From 811fc9451555cd6739cc56658a10fa64b8307133 Mon Sep 17 00:00:00 2001 From: "Russ Combs (rucombs)" Date: Tue, 3 Nov 2015 09:49:47 -0500 Subject: [PATCH] Merge pull request #114 in SNORT/snort3 from dnsstats to master Squashed commit of the following: commit 1b1feefb1888411a32344ceb4d73173d9b5138ef Author: Bhagyashree Bantwal Date: Tue Nov 3 09:43:05 2015 -0500 Add DNS shutdown stats commit 3fa2887834c652df99c6bcf04a80905385b20303 Merge: 80b5183 1b5e401 Author: Bhagyashree Bantwal Date: Mon Nov 2 16:02:26 2015 -0500 Merge branch 'master' of ssh://stash-eng-rtp1.cisco.com:7999/snort/snort3 commit 80b5183135af600acd08616f512579405f8cefa2 Author: Bhagyashree Bantwal Date: Mon Nov 2 16:02:15 2015 -0500 Add DNS shutdown stats commit bb7c5f178487029534107ec4c689e7e09d2c3554 Merge: b167456 52a9ccf Author: Bhagyashree Bantwal Date: Wed Oct 21 22:30:01 2015 -0400 Merge branch 'master' of ssh://stash-eng-rtp1.cisco.com:7999/snort/snort3 commit b16745640b5214d4bbdc7a20e642e074df90de3a Merge: 6b9e324 08e3998 Author: Bhagyashree Bantwal Date: Wed Oct 21 10:39:09 2015 -0400 Merge branch 'master' of ssh://stash-eng-rtp1.cisco.com:7999/snort/snort3 commit 6b9e3240b7ae3dd805be2d325223d19dc90d622c Author: Bhagyashree Bantwal Date: Fri Oct 9 14:26:23 2015 -0400 Remove global stats init function commit 2c5cdb4d749e5ed6c34e931400c8ff52820f430e Merge: b7c468e f05d70a Author: Bhagyashree Bantwal Date: Fri Oct 9 13:21:07 2015 -0400 Merge branch 'master' of ssh://stash-eng-rtp1.cisco.com:7999/snort/snort3 commit b7c468e8692ea68cda91f5278a7209a3b0d2f48b Author: Bhagyashree Bantwal Date: Wed Sep 30 16:57:36 2015 -0400 Check for bool value before setting fastpath config option in PPM commit 803dc5453c703ee48697cb24d7de886b1b01b79b Author: Bhagyashree Bantwal Date: Wed Sep 30 08:10:48 2015 -0400 SSL stats changes --- src/service_inspectors/dns/dns.cc | 49 +++++++++++++++++++----- src/service_inspectors/dns/dns_module.cc | 2 +- src/service_inspectors/dns/dns_module.h | 10 ++++- 3 files changed, 49 insertions(+), 12 deletions(-) diff --git a/src/service_inspectors/dns/dns.cc b/src/service_inspectors/dns/dns.cc index ffbbe5ec4..3f129bb66 100644 --- a/src/service_inspectors/dns/dns.cc +++ b/src/service_inspectors/dns/dns.cc @@ -43,11 +43,22 @@ #include "dns_module.h" +#define MAX_UDP_PAYLOAD 0x1FFF +#define DNS_RR_PTR 0xC0 + THREAD_LOCAL ProfileStats dnsPerfStats; -THREAD_LOCAL SimpleStats dnsstats; +THREAD_LOCAL DNSStats dnsstats; + +const PegInfo dns_peg_names[] = +{ + { "packets", "total packets processed" }, + { "requests", "total dns requests" }, + { "responses", "total dns responses" }, + + { nullptr, nullptr } +}; + -#define MIN_UDP_PAYLOAD 0x1FFF -#define DNS_RR_PTR 0xC0 /* * Function prototype(s) @@ -71,15 +82,26 @@ DNSData* SetNewDNSData(Packet* p) return &fd->session; } -static DNSData* get_dns_session_data(Packet* p) +static DNSData* get_dns_session_data(Packet* p, bool from_server) { DnsFlowData* fd; if (p->is_udp()) { - if (p->dsize < (sizeof(DNSHdr) + sizeof(DNSRR) + MIN_UDP_PAYLOAD)) + if(p->dsize > MAX_UDP_PAYLOAD) return NULL; + if(!from_server) + { + if (p->dsize < (sizeof(DNSHdr) + sizeof(DNSQuestion) + 2)) + return NULL; + } + else + { + if (p->dsize < (sizeof(DNSHdr))) + return NULL; + } + memset(&udpSessionData, 0, sizeof(udpSessionData)); return &udpSessionData; } @@ -767,6 +789,8 @@ void ParseDNSResponseMessage(Packet* p, DNSData* dnsSessionData) } else { + if (dnsSessionData->hdr.flags & DNS_HDR_FLAG_RESPONSE) + dnsstats.responses++; /* No more data */ return; } @@ -794,6 +818,8 @@ void ParseDNSResponseMessage(Packet* p, DNSData* dnsSessionData) /* Not a response */ return; } + else + dnsstats.responses++; /* Handle the DNS Queries */ if (dnsSessionData->state == DNS_RESP_STATE_QUESTION) @@ -1022,12 +1048,11 @@ static void snort_dns(Packet* p) } // Get the direction of the packet. - uint8_t direction = ( (p->packet_flags & PKT_FROM_SERVER ) ? - DNS_DIR_FROM_SERVER : DNS_DIR_FROM_CLIENT ); + bool from_server = ( (p->packet_flags & PKT_FROM_SERVER ) ? true : false ); // Attempt to get a previously allocated DNS block. - DNSData* dnsSessionData = get_dns_session_data(p); + DNSData* dnsSessionData = get_dns_session_data(p, from_server); if (dnsSessionData == NULL) { @@ -1043,10 +1068,14 @@ static void snort_dns(Packet* p) if (dnsSessionData->flags & DNS_FLAG_NOT_DNS) return; - if (direction == DNS_DIR_FROM_SERVER) + if ( from_server ) { ParseDNSResponseMessage(p, dnsSessionData); } + else + { + dnsstats.requests++; + } } //------------------------------------------------------------------------- @@ -1076,7 +1105,7 @@ void Dns::eval(Packet* p) assert((p->is_udp() and p->dsize and p->data) or p->has_tcp_data()); assert(p->flow); - ++dnsstats.total_packets; + ++dnsstats.packets; snort_dns(p); } diff --git a/src/service_inspectors/dns/dns_module.cc b/src/service_inspectors/dns/dns_module.cc index 52c92fc9b..fd8dc4b86 100644 --- a/src/service_inspectors/dns/dns_module.cc +++ b/src/service_inspectors/dns/dns_module.cc @@ -56,7 +56,7 @@ const RuleMap* DnsModule::get_rules() const { return dns_rules; } const PegInfo* DnsModule::get_pegs() const -{ return simple_pegs; } +{ return dns_peg_names; } PegCount* DnsModule::get_counts() const { return (PegCount*)&dnsstats; } diff --git a/src/service_inspectors/dns/dns_module.h b/src/service_inspectors/dns/dns_module.h index 387c9ebe4..6b49fbe73 100644 --- a/src/service_inspectors/dns/dns_module.h +++ b/src/service_inspectors/dns/dns_module.h @@ -37,7 +37,15 @@ struct SnortConfig; -extern THREAD_LOCAL SimpleStats dnsstats; +struct DNSStats +{ + PegCount packets; + PegCount requests; + PegCount responses; +}; + +extern const PegInfo dns_peg_names[]; +extern THREAD_LOCAL DNSStats dnsstats; extern THREAD_LOCAL ProfileStats dnsPerfStats; class DnsModule : public Module -- 2.47.3