summaryrefslogtreecommitdiffstats
path: root/src/dump_cds.c
diff options
context:
space:
mode:
Diffstat (limited to 'src/dump_cds.c')
-rw-r--r--src/dump_cds.c1962
1 files changed, 1962 insertions, 0 deletions
diff --git a/src/dump_cds.c b/src/dump_cds.c
new file mode 100644
index 0000000..e151d35
--- /dev/null
+++ b/src/dump_cds.c
@@ -0,0 +1,1962 @@
+/*
+ * Copyright (c) 2016-2021, OARC, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in
+ * the documentation and/or other materials provided with the
+ * distribution.
+ *
+ * 3. Neither the name of the copyright holder nor the names of its
+ * contributors may be used to endorse or promote products derived
+ * from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
+ * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "dump_cds.h"
+#include "dnscap.h"
+#include "hashtbl.h"
+#include "iaddr.h"
+
+#if HAVE_LIBTINYCBOR
+
+#include <stdlib.h>
+#if HAVE_CBOR_CBOR_H
+#include <cbor/cbor.h>
+#endif
+#if HAVE_CBOR_H
+#include <cbor.h>
+#endif
+#include <assert.h>
+
+#define need8(v, p, l, d) \
+ if (l < 1) { \
+ if (sizeof(d) > 1) \
+ fprintf(stderr, "cds need 1B/8b, had %lu: %s\n", l, d); \
+ return 1; \
+ } \
+ v = *p; \
+ p += 1; \
+ l -= 1
+
+#define need16(v, p, l, d) \
+ if (l < 2) { \
+ if (sizeof(d) > 1) \
+ fprintf(stderr, "cds need 2B/16b, had %lu: %s\n", l, d); \
+ return 1; \
+ } \
+ v = (*p << 8) + *(p + 1); \
+ p += 2; \
+ l -= 2
+
+#define need32(v, p, l, d) \
+ if (l < 4) { \
+ if (sizeof(d) > 1) \
+ fprintf(stderr, "cds need 4B/32b, had %lu: %s\n", l, d); \
+ return 1; \
+ } \
+ v = (*p << 24) + (*(p + 1) << 16) + (*(p + 2) << 8) + *(p + 3); \
+ p += 4; \
+ l -= 4
+
+#define need64(v, p, l, d) \
+ if (l < 8) { \
+ if (sizeof(d) > 1) \
+ fprintf(stderr, "cds need 8B/64b, had %lu: %s\n", l, d); \
+ return 1; \
+ } \
+ v = (*p << 56) + (*(p + 1) << 48) + (*(p + 2) << 40) + (*(p + 3) << 32) + (*(p + 4) << 24) + (*(p + 5) << 16) + (*(p + 6) << 8) + *(p + 7); \
+ p += 8; \
+ l -= 8
+
+#define needxb(b, x, p, l, d) \
+ if (l < x) { \
+ if (sizeof(d) > 1) \
+ fprintf(stderr, "cds need %d bytes, had %lu: %s\n", x, l, d); \
+ return 1; \
+ } \
+ memcpy(b, p, x); \
+ p += x; \
+ l -= x
+
+#define advancexb(x, p, l, d) \
+ if (l < x) { \
+ if (sizeof(d) > 1) \
+ fprintf(stderr, "cds needed to advance %d bytes, had %lu: %s\n", x, l, d); \
+ return 1; \
+ } \
+ p += x; \
+ l -= x
+
+static uint8_t* cbor_buf = 0;
+static uint8_t* cbor_buf_p = 0;
+static size_t cbor_size = 1024 * 1024;
+static uint8_t* message_buf = 0;
+static size_t message_size = 64 * 1024;
+static int cbor_flushed = 1;
+static hashtbl* rdata_tbl = 0;
+static size_t MAX_RLABELS = CDS_DEFAULT_MAX_RLABELS;
+static size_t MIN_RLABEL_SIZE = CDS_DEFAULT_MIN_RLABEL_SIZE;
+static int use_rdata_index = 0;
+static int use_rdata_rindex = 0;
+static size_t RDATA_RINDEX_SIZE = CDS_DEFAULT_RDATA_RINDEX_SIZE;
+static size_t RDATA_RINDEX_MIN_SIZE = CDS_DEFAULT_RDATA_RINDEX_MIN_SIZE;
+static size_t RDATA_INDEX_MIN_SIZE = CDS_DEFAULT_RDATA_INDEX_MIN_SIZE;
+
+struct rdata;
+struct rdata {
+ struct rdata* prev;
+ struct rdata* next;
+ uint8_t* data;
+ size_t len;
+ size_t idx;
+};
+
+struct last {
+ my_bpftimeval ts;
+ ip_header_t ip;
+
+ uint16_t dns_type;
+ uint16_t dns_class;
+ uint32_t dns_ttl;
+
+ dns_rlabel_t* dns_rlabel;
+ dns_rlabel_t* dns_rlabel_last;
+ size_t dns_rlabels;
+
+ size_t rdata_index;
+ size_t rdata_num;
+ struct rdata* rdata;
+ struct rdata* rdata_last;
+};
+static struct last last;
+
+/*
+ * Set/Get
+ */
+
+int cds_set_cbor_size(size_t size)
+{
+ if (!size) {
+ return DUMP_CDS_EINVAL;
+ }
+
+ cbor_size = size;
+ if (message_size > cbor_size) {
+ message_size = cbor_size;
+ }
+
+ return DUMP_CDS_OK;
+}
+
+int cds_set_message_size(size_t size)
+{
+ if (!size) {
+ return DUMP_CDS_EINVAL;
+ }
+
+ message_size = size;
+ if (message_size > cbor_size) {
+ message_size = cbor_size;
+ }
+
+ return DUMP_CDS_OK;
+}
+
+int cds_set_max_rlabels(size_t size)
+{
+ if (!size) {
+ return DUMP_CDS_EINVAL;
+ }
+
+ MAX_RLABELS = size;
+
+ return DUMP_CDS_OK;
+}
+
+int cds_set_min_rlabel_size(size_t size)
+{
+ if (!size) {
+ return DUMP_CDS_EINVAL;
+ }
+
+ MIN_RLABEL_SIZE = size;
+
+ return DUMP_CDS_OK;
+}
+
+int cds_set_use_rdata_index(int use)
+{
+ use_rdata_index = use ? 1 : 0;
+
+ return DUMP_CDS_OK;
+}
+
+int cds_set_use_rdata_rindex(int use)
+{
+ use_rdata_rindex = use ? 1 : 0;
+
+ return DUMP_CDS_OK;
+}
+
+int cds_set_rdata_index_min_size(size_t size)
+{
+ if (!size) {
+ return DUMP_CDS_EINVAL;
+ }
+
+ RDATA_INDEX_MIN_SIZE = size;
+
+ return DUMP_CDS_OK;
+}
+
+int cds_set_rdata_rindex_min_size(size_t size)
+{
+ if (!size) {
+ return DUMP_CDS_EINVAL;
+ }
+
+ RDATA_RINDEX_MIN_SIZE = size;
+
+ return DUMP_CDS_OK;
+}
+
+int cds_set_rdata_rindex_size(size_t size)
+{
+ if (!size) {
+ return DUMP_CDS_EINVAL;
+ }
+
+ RDATA_RINDEX_SIZE = size;
+
+ return DUMP_CDS_OK;
+}
+
+/*
+ * DNS
+ */
+
+static int check_dns_label(size_t* labels, uint8_t** p, size_t* l)
+{
+ uint8_t len;
+
+ while (1) {
+ need8(len, *p, *l, "");
+ *labels += 1;
+
+ if ((len & 0xc0) == 0xc0) {
+ advancexb(1, *p, *l, "");
+ break;
+ } else if (len & 0xc0) {
+ break;
+ } else if (len) {
+ advancexb(len, *p, *l, "");
+ } else {
+ break;
+ }
+ }
+
+ return 0;
+}
+
+static unsigned int rdata_hash(const void* _item)
+{
+ const struct rdata* item = (const struct rdata*)_item;
+ size_t n, o, p;
+ unsigned int key = 0;
+
+ for (n = 0, o = 0, p = 0; n < item->len; n++) {
+ p |= item->data[n] << (o * 8);
+ o++;
+ if (o > 3) {
+ key ^= p;
+ p = 0;
+ o = 0;
+ }
+ }
+ if (o) {
+ key ^= p;
+ }
+
+ return key;
+}
+
+static int rdata_cmp(const void* _a, const void* _b)
+{
+ const struct rdata *a = (const struct rdata*)_a, *b = (const struct rdata*)_b;
+
+ if (a->len == b->len) {
+ return memcmp(a->data, b->data, a->len);
+ } else if (a->len < b->len)
+ return -1;
+ return 1;
+}
+
+static void rdata_free(void* d)
+{
+ struct rdata* item = (struct rdata*)d;
+
+ if (item) {
+ if (item->data) {
+ free(item->data);
+ }
+ free(item);
+ }
+}
+
+static int rdata_add(uint8_t* p, size_t len)
+{
+ struct rdata* key;
+
+ if (len < RDATA_INDEX_MIN_SIZE)
+ return 1;
+
+ if (!(key = calloc(1, sizeof(struct rdata)))) {
+ return 0;
+ }
+ if (!(key->data = calloc(1, len))) {
+ free(key);
+ return 0;
+ }
+
+ key->len = len;
+ memcpy(key->data, p, len);
+ key->idx = last.rdata_index++;
+
+ /* printf("rdata_add %u: ", rdata_hash(key));*/
+ /* {*/
+ /* size_t n = len;*/
+ /* uint8_t* x = p;*/
+ /* while (n--) {*/
+ /* printf("%02x", *x);*/
+ /* x++;*/
+ /* }*/
+ /* }*/
+ /* printf("\n");*/
+ hash_add(key, key, rdata_tbl);
+
+ return 0;
+}
+
+static size_t rdata_find(uint8_t* p, size_t len, size_t* found)
+{
+ struct rdata key;
+ struct rdata* r;
+
+ if (len < RDATA_INDEX_MIN_SIZE)
+ return 1;
+
+ key.data = p;
+ key.len = len;
+
+ /* printf("rdata_find %u: ", rdata_hash(&key));*/
+ /* {*/
+ /* size_t n = len;*/
+ /* uint8_t* x = p;*/
+ /* while (n--) {*/
+ /* printf("%02x", *x);*/
+ /* x++;*/
+ /* }*/
+ /* }*/
+ /* printf("\n");*/
+
+ if ((r = hash_find(&key, rdata_tbl))) {
+ /* printf("rdata found %lu at %lu\n", len, found->idx);*/
+ *found = r->idx;
+ return 0;
+ }
+
+ return 1;
+}
+
+int rdata_find2(uint8_t* p, size_t len, size_t* found)
+{
+ struct rdata* r = last.rdata;
+ size_t n = 0;
+
+ if (len < RDATA_RINDEX_MIN_SIZE)
+ return 1;
+
+ while (r) {
+ if (r->len == len && !memcmp(p, r->data, len)) {
+ break;
+ }
+ r = r->next;
+ n++;
+ }
+ if (r) {
+ /* printf("rdata found at %lu: ", n);*/
+ /* {*/
+ /* size_t n = len;*/
+ /* uint8_t* x = p;*/
+ /* while (n--) {*/
+ /* printf("%02x", *x);*/
+ /* x++;*/
+ /* }*/
+ /* }*/
+ /* printf("\n");*/
+
+ if (last.rdata != r) {
+ struct rdata *prev = r->prev, *next = r->next;
+
+ if (prev) {
+ prev->next = next;
+ }
+ if (next) {
+ next->prev = prev;
+ }
+
+ r->prev = 0;
+ r->next = last.rdata;
+ last.rdata->prev = r;
+ last.rdata = r;
+ }
+
+ *found = n;
+ return 0;
+ }
+
+ return 1;
+}
+
+int rdata_add2(uint8_t* p, size_t len)
+{
+ struct rdata* r;
+
+ if (len < RDATA_RINDEX_MIN_SIZE)
+ return 1;
+
+ if (!(r = calloc(1, sizeof(struct rdata)))) {
+ return -1;
+ }
+ if (!(r->data = calloc(1, len))) {
+ free(r);
+ return -1;
+ }
+
+ r->len = len;
+ memcpy(r->data, p, len);
+
+ /* printf("rdata_add: ");*/
+ /* {*/
+ /* size_t n = len;*/
+ /* uint8_t* x = p;*/
+ /* while (n--) {*/
+ /* printf("%02x", *x);*/
+ /* x++;*/
+ /* }*/
+ /* }*/
+ /* printf("\n");*/
+
+ if (last.rdata) {
+ last.rdata->prev = r;
+ }
+ r->next = last.rdata;
+ last.rdata = r;
+ last.rdata_num++;
+
+ if (last.rdata_last) {
+ if (last.rdata_num >= RDATA_RINDEX_SIZE) {
+ r = last.rdata_last;
+
+ last.rdata_last = r->prev;
+ last.rdata_last->next = 0;
+ last.rdata_num--;
+ free(r->data);
+ free(r);
+ }
+ } else {
+ last.rdata_last = r;
+ }
+
+ return 0;
+}
+
+static int parse_dns_rr(char is_q, dns_rr_t* rr, size_t expected_rrs, size_t* actual_rrs, uint8_t** p, size_t* l)
+{
+ uint8_t len;
+ uint8_t* p2;
+ size_t l2, idx;
+ dns_label_t* label;
+ size_t num_labels, offset;
+
+ while (expected_rrs--) {
+ /* first pass check number of labels */
+ p2 = *p;
+ l2 = *l;
+
+ if (check_dns_label(&(rr->labels), &p2, &l2)) {
+ if (!rr->labels) {
+ fprintf(stderr, "cds no labels\n");
+ return 1;
+ }
+ }
+
+ /* second pass, allocate labels and fill */
+ if (!(rr->label = calloc(rr->labels, sizeof(dns_label_t)))) {
+ fprintf(stderr, "cds out of memory\n");
+ return -1;
+ }
+
+ *actual_rrs += 1;
+
+ label = rr->label;
+ rr->have_labels = 1;
+
+ while (1) {
+ need8(len, *p, *l, "name length");
+
+ if ((len & 0xc0) == 0xc0) {
+ label->offset_p = *p;
+ need8(label->offset, *p, *l, "name offset");
+ label->offset |= (len & 0x3f) << 8;
+ label->have_offset = 1;
+ label->is_complete = 1;
+ break;
+ } else if (len & 0xc0) {
+ label->extension_bits = len;
+ label->have_extension_bits = 1;
+ label->is_complete = 1;
+ break;
+ } else if (len) {
+ label->size = len;
+ label->have_size = 1;
+ label->label = *p;
+ advancexb(len, *p, *l, "name label");
+ label->have_label = 1;
+ } else {
+ label->have_size = 1;
+ label->is_complete = 1;
+ break;
+ }
+
+ label->is_complete = 1;
+ label++;
+ }
+
+ need16(rr->type, *p, *l, "type");
+ rr->have_type = 1;
+ need16(rr->class, *p, *l, "class");
+ rr->have_class = 1;
+
+ if (!is_q) {
+ need32(rr->ttl, *p, *l, "ttl");
+ rr->have_ttl = 1;
+ need16(rr->rdlength, *p, *l, "rdlength");
+ rr->have_rdlength = 1;
+ rr->rdata = *p;
+ advancexb(rr->rdlength, *p, *l, "rdata");
+
+ if (use_rdata_index) {
+ if (!rdata_find(rr->rdata, rr->rdlength, &(rr->rdata_index))) {
+ rr->have_rdata_index = 1;
+ } else {
+ rdata_add(rr->rdata, rr->rdlength);
+ }
+ } else if (use_rdata_rindex) {
+ if (!rdata_find2(rr->rdata, rr->rdlength, &(rr->rdata_rindex))) {
+ rr->have_rdata_rindex = 1;
+ } else {
+ rdata_add2(rr->rdata, rr->rdlength);
+ }
+ }
+
+ num_labels = offset = 0;
+ switch (rr->type) {
+ case 2: /* NS */
+ case 3: /* MD */
+ case 4: /* MF */
+ case 5: /* CNAME */
+ case 7: /* MB */
+ case 8: /* MG */
+ case 9: /* MR */
+ case 12: /* PTR */
+ case 30: /* NXT */
+ case 39: /* DNAME */
+ case 47: /* NSEC */
+ case 249: /* TKEY */
+ case 250: /* TSIG */
+ num_labels = 1;
+ break;
+
+ case 6: /* SOA */
+ case 14: /* MINFO */
+ case 17: /* RP */
+ case 58: /* TALINK */
+ num_labels = 2;
+ break;
+
+ case 15: /* MX */
+ case 18: /* AFSDB */
+ case 21: /* RT */
+ case 36: /* KX */
+ case 107: /* LP */
+ num_labels = 1;
+ offset = 2;
+ break;
+
+ case 26: /* PX */
+ num_labels = 2;
+ offset = 2;
+ break;
+
+ case 24: /* SIG */
+ case 46: /* RRSIG */
+ num_labels = 1;
+ offset = 18;
+ break;
+
+ case 33: /* SRV */
+ num_labels = 1;
+ offset = 6;
+ break;
+
+ case 35: /* NAPTR */
+ num_labels = 1;
+ p2 = *p;
+ l2 = *l;
+ advancexb(2, p2, l2, "naptr int16 #1");
+ advancexb(2, p2, l2, "naptr int16 #2");
+ need8(len, p2, l2, "naptr str len #1");
+ advancexb(len, p2, l2, "naptr str #1");
+ need8(len, p2, l2, "naptr str len #2");
+ advancexb(len, p2, l2, "naptr str #2");
+ need8(len, p2, l2, "naptr str len #3");
+ advancexb(len, p2, l2, "naptr str #3");
+ offset = p2 - *p;
+ break;
+
+ case 55: /* HIP TODO */
+ break;
+ }
+
+ if (num_labels) {
+ dns_rdata_t* rdata;
+
+ rr->mixed_rdatas = num_labels + (offset ? 1 : 0) + 1;
+ if (!(rr->mixed_rdata = calloc(rr->mixed_rdatas, sizeof(dns_rdata_t)))) {
+ fprintf(stderr, "cds out of memory\n");
+ return -1;
+ }
+
+ p2 = rr->rdata;
+ l2 = rr->rdlength;
+ rdata = rr->mixed_rdata;
+ rr->have_mixed_rdata = 1;
+
+ if (offset) {
+ rdata->rdata_len = offset;
+ rdata->rdata = p2;
+ advancexb((int)offset, p2, l2, "mixed rdata");
+ rdata->have_rdata = 1;
+ rdata->is_complete = 1;
+ rdata++;
+ }
+ while (num_labels--) {
+ uint8_t* p3;
+ size_t l3;
+
+ /* first pass check number of rdata labels */
+
+ p3 = p2;
+ l3 = l2;
+
+ if (check_dns_label(&(rdata->labels), &p3, &l3)) {
+ if (!rdata->labels) {
+ fprintf(stderr, "cds mixed rdata no labels\n");
+ return 1;
+ }
+ }
+
+ /* second pass, allocate mixed rdata */
+ if (!(rdata->label = calloc(rdata->labels, sizeof(dns_label_t)))) {
+ fprintf(stderr, "cds out of memory\n");
+ return -1;
+ }
+
+ label = rdata->label;
+ rdata->have_labels = 1;
+ while (1) {
+ need8(len, p2, l2, "name length");
+
+ if ((len & 0xc0) == 0xc0) {
+ label->offset_p = p2;
+ need8(label->offset, p2, l2, "name offset");
+ label->offset |= (len & 0x3f) << 8;
+ label->have_offset = 1;
+ label->is_complete = 1;
+ break;
+ } else if (len & 0xc0) {
+ label->extension_bits = len;
+ label->have_extension_bits = 1;
+ label->is_complete = 1;
+ break;
+ } else if (len) {
+ label->size = len;
+ label->have_size = 1;
+ label->label = p2;
+ advancexb(len, p2, l2, "name label");
+ label->have_label = 1;
+ } else {
+ label->have_size = 1;
+ label->is_complete = 1;
+ break;
+ }
+
+ label->is_complete = 1;
+ label++;
+ }
+ rdata->is_complete = 1;
+ rdata++;
+ }
+ if (l2) {
+ /*printf("last rdata %lu\n", l2);*/
+ rdata->rdata_len = l2;
+ rdata->rdata = p2;
+ advancexb((int)l2, p2, l2, "mixed rdata");
+ rdata->have_rdata = 1;
+ rdata->is_complete = 1;
+ } else {
+ rr->mixed_rdatas--;
+ }
+ }
+ rr->have_rdata = 1;
+ }
+
+ rr->is_complete = 1;
+ rr++;
+ }
+
+ return 0;
+}
+
+int print_cbor = 0;
+
+static int parse_dns(dns_t* dns, uint8_t** p, size_t* l)
+{
+ int ret;
+
+ need16(dns->id, *p, *l, "dns id");
+ dns->have_id = 1;
+ need16(dns->raw, *p, *l, "raw dns bits");
+ dns->have_raw = 1;
+ need16(dns->qdcount, *p, *l, "qdcount");
+ dns->have_qdcount = 1;
+ need16(dns->ancount, *p, *l, "ancount");
+ dns->have_ancount = 1;
+ need16(dns->nscount, *p, *l, "nscount");
+ dns->have_nscount = 1;
+ need16(dns->arcount, *p, *l, "arcount");
+ dns->have_arcount = 1;
+
+ dns->header_is_complete = 1;
+
+ if (dns->qdcount) {
+ if (!(dns->question = calloc(dns->qdcount, sizeof(dns_rr_t)))) {
+ fprintf(stderr, "cds out of memory\n");
+ return -1;
+ }
+ ret = parse_dns_rr(1, dns->question, dns->qdcount, &(dns->questions), p, l);
+ /*if (ret) printf("qr %d\n", ret);*/
+ if (ret > -1 && dns->questions) {
+ dns->have_questions = 1;
+ }
+ if (ret) {
+ return ret;
+ }
+ }
+
+ if (dns->ancount) {
+ if (!(dns->answer = calloc(dns->ancount, sizeof(dns_rr_t)))) {
+ fprintf(stderr, "cds out of memory\n");
+ return -1;
+ }
+ ret = parse_dns_rr(0, dns->answer, dns->ancount, &(dns->answers), p, l);
+ /*if (ret) printf("an %d\n", ret);*/
+ if (ret > -1 && dns->answers) {
+ dns->have_answers = 1;
+ }
+ if (ret) {
+ return ret;
+ }
+ }
+
+ if (dns->nscount) {
+ if (!(dns->authority = calloc(dns->nscount, sizeof(dns_rr_t)))) {
+ fprintf(stderr, "cds out of memory\n");
+ return -1;
+ }
+ ret = parse_dns_rr(0, dns->authority, dns->nscount, &(dns->authorities), p, l);
+ /*if (ret) { printf("ns %d %lu\n", ret, dns->authorities);*/
+ /*{*/
+ /* size_t n;*/
+ /* for (n = 0; n < dns->authorities; n++) {*/
+ /* printf("%lu %d\n", n, dns->authority[n].is_complete);*/
+ /* if (!dns->authority[n].is_complete) print_cbor = 1;*/
+ /* }*/
+ /*} }*/
+ if (ret > -1 && dns->authorities) {
+ dns->have_authorities = 1;
+ }
+ if (ret) {
+ return ret;
+ }
+ }
+
+ if (dns->arcount) {
+ if (!(dns->additional = calloc(dns->arcount, sizeof(dns_rr_t)))) {
+ fprintf(stderr, "cds out of memory\n");
+ return -1;
+ }
+ ret = parse_dns_rr(0, dns->additional, dns->arcount, &(dns->additionals), p, l);
+ /*if (ret) printf("ar %d\n", ret);*/
+ if (ret > -1 && dns->additionals) {
+ dns->have_additionals = 1;
+ }
+ if (ret) {
+ return ret;
+ }
+ }
+
+ return 0;
+}
+
+static CborError encode_label(CborEncoder* encoder, dns_label_t* label, size_t labels)
+{
+ CborError cbor_err = CborNoError;
+ CborEncoder array;
+
+ if (labels && label[labels - 1].have_size && !label[labels - 1].size) {
+ labels--;
+ }
+
+ cbor_err = cbor_encoder_create_array(encoder, &array, labels);
+ while (labels--) {
+ if (label->have_offset) {
+ if (label->have_n_offset) {
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encode_uint(&array, label->n_offset);
+ } else {
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encode_negative_int(&array, label->offset);
+ }
+ } else if (label->have_extension_bits) {
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encode_simple_value(&array, label->extension_bits >> 6);
+ } else if (label->have_label) {
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encode_text_string(&array, (const char*)label->label, label->size);
+ } else {
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encode_null(&array);
+ }
+
+ label++;
+ }
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encoder_close_container_checked(encoder, &array);
+
+ return cbor_err;
+}
+
+/*
+ * OUTPUT
+ */
+
+int print_label(dns_label_t* label, size_t labels)
+{
+ size_t n;
+
+ for (n = 0; n < labels; n++) {
+ if (label[n].have_offset) {
+ if (label[n].have_n_offset) {
+ printf(" %lu", label[n].n_offset);
+ } else {
+ printf(" %d", -label[n].offset);
+ }
+ } else if (label[n].have_extension_bits) {
+ printf(" %x", label[n].extension_bits);
+ } else if (label[n].have_label) {
+ printf(" %.*s", label[n].size, label[n].label);
+ } else {
+ printf(" $");
+ }
+ }
+ return 0;
+}
+
+int print_rlabel(dns_rlabel_t* label)
+{
+ size_t n;
+
+ for (n = 0; n < label->labels; n++) {
+ if (label->label[n].size) {
+ printf(" %.*s", label->label[n].size, label->label[n].label);
+ } else if (label->label[n].have_n_offset) {
+ printf(" %lu", label->label[n].n_offset);
+ } else {
+ printf(" $");
+ }
+ }
+ return 0;
+}
+
+int dns_rlabel_add(dns_label_t* label, size_t labels)
+{
+ dns_rlabel_t* copy;
+ size_t n, size = 0;
+
+ for (n = 0; n < labels; n++) {
+ if ((label[n].have_offset && !label[n].have_n_offset)
+ || label[n].have_extension_bits) {
+ return 1;
+ }
+ if (label[n].have_size) {
+ size += label[n].size;
+ }
+ }
+ /*printf("label size: %lu\n", size);*/
+ if (size < MIN_RLABEL_SIZE) {
+ return 1;
+ }
+
+ if (!(copy = calloc(1, sizeof(dns_rlabel_t)))) {
+ return -1;
+ }
+
+ assert(labels <= CDS_RLABEL_T_LABELS);
+ copy->labels = labels;
+
+ for (n = 0; n < labels; n++) {
+ if (label[n].have_n_offset) {
+ copy->label[n].have_n_offset = 1;
+ copy->label[n].n_offset = label[n].n_offset;
+ continue;
+ }
+ if (label[n].size) {
+ assert(label[n].size <= CDS_RLABEL_LABEL_T_LABEL);
+
+ copy->label[n].size = label[n].size;
+ memcpy(&(copy->label[n].label), label[n].label, label[n].size);
+ }
+ }
+
+ /*printf("add"); print_label(label, labels); printf("\n");*/
+
+ if (last.dns_rlabel) {
+ last.dns_rlabel->prev = copy;
+ }
+ copy->next = last.dns_rlabel;
+ last.dns_rlabel = copy;
+ last.dns_rlabels++;
+ if (last.dns_rlabel_last) {
+ if (last.dns_rlabels >= MAX_RLABELS) {
+ dns_rlabel_t* remove = last.dns_rlabel_last;
+
+ /*printf("remove %p %p\n", remove, remove->prev);*/
+
+ last.dns_rlabel_last = remove->prev;
+ last.dns_rlabel_last->next = 0;
+ free(remove);
+ last.dns_rlabels--;
+ }
+ } else {
+ last.dns_rlabel_last = copy;
+ }
+
+ return 0;
+}
+
+static size_t dns_rlabel_find(dns_label_t* label, size_t labels, size_t* rlabel_idx)
+{
+ size_t n, n2, size = 0;
+ dns_rlabel_t* rlabel;
+
+ for (n = 0; n < labels; n++) {
+ if ((label[n].have_offset && !label[n].have_n_offset)
+ || label[n].have_extension_bits) {
+ return 1;
+ }
+ if (label[n].have_size) {
+ size += label[n].size;
+ }
+ }
+ /*printf("label size: %lu\n", size);*/
+ if (size < MIN_RLABEL_SIZE) {
+ return 1;
+ }
+
+ /*printf("find"); print_label(label, labels); printf("\n");*/
+
+ n = 0;
+ rlabel = last.dns_rlabel;
+ while (rlabel) {
+ if (rlabel->labels == labels) {
+ /*printf("check"); print_rlabel(rlabel); printf("\n");*/
+
+ for (n2 = 0; n2 < labels; n2++) {
+ /*printf("%d %lu <> %d %lu\n", label[n2].have_n_offset, label[n2].n_offset, rlabel->label[n2].have_n_offset, rlabel->label[n2].n_offset);*/
+ if (label[n2].have_n_offset
+ || rlabel->label[n2].have_n_offset) {
+ if (label[n2].n_offset == rlabel->label[n2].n_offset)
+ continue;
+ } else if (label[n2].size == rlabel->label[n2].size
+ && !memcmp(label[n2].label, rlabel->label[n2].label, label[n2].size)) {
+ continue;
+ }
+ break;
+ }
+
+ if (n2 == labels) {
+ /*printf("found at %lu: ", n); print_rlabel(rlabel); printf("\n");*/
+ break;
+ }
+ }
+ rlabel = rlabel->next;
+ n++;
+ }
+ if (rlabel) {
+ if (last.dns_rlabel != rlabel) {
+ dns_rlabel_t *prev = rlabel->prev, *next = rlabel->next;
+
+ if (prev) {
+ prev->next = next;
+ }
+ if (next) {
+ next->prev = prev;
+ }
+
+ rlabel->prev = 0;
+ rlabel->next = last.dns_rlabel;
+ last.dns_rlabel->prev = rlabel;
+ last.dns_rlabel = rlabel;
+ }
+
+ *rlabel_idx = n;
+ return 0;
+ }
+
+ return 1;
+}
+
+static void free_rdata(dns_rdata_t* rdata)
+{
+ if (rdata->label) {
+ free(rdata->label);
+ }
+}
+
+static void free_rr(dns_rr_t* rr)
+{
+ size_t n;
+
+ if (rr->label) {
+ free(rr->label);
+ }
+ for (n = 0; n < rr->mixed_rdatas; n++) {
+ free_rdata(&(rr->mixed_rdata[n]));
+ }
+ if (rr->mixed_rdata) {
+ free(rr->mixed_rdata);
+ }
+}
+
+static void free_dns(dns_t* dns)
+{
+ size_t n;
+
+ for (n = 0; n < dns->questions; n++) {
+ free_rr(&(dns->question[n]));
+ }
+ for (n = 0; n < dns->answers; n++) {
+ free_rr(&(dns->answer[n]));
+ }
+ for (n = 0; n < dns->authorities; n++) {
+ free_rr(&(dns->authority[n]));
+ }
+ for (n = 0; n < dns->additionals; n++) {
+ free_rr(&(dns->additional[n]));
+ }
+}
+
+void dns_rr_build_offset(dns_rr_t* rr_list, size_t count, uint16_t* offset, size_t offsets, size_t* n_offset, const u_char* payload)
+{
+ dns_rr_t* rrp;
+ size_t rr, n, n2;
+
+ for (rr = 0; rr < count && *n_offset < offsets; rr++) {
+ rrp = &(rr_list[rr]);
+
+ for (n = 0; n < rrp->labels && *n_offset < offsets; n++) {
+ if (rrp->label[n].size) {
+ rrp->label[n].offset = rrp->label[n].label - payload - 1;
+ offset[*n_offset] = rrp->label[n].offset;
+ *n_offset += 1;
+ } else if (rrp->label[n].have_offset) {
+ offset[*n_offset] = rrp->label[n].offset_p - payload - 1;
+ *n_offset += 1;
+ }
+
+ /* printf("%u %u %u %.*s\n",*/
+ /* rrp->label[n].size,*/
+ /* rrp->label[n].extension_bits,*/
+ /* rrp->label[n].offset,*/
+ /* rrp->label[n].size ? rrp->label[n].size : 0,*/
+ /* rrp->label[n].size ? (char*)rrp->label[n].label : ""*/
+ /* );*/
+ }
+ for (n = 0; n < rrp->mixed_rdatas && *n_offset < offsets; n++) {
+ for (n2 = 0; n2 < rrp->mixed_rdata[n].labels; n2++) {
+ if (rrp->mixed_rdata[n].label[n2].size) {
+ rrp->mixed_rdata[n].label[n2].offset = rrp->mixed_rdata[n].label[n2].label - payload - 1;
+ offset[*n_offset] = rrp->mixed_rdata[n].label[n2].offset;
+ *n_offset += 1;
+ } else if (rrp->mixed_rdata[n].label[n2].have_offset) {
+ offset[*n_offset] = rrp->mixed_rdata[n].label[n2].offset_p - payload - 1;
+ *n_offset += 1;
+ }
+
+ /* printf(" %u %u %u %.*s\n",*/
+ /* rrp->mixed_rdata[n].label[n2].size,*/
+ /* rrp->mixed_rdata[n].label[n2].extension_bits,*/
+ /* rrp->mixed_rdata[n].label[n2].offset,*/
+ /* rrp->mixed_rdata[n].label[n2].size ? rrp->mixed_rdata[n].label[n2].size : 0,*/
+ /* rrp->mixed_rdata[n].label[n2].size ? (char*)rrp->mixed_rdata[n].label[n2].label : ""*/
+ /* );*/
+ }
+ }
+ }
+}
+
+void dns_rr_set_offset(dns_rr_t* rr_list, size_t count, uint16_t* offset, size_t n_offset)
+{
+ dns_rr_t* rrp;
+ size_t rr, n, n2, n3;
+
+ for (rr = 0; rr < count; rr++) {
+ rrp = &(rr_list[rr]);
+
+ for (n = 0; n < rrp->labels; n++) {
+ if (!rrp->label[n].size && rrp->label[n].offset) {
+ for (n3 = 0; n3 < n_offset; n3++) {
+ if (rrp->label[n].offset == offset[n3]) {
+ /* printf("%u => %lu\n", rrp->label[n].offset, n3);*/
+ rrp->label[n].n_offset = n3;
+ rrp->label[n].have_n_offset = 1;
+ break;
+ }
+ }
+ }
+ }
+ for (n = 0; n < rrp->mixed_rdatas; n++) {
+ for (n2 = 0; n2 < rrp->mixed_rdata[n].labels; n2++) {
+ if (!rrp->mixed_rdata[n].label[n2].size && rrp->mixed_rdata[n].label[n2].offset) {
+ for (n3 = 0; n3 < n_offset; n3++) {
+ if (rrp->mixed_rdata[n].label[n2].offset == offset[n3]) {
+ /* printf("%u => %lu\n", rrp->mixed_rdata[n].label[n2].offset, n3);*/
+ rrp->mixed_rdata[n].label[n2].n_offset = n3;
+ rrp->mixed_rdata[n].label[n2].have_n_offset = 1;
+ break;
+ }
+ }
+ }
+ }
+ }
+ }
+}
+
+void dns_rr_build_rlabel(dns_rr_t* rr_list, size_t count)
+{
+ dns_rr_t* rrp;
+ size_t rr, n;
+
+ for (rr = 0; rr < count; rr++) {
+ rrp = &(rr_list[rr]);
+
+ if (rrp->labels) {
+ if (!dns_rlabel_find(rrp->label, rrp->labels, &(rrp->rlabel_idx))) {
+ rrp->have_rlabel_idx = 1;
+ } else {
+ dns_rlabel_add(rrp->label, rrp->labels);
+ }
+ }
+
+ for (n = 0; n < rrp->mixed_rdatas; n++) {
+ if (rrp->mixed_rdata[n].labels) {
+ if (!dns_rlabel_find(rrp->mixed_rdata[n].label, rrp->mixed_rdata[n].labels, &(rrp->mixed_rdata[n].rlabel_idx))) {
+ rrp->mixed_rdata[n].have_rlabel_idx = 1;
+ } else {
+ dns_rlabel_add(rrp->mixed_rdata[n].label, rrp->mixed_rdata[n].labels);
+ }
+ }
+ }
+ }
+}
+
+CborError dns_build_rrs(CborEncoder* message, dns_rr_t* rr_list, size_t count)
+{
+ CborError cbor_err = CborNoError;
+ CborEncoder rrs;
+ dns_rr_t* rr = rr_list;
+ size_t n = count;
+
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encoder_create_array(message, &rrs, n);
+ while (n--) {
+ CborEncoder item;
+ if (!(rr->have_type && rr->type == 41)) {
+ if (rr->have_type && rr->type == last.dns_type) {
+ rr->have_type = 0;
+ }
+ if (rr->have_class && rr->class == last.dns_class) {
+ rr->have_class = 0;
+ }
+ if (rr->have_ttl && rr->ttl == last.dns_ttl) {
+ rr->have_ttl = 0;
+ }
+ }
+ if (rr->have_rdlength && rr->have_rdata) {
+ rr->have_rdlength = 0;
+ }
+
+ rr->bits = rr->have_type
+ | rr->have_class << 1
+ | rr->have_ttl << 2
+ | rr->have_rdlength << 3;
+ if (rr->bits && rr->bits != 0xf) {
+ rr->have_bits = 1;
+ }
+
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encoder_create_array(&rrs, &item,
+ (rr->is_complete ? 0 : 1) + rr->have_labels
+ + rr->have_bits + rr->have_type + rr->have_class + rr->have_ttl + rr->have_rdlength
+ + rr->have_rdata);
+ if (!rr->is_complete) {
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encode_boolean(&item, false);
+ }
+ if (rr->have_labels) {
+ if (rr->have_rlabel_idx) {
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encode_negative_int(&item, rr->rlabel_idx);
+ } else {
+ if (cbor_err == CborNoError)
+ cbor_err = encode_label(&item, rr->label, rr->labels);
+ }
+ }
+ if (rr->have_bits && cbor_err == CborNoError)
+ cbor_err = cbor_encode_simple_value(&item, rr->bits);
+ if (rr->have_type && cbor_err == CborNoError)
+ cbor_err = cbor_encode_uint(&item, rr->type);
+ if (rr->have_class && cbor_err == CborNoError)
+ cbor_err = cbor_encode_uint(&item, rr->class);
+ if (rr->have_ttl && cbor_err == CborNoError)
+ cbor_err = cbor_encode_uint(&item, rr->ttl);
+ if (rr->have_rdlength && cbor_err == CborNoError)
+ cbor_err = cbor_encode_uint(&item, rr->rdlength);
+ if (rr->have_rdata_index) {
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encode_uint(&item, rr->rdata_index);
+ } else if (rr->have_rdata_rindex) {
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encode_negative_int(&item, rr->rdata_rindex);
+ } else if (rr->have_mixed_rdata) {
+ CborEncoder rdatas;
+ size_t n2 = rr->mixed_rdatas;
+ dns_rdata_t* rdata = rr->mixed_rdata;
+
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encoder_create_array(&item, &rdatas, rr->mixed_rdatas);
+ while (n2--) {
+ if (rdata->have_labels) {
+ if (rdata->have_rlabel_idx) {
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encode_negative_int(&rdatas, rdata->rlabel_idx);
+ } else {
+ if (cbor_err == CborNoError)
+ cbor_err = encode_label(&rdatas, rdata->label, rdata->labels);
+ }
+ } else if (rdata->have_rdata) {
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encode_byte_string(&rdatas, rdata->rdata, rdata->rdata_len);
+ }
+
+ rdata++;
+ }
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encoder_close_container_checked(&item, &rdatas);
+ } else if (rr->have_rdata && cbor_err == CborNoError)
+ cbor_err = cbor_encode_byte_string(&item, rr->rdata, rr->rdlength);
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encoder_close_container_checked(&rrs, &item);
+
+ if (!(rr->have_type && rr->type == 41)) {
+ if (rr->have_type) {
+ last.dns_type = rr->type;
+ }
+ if (rr->have_class) {
+ last.dns_class = rr->class;
+ }
+ if (rr->have_ttl) {
+ last.dns_ttl = rr->ttl;
+ }
+ }
+ rr++;
+ }
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encoder_close_container_checked(message, &rrs);
+
+ return cbor_err;
+}
+
+int output_cds(iaddr from, iaddr to, uint8_t proto, unsigned flags, unsigned sport, unsigned dport, my_bpftimeval ts, const u_char* pkt_copy, size_t olen, const u_char* payload, size_t payloadlen)
+{
+ CborEncoder cbor, message;
+ CborError cbor_err = CborNoError;
+ ip_header_t ip;
+ dns_t dns;
+ uint8_t* malformed = 0;
+ size_t malformed_size = 0;
+ size_t dns_parts = 0;
+
+ if (!payload) {
+ return DUMP_CDS_EINVAL;
+ }
+ if (!payloadlen) {
+ return DUMP_CDS_EINVAL;
+ }
+
+ if (!cbor_buf) {
+ memset(&last, 0, sizeof(last));
+ if (!(cbor_buf = calloc(1, cbor_size + message_size))) {
+ return DUMP_CDS_ENOMEM;
+ }
+ }
+ if (!cbor_buf_p) {
+ cbor_buf_p = cbor_buf;
+ }
+ if (!message_buf) {
+ if (!(message_buf = calloc(1, message_size))) {
+ return DUMP_CDS_ENOMEM;
+ }
+ }
+ if (cbor_flushed) {
+ dns_rlabel_t* rlabel;
+ struct rdata* r;
+
+ cbor_buf_p = cbor_buf;
+ while ((rlabel = last.dns_rlabel)) {
+ last.dns_rlabel = rlabel->next;
+ free(rlabel);
+ }
+ while ((r = last.rdata)) {
+ last.rdata = r->next;
+ rdata_free(r);
+ }
+ memset(&last, 0, sizeof(last));
+ if (rdata_tbl) {
+ hash_free(rdata_tbl);
+ rdata_tbl = 0;
+ }
+
+ cbor_encoder_init(&cbor, message_buf, message_size, 0);
+ cbor_err = cbor_encoder_create_array(&cbor, &message, 5 + (use_rdata_index ? 3 : 0) + (use_rdata_rindex ? 4 : 0));
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encode_text_stringz(&message, "CDSv1");
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encode_uint(&message, CDS_OPTION_RLABELS);
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encode_uint(&message, MAX_RLABELS);
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encode_uint(&message, CDS_OPTION_RLABEL_MIN_SIZE);
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encode_uint(&message, MIN_RLABEL_SIZE);
+ if (use_rdata_index) {
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encode_uint(&message, CDS_OPTION_USE_RDATA_INDEX);
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encode_uint(&message, CDS_OPTION_RDATA_INDEX_MIN_SIZE);
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encode_uint(&message, RDATA_INDEX_MIN_SIZE);
+ } else if (use_rdata_rindex) {
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encode_uint(&message, CDS_OPTION_RDATA_RINDEX_SIZE);
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encode_uint(&message, RDATA_RINDEX_SIZE);
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encode_uint(&message, CDS_OPTION_RDATA_RINDEX_MIN_SIZE);
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encode_uint(&message, RDATA_RINDEX_MIN_SIZE);
+ }
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encoder_close_container_checked(&cbor, &message);
+ if (cbor_err != CborNoError) {
+ fprintf(stderr, "cbor error[%d]: %s\n", cbor_err, cbor_error_string(cbor_err));
+ return DUMP_CDS_ECBOR;
+ }
+
+ /* *cbor_buf_p = 0x9f;*/
+ /* cbor_buf_p++;*/
+
+ if ((cbor_size - (cbor_buf_p - cbor_buf)) < cbor_encoder_get_buffer_size(&cbor, message_buf)) {
+ return DUMP_CDS_EBUF;
+ }
+ memcpy(cbor_buf_p, message_buf, cbor_encoder_get_buffer_size(&cbor, message_buf));
+ cbor_buf_p += cbor_encoder_get_buffer_size(&cbor, message_buf);
+
+ cbor_flushed = 0;
+ }
+ if (!rdata_tbl) {
+ if (!(rdata_tbl = hash_create(64 * 1024, rdata_hash, rdata_cmp, rdata_free))) {
+ return DUMP_CDS_ENOMEM;
+ }
+ }
+
+ /*
+ * IP Header
+ */
+
+ memset(&ip, 0, sizeof(ip_header_t));
+
+ /* fill ip */
+ if (from.af == AF_INET6) {
+ ip.is_v6 = 1;
+ memcpy(&(ip.src_addr6), &(from.u.a6), sizeof(struct in6_addr));
+ memcpy(&(ip.dest_addr6), &(to.u.a6), sizeof(struct in6_addr));
+ ip.src_port6 = sport;
+ ip.dest_port6 = dport;
+ } else {
+ memcpy(&(ip.src_addr4), &(from.u.a4), sizeof(struct in_addr));
+ memcpy(&(ip.dest_addr4), &(to.u.a4), sizeof(struct in_addr));
+ ip.src_port4 = sport;
+ ip.dest_port4 = dport;
+ }
+
+ /* deduplicate */
+ {
+ int dedup = 0;
+ ip_header_t reverse;
+
+ reverse = ip;
+
+ /* check last.ip */
+ if (ip.is_v6) {
+ if (!memcmp(&(ip.src_addr6), &(last.ip.src_addr6), sizeof(struct in6_addr)))
+ dedup++;
+ else
+ ip.have_src_addr = 1;
+
+ if (!memcmp(&(ip.dest_addr6), &(last.ip.dest_addr6), sizeof(struct in6_addr)))
+ dedup++;
+ else
+ ip.have_dest_addr = 1;
+
+ if (ip.src_port6 == last.ip.src_port6)
+ dedup++;
+ else
+ ip.have_src_port = 1;
+
+ if (ip.dest_port6 == last.ip.dest_port6)
+ dedup++;
+ else
+ ip.have_dest_port = 1;
+ } else {
+ if (!memcmp(&(ip.src_addr4), &(last.ip.src_addr4), sizeof(struct in_addr)))
+ dedup++;
+ else
+ ip.have_src_addr = 1;
+
+ if (!memcmp(&(ip.dest_addr4), &(last.ip.dest_addr4), sizeof(struct in_addr)))
+ dedup++;
+ else
+ ip.have_dest_addr = 1;
+
+ if (ip.src_port4 == last.ip.src_port4)
+ dedup++;
+ else
+ ip.have_src_port = 1;
+
+ if (ip.dest_port4 == last.ip.dest_port4)
+ dedup++;
+ else
+ ip.have_dest_port = 1;
+ }
+
+ /* check reverse last.ip */
+ if (ip.is_v6) {
+ if (!memcmp(&(ip.src_addr6), &(last.ip.dest_addr6), sizeof(struct in6_addr)))
+ dedup--;
+ else
+ reverse.have_src_addr = 1;
+
+ if (!memcmp(&(ip.dest_addr6), &(last.ip.src_addr6), sizeof(struct in6_addr)))
+ dedup--;
+ else
+ reverse.have_dest_addr = 1;
+
+ if (ip.src_port6 == last.ip.dest_port6)
+ dedup--;
+ else
+ reverse.have_src_port = 1;
+
+ if (ip.dest_port6 == last.ip.src_port6)
+ dedup--;
+ else
+ reverse.have_dest_port = 1;
+ } else {
+ if (!memcmp(&(ip.src_addr4), &(last.ip.dest_addr4), sizeof(struct in_addr)))
+ dedup--;
+ else
+ reverse.have_src_addr = 1;
+
+ if (!memcmp(&(ip.dest_addr4), &(last.ip.src_addr4), sizeof(struct in_addr)))
+ dedup--;
+ else
+ reverse.have_dest_addr = 1;
+
+ if (ip.src_port4 == last.ip.dest_port4)
+ dedup--;
+ else
+ reverse.have_src_port = 1;
+
+ if (ip.dest_port4 == last.ip.src_port4)
+ dedup--;
+ else
+ reverse.have_dest_port = 1;
+ }
+
+ if (dedup < 0) {
+ ip = reverse;
+ ip.is_reverse = 1;
+ /*fprintf(stderr, "reverse of last ip ");*/
+ }
+ /*fprintf(stderr, "v6:%d src:%d dest:%d sport:%d dport:%d\n", ip.is_v6, ip.have_src_addr, ip.have_dest_addr, ip.have_src_port, ip.have_dest_port);*/
+
+ ip.bits = ip.is_v6
+ | ip.have_src_addr << 1
+ | ip.have_dest_addr << 2
+ | (ip.have_src_port | ip.have_dest_port) << 3;
+
+ if (ip.is_v6) {
+ last.ip.src_addr6 = ip.src_addr6;
+ last.ip.dest_addr6 = ip.dest_addr6;
+ last.ip.src_port6 = ip.src_port6;
+ last.ip.dest_port6 = ip.dest_port6;
+ } else {
+ last.ip.src_addr4 = ip.src_addr4;
+ last.ip.dest_addr4 = ip.dest_addr4;
+ last.ip.src_port4 = ip.src_port4;
+ last.ip.dest_port4 = ip.dest_port4;
+ }
+ }
+
+ /*
+ * DNS Message
+ */
+
+ if (flags & DNSCAP_OUTPUT_ISDNS) {
+ uint8_t* p = (uint8_t*)payload;
+ size_t l = payloadlen, rr, n, n2, n3;
+ int ret;
+ dns_rr_t* rrp;
+
+ size_t n_offset = 0;
+ uint16_t offset[256]; /* TODO: Handle offsets better */
+
+ memset(&dns, 0, sizeof(dns));
+ ret = parse_dns(&dns, &p, &l);
+
+ if (ret < 0) {
+ free_dns(&dns);
+ return DUMP_CDS_ENOMEM;
+ } else if (ret > 0) {
+ malformed = p;
+ malformed_size = l;
+ }
+
+ if (dns.have_qdcount && dns.qdcount == dns.questions) {
+ dns.have_qdcount = 0;
+ }
+ if (dns.have_ancount && dns.ancount == dns.answers) {
+ dns.have_ancount = 0;
+ }
+ if (dns.have_nscount && dns.nscount == dns.authorities) {
+ dns.have_nscount = 0;
+ }
+ if (dns.have_arcount && dns.arcount == dns.additionals) {
+ dns.have_arcount = 0;
+ }
+
+ dns.cnt_bits = dns.have_qdcount
+ | dns.have_ancount << 1
+ | dns.have_nscount << 2
+ | dns.have_arcount << 3;
+ if (dns.cnt_bits && dns.cnt_bits != 0xf) {
+ dns.have_cnt_bits = 1;
+ }
+
+ dns.rr_bits = dns.have_questions
+ | dns.have_answers << 1
+ | dns.have_authorities << 2
+ | dns.have_additionals << 3;
+ if (dns.rr_bits && dns.rr_bits != 0xf) {
+ dns.have_rr_bits = 1;
+ }
+
+ dns_rr_build_offset(dns.question, dns.questions, &offset[0], sizeof(offset), &n_offset, payload);
+ dns_rr_build_offset(dns.answer, dns.answers, &offset[0], sizeof(offset), &n_offset, payload);
+ dns_rr_build_offset(dns.authority, dns.authorities, &offset[0], sizeof(offset), &n_offset, payload);
+ dns_rr_build_offset(dns.additional, dns.additionals, &offset[0], sizeof(offset), &n_offset, payload);
+
+ /* for (n = 0; n < n_offset; n++) {*/
+ /* printf("%lu: %u\n", n, offset[n]);*/
+ /* }*/
+
+ dns_rr_set_offset(dns.question, dns.questions, &offset[0], n_offset);
+ dns_rr_set_offset(dns.answer, dns.answers, &offset[0], n_offset);
+ dns_rr_set_offset(dns.authority, dns.authorities, &offset[0], n_offset);
+ dns_rr_set_offset(dns.additional, dns.additionals, &offset[0], n_offset);
+
+ dns_rr_build_rlabel(dns.question, dns.questions);
+ dns_rr_build_rlabel(dns.answer, dns.answers);
+ dns_rr_build_rlabel(dns.authority, dns.authorities);
+ dns_rr_build_rlabel(dns.additional, dns.additionals);
+ }
+
+ /*
+ * CBOR
+ */
+
+ cbor_encoder_init(&cbor, message_buf, message_size, 0);
+ cbor_err = cbor_encoder_create_array(&cbor, &message,
+ /* timestamp */
+ 1
+ /* message bits */
+ + 1
+ /* ip header */
+ + 1 + ip.have_src_addr + ip.have_dest_addr + (ip.have_src_port | ip.have_dest_port)
+ /* dns message */
+ + dns.have_id + dns.have_raw
+ + dns.have_cnt_bits + dns.have_qdcount + dns.have_ancount + dns.have_nscount + dns.have_arcount
+ + dns.have_rr_bits + dns.have_questions + dns.have_answers + dns.have_authorities + dns.have_additionals
+ + (malformed ? 1 : 0));
+
+ /*
+ * Encode timestamp
+ */
+
+ {
+ CborEncoder timestamp;
+
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encoder_create_array(&message, &timestamp, 2);
+ if (last.ts.tv_sec && last.ts.tv_sec <= ts.tv_sec) {
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encode_negative_int(&timestamp, ts.tv_sec - last.ts.tv_sec);
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encode_int(&timestamp, ts.tv_usec - last.ts.tv_usec);
+ } else {
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encode_uint(&timestamp, ts.tv_sec);
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encode_uint(&timestamp, ts.tv_usec);
+ }
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encoder_close_container_checked(&message, &timestamp);
+
+ last.ts = ts;
+ }
+
+ /*
+ * Encode message bits
+ */
+
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encode_uint(&message,
+ (flags & DNSCAP_OUTPUT_ISDNS ? 1 : 0)
+ + (flags & DNSCAP_OUTPUT_ISDNS ? proto == IPPROTO_TCP ? 1 << 1 : 0
+ : 0)
+ + (flags & DNSCAP_OUTPUT_ISFRAG ? 1 << 2 : 0)
+ + (malformed ? 1 << 3 : 0));
+
+ /*
+ * Encode IP Header
+ */
+
+ if (ip.is_reverse) {
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encode_negative_int(&message, ip.bits);
+ } else {
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encode_uint(&message, ip.bits);
+ }
+
+ if (ip.is_v6) {
+ if (ip.have_src_addr && cbor_err == CborNoError)
+ cbor_err = cbor_encode_byte_string(&message, (uint8_t*)&(ip.src_addr6), sizeof(struct in6_addr));
+ if (ip.have_dest_addr && cbor_err == CborNoError)
+ cbor_err = cbor_encode_byte_string(&message, (uint8_t*)&(ip.dest_addr6), sizeof(struct in6_addr));
+ if (ip.have_src_port && ip.have_dest_port) {
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encode_uint(&message, (ip.dest_port6 << 16) | ip.src_port6);
+ } else if (ip.have_src_port) {
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encode_uint(&message, ip.src_port6);
+ } else if (ip.have_dest_port) {
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encode_negative_int(&message, ip.dest_port6);
+ }
+ } else {
+ if (ip.have_src_addr && cbor_err == CborNoError)
+ cbor_err = cbor_encode_byte_string(&message, (uint8_t*)&(ip.src_addr4), sizeof(struct in_addr));
+ if (ip.have_dest_addr && cbor_err == CborNoError)
+ cbor_err = cbor_encode_byte_string(&message, (uint8_t*)&(ip.dest_addr4), sizeof(struct in_addr));
+ if (ip.have_src_port && ip.have_dest_port) {
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encode_uint(&message, (ip.dest_port4 << 16) | ip.src_port4);
+ } else if (ip.have_src_port) {
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encode_uint(&message, ip.src_port4);
+ } else if (ip.have_dest_port) {
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encode_negative_int(&message, ip.dest_port4);
+ }
+ }
+
+ /*
+ * Encode DNS Message
+ */
+ if (flags & DNSCAP_OUTPUT_ISDNS && !dns.header_is_complete) {
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encode_boolean(&message, false);
+ }
+ if (dns.have_id && cbor_err == CborNoError)
+ cbor_err = cbor_encode_uint(&message, dns.id);
+ if (dns.have_raw && cbor_err == CborNoError)
+ cbor_err = cbor_encode_uint(&message, dns.raw);
+ if (dns.have_cnt_bits && cbor_err == CborNoError)
+ cbor_err = cbor_encode_negative_int(&message, dns.cnt_bits);
+ if (dns.have_qdcount && cbor_err == CborNoError)
+ cbor_err = cbor_encode_uint(&message, dns.qdcount);
+ if (dns.have_ancount && cbor_err == CborNoError)
+ cbor_err = cbor_encode_uint(&message, dns.ancount);
+ if (dns.have_nscount && cbor_err == CborNoError)
+ cbor_err = cbor_encode_uint(&message, dns.nscount);
+ if (dns.have_arcount && cbor_err == CborNoError)
+ cbor_err = cbor_encode_uint(&message, dns.arcount);
+ if (dns.have_rr_bits && cbor_err == CborNoError)
+ cbor_err = cbor_encode_simple_value(&message, dns.rr_bits);
+ if (dns.have_questions) {
+ CborEncoder rrs;
+ dns_rr_t* rr = dns.question;
+ size_t n = dns.questions;
+
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encoder_create_array(&message, &rrs, n);
+ while (n--) {
+ CborEncoder item;
+
+ if (rr->have_type && rr->type == last.dns_type) {
+ rr->have_type = 0;
+ }
+ if (rr->have_class && rr->class == last.dns_class) {
+ rr->have_class = 0;
+ }
+
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encoder_create_array(&rrs, &item,
+ (rr->is_complete ? 0 : 1) + rr->have_labels + rr->have_type + rr->have_class);
+ if (!rr->is_complete) {
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encode_boolean(&item, false);
+ }
+ if (rr->have_labels) {
+ if (rr->have_rlabel_idx) {
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encode_negative_int(&item, rr->rlabel_idx);
+ } else {
+ if (cbor_err == CborNoError)
+ cbor_err = encode_label(&item, rr->label, rr->labels);
+ }
+ }
+ if (rr->have_type && cbor_err == CborNoError)
+ cbor_err = cbor_encode_uint(&item, rr->type);
+ if (rr->have_class && cbor_err == CborNoError)
+ cbor_err = cbor_encode_negative_int(&item, rr->class);
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encoder_close_container_checked(&rrs, &item);
+
+ if (rr->have_type) {
+ last.dns_type = rr->type;
+ }
+ if (rr->have_class) {
+ last.dns_class = rr->class;
+ }
+
+ rr++;
+ }
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encoder_close_container_checked(&message, &rrs);
+ }
+ if (dns.have_answers && cbor_err == CborNoError)
+ cbor_err = dns_build_rrs(&message, dns.answer, dns.answers);
+ if (dns.have_authorities && cbor_err == CborNoError)
+ cbor_err = dns_build_rrs(&message, dns.authority, dns.authorities);
+ if (dns.have_additionals && cbor_err == CborNoError)
+ cbor_err = dns_build_rrs(&message, dns.additional, dns.additionals);
+
+ /*
+ * Encode malformed
+ */
+
+ if (malformed && cbor_err == CborNoError)
+ cbor_err = cbor_encode_byte_string(&message, (uint8_t*)malformed, malformed_size);
+
+ /*
+ * Close
+ */
+
+ free_dns(&dns);
+
+ if (cbor_err == CborNoError)
+ cbor_err = cbor_encoder_close_container_checked(&cbor, &message);
+ if (cbor_err != CborNoError) {
+ fprintf(stderr, "cbor error[%d]: %s\n", cbor_err, cbor_error_string(cbor_err));
+ return DUMP_CDS_ECBOR;
+ }
+
+ /* if (print_cbor>1)*/
+ /* {*/
+ /* uint8_t* p = message_buf;*/
+ /* size_t s = cbor_encoder_get_buffer_size(&cbor, message_buf);*/
+
+ /* while (s--) {*/
+ /* printf("%02x", *p++);*/
+ /* }*/
+ /* printf("\n");*/
+ /* }*/
+
+ if (((cbor_size + message_size) - (cbor_buf_p - cbor_buf)) < cbor_encoder_get_buffer_size(&cbor, message_buf)) {
+ return DUMP_CDS_EBUF;
+ }
+ memcpy(cbor_buf_p, message_buf, cbor_encoder_get_buffer_size(&cbor, message_buf));
+ cbor_buf_p += cbor_encoder_get_buffer_size(&cbor, message_buf);
+
+ if (cbor_buf_p < (cbor_buf + cbor_size)) {
+ return DUMP_CDS_OK;
+ }
+
+ cbor_flushed = 1;
+ return DUMP_CDS_FLUSH;
+}
+
+int dump_cds(FILE* fp)
+{
+ CborError cbor_err;
+
+ if (!fp) {
+ return DUMP_CDS_EINVAL;
+ }
+
+ /* *cbor_buf_p = 0xff;*/
+ /* cbor_buf_p++;*/
+
+ /* fprintf(stderr, "cds output: %lu bytes\n", cbor_buf_p - cbor_buf);*/
+
+ if (fwrite(cbor_buf, cbor_buf_p - cbor_buf, 1, fp) != 1) {
+ return DUMP_CDS_EWRITE;
+ }
+
+ return DUMP_CDS_OK;
+}
+
+int have_cds_support()
+{
+ return 1;
+}
+
+#else /* HAVE_LIBTINYCBOR */
+
+int cds_set_cbor_size(size_t size)
+{
+ return DUMP_CDS_ENOSUP;
+}
+
+int cds_set_message_size(size_t size)
+{
+ return DUMP_CDS_ENOSUP;
+}
+
+int cds_set_max_rlabels(size_t size)
+{
+ return DUMP_CDS_ENOSUP;
+}
+
+int cds_set_min_rlabel_size(size_t size)
+{
+ return DUMP_CDS_ENOSUP;
+}
+
+int cds_set_use_rdata_index(int use)
+{
+ return DUMP_CDS_ENOSUP;
+}
+
+int cds_set_use_rdata_rindex(int use)
+{
+ return DUMP_CDS_ENOSUP;
+}
+
+int cds_set_rdata_index_min_size(size_t size)
+{
+ return DUMP_CDS_ENOSUP;
+}
+
+int cds_set_rdata_rindex_min_size(size_t size)
+{
+ return DUMP_CDS_ENOSUP;
+}
+
+int cds_set_rdata_rindex_size(size_t size)
+{
+ return DUMP_CDS_ENOSUP;
+}
+
+int output_cds(iaddr from, iaddr to, uint8_t proto, unsigned flags, unsigned sport, unsigned dport, my_bpftimeval ts, const u_char* pkt_copy, size_t olen, const u_char* payload, size_t payloadlen)
+{
+ return DUMP_CDS_ENOSUP;
+}
+
+int dump_cds(FILE* fp)
+{
+ return DUMP_CDS_ENOSUP;
+}
+
+int have_cds_support()
+{
+ return 0;
+}
+
+#endif
generated by cgit v1.2.3 (git 2.39.1) at 2024-05-13 07:28:29 +0000