/src/PcapPlusPlus/Packet++/header/DnsLayer.h
Line | Count | Source |
1 | | #pragma once |
2 | | |
3 | | #include "DnsLayerEnums.h" |
4 | | #include "DnsResource.h" |
5 | | #include "DnsResourceData.h" |
6 | | #include "Layer.h" |
7 | | |
8 | | /// @file |
9 | | |
10 | | /// @namespace pcpp |
11 | | /// @brief The main namespace for the PcapPlusPlus lib |
12 | | namespace pcpp |
13 | | { |
14 | | /// @struct dnshdr |
15 | | /// Represents the fixed part of the DNS header, meaning the part that doesn't include the DNS data (queries, |
16 | | /// answers, authorities and additional records) |
17 | | #pragma pack(push, 1) |
18 | | struct dnshdr |
19 | | { |
20 | | /// DNS query identification |
21 | | uint16_t transactionID; |
22 | | #if (BYTE_ORDER == LITTLE_ENDIAN) |
23 | | uint16_t |
24 | | /// Recursion desired flag |
25 | | recursionDesired : 1, |
26 | | /// Truncated flag |
27 | | truncation : 1, |
28 | | /// Authoritative answer flag |
29 | | authoritativeAnswer : 1, |
30 | | /// Operation Code |
31 | | opcode : 4, |
32 | | /// Query/Response flag |
33 | | queryOrResponse : 1, |
34 | | /// Return Code |
35 | | responseCode : 4, |
36 | | /// Checking disabled flag |
37 | | checkingDisabled : 1, |
38 | | /// Authenticated data flag |
39 | | authenticData : 1, |
40 | | /// Zero flag (Reserved) |
41 | | zero : 1, |
42 | | /// Recursion available flag |
43 | | recursionAvailable : 1; |
44 | | #elif (BYTE_ORDER == BIG_ENDIAN) |
45 | | uint16_t |
46 | | /// Query/Response flag |
47 | | queryOrResponse : 1, |
48 | | /// Operation Code |
49 | | opcode : 4, |
50 | | /// Authoritative answer flag |
51 | | authoritativeAnswer : 1, |
52 | | /// Truncated flag |
53 | | truncation : 1, |
54 | | /// Recursion desired flag |
55 | | recursionDesired : 1, |
56 | | /// Recursion available flag |
57 | | recursionAvailable : 1, |
58 | | /// Zero flag (Reserved) |
59 | | zero : 1, |
60 | | /// Authenticated data flag |
61 | | authenticData : 1, |
62 | | /// Checking disabled flag |
63 | | checkingDisabled : 1, |
64 | | /// Return Code |
65 | | responseCode : 4; |
66 | | #endif |
67 | | /// Number of DNS query records in packet |
68 | | uint16_t numberOfQuestions; |
69 | | /// Number of DNS answer records in packet |
70 | | uint16_t numberOfAnswers; |
71 | | /// Number of authority records in packet |
72 | | uint16_t numberOfAuthority; |
73 | | /// Number of additional records in packet |
74 | | uint16_t numberOfAdditional; |
75 | | }; |
76 | | #pragma pack(pop) |
77 | | static_assert(sizeof(dnshdr) == 12, "dnshdr size is not 12 bytes"); |
78 | | |
79 | | // forward declarations |
80 | | class DnsQuery; |
81 | | class IDnsResource; |
82 | | class DnsResource; |
83 | | class IDnsResourceData; |
84 | | |
85 | | /// @class DnsLayer |
86 | | /// Represents the DNS protocol layer |
87 | | class DnsLayer : public Layer |
88 | | { |
89 | | friend class IDnsResource; |
90 | | friend class DnsQuery; |
91 | | friend class DnsResource; |
92 | | |
93 | | public: |
94 | | /// A constructor that creates the layer from an existing packet raw data |
95 | | /// @param[in] data A pointer to the raw data |
96 | | /// @param[in] dataLen Size of the data in bytes |
97 | | /// @param[in] prevLayer A pointer to the previous layer |
98 | | /// @param[in] packet A pointer to the Packet instance where layer will be stored in |
99 | | DnsLayer(uint8_t* data, size_t dataLen, Layer* prevLayer, Packet* packet); |
100 | | |
101 | | /// A constructor that creates an empty DNS layer: all members of dnshdr are set to 0 and layer will contain no |
102 | | /// records |
103 | | DnsLayer(); |
104 | | |
105 | | /// A copy constructor for this layer |
106 | | /// @param[in] other The DNS layer to copy from |
107 | | DnsLayer(const DnsLayer& other); |
108 | | |
109 | | /// An assignment operator for this layer |
110 | | /// @param[in] other The DNS layer to assign |
111 | | /// @return A reference to the assignee |
112 | | DnsLayer& operator=(const DnsLayer& other); |
113 | | |
114 | | ~DnsLayer() override; |
115 | | |
116 | | /// Get a pointer to the DNS header (as opposed to the DNS data which is the queries, answers, etc. Data can be |
117 | | /// retrieved through the other methods of this layer. Notice the return value points directly to the data, so |
118 | | /// every change will change the actual packet data |
119 | | /// @return A pointer to the @ref dnshdr |
120 | | dnshdr* getDnsHeader() const; |
121 | | |
122 | | /// Searches for a DNS query by its name field. Notice this method returns only a query which its name equals to |
123 | | /// the requested name. If several queries match the requested name, the first one will be returned. If no |
124 | | /// queries match the requested name, nullptr will be returned |
125 | | /// @param[in] name The name of the query to search |
126 | | /// @param[in] exactMatch Indicate whether to match the whole name or just a part of it |
127 | | /// @return The first matching DNS query or nullptr if no queries were found |
128 | | DnsQuery* getQuery(const std::string& name, bool exactMatch) const; |
129 | | |
130 | | /// @return The first DNS query in the packet or nullptr if packet doesn't contain any queries |
131 | | DnsQuery* getFirstQuery() const; |
132 | | |
133 | | /// Get the DNS query following a certain query |
134 | | /// @param[in] query A pointer to a DNS query that exist in the packet |
135 | | /// @return The DNS query following 'query'. If 'query' is nullptr or 'query' is the last query in the packet |
136 | | /// nullptr will be returned |
137 | | DnsQuery* getNextQuery(DnsQuery* query) const; |
138 | | |
139 | | /// @return The number of DNS queries in the packet |
140 | | size_t getQueryCount() const; |
141 | | |
142 | | /// Add a new DNS query to the layer |
143 | | /// @param[in] name The value that shall be set in the name field of the query |
144 | | /// @param[in] dnsType The value that shall be set in the DNS type field of the query |
145 | | /// @param[in] dnsClass The value that shall be set in the DNS class field of the query |
146 | | /// @return A pointer to the newly created DNS query or nullptr if query could not be created (an appropriate |
147 | | /// error log message will be printed in this case) |
148 | | DnsQuery* addQuery(const std::string& name, DnsType dnsType, DnsClass dnsClass); |
149 | | |
150 | | /// Add a new DNS query similar to an already existing DNS query. All query fields will be copied from the |
151 | | /// existing query |
152 | | /// @param[in] copyQuery The record to create the new record from. copyQuery won't be changed in any way |
153 | | /// @return A pointer to the newly created DNS query or nullptr if query could not be created (an appropriate |
154 | | /// error log message will be printed in this case) |
155 | | DnsQuery* addQuery(DnsQuery* const copyQuery); |
156 | | |
157 | | /// Remove an existing query by name. If several queries matches the name, the first match will be removed |
158 | | /// @param[in] queryNameToRemove The name of the query to remove |
159 | | /// @param[in] exactMatch Indicate whether to match the whole name or just a part of it |
160 | | /// @return True if query was found and successfully removed or false if query was not found or couldn't be |
161 | | /// removed |
162 | | bool removeQuery(const std::string& queryNameToRemove, bool exactMatch); |
163 | | |
164 | | /// Remove an existing query |
165 | | /// @param[in] queryToRemove A pointer to the query to remove |
166 | | /// @return True if query was found and successfully removed or false if query was not found or couldn't be |
167 | | /// removed |
168 | | bool removeQuery(DnsQuery* queryToRemove); |
169 | | |
170 | | /// Searches for a DNS answer by its name field. Notice this method returns only an answer which its name equals |
171 | | /// to the requested name. If several answers match the requested name, the first one will be returned. If no |
172 | | /// answers match the requested name, nullptr will be returned |
173 | | /// @param[in] name The name of the answer to search |
174 | | /// @param[in] exactMatch Indicate whether to match the whole name or just a part of it |
175 | | /// @return The first matching DNS answer or nullptr if no answers were found |
176 | | DnsResource* getAnswer(const std::string& name, bool exactMatch) const; |
177 | | |
178 | | /// @return The first DNS answer in the packet or nullptr if packet doesn't contain any answers |
179 | | DnsResource* getFirstAnswer() const; |
180 | | |
181 | | /// Get the DNS answer following a certain answer |
182 | | /// @param[in] answer A pointer to a DNS answer that exist in the packet |
183 | | /// @return The DNS answer following 'answer'. If 'answer' is nullptr or 'answer' is the last answer in the |
184 | | /// packet nullptr will be returned |
185 | | DnsResource* getNextAnswer(DnsResource* answer) const; |
186 | | |
187 | | /// @return The number of DNS answers in the packet |
188 | | size_t getAnswerCount() const; |
189 | | |
190 | | /// Add a new DNS answer to the layer |
191 | | /// @param[in] name The value that shall be set in the name field of the answer |
192 | | /// @param[in] dnsType The value that shall be set in the DNS type field of the answer |
193 | | /// @param[in] dnsClass The value that shall be set in the DNS class field of the answer |
194 | | /// @param[in] ttl The value that shall be set in the 'time-to-leave' field of the answer |
195 | | /// @param[in] data The answer data to be set. The type of the data should match the type of the DNS record |
196 | | /// (for example: DNS record of type A should have data of type IPv4DnsResourceData. Please see |
197 | | /// DnsResource#setData() for more info on this |
198 | | /// @return A pointer to the newly created DNS answer or nullptr if answer could not be created (an appropriate |
199 | | /// error log message will be printed in this case) |
200 | | DnsResource* addAnswer(const std::string& name, DnsType dnsType, DnsClass dnsClass, uint32_t ttl, |
201 | | IDnsResourceData* data); |
202 | | |
203 | | /// Add a new DNS answer similar to an already existing DNS answer. All answer fields will be copied from the |
204 | | /// existing answer |
205 | | /// @param[in] copyAnswer The record to create the new record from. copyAnswer won't be changed in any way |
206 | | /// @return A pointer to the newly created DNS answer or nullptr if query could not be created (an appropriate |
207 | | /// error log message will be printed in this case) |
208 | | DnsResource* addAnswer(DnsResource* const copyAnswer); |
209 | | |
210 | | /// Remove an existing answer by name. If several answers matches the name, the first match will be removed |
211 | | /// @param[in] answerNameToRemove The name of the answer to remove |
212 | | /// @param[in] exactMatch Indicate whether to match the whole name or just a part of it |
213 | | /// @return True if answer was found and successfully removed or false if answer was not found or couldn't be |
214 | | /// removed |
215 | | bool removeAnswer(const std::string& answerNameToRemove, bool exactMatch); |
216 | | |
217 | | /// Remove an existing answer |
218 | | /// @param[in] answerToRemove A pointer to the answer to remove |
219 | | /// @return True if answer was found and successfully removed or false if answer was not found or couldn't be |
220 | | /// removed |
221 | | bool removeAnswer(DnsResource* answerToRemove); |
222 | | |
223 | | /// Searches for a DNS authority by its name field. Notice this method returns only an authority which its name |
224 | | /// equals to the requested name. If several authorities match the requested name, the first one will be |
225 | | /// returned. If no authorities match the requested name, nullptr will be returned |
226 | | /// @param[in] name The name of the authority to search |
227 | | /// @param[in] exactMatch Indicate whether to match the whole name or just a part of it |
228 | | /// @return The first matching DNS authority or nullptr if no authorities were found |
229 | | DnsResource* getAuthority(const std::string& name, bool exactMatch) const; |
230 | | |
231 | | /// @return The first DNS authority in the packet or nullptr if packet doesn't contain any authorities |
232 | | DnsResource* getFirstAuthority() const; |
233 | | |
234 | | /// Get the DNS authority following a certain authority |
235 | | /// @param[in] authority A pointer to a DNS authority that exist in the packet |
236 | | /// @return The DNS authority following 'authority'. If 'authority' is nullptr or 'authority' is the last |
237 | | /// authority in the packet nullptr will be returned |
238 | | DnsResource* getNextAuthority(DnsResource* authority) const; |
239 | | |
240 | | /// @return The number of DNS authorities in the packet |
241 | | size_t getAuthorityCount() const; |
242 | | |
243 | | /// Add a new DNS authority to the layer |
244 | | /// @param[in] name The value that shall be set in the name field of the authority |
245 | | /// @param[in] dnsType The value that shall be set in the DNS type field of the authority |
246 | | /// @param[in] dnsClass The value that shall be set in the DNS class field of the authority |
247 | | /// @param[in] ttl The value that shall be set in the 'time-to-leave' field of the authority |
248 | | /// @param[in] data The authority data to be set. The type of the data should match the type of the DNS record |
249 | | /// (for example: DNS record of type A should have data of type IPv4DnsResourceData. Please see |
250 | | /// DnsResource#setData() for more info on this |
251 | | /// @return A pointer to the newly created DNS authority or nullptr if authority could not be created (an |
252 | | /// appropriate error log message will be printed in this case) |
253 | | DnsResource* addAuthority(const std::string& name, DnsType dnsType, DnsClass dnsClass, uint32_t ttl, |
254 | | IDnsResourceData* data); |
255 | | |
256 | | /// Add a new DNS authority similar to an already existing DNS authority. All authority fields will be copied |
257 | | /// from the existing authority |
258 | | /// @param[in] copyAuthority The record to create the new record from. copyAuthority won't be changed in any way |
259 | | /// @return A pointer to the newly created DNS authority or nullptr if query could not be created (an |
260 | | /// appropriate error log message will be printed in this case) |
261 | | DnsResource* addAuthority(DnsResource* const copyAuthority); |
262 | | |
263 | | /// Remove an existing authority by name. If several authorities matches the name, the first match will be |
264 | | /// removed |
265 | | /// @param[in] authorityNameToRemove The name of the authority to remove |
266 | | /// @param[in] exactMatch Indicate whether to match the whole name or just a part of it |
267 | | /// @return True if authority was found and successfully removed or false if authority was not found or couldn't |
268 | | /// be removed |
269 | | bool removeAuthority(const std::string& authorityNameToRemove, bool exactMatch); |
270 | | |
271 | | /// Remove an existing authority |
272 | | /// @param[in] authorityToRemove A pointer to the authority to remove |
273 | | /// @return True if authority was found and successfully removed or false if authority was not found or couldn't |
274 | | /// be removed |
275 | | bool removeAuthority(DnsResource* authorityToRemove); |
276 | | |
277 | | /// Searches for a DNS additional record by its name field. Notice this method returns only an additional record |
278 | | /// which its name equals to the requested name. If several additional records match the requested name, the |
279 | | /// first one will be returned. If no additional records match the requested name, nullptr will be returned |
280 | | /// @param[in] name The name of the additional record to search |
281 | | /// @param[in] exactMatch Indicate whether to match the whole name or just a part of it |
282 | | /// @return The first matching DNS additional record or nullptr if no additional records were found |
283 | | DnsResource* getAdditionalRecord(const std::string& name, bool exactMatch) const; |
284 | | |
285 | | /// @return The first DNS additional record in the packet or nullptr if packet doesn't contain any additional |
286 | | /// records |
287 | | DnsResource* getFirstAdditionalRecord() const; |
288 | | |
289 | | /// Get the DNS additional record following a certain additional record |
290 | | /// @param[in] additionalRecord A pointer to a DNS additional record that exist in the packet |
291 | | /// @return The DNS additional record following 'additionalRecord'. If 'additionalRecord' is nullptr or |
292 | | /// 'additionalRecord' is the last additional record in the packet nullptr will be returned |
293 | | DnsResource* getNextAdditionalRecord(DnsResource* additionalRecord) const; |
294 | | |
295 | | /// @return The number of DNS additional records in the packet |
296 | | size_t getAdditionalRecordCount() const; |
297 | | |
298 | | /// Add a new DNS additional record to the layer |
299 | | /// @param[in] name The value that shall be set in the name field of the additional record |
300 | | /// @param[in] dnsType The value that shall be set in the DNS type field of the additional record |
301 | | /// @param[in] dnsClass The value that shall be set in the DNS class field of the additional record |
302 | | /// @param[in] ttl The value that shall be set in the 'time-to-leave' field of the additional record |
303 | | /// @param[in] data The additional record data to be set. The type of the data should match the type of the DNS |
304 | | /// record (for example: DNS record of type A should have data of type IPv4DnsResourceData. Please see |
305 | | /// DnsResource#setData() for more info on this |
306 | | /// @return A pointer to the newly created DNS additional record or nullptr if additional record could not be |
307 | | /// created (an appropriate error log message will be printed in this case) |
308 | | DnsResource* addAdditionalRecord(const std::string& name, DnsType dnsType, DnsClass dnsClass, uint32_t ttl, |
309 | | IDnsResourceData* data); |
310 | | |
311 | | /// Add a new DNS additional record to the layer that doesn't have DNS class and TTL. Instead these bytes may |
312 | | /// contains some arbitrary data. In the future I may add support for these kinds of additional data records. |
313 | | /// For now, these bytes are set as raw |
314 | | /// @param[in] name The value that shall be set in the name field of the additional record |
315 | | /// @param[in] dnsType The value that shall be set in the DNS type field of the additional record |
316 | | /// @param[in] customData1 Two bytes of the arbitrary data that will be set in the offset usually used for the |
317 | | /// DNS class |
318 | | /// @param[in] customData2 Four bytes of the arbitrary data that will be set in the offset usually used for the |
319 | | /// TTL |
320 | | /// @param[in] data The additional record data to be set. The type of the data should match the type of the DNS |
321 | | /// record. (for example: DNS record of type A should have data of type IPv4DnsResourceData. Please see |
322 | | /// DnsResource#setData() for more info on this |
323 | | /// @return A pointer to the newly created DNS additional record or nullptr if additional record could not be |
324 | | /// created (an appropriate error log message will be printed in this case) |
325 | | DnsResource* addAdditionalRecord(const std::string& name, DnsType dnsType, uint16_t customData1, |
326 | | uint32_t customData2, IDnsResourceData* data); |
327 | | |
328 | | /// Add a new DNS additional record similar to an already existing DNS additional record. All additional record |
329 | | /// fields will be copied from the existing additional record |
330 | | /// @param[in] copyAdditionalRecord The record to create the new record from. copyAdditionalRecord won't be |
331 | | /// changed in any way |
332 | | /// @return A pointer to the newly created DNS additional record or nullptr if query could not be created (an |
333 | | /// appropriate error log message will be printed in this case) |
334 | | DnsResource* addAdditionalRecord(DnsResource* const copyAdditionalRecord); |
335 | | |
336 | | /// Remove an existing additional record by name. If several additional records matches the name, the first |
337 | | /// match will be removed |
338 | | /// @param[in] additionalRecordNameToRemove The name of the additional record to remove |
339 | | /// @param[in] exactMatch Indicate whether to match the whole name or just a part of it |
340 | | /// @return True if additional record was found and successfully removed or false if additional record was not |
341 | | /// found or couldn't be removed |
342 | | bool removeAdditionalRecord(const std::string& additionalRecordNameToRemove, bool exactMatch); |
343 | | |
344 | | /// Remove an existing additional record |
345 | | /// @param[in] additionalRecordToRemove A pointer to the additional record to remove |
346 | | /// @return True if additional record was found and successfully removed or false if additional record was not |
347 | | /// found or couldn't be removed |
348 | | bool removeAdditionalRecord(DnsResource* additionalRecordToRemove); |
349 | | |
350 | | // implement abstract methods |
351 | | |
352 | | /// Does nothing for this layer (DnsLayer is always last) |
353 | | void parseNextLayer() override |
354 | 40.2k | {} |
355 | | |
356 | | /// @return The size of the DNS data in the packet including he DNS header and size of all queries, answers, |
357 | | /// authorities and additional records |
358 | | size_t getHeaderLen() const override |
359 | 117k | { |
360 | 117k | return m_DataLen; |
361 | 117k | } // No layer above DNS |
362 | | |
363 | | /// Does nothing for this layer |
364 | | void computeCalculateFields() override |
365 | 7.70k | {} |
366 | | |
367 | | std::string toString() const override; |
368 | | |
369 | | OsiModelLayer getOsiModelLayer() const override |
370 | 8.26k | { |
371 | 8.26k | return OsiModelApplicationLayer; |
372 | 8.26k | } |
373 | | |
374 | | /// A static method that checks whether the port is considered as DNS |
375 | | /// @param[in] port The port number to be checked |
376 | | /// @return True if the port is associated with the DNS protocol |
377 | | static inline bool isDnsPort(uint16_t port); |
378 | | |
379 | | /// A static method that validates the input data |
380 | | /// @param[in] data The pointer to the beginning of a byte stream of a DNS packet |
381 | | /// @param[in] dataLen The length of the byte stream |
382 | | /// @param[in] dnsOverTcp Should be set to "true" if this is DNS is over TCP, otherwise set to "false" |
383 | | /// (which is also the default value) |
384 | | /// @return True if the data is valid and can represent a DNS packet |
385 | | static inline bool isDataValid(const uint8_t* data, size_t dataLen, bool dnsOverTcp = false); |
386 | | |
387 | | /// @struct SerializedFields |
388 | | /// Fields written by DnsLayer's serializeLayer(), in addition to Layer::SerializedFields. |
389 | | struct SerializedFields : Layer::SerializedFields |
390 | | { |
391 | | /// @return All field descriptors for DnsLayer |
392 | | static std::vector<FieldDescriptor> all() |
393 | 0 | { |
394 | 0 | auto result = Layer::SerializedFields::all(); |
395 | 0 | std::initializer_list<FieldDescriptor> extra{ TransactionID, IsResponse, Opcode, |
396 | 0 | AuthoritativeAnswer, Truncation, RecursionDesired, |
397 | 0 | RecursionAvailable, AuthenticData, CheckingDisabled, |
398 | 0 | ResponseCode, Queries, Answers, |
399 | 0 | Authorities, AdditionalRecords }; |
400 | 0 | std::copy(extra.begin(), extra.end(), std::back_inserter(result)); |
401 | 0 | return result; |
402 | 0 | } |
403 | | |
404 | | /// @struct QueryObject |
405 | | /// Fields describing one element of the Queries array |
406 | | struct QueryObject : ObjectFieldDescriptor<QueryObject> |
407 | | { |
408 | | using ObjectFieldDescriptor::ObjectFieldDescriptor; |
409 | | |
410 | | /// @return All field descriptors for one query |
411 | | static std::vector<FieldDescriptor> all() |
412 | 0 | { |
413 | 0 | return { Name, Type, TypeName, Class }; |
414 | 0 | } |
415 | | |
416 | | /// @brief Field descriptor for the queried name, written as a string. |
417 | | static const FieldDescriptor Name; |
418 | | |
419 | | /// @brief Field descriptor for the DNS type, written as a number (see ::DnsType). |
420 | | static const FieldDescriptor Type; |
421 | | |
422 | | /// @brief Field descriptor for the DNS type name (for example "A", "AAAA" or "CNAME"), written as a |
423 | | /// string, or "Unknown" if the type isn't recognized. |
424 | | static const FieldDescriptor TypeName; |
425 | | |
426 | | /// @brief Field descriptor for the DNS class, written as a number (see ::DnsClass). |
427 | | static const FieldDescriptor Class; |
428 | | }; |
429 | | |
430 | | /// @struct ResourceObject |
431 | | /// Fields describing one element of the Answers, Authorities and AdditionalRecords arrays |
432 | | struct ResourceObject : ObjectFieldDescriptor<ResourceObject> |
433 | | { |
434 | | using ObjectFieldDescriptor::ObjectFieldDescriptor; |
435 | | |
436 | | /// @return All field descriptors for one resource record |
437 | | static std::vector<FieldDescriptor> all() |
438 | 0 | { |
439 | 0 | return { Name, Type, TypeName, Class, Ttl, DataLength, Data }; |
440 | 0 | } |
441 | | |
442 | | /// @brief Field descriptor for the record name, written as a string. |
443 | | static const FieldDescriptor Name; |
444 | | |
445 | | /// @brief Field descriptor for the DNS type, written as a number (see ::DnsType). |
446 | | static const FieldDescriptor Type; |
447 | | |
448 | | /// @brief Field descriptor for the DNS type name (for example "A", "AAAA" or "CNAME"), written as a |
449 | | /// string, or "Unknown" if the type isn't recognized. |
450 | | static const FieldDescriptor TypeName; |
451 | | |
452 | | /// @brief Field descriptor for the DNS class, written as a number (see ::DnsClass). For records that |
453 | | /// don't have a DNS class (such as OPT records) this is the raw value of the class field. |
454 | | static const FieldDescriptor Class; |
455 | | |
456 | | /// @brief Field descriptor for the TTL, written as a number. For records that don't have a TTL (such |
457 | | /// as OPT records) this is the raw value of the TTL field. |
458 | | static const FieldDescriptor Ttl; |
459 | | |
460 | | /// @brief Field descriptor for the record data length in bytes, written as a number. |
461 | | static const FieldDescriptor DataLength; |
462 | | |
463 | | /// @brief Field descriptor for the record data, written as a string (see IDnsResourceData::toString()). |
464 | | /// Only written for records whose data has a dedicated type (A, AAAA, NS, CNAME, DNAME, PTR and MX), |
465 | | /// not for records whose data is stored as a raw byte array (see GenericDnsResourceData). |
466 | | static const FieldDescriptor Data; |
467 | | }; |
468 | | |
469 | | /// @brief Field descriptor for the transaction ID, written as a hex value. |
470 | | static const FieldDescriptor TransactionID; |
471 | | |
472 | | /// @brief Field descriptor for the query/response flag, written as a boolean (true for a response). |
473 | | static const FieldDescriptor IsResponse; |
474 | | |
475 | | /// @brief Field descriptor for the operation code, written as a number. |
476 | | static const FieldDescriptor Opcode; |
477 | | |
478 | | /// @brief Field descriptor for the authoritative answer flag, written as a boolean. |
479 | | static const FieldDescriptor AuthoritativeAnswer; |
480 | | |
481 | | /// @brief Field descriptor for the truncation flag, written as a boolean. |
482 | | static const FieldDescriptor Truncation; |
483 | | |
484 | | /// @brief Field descriptor for the recursion desired flag, written as a boolean. |
485 | | static const FieldDescriptor RecursionDesired; |
486 | | |
487 | | /// @brief Field descriptor for the recursion available flag, written as a boolean. |
488 | | static const FieldDescriptor RecursionAvailable; |
489 | | |
490 | | /// @brief Field descriptor for the authenticated data flag, written as a boolean. |
491 | | static const FieldDescriptor AuthenticData; |
492 | | |
493 | | /// @brief Field descriptor for the checking disabled flag, written as a boolean. |
494 | | static const FieldDescriptor CheckingDisabled; |
495 | | |
496 | | /// @brief Field descriptor for the response code, written as a number. |
497 | | static const FieldDescriptor ResponseCode; |
498 | | |
499 | | /// @brief Field descriptor for the array of queries; elements described by QueryObject. |
500 | | static const FieldDescriptor Queries; |
501 | | |
502 | | /// @brief Field descriptor for the array of answers; elements described by ResourceObject. |
503 | | static const FieldDescriptor Answers; |
504 | | |
505 | | /// @brief Field descriptor for the array of authorities; elements described by ResourceObject. |
506 | | static const FieldDescriptor Authorities; |
507 | | |
508 | | /// @brief Field descriptor for the array of additional records; elements described by ResourceObject. |
509 | | static const FieldDescriptor AdditionalRecords; |
510 | | |
511 | | /// Maximum field ID used by the layer. |
512 | | static constexpr uint16_t MaxID = Layer::SerializedFields::MaxID + 14; |
513 | | }; |
514 | | |
515 | | protected: |
516 | | DnsLayer(uint8_t* data, size_t dataLen, Layer* prevLayer, Packet* packet, size_t offsetAdjustment); |
517 | | explicit DnsLayer(size_t offsetAdjustment); |
518 | | |
519 | | void serializeLayer(ObjectScope& serializer) const override; |
520 | | |
521 | | private: |
522 | | IDnsResource* m_ResourceList; |
523 | | DnsQuery* m_FirstQuery; |
524 | | DnsResource* m_FirstAnswer; |
525 | | DnsResource* m_FirstAuthority; |
526 | | DnsResource* m_FirstAdditional; |
527 | | uint16_t m_OffsetAdjustment; |
528 | | |
529 | | size_t getBasicHeaderSize(); |
530 | | void init(size_t offsetAdjustment, bool callParseResource); |
531 | | void initNewLayer(size_t offsetAdjustment); |
532 | | |
533 | | IDnsResource* getFirstResource(DnsResourceType resType) const; |
534 | | void setFirstResource(DnsResourceType resType, IDnsResource* resource); |
535 | | |
536 | | using Layer::extendLayer; |
537 | | bool extendLayer(int offsetInLayer, size_t numOfBytesToExtend, IDnsResource* resource); |
538 | | |
539 | | using Layer::shortenLayer; |
540 | | bool shortenLayer(int offsetInLayer, size_t numOfBytesToShorten, IDnsResource* resource); |
541 | | |
542 | | IDnsResource* getResourceByName(IDnsResource* startFrom, size_t resourceCount, const std::string& name, |
543 | | bool exactMatch) const; |
544 | | |
545 | | void parseResources(); |
546 | | |
547 | | DnsResource* addResource(DnsResourceType resType, const std::string& name, DnsType dnsType, DnsClass dnsClass, |
548 | | uint32_t ttl, IDnsResourceData* data); |
549 | | |
550 | | bool removeResource(IDnsResource* resourceToRemove); |
551 | | }; |
552 | | |
553 | | /// @class DnsOverTcpLayer |
554 | | /// Represents the DNS over TCP layer. |
555 | | /// DNS over TCP is described here: https://tools.ietf.org/html/rfc7766 . |
556 | | /// It is very similar to DNS over UDP, except for one field: TCP message length which is added in the beginning of |
557 | | /// the message before the other DNS data properties. The rest of the data is similar. |
558 | | |
559 | | /// Note: DNS over TCP can spread over more than one packet, but this implementation doesn't support this use-case |
560 | | /// and assumes the whole message fits in a single packet. |
561 | | class DnsOverTcpLayer : public DnsLayer |
562 | | { |
563 | | public: |
564 | | /// A constructor that creates the layer from an existing packet raw data |
565 | | /// @param[in] data A pointer to the raw data |
566 | | /// @param[in] dataLen Size of the data in bytes |
567 | | /// @param[in] prevLayer A pointer to the previous layer |
568 | | /// @param[in] packet A pointer to the Packet instance where layer will be stored in |
569 | | DnsOverTcpLayer(uint8_t* data, size_t dataLen, Layer* prevLayer, Packet* packet) |
570 | 2.77k | : DnsLayer(data, dataLen, prevLayer, packet, sizeof(uint16_t)) |
571 | 2.77k | {} |
572 | | |
573 | | /// A constructor that creates an empty DNS layer: all members of dnshdr are set to 0 and layer will contain no |
574 | | /// records |
575 | | DnsOverTcpLayer() : DnsLayer(sizeof(uint16_t)) |
576 | 0 | {} |
577 | | |
578 | | /// A copy constructor for this layer |
579 | | /// @param[in] other The DNS over TCP layer to copy from |
580 | | DnsOverTcpLayer(const DnsOverTcpLayer& other) : DnsLayer(other) |
581 | 0 | {} |
582 | | |
583 | | /// @return The value of the TCP message length as described in https://tools.ietf.org/html/rfc7766#section-8 |
584 | | uint16_t getTcpMessageLength(); |
585 | | |
586 | | /// Set the TCP message length value as described in https://tools.ietf.org/html/rfc7766#section-8 |
587 | | /// @param[in] value The value to set |
588 | | void setTcpMessageLength(uint16_t value); |
589 | | |
590 | | // overridden methods |
591 | | |
592 | | /// Calculate the TCP message length field |
593 | | void computeCalculateFields() override; |
594 | | |
595 | | /// @struct SerializedFields |
596 | | /// Fields written by DnsOverTcpLayer's serializeLayer(), in addition to DnsLayer::SerializedFields. |
597 | | struct SerializedFields : DnsLayer::SerializedFields |
598 | | { |
599 | | // cppcheck-suppress duplInheritedMember |
600 | | /// @return All field descriptors for DnsOverTcpLayer |
601 | | static std::vector<FieldDescriptor> all() |
602 | 0 | { |
603 | 0 | auto result = DnsLayer::SerializedFields::all(); |
604 | 0 | result.push_back(TcpMessageLength); |
605 | 0 | return result; |
606 | 0 | } |
607 | | |
608 | | /// @brief Field descriptor for the TCP message length, written as a number. |
609 | | static const FieldDescriptor TcpMessageLength; |
610 | | }; |
611 | | |
612 | | protected: |
613 | | void serializeLayer(ObjectScope& serializer) const override; |
614 | | }; |
615 | | |
616 | | // implementation of inline methods |
617 | | |
618 | | bool DnsLayer::isDnsPort(uint16_t port) |
619 | 624k | { |
620 | 624k | switch (port) |
621 | 624k | { |
622 | 29.5k | case 53: |
623 | 35.3k | case 5353: |
624 | 40.2k | case 5355: |
625 | 40.2k | return true; |
626 | 584k | default: |
627 | 584k | return false; |
628 | 624k | } |
629 | 624k | } |
630 | | |
631 | | bool DnsLayer::isDataValid(const uint8_t* data, size_t dataLen, bool dnsOverTcp) |
632 | 383k | { |
633 | 383k | size_t minSize = sizeof(dnshdr) + (dnsOverTcp ? sizeof(uint16_t) : 0); |
634 | 383k | return data && dataLen >= minSize; |
635 | 383k | } |
636 | | |
637 | | } // namespace pcpp |