/* packet-dns.c * Routines for DNS packet disassembly * * $Id: packet-dns.c,v 1.4 1998/09/27 22:12:28 gerald Exp $ * * Ethereal - Network traffic analyzer * By Gerald Combs * Copyright 1998 Gerald Combs * * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. */ #ifdef HAVE_CONFIG_H # include "config.h" #endif #include #include #include #include #ifdef HAVE_SYS_TYPES_H # include #endif #ifdef HAVE_NETINET_IN_H # include #endif #include "ethereal.h" #include "packet.h" /* DNS structs and definitions */ typedef struct _e_dns { guint16 dns_id; guint16 dns_flags; guint16 dns_quest; guint16 dns_ans; guint16 dns_auth; guint16 dns_add; } e_dns; #define MAXDNAME 1025 /* maximum domain name */ /* type values */ #define T_A 1 /* host address */ #define T_NS 2 /* authoritative server */ #define T_CNAME 5 /* canonical name */ #define T_SOA 6 /* start of authority zone */ #define T_WKS 11 /* well known service */ #define T_PTR 12 /* domain name pointer */ #define T_HINFO 13 /* host information */ #define T_MX 15 /* mail routing information */ #define T_TXT 16 /* text strings */ #define T_AAAA 28 /* IP6 Address */ static const u_char *dns_data_ptr; static char * dns_type_name (int type) { char *type_names[36] = { "unused", "A", "NS", "MD", "MF", "CNAME", "SOA", "MB", "MG", "MR", "NULL", "WKS", "PTR", "HINFO", "MINFO", "MX", "TXT", "RP", "AFSDB", "X25", "ISDN", "RT", "NSAP", "NSAP_PTR", "SIG", "KEY", "PX", "GPOS", "AAAA", "LOC", "NXT", "EID", "NIMLOC", "SRV", "ATMA", "NAPTR" }; if (type <= 35) return type_names[type]; /* special cases */ switch (type) { /* non standard */ case 100: return "UINFO"; case 101: return "UID"; case 102: return "GID"; case 103: return "UNSPEC"; /* queries */ case 251: return "IXFR"; case 252: return "AXFR"; case 253: return "MAILB"; case 254: return "MAILA"; case 255: return "ANY"; } return "unknown"; } static char * dns_class_name(int class) { char *class_name; switch (class) { case 1: class_name = "inet"; break; case 3: class_name = "chaos"; break; case 4: class_name = "hesiod"; break; default: class_name = "unknown"; } return class_name; } static int is_compressed_name(const u_char *foo) { return (0xc0 == (*foo & 0xc0)); } static int get_compressed_name_offset(const u_char *ptr) { return ((*ptr & ~0xc0) << 8) | *(ptr+1); } static int copy_one_name_component(const u_char *dataptr, char *nameptr) { int len; int n; len = n = *dataptr++; if (0 == len) return 0; while (n-- > 0) *nameptr++ = *dataptr++; return len; } static int copy_name_component_rec(const u_char *dataptr, char *nameptr, int *real_string_len) { int len = 0; int str_len; int offset; int compress = 0; if (is_compressed_name(dataptr)) { compress = 1; offset = get_compressed_name_offset(dataptr); dataptr = dns_data_ptr + offset; copy_name_component_rec(dataptr, nameptr, &str_len); *real_string_len += str_len; nameptr += str_len; len = 2; } else { str_len = copy_one_name_component(dataptr, nameptr); *real_string_len = str_len; dataptr += str_len + 1; len += str_len + 1; nameptr += str_len; } if (compress) return len; (*real_string_len)++; if (*dataptr > 0) { *nameptr++ = '.'; len += copy_name_component_rec(dataptr, nameptr, &str_len); *real_string_len += str_len; return len; } return len + 1; } static int get_dns_name(const u_char *pd, int offset, char *nameptr, int maxname) { int len; const u_char *dataptr = pd + offset; int str_len = 0; memset (nameptr, 0, maxname); len = copy_name_component_rec(dataptr, nameptr, &str_len); return len; } static int get_dns_name_type_class (const u_char *pd, int offset, char *name_ret, int *type_ret, int *class_ret) { int len; int name_len; int type; int class; char name[MAXDNAME]; const u_char *pd_save; name_len = get_dns_name(pd, offset, name, sizeof(name)); pd += offset; pd_save = pd; pd += name_len; type = (*pd << 8) | *(pd + 1); pd += 2; class = (*pd << 8) | *(pd + 1); pd += 2; strcpy (name_ret, name); *type_ret = type; *class_ret = class; len = pd - pd_save; return len; } static int dissect_dns_query(const u_char *pd, int offset, GtkWidget *dns_tree) { int len; char name[MAXDNAME]; int type; int class; char *class_name; char *type_name; len = get_dns_name_type_class (pd, offset, name, &type, &class); type_name = dns_type_name(type); class_name = dns_class_name(class); add_item_to_tree(dns_tree, offset, len, "%s: type %s, class %s", name, type_name, class_name ); return len; } static int dissect_dns_answer(const u_char *pd, int offset, GtkWidget *dns_tree) { int len; char name[MAXDNAME]; int type; int class; char *class_name; char *type_name; const u_char *dptr; const u_char *data_start; const u_char *res_ptr; u_int ttl; u_short data_len; data_start = dptr = pd + offset; len = get_dns_name_type_class (pd, offset, name, &type, &class); dptr += len; /* this works regardless of the alignment */ ttl = (*dptr << 24) | *(dptr + 1) << 16 | *(dptr + 2) << 8 | *(dptr + 3); dptr += 4; data_len = (*dptr << 8) | *(dptr + 1); dptr += 2; type_name = dns_type_name(type); class_name = dns_class_name(class); res_ptr = dptr; /* skip the resource data */ dptr += data_len; len = dptr - data_start; switch (type) { case T_A: /* "A" record */ add_item_to_tree(dns_tree, offset, len, "%s: type %s, class %s, addr %d.%d.%d.%d", name, type_name, class_name, *res_ptr, *(res_ptr+1), *(res_ptr+2), *(res_ptr+3)); break; case T_NS: /* "NS" record */ { char ns_name[MAXDNAME]; get_dns_name(res_ptr, 0, ns_name, sizeof(ns_name)); add_item_to_tree(dns_tree, offset, len, "%s: %s, type %s, class %s", name, ns_name, type_name, class_name); } break; /* TODO: parse more record types */ default: add_item_to_tree(dns_tree, offset, len, "%s: type %s, class %s", name, type_name, class_name); } return len; } static int dissect_answer_records(int count, const u_char *pd, int cur_off, GtkWidget *dns_tree, char *name) { int start_off; GtkWidget *qatree, *ti; qatree = gtk_tree_new(); start_off = cur_off; while (count-- > 0) cur_off += dissect_dns_answer(pd, cur_off, qatree); ti = add_item_to_tree(GTK_WIDGET(dns_tree), start_off, cur_off - start_off, name); add_subtree(ti, qatree, ETT_DNS_ANS); return cur_off - start_off; } static int dissect_query_records(int count, const u_char *pd, int cur_off, GtkWidget *dns_tree) { int start_off; GtkWidget *qatree, *ti; qatree = gtk_tree_new(); start_off = cur_off; while (count-- > 0) cur_off += dissect_dns_query(pd, cur_off, qatree); ti = add_item_to_tree(GTK_WIDGET(dns_tree), start_off, cur_off - start_off, "Queries"); add_subtree(ti, qatree, ETT_DNS_QRY); return cur_off - start_off; } void dissect_dns(const u_char *pd, int offset, frame_data *fd, GtkTree *tree) { e_dns *dh; GtkWidget *dns_tree, *ti; guint16 id, flags, quest, ans, auth, add; int query = 0; int cur_off; dns_data_ptr = &pd[offset]; dh = (e_dns *) dns_data_ptr; /* To do: check for runts, errs, etc. */ id = ntohs(dh->dns_id); flags = ntohs(dh->dns_flags); quest = ntohs(dh->dns_quest); ans = ntohs(dh->dns_ans); auth = ntohs(dh->dns_auth); add = ntohs(dh->dns_add); query = ! (flags & (1 << 15)); if (fd->win_info[COL_NUM]) { strcpy(fd->win_info[COL_PROTOCOL], "DNS (UDP)"); strcpy(fd->win_info[COL_INFO], query ? "Query" : "Response"); } if (tree) { ti = add_item_to_tree(GTK_WIDGET(tree), offset, 4, query ? "DNS query" : "DNS response"); dns_tree = gtk_tree_new(); add_subtree(ti, dns_tree, ETT_DNS); add_item_to_tree(dns_tree, offset, 2, "ID: 0x%04x", id); add_item_to_tree(dns_tree, offset + 2, 2, "Flags: 0x%04x", flags); add_item_to_tree(dns_tree, offset + 4, 2, "Questions: %d", quest); add_item_to_tree(dns_tree, offset + 6, 2, "Answer RRs: %d", ans); add_item_to_tree(dns_tree, offset + 8, 2, "Authority RRs: %d", auth); add_item_to_tree(dns_tree, offset + 10, 2, "Additional RRs: %d", add); cur_off = offset + 12; if (quest > 0) cur_off += dissect_query_records(quest, pd, cur_off, dns_tree); if (ans > 0) cur_off += dissect_answer_records(ans, pd, cur_off, dns_tree, "Answers"); if (auth > 0) cur_off += dissect_answer_records(auth, pd, cur_off, dns_tree, "Authoritative nameservers"); if (add > 0) cur_off += dissect_answer_records(add, pd, cur_off, dns_tree, "Additional records"); } }