Fix rcode parsing, as noticed by Coverity.

Without support for OPT RR from RFC6891 (Extension mechanisms for DNS)
values of RCODE above 15 are not possible.  Remove dead code which will
never match.

diff --git a/src/app-layer-dns-common.h b/src/app-layer-dns-common.h
index 1a06f8d1dc0971c3c285f47c79902ee6941adf7b..203b2908e6d5b8e11dd037dd709f77e6b8b05e44 100644 (file)
--- a/src/app-layer-dns-common.h
+++ b/src/app-layer-dns-common.h
@@ -71,6 +71,8 @@
 #define DNS_RCODE_NXRRSET       8
 #define DNS_RCODE_NOTAUTH       9
 #define DNS_RCODE_NOTZONE       10
+// Support for OPT RR from RFC6891 will be needed to
+// parse RCODE values over 15
 #define DNS_RCODE_BADVERS       16
 #define DNS_RCODE_BADSIG        16
 #define DNS_RCODE_BADKEY        17

diff --git a/src/app-layer-dns-tcp.c b/src/app-layer-dns-tcp.c
index 0842c6686e64cbbbe6b19f732c3bb584deb41776..840a0f8086e51f14aefa43c22420076f460bc78e 100644 (file)
--- a/src/app-layer-dns-tcp.c
+++ b/src/app-layer-dns-tcp.c
@@ -449,7 +449,7 @@ static int DNSReponseParseData(Flow *f, DNSState *dns_state, const uint8_t *inpu
 
     /* parse rcode, e.g. "noerror" or "nxdomain" */
     uint8_t rcode = ntohs(dns_header->flags) & 0x0F;
-    if (rcode <= DNS_RCODE_NOTZONE || (rcode >= DNS_RCODE_BADSIG && rcode <= DNS_RCODE_BADTRUNC)) {
+    if (rcode <= DNS_RCODE_NOTZONE) {
         SCLogDebug("rcode %u", rcode);
         if (tx != NULL)
             tx->rcode = rcode;

diff --git a/src/app-layer-dns-udp.c b/src/app-layer-dns-udp.c
index bb0c73bf555dabb26bddd6d06d24716bcae25b92..eb87849c5211d10df3b39cf38ba13888ba6fc5a1 100644 (file)
--- a/src/app-layer-dns-udp.c
+++ b/src/app-layer-dns-udp.c
@@ -271,7 +271,7 @@ static int DNSUDPResponseParse(Flow *f, void *dstate,
 
     /* parse rcode, e.g. "noerror" or "nxdomain" */
     uint8_t rcode = ntohs(dns_header->flags) & 0x0F;
-    if (rcode <= DNS_RCODE_NOTZONE || (rcode >= DNS_RCODE_BADSIG && rcode <= DNS_RCODE_BADTRUNC)) {
+    if (rcode <= DNS_RCODE_NOTZONE) {
         SCLogDebug("rcode %u", rcode);
         if (tx != NULL)
             tx->rcode = rcode;