test for lua dns output

diff --git a/lua-output-dns/README.md b/lua-output-dns/README.md
new file mode 100644 (file)
index 0000000..6bbac17
--- /dev/null
+++ b/lua-output-dns/README.md
@@ -0,0 +1,3 @@
+Tests the output of DNS being logged by Lua.
+
+PCAPs created by Jason Ish.

diff --git a/lua-output-dns/check.sh b/lua-output-dns/check.sh
new file mode 100755 (executable)
index 0000000..1d4cc6f
--- /dev/null
+++ b/lua-output-dns/check.sh
@@ -0,0 +1,32 @@
+#! /bin/sh
+
+set -e
+
+if ! grep -q "Query TX 0d4f \[\*\*\] block.dropbox.com \[\*\*\] A \[\*\*\] 10.16.1.11:49697 -> 10.16.1.1:53" output/lua-dns.log; then
+    echo "failed to find query for block.dropbox.com"
+    exit 1
+fi
+
+if ! cat output/lua-dns.log | \
+       grep "Response" | \
+       grep "client-cf.dropbox.com" | \
+       grep "52.85.112.21" > /dev/null;
+then
+    echo "failed to find response for client-cf.dropbox.com"
+    exit 1
+fi
+
+if ! cat output/lua-dns.log | \
+       grep "Response TX 62b2" | \
+       grep "NXDOMAIN" > /dev/null;
+then
+    echo "failed to find NXDOMAIN error"
+    exit 1
+fi
+
+if ! cat output/lua-dns.log | grep "SOA" > /dev/null; then
+    echo "failed find SOA response record"
+    exit 1
+fi
+
+exit 0

diff --git a/lua-output-dns/suricata.yaml b/lua-output-dns/suricata.yaml
new file mode 100644 (file)
index 0000000..0b35bce
--- /dev/null
+++ b/lua-output-dns/suricata.yaml
@@ -0,0 +1,13 @@
+%YAML 1.1
+---
+
+include: ../etc/suricata-3.1.2.yaml
+
+rule-files:
+
+outputs:
+  - lua:
+      enabled: yes
+      scripts-dir: ../verify/lua-output-dns
+      scripts:
+        - test.lua

diff --git a/lua-output-dns/test.lua b/lua-output-dns/test.lua
new file mode 100644 (file)
index 0000000..d0515cc
--- /dev/null
+++ b/lua-output-dns/test.lua
@@ -0,0 +1,95 @@
+filename = "lua-dns.log"
+
+function init (args)
+   local needs = {}
+   needs["protocol"] = "dns"
+   return needs
+end
+
+function setup (args)
+   SCLogNotice("lua: setup()")
+   file = assert(io.open(SCLogPath() .. "/" .. filename, "w"))
+end
+
+function log(args)
+   ts = SCPacketTimeString()
+   ip_ver, src_ip, dst_ip, proto, sp, dp = SCFlowTuple()
+   tx_id = DnsGetTxid()
+
+   queries = DnsGetQueries()
+   if queries ~= nil then
+      for n, t in pairs(queries) do
+        msg = string.format(
+           "%s [**] Query TX %04x [**] %s [**] %s [**] %s:%d -> %s:%d",
+           ts,
+           tx_id,
+           t["rrname"],
+           t["type"],
+           src_ip,
+           sp,
+           dst_ip,
+           dp)
+        write(msg)
+      end
+   end
+
+   rcode = DnsGetRcode()
+   if rcode ~= nil then
+      msg = string.format(
+        "%s [**] Response TX %04x [**] %s [**] %s:%d -> %s:%d",
+        ts,
+        tx_id,
+        rcode,
+        src_ip,
+        sp,
+        dst_ip,
+        dp)
+      write(msg)
+   end
+   
+   answers = DnsGetAnswers()
+   if answers ~= nil then
+      for n, t in pairs(answers) do
+        msg = string.format(
+           "%s [**] Response TX %04x [**] %s [**] %s [**] TTL %d [**] %s [**] %s:%d -> %s:%d",
+           ts,
+           tx_id,
+           t["rrname"],
+           t["type"],
+           t["ttl"],
+           t["addr"],
+           src_ip,
+           sp,
+           dst_ip,
+           dp);
+        write(msg)
+      end
+   end
+   
+   authorities = DnsGetAuthorities()
+   if authorities ~= nil then
+      for n, t in pairs(authorities) do
+        msg = string.format(
+           "%s [**] Response TX %04x [**] %s [**] %s [**] TTL %d [**] %s:%d -> %s:%d",
+           ts,
+           tx_id,
+           t["rrname"],
+           t["type"],
+           t["ttl"],
+           src_ip,
+           sp,
+           dst_ip,
+           dp);
+        write(msg)
+      end
+   end
+   
+end
+
+function deinit(args)
+   file:close(file)
+end
+
+function write(msg)
+   file:write(msg .. "\n")
+end

diff --git a/lua-output-dns/test.pcap b/lua-output-dns/test.pcap
new file mode 100644 (file)
index 0000000..815fc7e
Binary files /dev/null and b/lua-output-dns/test.pcap differ

diff --git a/lua-output-dns/test.rules b/lua-output-dns/test.rules
new file mode 100644 (file)
index 0000000..e69de29