From: Odin Jenseg <odin@mnemonic.no>
Date: Tue, 8 Jun 2021 19:55:36 +0000 (+0200)
Subject: dns: Logging of Z-bit
X-Git-Tag: suricata-5.0.9~108
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f9884edc976b52e56a88c1f5c7ad836be712dede;p=thirdparty%2Fsuricata.git

dns: Logging of Z-bit

[Edit by Jason Ish: fix flag bit value]

Ticket #4515

(cherry picked from commit dfb6f105e8b104bf27cce24b650d047d0925c145)
---

diff --git a/rust/src/dns/log.rs b/rust/src/dns/log.rs
index 8225508fce..1b522bac50 100644
--- a/rust/src/dns/log.rs
+++ b/rust/src/dns/log.rs
@@ -469,6 +469,9 @@ fn dns_log_json_answer(response: &DNSResponse, flags: u64) -> Json
     if header.flags & 0x0080 != 0 {
         js.set_boolean("ra", true);
     }
+    if header.flags & 0x0040 != 0 {
+        js.set_boolean("z", true);
+    }
 
     for query in &response.queries {
         js.set_string_from_bytes("rrname", &query.name);
@@ -624,6 +627,9 @@ fn dns_log_json_answer_v1(header: &DNSHeader, answer: &DNSAnswerEntry)
     if header.flags & 0x0080 != 0 {
         js.set_boolean("ra", true);
     }
+    if header.flags & 0x0040 != 0 {
+        js.set_boolean("z", true);
+    }
     js.set_string("rcode", &dns_rcode_string(header.flags));
     js.set_string_from_bytes("rrname", &answer.name);
     js.set_string("rrtype", &dns_rrtype_string(answer.rrtype));