diff options
| author | Ivan Nardi <nardi.ivan@gmail.com> | 2025-02-10 21:06:27 +0100 |
|---|---|---|
| committer | Ivan Nardi <12729895+IvanNardi@users.noreply.github.com> | 2025-02-11 12:44:46 +0100 |
| commit | 65c224e19cddf78f7579f7954a79746ab729d0c3 (patch) | |
| tree | c9449dd56e081f64e7218789a6ce4d4ce2538706 /src/lib/protocols/dns.c | |
| parent | dff5b2beac5cd49df5267b4ada7de07b0ba865ce (diff) | |
dns: fix writing to `flow->protos.dns`
We can't write to `flow->protos.dns` until we are sure it is a valid DNS
flow
Diffstat (limited to 'src/lib/protocols/dns.c')
| -rw-r--r-- | src/lib/protocols/dns.c | 33 |
1 files changed, 17 insertions, 16 deletions
diff --git a/src/lib/protocols/dns.c b/src/lib/protocols/dns.c index 607c4867b..70e1b81f5 100644 --- a/src/lib/protocols/dns.c +++ b/src/lib/protocols/dns.c @@ -329,28 +329,29 @@ static int search_valid_dns(struct ndpi_detection_module_struct *ndpi_struct, } else { /* DNS Reply */ - flow->protos.dns.transaction_id = dns_header->tr_id; - flow->protos.dns.reply_code = dns_header->flags & 0x0F; - - if(flow->protos.dns.reply_code != 0) { - char str[32], buf[16]; - - snprintf(str, sizeof(str), "DNS Error Code %s", - dns_error_code2string(flow->protos.dns.reply_code, buf, sizeof(buf))); - ndpi_set_risk(ndpi_struct, flow, NDPI_ERROR_CODE_DETECTED, str); - } else { - if(ndpi_isset_risk(flow, NDPI_SUSPICIOUS_DGA_DOMAIN)) { - ndpi_set_risk(ndpi_struct, flow, NDPI_RISKY_DOMAIN, "DGA Name Query with no Error Code"); - } - } - if((dns_header->num_queries > 0) && (dns_header->num_queries <= NDPI_MAX_DNS_REQUESTS) /* Don't assume that num_queries must be zero */ && ((((dns_header->num_answers > 0) && (dns_header->num_answers <= NDPI_MAX_DNS_REQUESTS)) || ((dns_header->authority_rrs > 0) && (dns_header->authority_rrs <= NDPI_MAX_DNS_REQUESTS)) - || ((dns_header->additional_rrs > 0) && (dns_header->additional_rrs <= NDPI_MAX_DNS_REQUESTS)))) + || ((dns_header->additional_rrs > 0) && (dns_header->additional_rrs <= NDPI_MAX_DNS_REQUESTS))) + || (dns_header->num_answers == 0 && dns_header->authority_rrs == 0 && dns_header->additional_rrs == 0)) ) { /* This is a good reply: we dissect it both for request and response */ + flow->protos.dns.transaction_id = dns_header->tr_id; + flow->protos.dns.reply_code = dns_header->flags & 0x0F; + + if(flow->protos.dns.reply_code != 0) { + char str[32], buf[16]; + + snprintf(str, sizeof(str), "DNS Error Code %s", + dns_error_code2string(flow->protos.dns.reply_code, buf, sizeof(buf))); + ndpi_set_risk(ndpi_struct, flow, NDPI_ERROR_CODE_DETECTED, str); + } else { + if(ndpi_isset_risk(flow, NDPI_SUSPICIOUS_DGA_DOMAIN)) { + ndpi_set_risk(ndpi_struct, flow, NDPI_RISKY_DOMAIN, "DGA Name Query with no Error Code"); + } + } + if(dns_header->num_queries > 0) { u_int16_t rsp_type; u_int16_t num; |