Merge pull request #2946 in SNORT/snort3 from ~BRASTULT/snort3:dns_splitter to master

Squashed commit of the following:

commit b40a755375381c084237a3113cc74a74857aabb3
Author: Brandon Stultz <brastult@cisco.com>
Date:   Tue Jun 15 17:31:03 2021 -0400

    dns: add DNS splitter

diff --git a/src/service_inspectors/dns/CMakeLists.txt b/src/service_inspectors/dns/CMakeLists.txt
index 4265a76d77dd088c7f8f60ede0a468e7b3e5de86..151d3ae573c1ebbaaca8a1bacabb763dbbb456ed 100644 (file)
--- a/src/service_inspectors/dns/CMakeLists.txt
+++ b/src/service_inspectors/dns/CMakeLists.txt
@@ -4,6 +4,8 @@ set( FILE_LIST
     dns.h
     dns_module.cc
     dns_module.h
+    dns_splitter.cc
+    dns_splitter.h
 )
 
 if (STATIC_INSPECTORS)

diff --git a/src/service_inspectors/dns/dns.cc b/src/service_inspectors/dns/dns.cc
index 4b830982b5a1c16d2ff3956484ff22e18bf23bcd..bcd1e2d8139d72f338c854fa0cf5c76ec59c5f2a 100644 (file)
--- a/src/service_inspectors/dns/dns.cc
+++ b/src/service_inspectors/dns/dns.cc
@@ -34,6 +34,7 @@
 #include "stream/stream.h"
 
 #include "dns_module.h"
+#include "dns_splitter.h"
 
 using namespace snort;
 
@@ -1012,6 +1013,7 @@ public:
     Dns(DnsModule*);
 
     void eval(Packet*) override;
+    StreamSplitter* get_splitter(bool) override;
 };
 
 Dns::Dns(DnsModule*)
@@ -1027,6 +1029,11 @@ void Dns::eval(Packet* p)
     snort_dns(p);
 }
 
+StreamSplitter* Dns::get_splitter(bool c2s)
+{
+    return new DnsSplitter(c2s);
+}
+
 //-------------------------------------------------------------------------
 // api stuff
 //-------------------------------------------------------------------------

diff --git a/src/service_inspectors/dns/dns_splitter.cc b/src/service_inspectors/dns/dns_splitter.cc
new file mode 100644 (file)
index 0000000..1b350a9
--- /dev/null
+++ b/src/service_inspectors/dns/dns_splitter.cc
@@ -0,0 +1,53 @@
+//--------------------------------------------------------------------------
+// Copyright (C) 2021-2021 Cisco and/or its affiliates. All rights reserved.
+//
+// This program is free software; you can redistribute it and/or modify it
+// under the terms of the GNU General Public License Version 2 as published
+// by the Free Software Foundation.  You may not use, modify or distribute
+// this program under any other version of the GNU General Public License.
+//
+// This program is distributed in the hope that it will be useful, but
+// WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+// General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+//--------------------------------------------------------------------------
+// dns_splitter.cc author Brandon Stultz <brastult@cisco.com>
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include "dns_splitter.h"
+
+#include <cassert>
+
+using namespace snort;
+
+StreamSplitter::Status DnsSplitter::scan(
+    Packet*, const uint8_t* data, uint32_t len,
+    uint32_t, uint32_t* fp)
+{
+    assert(len > 0);
+
+    if ( partial )
+    {
+        *fp = size + *data + 1;
+        partial = false;
+        return FLUSH;
+    }
+
+    if ( len == 1 )
+    {
+        size = *data << 8;
+        partial = true;
+        return SEARCH;
+    }
+
+    *fp = (*data << 8) + data[1] + 2;
+    return FLUSH;
+}
+

diff --git a/src/service_inspectors/dns/dns_splitter.h b/src/service_inspectors/dns/dns_splitter.h
new file mode 100644 (file)
index 0000000..ba68931
--- /dev/null
+++ b/src/service_inspectors/dns/dns_splitter.h
@@ -0,0 +1,42 @@
+//--------------------------------------------------------------------------
+// Copyright (C) 2021-2021 Cisco and/or its affiliates. All rights reserved.
+//
+// This program is free software; you can redistribute it and/or modify it
+// under the terms of the GNU General Public License Version 2 as published
+// by the Free Software Foundation.  You may not use, modify or distribute
+// this program under any other version of the GNU General Public License.
+//
+// This program is distributed in the hope that it will be useful, but
+// WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+// General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+//--------------------------------------------------------------------------
+// dns_splitter.h author Brandon Stultz <brastult@cisco.com>
+
+#ifndef DNS_SPLITTER_H
+#define DNS_SPLITTER_H
+
+#include "stream/stream_splitter.h"
+
+class DnsSplitter : public snort::StreamSplitter
+{
+public:
+    DnsSplitter(bool c2s) : snort::StreamSplitter(c2s) { }
+
+    Status scan(snort::Packet* p, const uint8_t* data, uint32_t len,
+        uint32_t flags, uint32_t* fp) override;
+
+    bool is_paf() override
+    { return true; }
+
+private:
+    bool partial = false;
+    uint16_t size = 0;
+};
+
+#endif
+