425 lines
12 KiB
C
425 lines
12 KiB
C
/* eventlog.c
|
|
*
|
|
* Byron Darrah - May 20, 2020
|
|
* Version 1.0
|
|
*
|
|
* This is a plugin for dnscap, based on the txtout plugin.
|
|
*
|
|
* This plugin generates one line of output for each packet, with a human-
|
|
* readable timestamp, and includes the results of A and AAAA queries (which
|
|
* is either a list of IP addresses, or an NXDOMAIN flag).
|
|
*
|
|
* Below is the original copyright notice from txtout.c.
|
|
*/
|
|
/*
|
|
* Copyright (c) 2016-2022, OARC, Inc.
|
|
* All rights reserved.
|
|
*
|
|
* Redistribution and use in source and binary forms, with or without
|
|
* modification, are permitted provided that the following conditions
|
|
* are met:
|
|
*
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
* notice, this list of conditions and the following disclaimer.
|
|
*
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
* notice, this list of conditions and the following disclaimer in
|
|
* the documentation and/or other materials provided with the
|
|
* distribution.
|
|
*
|
|
* 3. Neither the name of the copyright holder nor the names of its
|
|
* contributors may be used to endorse or promote products derived
|
|
* from this software without specific prior written permission.
|
|
*
|
|
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
|
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
|
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
|
|
* FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
|
|
* COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
|
|
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
|
|
* BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
|
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
|
|
* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
|
|
* ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
|
* POSSIBILITY OF SUCH DAMAGE.
|
|
*/
|
|
|
|
#include "config.h"
|
|
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <unistd.h>
|
|
#include <string.h>
|
|
#include <netinet/in.h>
|
|
#include <ctype.h>
|
|
#include <errno.h>
|
|
#include <arpa/inet.h>
|
|
#include <arpa/nameser.h>
|
|
#include <ldns/ldns.h>
|
|
|
|
#include "dnscap_common.h"
|
|
|
|
static logerr_t* logerr;
|
|
static char* opt_o = NULL;
|
|
static int opt_s = 0;
|
|
static FILE* out = 0;
|
|
static int opt_t = 0;
|
|
static char* opt_n = NULL;
|
|
|
|
output_t eventlog_output;
|
|
|
|
void eventlog_usage()
|
|
{
|
|
fprintf(stderr,
|
|
"\neventlog.so options:\n"
|
|
" -? print these instructions and exit\n"
|
|
" -o <arg> output file name\n"
|
|
" -s short output, only QTYPE/QNAME for IN\n"
|
|
" -t prefix event messages with DNS packet timestamp\n"
|
|
" -n <arg> include name with each event message\n\n"
|
|
"Produces a line of text per packet suitable for event logging,\n"
|
|
"including IP addresses from query responses.\n");
|
|
}
|
|
|
|
void eventlog_getopt(int* argc, char** argv[])
|
|
{
|
|
/*
|
|
* The "getopt" function will be called from the parent to
|
|
* process plugin options.
|
|
*/
|
|
int c;
|
|
while ((c = getopt(*argc, *argv, "?so:tn:")) != EOF) {
|
|
switch (c) {
|
|
case 'o':
|
|
if (opt_o)
|
|
free(opt_o);
|
|
opt_o = strdup(optarg);
|
|
break;
|
|
case 's':
|
|
opt_s = 1;
|
|
break;
|
|
case 't':
|
|
opt_t = 1;
|
|
break;
|
|
case 'n':
|
|
opt_n = strdup(optarg);
|
|
break;
|
|
case '?':
|
|
eventlog_usage();
|
|
if (!optopt || optopt == '?') {
|
|
exit(0);
|
|
}
|
|
// fallthrough
|
|
default:
|
|
exit(1);
|
|
}
|
|
}
|
|
}
|
|
|
|
int eventlog_start(logerr_t* a_logerr)
|
|
{
|
|
/*
|
|
* The "start" function is called once, when the program
|
|
* starts. It is used to initialize the plugin. If the
|
|
* plugin wants to write debugging and or error messages,
|
|
* it should save the a_logerr pointer passed from the
|
|
* parent code.
|
|
*/
|
|
logerr = a_logerr;
|
|
if (opt_o) {
|
|
out = fopen(opt_o, "a");
|
|
if (0 == out) {
|
|
logerr("%s: %s\n", opt_o, strerror(errno));
|
|
exit(1);
|
|
}
|
|
} else {
|
|
out = stdout;
|
|
}
|
|
setbuf(out, 0);
|
|
|
|
if (opt_t) {
|
|
time_t curtime;
|
|
char time_text[25];
|
|
struct tm res;
|
|
curtime = time(NULL);
|
|
if (strftime(time_text, 25, "%G %m/%d %T", localtime_r(&curtime, &res)) > 0) {
|
|
fprintf(out, "%s ", time_text);
|
|
} else {
|
|
fprintf(out, "**ERROR reading time** ");
|
|
}
|
|
}
|
|
if (opt_n) {
|
|
fprintf(out, "%s ", opt_n);
|
|
}
|
|
fprintf(out, "DNS event logging started.\n");
|
|
|
|
return 0;
|
|
}
|
|
|
|
void eventlog_stop()
|
|
{
|
|
/*
|
|
* The "start" function is called once, when the program
|
|
* is exiting normally. It might be used to clean up state,
|
|
* free memory, etc.
|
|
*/
|
|
if (out != stdout)
|
|
fclose(out);
|
|
}
|
|
|
|
int eventlog_open(my_bpftimeval ts)
|
|
{
|
|
/*
|
|
* The "open" function is called at the start of each
|
|
* collection interval, which might be based on a period
|
|
* of time or a number of packets. In the original code,
|
|
* this is where we opened an output pcap file.
|
|
*/
|
|
return 0;
|
|
}
|
|
|
|
int eventlog_close(my_bpftimeval ts)
|
|
{
|
|
/*
|
|
* The "close" function is called at the end of each
|
|
* collection interval, which might be based on a period
|
|
* of time or on a number of packets. In the original code
|
|
* this is where we closed an output pcap file.
|
|
*/
|
|
return 0;
|
|
}
|
|
|
|
ia_str_t ia_str = 0;
|
|
tcpstate_getcurr_t tcpstate_getcurr = 0;
|
|
tcpstate_reset_t tcpstate_reset = 0;
|
|
|
|
void eventlog_extension(int ext, void* arg)
|
|
{
|
|
switch (ext) {
|
|
case DNSCAP_EXT_IA_STR:
|
|
ia_str = (ia_str_t)arg;
|
|
break;
|
|
case DNSCAP_EXT_TCPSTATE_GETCURR:
|
|
tcpstate_getcurr = (tcpstate_getcurr_t)arg;
|
|
break;
|
|
case DNSCAP_EXT_TCPSTATE_RESET:
|
|
tcpstate_reset = (tcpstate_reset_t)arg;
|
|
break;
|
|
}
|
|
}
|
|
|
|
static void eventlog_output_ipbytes(size_t len, const uint8_t* data)
|
|
{
|
|
|
|
/* If there are 4 bytes, print them as an IPv4 address. */
|
|
if (len == 4) {
|
|
fprintf(out, "%u.%u.%u.%u", data[0], data[1], data[2], data[3]);
|
|
}
|
|
|
|
/* If there are 16 bytes, print them as an IPv6 address. */
|
|
else if (len == 16) {
|
|
/* If there are 16 bytes, print them as an IPv6 address. */
|
|
fprintf(out, "%x:%x:%x:%x:%x:%x:%x:%x",
|
|
((unsigned int)data[0]) << 8 | data[1],
|
|
((unsigned int)data[2]) << 8 | data[3],
|
|
((unsigned int)data[4]) << 8 | data[5],
|
|
((unsigned int)data[6]) << 8 | data[7],
|
|
((unsigned int)data[8]) << 8 | data[9],
|
|
((unsigned int)data[10]) << 8 | data[11],
|
|
((unsigned int)data[12]) << 8 | data[13],
|
|
((unsigned int)data[14]) << 8 | data[15]);
|
|
}
|
|
}
|
|
|
|
void eventlog_output(const char* descr, iaddr from, iaddr to, uint8_t proto, unsigned flags,
|
|
unsigned sport, unsigned dport, my_bpftimeval ts,
|
|
const u_char* pkt_copy, unsigned olen,
|
|
const u_char* payload, unsigned payloadlen)
|
|
{
|
|
|
|
/* Do not output anything if there is no DNS info to report. */
|
|
if (!(flags & DNSCAP_OUTPUT_ISDNS)) {
|
|
return;
|
|
}
|
|
ldns_pkt* pkt;
|
|
if (ldns_wire2pkt(&pkt, payload, payloadlen) != LDNS_STATUS_OK) {
|
|
if (tcpstate_getcurr && tcpstate_reset)
|
|
tcpstate_reset(tcpstate_getcurr(), "");
|
|
return;
|
|
}
|
|
ldns_buffer* buf = ldns_buffer_new(512);
|
|
if (!buf) {
|
|
logerr("out of memmory\n");
|
|
exit(1);
|
|
}
|
|
|
|
/*
|
|
* Output the packet timestamp
|
|
*/
|
|
if (opt_t) {
|
|
char time_text[25];
|
|
struct tm res;
|
|
if (strftime(time_text, 25, "%G %m/%d %T", localtime_r(&ts.tv_sec, &res)) > 0) {
|
|
fprintf(out, "%s ", time_text);
|
|
} else {
|
|
fprintf(out, "**ERROR reading packet time** ");
|
|
}
|
|
}
|
|
if (opt_n) {
|
|
fprintf(out, "%s ", opt_n);
|
|
}
|
|
|
|
/*
|
|
* Short output, only print QTYPE and QNAME for IN records
|
|
*/
|
|
if (opt_s) {
|
|
ldns_rr_list* qds = ldns_pkt_question(pkt);
|
|
if (qds) {
|
|
ldns_rr* qd = ldns_rr_list_rr(qds, 0);
|
|
|
|
if (qd && ldns_rr_get_class(qd) == LDNS_RR_CLASS_IN) {
|
|
if (ldns_rr_type2buffer_str(buf, ldns_rr_get_type(qd)) == LDNS_STATUS_OK) {
|
|
fprintf(out, "%s", (char*)ldns_buffer_begin(buf));
|
|
} else {
|
|
fprintf(out, "ERR");
|
|
}
|
|
|
|
ldns_buffer_clear(buf);
|
|
if (ldns_rdf2buffer_str(buf, ldns_rr_owner(qd)) == LDNS_STATUS_OK) {
|
|
fprintf(out, " %s\n", (char*)ldns_buffer_begin(buf));
|
|
} else {
|
|
fprintf(out, "ERR\n");
|
|
}
|
|
}
|
|
}
|
|
ldns_pkt_free(pkt);
|
|
ldns_buffer_free(buf);
|
|
return;
|
|
}
|
|
|
|
/*
|
|
* IP Stuff
|
|
*/
|
|
fprintf(out, "src=%s spt=%u ", ia_str(from), sport);
|
|
fprintf(out, "dst=%s dpt=%u ", ia_str(to), dport);
|
|
switch (proto) {
|
|
case 17:
|
|
fprintf(out, "proto=UDP");
|
|
break;
|
|
case 6:
|
|
fprintf(out, "proto=TCP");
|
|
break;
|
|
default:
|
|
fprintf(out, "proto=%hhu", proto);
|
|
break;
|
|
}
|
|
|
|
/*
|
|
* DNS Header
|
|
*/
|
|
fprintf(out, " mid=%u", ldns_pkt_id(pkt));
|
|
fprintf(out, " op=%u", ldns_pkt_get_opcode(pkt));
|
|
fprintf(out, " fl=|");
|
|
if (ldns_pkt_qr(pkt))
|
|
fprintf(out, "QR|");
|
|
if (ldns_pkt_aa(pkt))
|
|
fprintf(out, "AA|");
|
|
if (ldns_pkt_tc(pkt))
|
|
fprintf(out, "TC|");
|
|
if (ldns_pkt_rd(pkt))
|
|
fprintf(out, "RD|");
|
|
if (ldns_pkt_ra(pkt))
|
|
fprintf(out, "RA|");
|
|
if (ldns_pkt_ad(pkt))
|
|
fprintf(out, "AD|");
|
|
if (ldns_pkt_cd(pkt))
|
|
fprintf(out, "CD|");
|
|
switch (ldns_pkt_get_rcode(pkt)) {
|
|
case LDNS_RCODE_NOERROR:
|
|
fprintf(out, " rc=OK");
|
|
break;
|
|
case LDNS_RCODE_NXDOMAIN:
|
|
fprintf(out, " rc=NXDOMAIN");
|
|
break;
|
|
case LDNS_RCODE_SERVFAIL:
|
|
fprintf(out, " rc=SRVFAIL");
|
|
break;
|
|
default:
|
|
fprintf(out, " rc=%u", ldns_pkt_get_rcode(pkt));
|
|
break;
|
|
}
|
|
|
|
ldns_rr_list* qds = ldns_pkt_question(pkt);
|
|
ldns_rr* qd;
|
|
if (qds && (qd = ldns_rr_list_rr(qds, 0))) {
|
|
if (ldns_rr_class2buffer_str(buf, ldns_rr_get_class(qd)) == LDNS_STATUS_OK) {
|
|
fprintf(out, " cl=%s", (char*)ldns_buffer_begin(buf));
|
|
} else {
|
|
fprintf(out, " **ERROR parsing response record**\n");
|
|
ldns_pkt_free(pkt);
|
|
ldns_buffer_free(buf);
|
|
return;
|
|
}
|
|
|
|
ldns_buffer_clear(buf);
|
|
if (ldns_rr_type2buffer_str(buf, ldns_rr_get_type(qd)) == LDNS_STATUS_OK) {
|
|
fprintf(out, " tp=%s", (char*)ldns_buffer_begin(buf));
|
|
} else {
|
|
fprintf(out, " **ERROR parsing response record**\n");
|
|
ldns_pkt_free(pkt);
|
|
ldns_buffer_free(buf);
|
|
return;
|
|
}
|
|
|
|
ldns_buffer_clear(buf);
|
|
if (ldns_rdf2buffer_str(buf, ldns_rr_owner(qd)) == LDNS_STATUS_OK) {
|
|
fprintf(out, " name=%s", (char*)ldns_buffer_begin(buf));
|
|
} else {
|
|
fprintf(out, " **ERROR parsing response record**\n");
|
|
ldns_pkt_free(pkt);
|
|
ldns_buffer_free(buf);
|
|
return;
|
|
}
|
|
}
|
|
|
|
/* output the query answers */
|
|
ldns_rr_list* ans = ldns_pkt_answer(pkt);
|
|
if (ans) {
|
|
const char* delim = " ans=";
|
|
size_t i, n;
|
|
for (i = 0, n = ldns_rr_list_rr_count(ans); i < n; i++) {
|
|
ldns_rr* rr = ldns_rr_list_rr(ans, i);
|
|
|
|
if (rr) {
|
|
switch (ldns_rr_get_type(rr)) {
|
|
case LDNS_RR_TYPE_A:
|
|
case LDNS_RR_TYPE_AAAA: {
|
|
ldns_rdf* rdf = ldns_rr_rdf(rr, 0);
|
|
if (rdf) {
|
|
fprintf(out, "%s", delim);
|
|
delim = ",";
|
|
eventlog_output_ipbytes(ldns_rdf_size(rdf), ldns_rdf_data(rdf));
|
|
continue;
|
|
}
|
|
break;
|
|
}
|
|
default:
|
|
continue;
|
|
}
|
|
}
|
|
|
|
fprintf(out, " **ERROR parsing response record**\n");
|
|
ldns_pkt_free(pkt);
|
|
ldns_buffer_free(buf);
|
|
return;
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Done
|
|
*/
|
|
fprintf(out, "\n");
|
|
ldns_pkt_free(pkt);
|
|
ldns_buffer_free(buf);
|
|
}
|