_RT:
|
|
{
|
|
guint16 subtype = 0;
|
|
const guchar *host_name;
|
|
int host_name_len;
|
|
|
|
if (cinfo != NULL) {
|
|
col_append_fstr(cinfo, COL_INFO, " %s", name);
|
|
}
|
|
subtype = tvb_get_ntohs(tvb, cur_offset);
|
|
host_name_len = get_dns_name(tvb, cur_offset + 2, 0, dns_data_offset, &host_name);
|
|
|
|
if (data_len < 1) {
|
|
goto bad_rr;
|
|
}
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 2,
|
|
(type == T_AFSDB) ? "Subtype: %u" : "Preference: %u", subtype);
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset + 2, host_name_len,
|
|
(type == T_AFSDB) ? "Hostname: %s" : "Intermediate-Host: %s",
|
|
format_text(host_name, strlen(host_name)));
|
|
|
|
|
|
}
|
|
break;
|
|
|
|
case T_X25:
|
|
{
|
|
guint8 x25_len;
|
|
|
|
if (cinfo != NULL) {
|
|
col_append_fstr(cinfo, COL_INFO, " %s", name);
|
|
}
|
|
if (data_len < 1) {
|
|
goto bad_rr;
|
|
}
|
|
x25_len = tvb_get_guint8(tvb, cur_offset);
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, x25_len + 1,
|
|
"PSDN-Address: %.*s", x25_len,
|
|
tvb_get_ephemeral_string(tvb, cur_offset +1, x25_len));
|
|
}
|
|
break;
|
|
|
|
case T_ISDN:
|
|
{
|
|
guint8 isdn_address_len, isdn_sa_len;
|
|
int rr_len = data_len;
|
|
|
|
if (cinfo != NULL) {
|
|
col_append_fstr(cinfo, COL_INFO, " %s", name);
|
|
}
|
|
if (rr_len < 1) {
|
|
goto bad_rr;
|
|
}
|
|
isdn_address_len = tvb_get_guint8(tvb, cur_offset);
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, isdn_address_len + 1,
|
|
"ISDN Address: %.*s", isdn_address_len,
|
|
tvb_get_ephemeral_string(tvb, cur_offset +1, isdn_address_len));
|
|
cur_offset += 1 + isdn_address_len;
|
|
rr_len -= 1 + isdn_address_len;
|
|
|
|
if (rr_len > 1) /* ISDN SA is optional */ {
|
|
isdn_sa_len = tvb_get_guint8(tvb, cur_offset);
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, isdn_sa_len + 1,
|
|
"Subaddress: %.*s", isdn_sa_len,
|
|
tvb_get_ephemeral_string(tvb, cur_offset +1, isdn_sa_len));
|
|
}
|
|
}
|
|
break;
|
|
|
|
case T_PX:
|
|
{
|
|
int px_map822_len, px_mapx400_len;
|
|
const guchar *px_map822_dnsname, *px_mapx400_dnsname;
|
|
|
|
if (cinfo != NULL) {
|
|
col_append_fstr(cinfo, COL_INFO, " %s", name);
|
|
}
|
|
if (data_len < 1) {
|
|
goto bad_rr;
|
|
}
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, 2, "Preference: %u", tvb_get_ntohs(tvb, cur_offset));
|
|
cur_offset += 2;
|
|
px_map822_len = get_dns_name(tvb, cur_offset, 0, dns_data_offset, &px_map822_dnsname);
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, px_map822_len,
|
|
"MAP822: %s", format_text(px_map822_dnsname, strlen(px_map822_dnsname)));
|
|
cur_offset += px_map822_len;
|
|
px_mapx400_len = get_dns_name(tvb, cur_offset, 0, dns_data_offset, &px_mapx400_dnsname);
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, px_mapx400_len,
|
|
"MAPX400: %s", format_text(px_mapx400_dnsname, strlen(px_mapx400_dnsname)) );
|
|
/*cur_offset += px_mapx400_len;*/
|
|
}
|
|
break;
|
|
|
|
case T_NSAP:
|
|
{
|
|
if (cinfo != NULL) {
|
|
col_append_fstr(cinfo, COL_INFO, " %s", name);
|
|
}
|
|
if (data_len < 1) {
|
|
goto bad_rr;
|
|
}
|
|
proto_tree_add_item(rr_tree, hf_dns_nsap_rdata, tvb, cur_offset, data_len, ENC_NA);
|
|
}
|
|
break;
|
|
|
|
case T_NSAP_PTR:
|
|
{
|
|
int nsap_ptr_owner_len;
|
|
const guchar *nsap_ptr_owner;
|
|
|
|
if (cinfo != NULL) {
|
|
col_append_fstr(cinfo, COL_INFO, " %s", name);
|
|
}
|
|
if (data_len < 1) {
|
|
goto bad_rr;
|
|
}
|
|
nsap_ptr_owner_len = get_dns_name(tvb, cur_offset, 0, dns_data_offset, &nsap_ptr_owner);
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, nsap_ptr_owner_len,
|
|
"Owner: %s", format_text(nsap_ptr_owner, strlen(nsap_ptr_owner)) );
|
|
}
|
|
break;
|
|
|
|
case T_MB:
|
|
case T_MF:
|
|
case T_MD:
|
|
case T_MG:
|
|
case T_MR:
|
|
{
|
|
int hostname_len;
|
|
const guchar *hostname_str;
|
|
|
|
if (cinfo != NULL) {
|
|
col_append_fstr(cinfo, COL_INFO, " %s", name);
|
|
}
|
|
if (data_len < 1) {
|
|
goto bad_rr;
|
|
}
|
|
hostname_len = get_dns_name(tvb, cur_offset, 0, dns_data_offset, &hostname_str);
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, hostname_len, "Host: %s", format_text(hostname_str, strlen(hostname_str)));
|
|
}
|
|
break;
|
|
|
|
case T_MINFO:
|
|
{
|
|
int rmailbx_len, emailbx_len;
|
|
const guchar *rmailbx_str, *emailbx_str;
|
|
|
|
if (cinfo != NULL) {
|
|
col_append_fstr(cinfo, COL_INFO, " %s", name);
|
|
}
|
|
if (data_len < 1) {
|
|
goto bad_rr;
|
|
}
|
|
rmailbx_len = get_dns_name(tvb, cur_offset, 0, dns_data_offset, &rmailbx_str);
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, rmailbx_len,
|
|
"Responsible Mailbox: %s", format_text(rmailbx_str, strlen(rmailbx_str)));
|
|
cur_offset += rmailbx_len;
|
|
emailbx_len = get_dns_name(tvb, cur_offset, 0, dns_data_offset, &emailbx_str);
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, emailbx_len,
|
|
"Error Mailbox: %s", format_text(emailbx_str, strlen(emailbx_str)));
|
|
}
|
|
break;
|
|
|
|
case T_NULL:
|
|
{
|
|
if (cinfo != NULL) {
|
|
col_append_fstr(cinfo, COL_INFO, " %s", name);
|
|
}
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, data_len, "Data");
|
|
}
|
|
break;
|
|
|
|
/* TODO: parse more record types */
|
|
|
|
default:
|
|
|
|
proto_tree_add_text(rr_tree, tvb, cur_offset, data_len, "Data");
|
|
break;
|
|
}
|
|
|
|
data_offset += data_len;
|
|
|
|
return data_offset - data_start;
|
|
|
|
bad_rr:
|
|
|
|
proto_item_append_text(trr, ", bad RR length %d, too short",
|
|
data_len);
|
|
|
|
|
|
data_offset += data_len;
|
|
|
|
return data_offset - data_start;
|
|
}
|
|
|
|
static int
|
|
dissect_query_records(tvbuff_t *tvb, int cur_off, int dns_data_offset,
|
|
int count, column_info *cinfo, proto_tree *dns_tree, gboolean isupdate,
|
|
gboolean is_mdns)
|
|
{
|
|
int start_off, add_off;
|
|
proto_tree *qatree = NULL;
|
|
proto_item *ti = NULL;
|
|
|
|
start_off = cur_off;
|
|
if (dns_tree) {
|
|
const char *s = (isupdate ? "Zone" : "Queries");
|
|
ti = proto_tree_add_text(dns_tree, tvb, start_off, -1, "%s", s);
|
|
qatree = proto_item_add_subtree(ti, ett_dns_qry);
|
|
}
|
|
while (count-- > 0) {
|
|
add_off = dissect_dns_query(tvb, cur_off, dns_data_offset, cinfo, qatree,
|
|
is_mdns);
|
|
cur_off += add_off;
|
|
}
|
|
if (ti) {
|
|
proto_item_set_len(ti, cur_off - start_off);
|
|
}
|
|
return cur_off - start_off;
|
|
}
|
|
|
|
static int
|
|
dissect_answer_records(tvbuff_t *tvb, int cur_off, int dns_data_offset,
|
|
int count, column_info *cinfo, proto_tree *dns_tree, const char *name,
|
|
packet_info *pinfo, gboolean is_mdns)
|
|
{
|
|
int start_off, add_off;
|
|
proto_tree *qatree = NULL;
|
|
proto_item *ti = NULL;
|
|
|
|
start_off = cur_off;
|
|
if (dns_tree) {
|
|
ti = proto_tree_add_text(dns_tree, tvb, start_off, -1, "%s", name);
|
|
qatree = proto_item_add_subtree(ti, ett_dns_ans);
|
|
}
|
|
while (count-- > 0) {
|
|
add_off = dissect_dns_answer(
|
|
tvb, cur_off, dns_data_offset, cinfo, qatree, pinfo, is_mdns);
|
|
cur_off += add_off;
|
|
}
|
|
if (ti) {
|
|
proto_item_set_len(ti, cur_off - start_off);
|
|
}
|
|
return cur_off - start_off;
|
|
}
|
|
|
|
static void
|
|
dissect_dns_common(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
|
|
gboolean is_tcp, gboolean is_mdns, gboolean is_llmnr)
|
|
{
|
|
int offset = is_tcp ? 2 : 0;
|
|
int dns_data_offset;
|
|
column_info *cinfo;
|
|
proto_tree *dns_tree = NULL, *field_tree;
|
|
proto_item *ti, *tf;
|
|
guint16 id, flags, opcode, rcode, quest, ans, auth, add;
|
|
int cur_off;
|
|
gboolean isupdate;
|
|
conversation_t *conversation;
|
|
dns_conv_info_t *dns_info;
|
|
dns_transaction_t *dns_trans;
|
|
|
|
dns_data_offset = offset;
|
|
|
|
col_clear(pinfo->cinfo, COL_INFO);
|
|
|
|
|
|
/* To do: check for errs, etc. */
|
|
id = tvb_get_ntohs(tvb, offset + DNS_ID);
|
|
flags = tvb_get_ntohs(tvb, offset + DNS_FLAGS);
|
|
opcode = (guint16) ((flags & F_OPCODE) >> OPCODE_SHIFT);
|
|
rcode = (guint16) (flags & F_RCODE);
|
|
|
|
if (check_col(pinfo->cinfo, COL_INFO)) {
|
|
col_add_fstr(pinfo->cinfo, COL_INFO, "%s%s 0x%04x ",
|
|
val_to_str(opcode, opcode_vals, "Unknown operation (%u)"),
|
|
(flags&F_RESPONSE)?" response":"", id);
|
|
|
|
if (flags & F_RESPONSE) {
|
|
if (rcode != RCODE_NOERROR) {
|
|
col_append_str(pinfo-> cinfo,COL_INFO,
|
|
val_to_str(rcode, rcode_vals, "Unknown error (%u)"));
|
|
}
|
|
}
|
|
cinfo = pinfo->cinfo;
|
|
} else {
|
|
/* Set "cinfo" to NULL; we pass a NULL "cinfo" to the query and answer
|
|
dissectors, as a way of saying that they shouldn't add stuff
|
|
to the COL_INFO column (a call to "check_col(cinfo, COL_INFO)"
|
|
is more expensive than a check that a pointer isn't NULL). */
|
|
cinfo = NULL;
|
|
}
|
|
if (opcode == OPCODE_UPDATE) {
|
|
isupdate = TRUE;
|
|
} else {
|
|
isupdate = FALSE;
|
|
}
|
|
if (tree) {
|
|
if (is_llmnr) {
|
|
ti = proto_tree_add_protocol_format(tree, proto_dns, tvb, 0, -1,
|
|
"Link-local Multicast Name Resolution (%s)", (flags & F_RESPONSE) ? "response" : "query");
|
|
} else {
|
|
ti = proto_tree_add_protocol_format(tree, proto_dns, tvb, 0, -1,
|
|
"Domain Name System (%s)", (flags & F_RESPONSE) ? "response" : "query");
|
|
}
|
|
|
|
dns_tree = proto_item_add_subtree(ti, ett_dns);
|
|
}
|
|
|
|
/*
|
|
* Do we have a conversation for this connection?
|
|
*/
|
|
conversation = find_or_create_conversation(pinfo);
|
|
|
|
/*
|
|
* Do we already have a state structure for this conv
|
|
*/
|
|
dns_info = (dns_conv_info_t *)conversation_get_proto_data(conversation, proto_dns);
|
|
if (!dns_info) {
|
|
/* No. Attach that information to the conversation, and add
|
|
* it to the list of information structures.
|
|
*/
|
|
dns_info = se_new(dns_conv_info_t);
|
|
dns_info->pdus=se_tree_create_non_persistent(EMEM_TREE_TYPE_RED_BLACK, "dns_pdus");
|
|
conversation_add_proto_data(conversation, proto_dns, dns_info);
|
|
}
|
|
if (!pinfo->fd->flags.visited) {
|
|
if (!(flags&F_RESPONSE)) {
|
|
/* This is a request */
|
|
dns_trans=se_new(dns_transaction_t);
|
|
dns_trans->req_frame=pinfo->fd->num;
|
|
dns_trans->rep_frame=0;
|
|
dns_trans->req_time=pinfo->fd->abs_ts;
|
|
se_tree_insert32(dns_info->pdus, id, (void *)dns_trans);
|
|
} else {
|
|
dns_trans=(dns_transaction_t *)se_tree_lookup32(dns_info->pdus, id);
|
|
if (dns_trans) {
|
|
dns_trans->rep_frame=pinfo->fd->num;
|
|
}
|
|
}
|
|
} else {
|
|
dns_trans=(dns_transaction_t *)se_tree_lookup32(dns_info->pdus, id);
|
|
}
|
|
if (!dns_trans) {
|
|
/* create a "fake" pana_trans structure */
|
|
dns_trans=ep_new(dns_transaction_t);
|
|
dns_trans->req_frame=0;
|
|
dns_trans->rep_frame=0;
|
|
dns_trans->req_time=pinfo->fd->abs_ts;
|
|
}
|
|
|
|
/* print state tracking in the tree */
|
|
if (!(flags&F_RESPONSE)) {
|
|
/* This is a request */
|
|
if (dns_trans->rep_frame) {
|
|
proto_item *it;
|
|
|
|
it=proto_tree_add_uint(dns_tree, hf_dns_response_in, tvb, 0, 0, dns_trans->rep_frame);
|
|
PROTO_ITEM_SET_GENERATED(it);
|
|
}
|
|
} else {
|
|
/* This is a reply */
|
|
if (dns_trans->req_frame) {
|
|
proto_item *it;
|
|
nstime_t ns;
|
|
|
|
it=proto_tree_add_uint(dns_tree, hf_dns_response_to, tvb, 0, 0, dns_trans->req_frame);
|
|
PROTO_ITEM_SET_GENERATED(it);
|
|
|
|
nstime_delta(&ns, &pinfo->fd->abs_ts, &dns_trans->req_time);
|
|
it=proto_tree_add_time(dns_tree, hf_dns_time, tvb, 0, 0, &ns);
|
|
PROTO_ITEM_SET_GENERATED(it);
|
|
}
|
|
}
|
|
|
|
if (is_tcp) {
|
|
/* Put the length indication into the tree. */
|
|
proto_tree_add_item(dns_tree, hf_dns_length, tvb, offset - 2, 2, ENC_BIG_ENDIAN);
|
|
}
|
|
|
|
proto_tree_add_uint(dns_tree, hf_dns_transaction_id, tvb,
|
|
offset + DNS_ID, 2, id);
|
|
|
|
tf = proto_tree_add_item(dns_tree, hf_dns_flags, tvb,
|
|
offset + DNS_FLAGS, 2, ENC_BIG_ENDIAN);
|
|
proto_item_append_text(tf, " %s",
|
|
val_to_str_const(opcode, opcode_vals, "Unknown operation"));
|
|
if (flags & F_RESPONSE) {
|
|
proto_item_append_text(tf, " response, %s",
|
|
val_to_str_const(rcode, rcode_vals, "Unknown error"));
|
|
}
|
|
field_tree = proto_item_add_subtree(tf, ett_dns_flags);
|
|
proto_tree_add_item(field_tree, hf_dns_flags_response,
|
|
tvb, offset + DNS_FLAGS, 2, ENC_BIG_ENDIAN);
|
|
proto_tree_add_item(field_tree, hf_dns_flags_opcode,
|
|
tvb, offset + DNS_FLAGS, 2, ENC_BIG_ENDIAN);
|
|
if (is_llmnr) {
|
|
if (flags & F_RESPONSE) {
|
|
proto_tree_add_item(field_tree, hf_dns_flags_conflict_response,
|
|
tvb, offset + DNS_FLAGS, 2, ENC_BIG_ENDIAN);
|
|
} else {
|
|
proto_tree_add_item(field_tree, hf_dns_flags_conflict_query,
|
|
tvb, offset + DNS_FLAGS, 2, ENC_BIG_ENDIAN);
|
|
}
|
|
proto_tree_add_item(field_tree, hf_dns_flags_truncated,
|
|
tvb, offset + DNS_FLAGS, 2, ENC_BIG_ENDIAN);
|
|
proto_tree_add_item(field_tree, hf_dns_flags_tentative,
|
|
tvb, offset + DNS_FLAGS, 2, ENC_BIG_ENDIAN);
|
|
if (flags & F_RESPONSE) {
|
|
proto_tree_add_item(field_tree, hf_dns_flags_rcode,
|
|
tvb, offset + DNS_FLAGS, 2, ENC_BIG_ENDIAN);
|
|
}
|
|
} else {
|
|
if (flags & F_RESPONSE) {
|
|
proto_tree_add_item(field_tree, hf_dns_flags_authoritative,
|
|
tvb, offset + DNS_FLAGS, 2, ENC_BIG_ENDIAN);
|
|
}
|
|
proto_tree_add_item(field_tree, hf_dns_flags_truncated,
|
|
tvb, offset + DNS_FLAGS, 2, ENC_BIG_ENDIAN);
|
|
proto_tree_add_item(field_tree, hf_dns_flags_recdesired,
|
|
tvb, offset + DNS_FLAGS, 2, ENC_BIG_ENDIAN);
|
|
if (flags & F_RESPONSE) {
|
|
proto_tree_add_item(field_tree, hf_dns_flags_recavail,
|
|
tvb, offset + DNS_FLAGS, 2, ENC_BIG_ENDIAN);
|
|
}
|
|
proto_tree_add_item(field_tree, hf_dns_flags_z,
|
|
tvb, offset + DNS_FLAGS, 2, ENC_BIG_ENDIAN);
|
|
if (flags & F_RESPONSE) {
|
|
proto_tree_add_item(field_tree, hf_dns_flags_authenticated,
|
|
tvb, offset + DNS_FLAGS, 2, ENC_BIG_ENDIAN);
|
|
} else if (flags & F_AUTHENTIC) {
|
|
proto_item *pi = proto_tree_add_item(field_tree, hf_dns_flags_ad,
|
|
tvb, offset + DNS_FLAGS, 2, ENC_BIG_ENDIAN);
|
|
expert_add_info_format(pinfo, pi, PI_SECURITY, PI_WARN,
|
|
"AD bit set in DNS Query");
|
|
}
|
|
proto_tree_add_item(field_tree, hf_dns_flags_checkdisable,
|
|
tvb, offset + DNS_FLAGS, 2, ENC_BIG_ENDIAN);
|
|
if (flags & F_RESPONSE) {
|
|
proto_tree_add_item(field_tree, hf_dns_flags_rcode,
|
|
tvb, offset + DNS_FLAGS, 2, ENC_BIG_ENDIAN);
|
|
}
|
|
}
|
|
|
|
quest = tvb_get_ntohs(tvb, offset + DNS_QUEST);
|
|
if (tree) {
|
|
if (isupdate) {
|
|
proto_tree_add_uint(dns_tree, hf_dns_count_zones, tvb,
|
|
offset + DNS_QUEST, 2, quest);
|
|
} else {
|
|
proto_tree_add_uint(dns_tree, hf_dns_count_questions, tvb,
|
|
offset + DNS_QUEST, 2, quest);
|
|
}
|
|
}
|
|
ans = tvb_get_ntohs(tvb, offset + DNS_ANS);
|
|
if (tree) {
|
|
if (isupdate) {
|
|
proto_tree_add_uint(dns_tree, hf_dns_count_prerequisites, tvb,
|
|
offset + DNS_ANS, 2, ans);
|
|
} else {
|
|
proto_tree_add_uint(dns_tree, hf_dns_count_answers, tvb,
|
|
offset + DNS_ANS, 2, ans);
|
|
}
|
|
}
|
|
auth = tvb_get_ntohs(tvb, offset + DNS_AUTH);
|
|
if (tree) {
|
|
if (isupdate) {
|
|
proto_tree_add_uint(dns_tree, hf_dns_count_updates, tvb,
|
|
offset + DNS_AUTH, 2, auth);
|
|
} else {
|
|
proto_tree_add_uint(dns_tree, hf_dns_count_auth_rr, tvb,
|
|
offset + DNS_AUTH, 2, auth);
|
|
}
|
|
}
|
|
add = tvb_get_ntohs(tvb, offset + DNS_ADD);
|
|
if (tree) {
|
|
proto_tree_add_uint(dns_tree, hf_dns_count_add_rr, tvb,
|
|
offset + DNS_ADD, 2, add);
|
|
|
|
}
|
|
cur_off = offset + DNS_HDRLEN;
|
|
|
|
if (quest > 0) {
|
|
/* If this is a response, don't add information about the queries
|
|
to the summary, just add information about the answers. */
|
|
cur_off += dissect_query_records(tvb, cur_off, dns_data_offset, quest,
|
|
(!(flags & F_RESPONSE) ? cinfo : NULL),
|
|
dns_tree, isupdate, is_mdns);
|
|
}
|
|
|
|
if (ans > 0) {
|
|
/* If this is a request, don't add information about the answers
|
|
to the summary, just add information about the queries. */
|
|
cur_off += dissect_answer_records(tvb, cur_off, dns_data_offset, ans,
|
|
((flags & F_RESPONSE) ? cinfo : NULL),
|
|
dns_tree, (isupdate ?
|
|
"Prerequisites" : "Answers"),
|
|
pinfo, is_mdns);
|
|
}
|
|
|
|
/* Don't add information about the authoritative name servers, or the
|
|
additional records, to the summary. */
|
|
if (auth > 0) {
|
|
cur_off += dissect_answer_records(tvb, cur_off, dns_data_offset, auth,
|
|
NULL, dns_tree,
|
|
(isupdate ? "Updates" :
|
|
"Authoritative nameservers"),
|
|
pinfo, is_mdns);
|
|
}
|
|
|
|
if (add > 0) {
|
|
dissect_answer_records(tvb, cur_off, dns_data_offset, add,
|
|
NULL, dns_tree, "Additional records",
|
|
pinfo, is_mdns);
|
|
}
|
|
}
|
|
|
|
static void
|
|
dissect_dns_udp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
|
|
{
|
|
col_set_str(pinfo->cinfo, COL_PROTOCOL, "DNS");
|
|
|
|
dissect_dns_common(tvb, pinfo, tree, FALSE, FALSE, FALSE);
|
|
}
|
|
|
|
static void
|
|
dissect_dns_sctp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
|
|
{
|
|
col_set_str(pinfo->cinfo, COL_PROTOCOL, "DNS");
|
|
|
|
dissect_dns_common(tvb, pinfo, tree, FALSE, FALSE, FALSE);
|
|
}
|
|
|
|
static void
|
|
dissect_mdns_udp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
|
|
{
|
|
col_set_str(pinfo->cinfo, COL_PROTOCOL, "MDNS");
|
|
|
|
dissect_dns_common(tvb, pinfo, tree, FALSE, TRUE, FALSE);
|
|
}
|
|
|
|
static void
|
|
dissect_llmnr_udp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
|
|
{
|
|
col_set_str(pinfo->cinfo, COL_PROTOCOL, "LLMNR");
|
|
|
|
dissect_dns_common(tvb, pinfo, tree, FALSE, FALSE, TRUE);
|
|
}
|
|
|
|
static guint
|
|
get_dns_pdu_len(packet_info *pinfo _U_, tvbuff_t *tvb, int offset)
|
|
{
|
|
guint16 plen;
|
|
|
|
/*
|
|
* Get the length of the DNS packet.
|
|
*/
|
|
plen = tvb_get_ntohs(tvb, offset);
|
|
|
|
/*
|
|
* That length doesn't include the length field itself; add that in.
|
|
*/
|
|
return plen + 2;
|
|
}
|
|
|
|
static void
|
|
dissect_dns_tcp_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
|
|
{
|
|
col_set_str(pinfo->cinfo, COL_PROTOCOL, "DNS");
|
|
|
|
dissect_dns_common(tvb, pinfo, tree, TRUE, FALSE, FALSE);
|
|
}
|
|
|
|
static void
|
|
dissect_dns_tcp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
|
|
{
|
|
tcp_dissect_pdus(tvb, pinfo, tree, dns_desegment, 2, get_dns_pdu_len,
|
|
dissect_dns_tcp_pdu);
|
|
}
|
|
|
|
static void
|
|
tcp_range_delete_callback(guint32 port)
|
|
{
|
|
dissector_delete_uint("tcp.port", port, dns_tcp_handle);
|
|
}
|
|
|
|
static void
|
|
udp_range_delete_callback(guint32 port)
|
|
{
|
|
dissector_delete_uint("udp.port", port, dns_udp_handle);
|
|
}
|
|
|
|
static void
|
|
tcp_range_add_callback(guint32 port)
|
|
{
|
|
dissector_add_uint("tcp.port", port, dns_tcp_handle);
|
|
}
|
|
|
|
static void
|
|
udp_range_add_callback(guint32 port)
|
|
{
|
|
dissector_add_uint("udp.port", port, dns_udp_handle);
|
|
}
|
|
|
|
void
|
|
proto_reg_handoff_dns(void)
|
|
{
|
|
dissector_handle_t dns_sctp_handle;
|
|
dissector_handle_t mdns_udp_handle;
|
|
dissector_handle_t llmnr_udp_handle;
|
|
|
|
static range_t *dns_tcp_port_range;
|
|
static range_t *dns_udp_port_range;
|
|
|
|
static gboolean Initialized = FALSE;
|
|
|
|
if (!Initialized) {
|
|
dns_udp_handle = create_dissector_handle(dissect_dns_udp, proto_dns);
|
|
dns_tcp_handle = create_dissector_handle(dissect_dns_tcp, proto_dns);
|
|
Initialized = TRUE;
|
|
|
|
} else {
|
|
range_foreach(dns_tcp_port_range, tcp_range_delete_callback);
|
|
range_foreach(dns_udp_port_range, udp_range_delete_callback);
|
|
g_free(dns_tcp_port_range);
|
|
g_free(dns_udp_port_range);
|
|
}
|
|
|
|
dns_tcp_port_range = range_copy(global_dns_tcp_port_range);
|
|
dns_udp_port_range = range_copy(global_dns_udp_port_range);
|
|
range_foreach(dns_tcp_port_range, tcp_range_add_callback);
|
|
range_foreach(dns_udp_port_range, udp_range_add_callback);
|
|
|
|
dns_sctp_handle = create_dissector_handle(dissect_dns_sctp, proto_dns);
|
|
mdns_udp_handle = create_dissector_handle(dissect_mdns_udp, proto_dns);
|
|
llmnr_udp_handle = create_dissector_handle(dissect_llmnr_udp, proto_dns);
|
|
|
|
dissector_add_uint("udp.port", UDP_PORT_MDNS, mdns_udp_handle);
|
|
dissector_add_uint("tcp.port", TCP_PORT_MDNS, dns_tcp_handle);
|
|
dissector_add_uint("udp.port", UDP_PORT_LLMNR, llmnr_udp_handle);
|
|
dissector_add_uint("sctp.port", SCTP_PORT_DNS, dns_sctp_handle);
|
|
#if 0
|
|
dissector_add_uint("sctp.ppi", DNS_PAYLOAD_PROTOCOL_ID, dns_sctp_handle);
|
|
#endif
|
|
|
|
gssapi_handle = find_dissector("gssapi");
|
|
ntlmssp_handle = find_dissector("ntlmssp");
|
|
}
|
|
|
|
void
|
|
proto_register_dns(void)
|
|
{
|
|
static hf_register_info hf[] = {
|
|
{ &hf_dns_length,
|
|
{ "Length", "dns.length",
|
|
FT_UINT16, BASE_DEC, NULL, 0x0,
|
|
"Length of DNS-over-TCP request or response", HFILL }},
|
|
|
|
{ &hf_dns_flags,
|
|
{ "Flags", "dns.flags",
|
|
FT_UINT16, BASE_HEX, NULL, 0x0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_flags_response,
|
|
{ "Response", "dns.flags.response",
|
|
FT_BOOLEAN, 16, TFS(&tfs_flags_response), F_RESPONSE,
|
|
"Is the message a response?", HFILL }},
|
|
|
|
{ &hf_dns_flags_opcode,
|
|
{ "Opcode", "dns.flags.opcode",
|
|
FT_UINT16, BASE_DEC, VALS(opcode_vals), F_OPCODE,
|
|
"Operation code", HFILL }},
|
|
|
|
{ &hf_dns_flags_authoritative,
|
|
{ "Authoritative", "dns.flags.authoritative",
|
|
FT_BOOLEAN, 16, TFS(&tfs_flags_authoritative), F_AUTHORITATIVE,
|
|
"Is the server is an authority for the domain?", HFILL }},
|
|
|
|
{ &hf_dns_flags_conflict_query,
|
|
{ "Conflict", "dns.flags.conflict",
|
|
FT_BOOLEAN, 16, TFS(&tfs_flags_conflict_query), F_CONFLICT,
|
|
"Did we receive multiple responses to a query?", HFILL }},
|
|
|
|
{ &hf_dns_flags_conflict_response,
|
|
{ "Conflict", "dns.flags.conflict",
|
|
FT_BOOLEAN, 16, TFS(&tfs_flags_conflict_response), F_CONFLICT,
|
|
"Is the name considered unique?", HFILL }},
|
|
|
|
{ &hf_dns_flags_truncated,
|
|
{ "Truncated", "dns.flags.truncated",
|
|
FT_BOOLEAN, 16, TFS(&tfs_flags_truncated), F_TRUNCATED,
|
|
"Is the message truncated?", HFILL }},
|
|
|
|
{ &hf_dns_flags_recdesired,
|
|
{ "Recursion desired", "dns.flags.recdesired",
|
|
FT_BOOLEAN, 16, TFS(&tfs_flags_recdesired), F_RECDESIRED,
|
|
"Do query recursively?", HFILL }},
|
|
|
|
{ &hf_dns_flags_tentative,
|
|
{ "Tentative", "dns.flags.tentative",
|
|
FT_BOOLEAN, 16, TFS(&tfs_flags_tentative), F_TENTATIVE,
|
|
"Is the responder authoritative for the name, but not yet verified the uniqueness?", HFILL }},
|
|
|
|
{ &hf_dns_flags_recavail,
|
|
{ "Recursion available", "dns.flags.recavail",
|
|
FT_BOOLEAN, 16, TFS(&tfs_flags_recavail), F_RECAVAIL,
|
|
"Can the server do recursive queries?", HFILL }},
|
|
|
|
{ &hf_dns_flags_z,
|
|
{ "Z", "dns.flags.z",
|
|
FT_BOOLEAN, 16, TFS(&tfs_flags_z), F_Z,
|
|
"Z flag", HFILL }},
|
|
|
|
{ &hf_dns_flags_authenticated,
|
|
{ "Answer authenticated", "dns.flags.authenticated",
|
|
FT_BOOLEAN, 16, TFS(&tfs_flags_authenticated), F_AUTHENTIC,
|
|
"Was the reply data authenticated by the server?", HFILL }},
|
|
|
|
{ &hf_dns_flags_ad,
|
|
{ "AD bit", "dns.flags.authenticated",
|
|
FT_BOOLEAN, 16, TFS(&tfs_set_notset), F_AUTHENTIC,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_flags_checkdisable,
|
|
{ "Non-authenticated data", "dns.flags.checkdisable",
|
|
FT_BOOLEAN, 16, TFS(&tfs_flags_checkdisable), F_CHECKDISABLE,
|
|
"Is non-authenticated data acceptable?", HFILL }},
|
|
|
|
{ &hf_dns_flags_rcode,
|
|
{ "Reply code", "dns.flags.rcode",
|
|
FT_UINT16, BASE_DEC, VALS(rcode_vals), F_RCODE,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_transaction_id,
|
|
{ "Transaction ID", "dns.id",
|
|
FT_UINT16, BASE_HEX, NULL, 0x0,
|
|
"Identification of transaction", HFILL }},
|
|
|
|
{ &hf_dns_qry_type,
|
|
{ "Type", "dns.qry.type",
|
|
FT_UINT16, BASE_HEX, VALS(dns_types), 0x0,
|
|
"Query Type", HFILL }},
|
|
|
|
{ &hf_dns_qry_class,
|
|
{ "Class", "dns.qry.class",
|
|
FT_UINT16, BASE_HEX, VALS(dns_classes), 0x0,
|
|
"Query Class", HFILL }},
|
|
|
|
{ &hf_dns_qry_class_mdns,
|
|
{ "Class", "dns.qry.class",
|
|
FT_UINT16, BASE_HEX, VALS(dns_classes), 0x7FFF,
|
|
"Query Class", HFILL }},
|
|
|
|
{ &hf_dns_qry_qu,
|
|
{ "\"QU\" question", "dns.qry.qu",
|
|
FT_BOOLEAN, 16, NULL, C_QU,
|
|
"QU flag", HFILL }},
|
|
|
|
{ &hf_dns_qry_name,
|
|
{ "Name", "dns.qry.name",
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
"Query Name", HFILL }},
|
|
|
|
{ &hf_dns_rr_type,
|
|
{ "Type", "dns.resp.type",
|
|
FT_UINT16, BASE_HEX, VALS(dns_types), 0x0,
|
|
"Response Type", HFILL }},
|
|
|
|
{ &hf_dns_rr_class,
|
|
{ "Class", "dns.resp.class",
|
|
FT_UINT16, BASE_HEX, VALS(dns_classes), 0x0,
|
|
"Response Class", HFILL }},
|
|
|
|
{ &hf_dns_rr_class_mdns,
|
|
{ "Class", "dns.resp.class",
|
|
FT_UINT16, BASE_HEX, VALS(dns_classes), 0x7FFF,
|
|
"Response Class", HFILL }},
|
|
|
|
{ &hf_dns_rr_cache_flush,
|
|
{ "Cache flush", "dns.resp.cache_flush",
|
|
FT_BOOLEAN, 16, NULL, C_FLUSH,
|
|
"Cache flush flag", HFILL }},
|
|
|
|
{ &hf_dns_srv_service,
|
|
{ "Service", "dns.srv.service",
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
"Desired service", HFILL }},
|
|
|
|
{ &hf_dns_srv_proto,
|
|
{ "Protocol", "dns.srv.proto",
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
"Desired protocol", HFILL }},
|
|
|
|
{ &hf_dns_srv_name,
|
|
{ "Name", "dns.srv.name",
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
"Domain this resource record refers to", HFILL }},
|
|
|
|
{ &hf_dns_srv_priority,
|
|
{ "Priority", "dns.srv.priority",
|
|
FT_UINT16, BASE_DEC, NULL, 0x0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_srv_weight,
|
|
{ "Weight", "dns.srv.weight",
|
|
FT_UINT16, BASE_DEC, NULL, 0x0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_srv_port,
|
|
{ "Port", "dns.srv.port",
|
|
FT_UINT16, BASE_DEC, NULL, 0x0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_srv_target,
|
|
{ "Target", "dns.srv.target",
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_rr_name,
|
|
{ "Name", "dns.resp.name",
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
"Response Name", HFILL }},
|
|
|
|
{ &hf_dns_rr_ttl,
|
|
{ "Time to live", "dns.resp.ttl",
|
|
FT_UINT32, BASE_DEC, NULL, 0x0,
|
|
"Response TTL", HFILL }},
|
|
|
|
{ &hf_dns_rr_len,
|
|
{ "Data length", "dns.resp.len",
|
|
FT_UINT32, BASE_DEC, NULL, 0x0,
|
|
"Response Length", HFILL }},
|
|
|
|
{ &hf_dns_rr_addr,
|
|
{ "Addr", "dns.resp.addr",
|
|
FT_IPv4, BASE_NONE, NULL, 0x0,
|
|
"Response Address", HFILL }},
|
|
|
|
{ &hf_dns_rr_primaryname,
|
|
{ "Primaryname", "dns.resp.primaryname",
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
"Response Primary Name", HFILL }},
|
|
|
|
{ &hf_dns_rr_udp_payload_size,
|
|
{ "UDP payload size", "dns.resp.udp_payload_size",
|
|
FT_UINT16, BASE_HEX, NULL, 0x7FFF,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_soa_mname,
|
|
{ "Primary name server", "dns.soa.mname",
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_soa_rname,
|
|
{ "Responsible authority's mailbox", "dns.soa.rname",
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_soa_serial_number,
|
|
{ "Serial Number", "dns.soa.serial_number",
|
|
FT_UINT32, BASE_DEC, NULL, 0x0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_soa_refresh_interval,
|
|
{ "Refresh Interval", "dns.soa.refresh_interval",
|
|
FT_UINT32, BASE_DEC, NULL, 0x0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_soa_retry_interval,
|
|
{ "Retry Interval", "dns.soa.retry_interval",
|
|
FT_UINT32, BASE_DEC, NULL, 0x0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_soa_expire_limit,
|
|
{ "Expire limit", "dns.soa.expire_limit",
|
|
FT_UINT32, BASE_DEC, NULL, 0x0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_soa_minimum_ttl,
|
|
{ "Minimum TTL", "dns.soa.mininum_ttl",
|
|
FT_UINT32, BASE_DEC, NULL, 0x0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_ptr_domain_name,
|
|
{ "Domain Name", "dns.ptr.domain_name",
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_wks_address,
|
|
{ "Address", "dns.wks.address",
|
|
FT_IPv4, BASE_NONE, NULL, 0x0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_wks_protocol,
|
|
{ "Protocol", "dns.wks.protocol",
|
|
FT_UINT8, BASE_DEC | BASE_EXT_STRING, &ipproto_val_ext, 0x0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_wks_bits,
|
|
{ "Bits", "dns.wks.bits",
|
|
FT_UINT8, BASE_HEX, NULL, 0x0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_hinfo_cpu_length,
|
|
{ "CPU Length", "dns.hinfo.cpu_length",
|
|
FT_UINT8, BASE_DEC, NULL, 0x0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_hinfo_cpu,
|
|
{ "CPU", "dns.hinfo.cpu",
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_hinfo_os_length,
|
|
{ "OS Length", "dns.hinfo.os_length",
|
|
FT_UINT8, BASE_DEC, NULL, 0x0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_hinfo_os,
|
|
{ "OS", "dns.hinfo.os",
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_mx_preference,
|
|
{ "Preference", "dns.mx.preference",
|
|
FT_UINT16, BASE_DEC, NULL, 0x0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_mx_mail_exchange,
|
|
{ "Mail Exchange", "dns.mx.mail_exchange",
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_txt_length,
|
|
{ "TXT Length", "dns.txt.length",
|
|
FT_UINT8, BASE_DEC, NULL, 0x0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_txt,
|
|
{ "TXT", "dns.txt",
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_spf_length,
|
|
{ "SPF Length", "dns.spf.length",
|
|
FT_UINT8, BASE_DEC, NULL, 0x0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_spf,
|
|
{ "SPF", "dns.spf",
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_rrsig_type_covered,
|
|
{ "Type Covered", "dns.rrsig.type_covered",
|
|
FT_UINT16, BASE_DEC, NULL, 0x0,
|
|
"Identifies the type of the RRset that is covered by this RRSIG record", HFILL }},
|
|
|
|
{ &hf_dns_rrsig_algorithm,
|
|
{ "Algorithm", "dns.rrsig.algorithm",
|
|
FT_UINT8, BASE_DEC, VALS(dnssec_algo_vals), 0x0,
|
|
"Identifies the cryptographic algorithm used to create the signature", HFILL }},
|
|
|
|
{ &hf_dns_rrsig_labels,
|
|
{ "Labels", "dns.rrsig.labels",
|
|
FT_UINT8, BASE_DEC, NULL, 0x0,
|
|
"Specifies the number of labels in the original RRSIG RR owner name", HFILL }},
|
|
|
|
{ &hf_dns_rrsig_original_ttl,
|
|
{ "Original TTL", "dns.rrsig.original_ttl",
|
|
FT_UINT32, BASE_DEC, NULL, 0x0,
|
|
"Specifies the TTL of the covered RRset as it appears in the authoritative zone", HFILL }},
|
|
|
|
{ &hf_dns_rrsig_signature_expiration,
|
|
{ "Signature Expiration", "dns.rrsig.signature_expiration",
|
|
FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
|
|
"Specify a validity period for the signature", HFILL }},
|
|
|
|
{ &hf_dns_rrsig_signature_inception,
|
|
{ "Signature Inception", "dns.rrsig.signature_inception",
|
|
FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
|
|
"Specify a validity period for the signature", HFILL }},
|
|
|
|
{ &hf_dns_rrsig_key_tag,
|
|
{ "Key Tag", "dns.rrsig.key_tag",
|
|
FT_UINT16, BASE_DEC, NULL, 0x0,
|
|
"Contains the key tag value of the DNSKEY RR that validates this signature", HFILL }},
|
|
|
|
{ &hf_dns_rrsig_signers_name,
|
|
{ "Signer's name", "dns.rrsig.signers_name",
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
"Identifies the owner name of the DNSKEY RR that a validator is supposed to use to validate this signature", HFILL }},
|
|
|
|
{ &hf_dns_rrsig_signature,
|
|
{ "Signature", "dns.rrsig.signature",
|
|
FT_BYTES, BASE_NONE, NULL, 0x0,
|
|
"Contains the cryptographic signature that covers the RRSIG RDATA", HFILL }},
|
|
|
|
{ &hf_dns_dnskey_flags,
|
|
{ "Flags", "dns.dnskey.flags",
|
|
FT_UINT16, BASE_HEX, NULL, 0x0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_dnskey_flags_zone_key,
|
|
{ "Zone Key", "dns.dnskey.flags.zone_key",
|
|
FT_BOOLEAN, 16, TFS(&dns_dnskey_zone_key_tfs), DNSKEY_FLAGS_ZK,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_dnskey_flags_key_revoked,
|
|
{ "Key Revoked", "dns.dnskey.flags.key_revoked",
|
|
FT_BOOLEAN, 16, TFS(&tfs_yes_no), DNSKEY_FLAGS_KR,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_dnskey_flags_secure_entry_point,
|
|
{ "Key Signing Key", "dns.dnskey.flags.secure_entry_point",
|
|
FT_BOOLEAN, 16, TFS(&tfs_yes_no), DNSKEY_FLAGS_SEP,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_dnskey_flags_reserved,
|
|
{ "Key Signing Key", "dns.dnskey.flags.reserved",
|
|
FT_UINT16, BASE_HEX, NULL, DNSKEY_FLAGS_RSV,
|
|
"Must be zero", HFILL }},
|
|
|
|
{ &hf_dns_dnskey_protocol,
|
|
{ "Protocol", "dns.dnskey.protocol",
|
|
FT_UINT8, BASE_DEC, NULL, 0x0,
|
|
"Must be 3", HFILL }},
|
|
|
|
{ &hf_dns_dnskey_algorithm,
|
|
{ "Algorithm", "dns.dnskey.algorithm",
|
|
FT_UINT8, BASE_DEC, VALS(dnssec_algo_vals), 0x0,
|
|
"Identifies the public key's cryptographic algorithm and determines the format of the Public Key field", HFILL }},
|
|
|
|
{ &hf_dns_dnskey_key_id,
|
|
{ "Key id", "dns.dnskey.key_id",
|
|
FT_UINT16, BASE_DEC, NULL, 0x0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_dnskey_public_key,
|
|
{ "Public Key", "dns.dnskey.public_key",
|
|
FT_BYTES, BASE_NONE, NULL, 0x0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_t_key_flags,
|
|
{ "Flags", "dns.t_key.flags",
|
|
FT_UINT16, BASE_HEX, NULL, 0x0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_t_key_flags_authentication,
|
|
{ "Key allowed for authentication", "dns.t_key.flags.authentication",
|
|
FT_BOOLEAN, 16, TFS(&tfs_not_allowed_allowed), 0x8000,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_t_key_flags_confidentiality,
|
|
{ "Key allowed for confidentiality", "dns.t_key.flags.confidentiality",
|
|
FT_BOOLEAN, 16, TFS(&tfs_not_allowed_allowed), 0x4000,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_t_key_flags_key_required,
|
|
{ "Key required", "dns.t_key.flags.required",
|
|
FT_BOOLEAN, 16, TFS(&tfs_required_experimental), 0x2000,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_t_key_flags_associated_user,
|
|
{ "Key is associated with a user", "dns.t_key.flags.associated_user",
|
|
FT_BOOLEAN, 16, TFS(&tfs_yes_no), 0x0400,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_t_key_flags_associated_named_entity,
|
|
{ "Key is associated with the named entity", "dns.t_key.flags.associated_named_entity",
|
|
FT_BOOLEAN, 16, TFS(&tfs_yes_no), 0x0200,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_t_key_flags_ipsec,
|
|
{ "Key use with IPSEC", "dns.t_key.flags.ipsec",
|
|
FT_BOOLEAN, 16, TFS(&tfs_valid_invalid), 0x0080,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_t_key_flags_mime,
|
|
{ "Key use with MIME security multiparts", "dns.t_key.flags.mime",
|
|
FT_BOOLEAN, 16, TFS(&tfs_valid_invalid), 0x0040,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_t_key_flags_signatory,
|
|
{ "Signatory", "dns.t_key.flags.signatory",
|
|
FT_UINT16, BASE_DEC, NULL, 0x000F,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_rr_ns,
|
|
{ "Name Server", "dns.resp.ns",
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_rr_opt,
|
|
{ "Option", "dns.rr.opt",
|
|
FT_NONE, BASE_NONE,
|
|
NULL, 0x0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_rr_opt_code,
|
|
{ "Option Code", "dns.rr.opt.code",
|
|
FT_UINT16, BASE_DEC,
|
|
VALS(edns0_opt_code_vals), 0x0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_rr_opt_len,
|
|
{ "Option Length", "dns.rr.opt.len",
|
|
FT_UINT16, BASE_DEC, NULL, 0x0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_rr_opt_data,
|
|
{ "Option Data", "dns.rr.opt.data",
|
|
FT_BYTES, BASE_NONE, NULL, 0x0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_rr_opt_client_family,
|
|
{ "Family", "dns.rr.opt.client.family",
|
|
FT_UINT16, BASE_DEC,
|
|
VALS(afamily_vals), 0x0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_rr_opt_client_netmask,
|
|
{ "Source Netmask", "dns.rr.opt.client.netmask",
|
|
FT_UINT8, BASE_DEC, NULL, 0x0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_rr_opt_client_scope,
|
|
{ "Scope Netmask", "dns.rr.opt.client.scope",
|
|
FT_UINT8, BASE_DEC, NULL, 0x0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_rr_opt_client_addr,
|
|
{ "Client Subnet", "dns.rr.opt.client.addr",
|
|
FT_BYTES, BASE_NONE, NULL, 0x0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_rr_opt_client_addr4,
|
|
{ "Client Subnet", "dns.rr.opt.client.addr4",
|
|
FT_IPv4, BASE_NONE, NULL, 0x0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_rr_opt_client_addr6,
|
|
{ "Client Subnet", "dns.rr.opt.client.addr6",
|
|
FT_IPv6, BASE_NONE, NULL, 0x0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_count_questions,
|
|
{ "Questions", "dns.count.queries",
|
|
FT_UINT16, BASE_DEC, NULL, 0x0,
|
|
"Number of queries in packet", HFILL }},
|
|
|
|
{ &hf_dns_count_zones,
|
|
{ "Zones", "dns.count.zones",
|
|
FT_UINT16, BASE_DEC, NULL, 0x0,
|
|
"Number of zones in packet", HFILL }},
|
|
|
|
{ &hf_dns_count_answers,
|
|
{ "Answer RRs", "dns.count.answers",
|
|
FT_UINT16, BASE_DEC, NULL, 0x0,
|
|
"Number of answers in packet", HFILL }},
|
|
|
|
{ &hf_dns_count_prerequisites,
|
|
{ "Prerequisites", "dns.count.prerequisites",
|
|
FT_UINT16, BASE_DEC, NULL, 0x0,
|
|
"Number of prerequisites in packet", HFILL }},
|
|
|
|
{ &hf_dns_count_auth_rr,
|
|
{ "Authority RRs", "dns.count.auth_rr",
|
|
FT_UINT16, BASE_DEC, NULL, 0x0,
|
|
"Number of authoritative records in packet", HFILL }},
|
|
|
|
{ &hf_dns_count_updates,
|
|
{ "Updates", "dns.count.updates",
|
|
FT_UINT16, BASE_DEC, NULL, 0x0,
|
|
"Number of updates records in packet", HFILL }},
|
|
|
|
{ &hf_dns_nsec3_algo,
|
|
{ "Hash algorithm", "dns.nsec3.algo",
|
|
FT_UINT8, BASE_DEC, VALS(hash_algorithms), 0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_nsec3_flags,
|
|
{ "NSEC3 flags", "dns.nsec3.flags",
|
|
FT_UINT8, BASE_DEC, NULL, 0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_nsec3_flag_optout,
|
|
{ "NSEC3 Opt-out flag", "dns.nsec3.flags.opt_out",
|
|
FT_BOOLEAN, 8, TFS(&tfs_flags_nsec3_optout), NSEC3_FLAG_OPTOUT,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_nsec3_iterations,
|
|
{ "NSEC3 iterations", "dns.nsec3.iterations",
|
|
FT_UINT16, BASE_DEC, NULL, 0,
|
|
"Number of hashing iterations", HFILL }},
|
|
|
|
{ &hf_dns_nsec3_salt_length,
|
|
{ "Salt length", "dns.nsec3.salt_length",
|
|
FT_UINT8, BASE_DEC, NULL, 0,
|
|
"Length of salt in bytes", HFILL }},
|
|
|
|
{ &hf_dns_nsec3_salt_value,
|
|
{ "Salt value", "dns.nsec3.salt_value",
|
|
FT_BYTES, BASE_NONE, NULL, 0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_nsec3_hash_length,
|
|
{ "Hash length", "dns.nsec3.hash_length",
|
|
FT_UINT8, BASE_DEC, NULL, 0,
|
|
"Length in bytes of next hashed owner", HFILL }},
|
|
|
|
{ &hf_dns_nsec3_hash_value,
|
|
{ "Next hashed owner", "dns.nsec3.hash_value",
|
|
FT_BYTES, BASE_NONE, NULL, 0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_tlsa_certificate_usage,
|
|
{ "Certificate Usage", "dns.tlsa.certificate_usage",
|
|
FT_UINT8, BASE_DEC, VALS(tlsa_certificate_usage_vals), 0,
|
|
"Specifies the provided association that will be used to match the certificate presented in the TLS handshake", HFILL }},
|
|
|
|
{ &hf_dns_tlsa_selector,
|
|
{ "Selector", "dns.tlsa.selector",
|
|
FT_UINT8, BASE_DEC, VALS(tlsa_selector_vals), 0,
|
|
"Specifies which part of the TLS certificate presented by the server will be matched against the association data", HFILL }},
|
|
|
|
{ &hf_dns_tlsa_matching_type,
|
|
{ "Matching Type", "dns.tlsa.matching_type",
|
|
FT_UINT8, BASE_DEC, VALS(tlsa_matching_type_vals), 0,
|
|
"Specifies how the certificate association is presented", HFILL }},
|
|
|
|
{ &hf_dns_tlsa_certificate_association_data,
|
|
{ "Certificate Association Data", "dns.tlsa.certificate_association_data",
|
|
FT_BYTES, BASE_NONE, NULL, 0,
|
|
"The data refers to the certificate in the association", HFILL }},
|
|
|
|
{ &hf_dns_tsig_original_id,
|
|
{ "Original Id", "dns.tsig.original_id",
|
|
FT_UINT16, BASE_DEC, NULL, 0x0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_tsig_error,
|
|
{ "Error", "dns.tsig.error",
|
|
FT_UINT16, BASE_DEC, NULL, 0x0,
|
|
"Expanded RCODE for TSIG", HFILL }},
|
|
|
|
{ &hf_dns_tsig_fudge,
|
|
{ "Fudge", "dns.tsig.fudge",
|
|
FT_UINT16, BASE_DEC, NULL, 0x0,
|
|
"Number of bytes for the MAC", HFILL }},
|
|
|
|
{ &hf_dns_tsig_mac_size,
|
|
{ "MAC Size", "dns.tsig.mac_size",
|
|
FT_UINT16, BASE_DEC, NULL, 0x0,
|
|
"Number of bytes for the MAC", HFILL }},
|
|
|
|
{ &hf_dns_tsig_other_len,
|
|
{ "Other Len", "dns.tsig.other_len",
|
|
FT_UINT16, BASE_DEC, NULL, 0x0,
|
|
"Number of bytes for Other Data", HFILL }},
|
|
|
|
{ &hf_dns_tsig_mac,
|
|
{ "MAC", "dns.tsig.mac",
|
|
FT_NONE, BASE_NONE, NULL, 0x0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_tsig_other_data,
|
|
{ "Other Data", "dns.tsig.other_data",
|
|
FT_BYTES, BASE_NONE, NULL, 0x0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_tsig_algorithm_name,
|
|
{ "Algorithm Name", "dns.tsig.algorithm_name",
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
"Name of algorithm used for the MAC", HFILL }},
|
|
|
|
{ &hf_dns_response_in,
|
|
{ "Response In", "dns.response_in",
|
|
FT_FRAMENUM, BASE_NONE, NULL, 0x0,
|
|
"The response to this DNS query is in this frame", HFILL }},
|
|
|
|
{ &hf_dns_response_to,
|
|
{ "Request In", "dns.response_to",
|
|
FT_FRAMENUM, BASE_NONE, NULL, 0x0,
|
|
"This is a response to the DNS query in this frame", HFILL }},
|
|
|
|
{ &hf_dns_time,
|
|
{ "Time", "dns.time",
|
|
FT_RELATIVE_TIME, BASE_NONE, NULL, 0x0,
|
|
"The time between the Query and the Response", HFILL }},
|
|
|
|
{ &hf_dns_count_add_rr,
|
|
{ "Additional RRs", "dns.count.add_rr",
|
|
FT_UINT16, BASE_DEC, NULL, 0x0,
|
|
"Number of additional records in packet", HFILL }},
|
|
|
|
{ &hf_dns_sshfp_fingerprint,
|
|
{ "Fingerprint", "dns.sshfp.fingerprint",
|
|
FT_BYTES, BASE_NONE, NULL, 0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_hip_hit,
|
|
{ "Host Identity Tag", "dns.hip.hit",
|
|
FT_BYTES, BASE_NONE, NULL, 0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_hip_pk,
|
|
{ "HIP Public Key", "dns.hip.pk",
|
|
FT_BYTES, BASE_NONE, NULL, 0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_dhcid_rdata,
|
|
{ "DHCID Data", "dns.dhcid.rdata",
|
|
FT_BYTES, BASE_NONE, NULL, 0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_apl_coded_prefix,
|
|
{ "Prefix Length", "dns.apl.coded.prefix",
|
|
FT_UINT8, BASE_DEC, NULL, 0,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_apl_negation,
|
|
{ "Negation Flag", "dns.apl.negation",
|
|
FT_BOOLEAN, 8, TFS(&tfs_dns_apl_negation), DNS_APL_NEGATION,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_apl_afdlength,
|
|
{ "Address Length, in octets","dns.apl.afdlength",
|
|
FT_UINT8, BASE_DEC, NULL, DNS_APL_AFDLENGTH,
|
|
NULL, HFILL }},
|
|
|
|
{ &hf_dns_nsap_rdata,
|
|
{ "NSAP Data", "dns.nsap.rdata",
|
|
FT_BYTES, BASE_NONE, NULL, 0,
|
|
NULL, HFILL }}
|
|
|
|
};
|
|
static gint *ett[] = {
|
|
&ett_dns,
|
|
&ett_dns_qd,
|
|
&ett_dns_rr,
|
|
&ett_dns_qry,
|
|
&ett_dns_ans,
|
|
&ett_dns_flags,
|
|
&ett_dns_opts,
|
|
&ett_nsec3_flags,
|
|
&ett_t_key_flags,
|
|
&ett_t_key,
|
|
&ett_dns_mac,
|
|
};
|
|
module_t *dns_module;
|
|
|
|
proto_dns = proto_register_protocol("Domain Name Service", "DNS", "dns");
|
|
proto_register_field_array(proto_dns, hf, array_length(hf));
|
|
proto_register_subtree_array(ett, array_length(ett));
|
|
|
|
/* Set default ports */
|
|
range_convert_str(&global_dns_tcp_port_range, DEFAULT_DNS_PORT_RANGE, MAX_TCP_PORT);
|
|
range_convert_str(&global_dns_udp_port_range, DEFAULT_DNS_PORT_RANGE, MAX_UDP_PORT);
|
|
|
|
dns_module = prefs_register_protocol(proto_dns, proto_reg_handoff_dns);
|
|
|
|
prefs_register_range_preference(dns_module, "tcp.ports", "DNS TCP ports",
|
|
"TCP ports to be decoded as DNS (default: "
|
|
DEFAULT_DNS_PORT_RANGE ")",
|
|
&global_dns_tcp_port_range, MAX_TCP_PORT);
|
|
|
|
prefs_register_range_preference(dns_module, "udp.ports", "DNS UDP Ports",
|
|
"UDP ports to be decoded as DNS (default: "
|
|
DEFAULT_DNS_PORT_RANGE ")",
|
|
&global_dns_udp_port_range, MAX_UDP_PORT);
|
|
|
|
prefs_register_bool_preference(dns_module, "desegment_dns_messages",
|
|
"Reassemble DNS messages spanning multiple TCP segments",
|
|
"Whether the DNS dissector should reassemble messages spanning multiple TCP segments."
|
|
" To use this option, you must also enable \"Allow subdissectors to reassemble TCP streams\" in the TCP protocol settings.",
|
|
&dns_desegment);
|
|
|
|
dns_tsig_dissector_table = register_dissector_table("dns.tsig.mac", "DNS TSIG MAC Dissectors", FT_STRING, BASE_NONE);
|
|
}
|
|
/*
|
|
* Editor modelines
|
|
*
|
|
* Local Variables:
|
|
* c-basic-offset: 2
|
|
* tab-width: 8
|
|
* indent-tabs-mode: nil
|
|
* End:
|
|
*
|
|
* ex: set shiftwidth=2 tabstop=8 expandtab:
|
|
* :indentSize=2:tabSize=8:noTabs=true:
|
|
*/
|