From 97e7a82be296a2f8a7264911dae89623df387773 Mon Sep 17 00:00:00 2001 From: Daiyuu Nobori Date: Thu, 21 Dec 2017 23:23:17 +0900 Subject: [PATCH] Added the function to save the DNS query log on the packet logs. --- src/Cedar/Logging.c | 24 ++++++++++ src/Cedar/Virtual.c | 98 --------------------------------------- src/Cedar/Virtual.h | 2 - src/Mayaqua/TcpIp.c | 109 ++++++++++++++++++++++++++++++++++++++++++++ src/Mayaqua/TcpIp.h | 5 ++ 5 files changed, 138 insertions(+), 100 deletions(-) diff --git a/src/Cedar/Logging.c b/src/Cedar/Logging.c index 0cfe1608..003b7af2 100644 --- a/src/Cedar/Logging.c +++ b/src/Cedar/Logging.c @@ -1307,6 +1307,11 @@ UINT CalcPacketLoggingLevelEx(HUB_LOG *g, PKT *packet) // OpenVPN connection request ret = MAX(ret, g->PacketLogConfig[PACKET_LOG_TCP_CONN]); break; + + case L7_DNS: + // DNS request + ret = MAX(ret, g->PacketLogConfig[PACKET_LOG_TCP_CONN]); + break; } break; @@ -1354,6 +1359,11 @@ UINT CalcPacketLoggingLevelEx(HUB_LOG *g, PKT *packet) // OpenVPN connection request ret = MAX(ret, g->PacketLogConfig[PACKET_LOG_TCP_CONN]); break; + + case L7_DNS: + // DNS request + ret = MAX(ret, g->PacketLogConfig[PACKET_LOG_TCP_CONN]); + break; } break; @@ -1758,6 +1768,13 @@ char *PacketLogParseProc(RECORD *rec) } } break; + + case L7_DNS: + // DNS query + t->Token[6] = CopyStr("DNSv4"); + t->Token[7] = CopyStr("DNS_Query"); + t->Token[14] = CopyStr(p->DnsQueryHost); + break; default: // Unknown Packet @@ -2023,6 +2040,13 @@ char *PacketLogParseProc(RECORD *rec) } } break; + + case L7_DNS: + // DNS query + t->Token[6] = CopyStr("DNSv6"); + t->Token[7] = CopyStr("DNS_Query"); + t->Token[14] = CopyStr(p->DnsQueryHost); + break; default: t->Token[6] = CopyStr("UDPv6"); diff --git a/src/Cedar/Virtual.c b/src/Cedar/Virtual.c index 9dfbac7a..f7f326d4 100644 --- a/src/Cedar/Virtual.c +++ b/src/Cedar/Virtual.c @@ -6955,104 +6955,6 @@ NAT_ENTRY *CreateNatDns(VH *v, UINT src_ip, UINT src_port, UINT dest_ip, UINT de return n; } -// Get the next byte -UCHAR GetNextByte(BUF *b) -{ - UCHAR c = 0; - // Validate arguments - if (b == NULL) - { - return 0; - } - - if (ReadBuf(b, &c, 1) != 1) - { - return 0; - } - - return c; -} - -// Interpret the DNS query -bool ParseDnsQuery(char *name, UINT name_size, void *data, UINT data_size) -{ - BUF *b; - char tmp[257]; - bool ok = true; - USHORT val; - // Validate arguments - if (name == NULL || data == NULL || data_size == 0) - { - return false; - } - StrCpy(name, name_size, ""); - - b = NewBuf(); - WriteBuf(b, data, data_size); - SeekBuf(b, 0, 0); - - while (true) - { - UINT next_len = (UINT)GetNextByte(b); - if (next_len > 0) - { - // Read only the specified length - Zero(tmp, sizeof(tmp)); - if (ReadBuf(b, tmp, next_len) != next_len) - { - ok = false; - break; - } - // Append - if (StrLen(name) != 0) - { - StrCat(name, name_size, "."); - } - StrCat(name, name_size, tmp); - } - else - { - // Read all - break; - } - } - - if (ReadBuf(b, &val, sizeof(val)) != sizeof(val)) - { - ok = false; - } - else - { - if (Endian16(val) != 0x01 && Endian16(val) != 0x0c) - { - ok = false; - } - } - - if (ReadBuf(b, &val, sizeof(val)) != sizeof(val)) - { - ok = false; - } - else - { - if (Endian16(val) != 0x01) - { - ok = false; - } - } - - FreeBuf(b); - - if (ok == false || StrLen(name) == 0) - { - return false; - } - else - { - return true; - } -} - // Set the VGS host name void SetDnsProxyVgsHostname(char *hostname) { diff --git a/src/Cedar/Virtual.h b/src/Cedar/Virtual.h index e86e07f0..54f14591 100644 --- a/src/Cedar/Virtual.h +++ b/src/Cedar/Virtual.h @@ -594,9 +594,7 @@ void SendTcp(VH *v, UINT src_ip, UINT src_port, UINT dest_ip, UINT dest_port, UI void DnsProxy(VH *v, UINT src_ip, UINT src_port, UINT dest_ip, UINT dest_port, void *data, UINT size); bool ParseDnsPacket(VH *v, UINT src_ip, UINT src_port, UINT dest_ip, UINT dest_port, void *data, UINT size); bool ParseDnsPacketEx(VH *v, UINT src_ip, UINT src_port, UINT dest_ip, UINT dest_port, void *data, UINT size, DNS_PARSED_PACKET *parsed_result); -bool ParseDnsQuery(char *name, UINT name_size, void *data, UINT data_size); void SetDnsProxyVgsHostname(char *hostname); -UCHAR GetNextByte(BUF *b); bool NatTransactDns(VH *v, NAT_ENTRY *n); void NatDnsThread(THREAD *t, void *param); bool NatGetIP(IP *ip, char *hostname); diff --git a/src/Mayaqua/TcpIp.c b/src/Mayaqua/TcpIp.c index a4220183..d371d9fd 100644 --- a/src/Mayaqua/TcpIp.c +++ b/src/Mayaqua/TcpIp.c @@ -1688,6 +1688,10 @@ PKT *ClonePacket(PKT *p, bool copy_data) ret->L7.IkeHeader = MallocFast(sizeof(IKE_HEADER)); Copy(ret->L7.IkeHeader, p->L7.IkeHeader, sizeof(IKE_HEADER)); break; + + case L7_DNS: + StrCpy(ret->DnsQueryHost, sizeof(ret->DnsQueryHost), p->DnsQueryHost); + break; } // Address data @@ -3010,6 +3014,104 @@ bool ParseTCP(PKT *p, UCHAR *buf, UINT size) return true; } +// Get the next byte +UCHAR GetNextByte(BUF *b) +{ + UCHAR c = 0; + // Validate arguments + if (b == NULL) + { + return 0; + } + + if (ReadBuf(b, &c, 1) != 1) + { + return 0; + } + + return c; +} + +// Interpret the DNS query +bool ParseDnsQuery(char *name, UINT name_size, void *data, UINT data_size) +{ + BUF *b; + char tmp[257]; + bool ok = true; + USHORT val; + // Validate arguments + if (name == NULL || data == NULL || data_size == 0) + { + return false; + } + StrCpy(name, name_size, ""); + + b = NewBuf(); + WriteBuf(b, data, data_size); + SeekBuf(b, 0, 0); + + while (true) + { + UINT next_len = (UINT)GetNextByte(b); + if (next_len > 0) + { + // Read only the specified length + Zero(tmp, sizeof(tmp)); + if (ReadBuf(b, tmp, next_len) != next_len) + { + ok = false; + break; + } + // Append + if (StrLen(name) != 0) + { + StrCat(name, name_size, "."); + } + StrCat(name, name_size, tmp); + } + else + { + // Read all + break; + } + } + + if (ReadBuf(b, &val, sizeof(val)) != sizeof(val)) + { + ok = false; + } + else + { + if (Endian16(val) != 0x01 && Endian16(val) != 0x0c) + { + ok = false; + } + } + + if (ReadBuf(b, &val, sizeof(val)) != sizeof(val)) + { + ok = false; + } + else + { + if (Endian16(val) != 0x01) + { + ok = false; + } + } + + FreeBuf(b); + + if (ok == false || StrLen(name) == 0) + { + return false; + } + else + { + return true; + } +} + // UDP parsing bool ParseUDP(PKT *p, UCHAR *buf, UINT size) { @@ -3052,6 +3154,13 @@ bool ParseUDP(PKT *p, UCHAR *buf, UINT size) return true; } } + + if (dst_port == 53) + { + ParseDNS(p, buf, size); + return true; + } + if (src_port == 500 || dst_port == 500 || src_port == 4500 || dst_port == 4500) { diff --git a/src/Mayaqua/TcpIp.h b/src/Mayaqua/TcpIp.h index 9996f81d..37df507f 100644 --- a/src/Mayaqua/TcpIp.h +++ b/src/Mayaqua/TcpIp.h @@ -705,6 +705,7 @@ struct PKT UCHAR *Payload; // Pointer to the payload of TCP or UDP UINT PayloadSize; // Payload size struct HTTPLOG *HttpLog; // HTTP log + char DnsQueryHost[64]; // DNS hostname } GCC_PACKED; // Layer-3 packet classification @@ -728,6 +729,7 @@ struct PKT #define L7_DHCPV4 1 // DHCPv4 packet #define L7_IKECONN 2 // IKE connection request packet #define L7_OPENVPNCONN 3 // OpenVPN connection request packet +#define L7_DNS 4 // DNS packet // IKE header @@ -869,6 +871,7 @@ bool ParseICMPv6(PKT *p, UCHAR *buf, UINT size); bool ParseTCP(PKT *p, UCHAR *buf, UINT size); bool ParseUDP(PKT *p, UCHAR *buf, UINT size); void ParseDHCPv4(PKT *p, UCHAR *buf, UINT size); +void ParseDNS(PKT *p, UCHAR *buf, UINT size); PKT *ClonePacket(PKT *p, bool copy_data); void FreeClonePacket(PKT *p); @@ -901,6 +904,8 @@ void FreeDHCPv4Data(DHCPV4_DATA *d); bool AdjustTcpMssL3(UCHAR *src, UINT src_size, UINT mss); bool AdjustTcpMssL2(UCHAR *src, UINT src_size, UINT mss, USHORT tag_vlan_tpid); UINT GetIpHeaderSize(UCHAR *src, UINT src_size); +bool ParseDnsQuery(char *name, UINT name_size, void *data, UINT data_size); +UCHAR GetNextByte(BUF *b); bool IsDhcpPacketForSpecificMac(UCHAR *data, UINT size, UCHAR *mac_address);