dns-oarc/dnsjit
1
0
Fork 0
Code Issues Activity

Adding upstream version 1.5.0.

Browse source 
Signed-off-by: Daniel Baumann <daniel@debian.org>
This commit is contained in:
Daniel Baumann 2025-04-21 09:36:45 +02:00
parent 4f2087bb21
commit 01446c9ac8
Signed by: daniel
GPG key ID: FBB4F0E80A80222F
419 changed files with 3061 additions and 1380 deletions
Download patch file Download diff file Expand all files Collapse all files

2
examples/Makefile.am
View file

@ -1,4 +1,4 @@
# Copyright (c) 2018-2024 OARC, Inc.
# Copyright (c) 2018-2025 OARC, Inc.
# All rights reserved.
#
# This file is part of dnsjit.

3
examples/Makefile.in
View file

@ -14,7 +14,7 @@
@SET_MAKE@
# Copyright (c) 2018-2024 OARC, Inc.
# Copyright (c) 2018-2025 OARC, Inc.
# All rights reserved.
#
# This file is part of dnsjit.
@ -209,6 +209,7 @@ EGREP = @EGREP@
ETAGS = @ETAGS@
EXEEXT = @EXEEXT@
FGREP = @FGREP@
FILECMD = @FILECMD@
GREP = @GREP@
INSTALL = @INSTALL@
INSTALL_DATA = @INSTALL_DATA@

34
examples/pcap2tcpdns.lua
View file

@ -3,18 +3,20 @@
-- Convert PCAP with IPv[46] & UDP payloads into TCP-stream binary format as
-- specified by RFC 1035 section "4.2.2. TCP usage". Each packet is preceded by
-- 2-byte pre‐ambule which specifies length of the following DNS packet in
-- network byte order, immediately followed by raw bytes of the packet.
-- 2-byte pre‐ambule which specifies length of the following DNS message in
-- network byte order, immediately followed by raw bytes of the DNS message.
--
-- Outputs raw binary to stdout!
--
-- This script does not do any filtering or input sanitation.
-- Outputs raw binary to stdout!
-- For filtering capabilities look at dnscap -o dump_format=tcpdns
local bit = require("bit")
local ffi = require("ffi")
local input = require("dnsjit.input.pcap").new()
local layer = require("dnsjit.filter.layer").new()
local object = require("dnsjit.core.objects")
local log = require("dnsjit.core.log").new("extract-clients.lua")
local log = require("dnsjit.core.log").new("pcap2tcpdns")
local getopt = require("dnsjit.lib.getopt").new({
{ "r", "read", "-", "input file to read, use - for stdin", "?" },
})
@ -54,27 +56,23 @@ local produce, pctx = layer:produce()
-- set up output
io.stdout:setvbuf("full")
local obj, obj_pcap_in, obj_ip, obj_udp, obj_pl
local npacketsin = 0
local obj, obj_udp, obj_pl
local npacketsout = 0
local npacketsskip = 0
local UDP_ID = object.UDP
while true do
obj = produce(pctx)
if obj == nil then break end
npacketsin = npacketsin + 1
obj_ip = obj:cast_to(object.IP)
if obj_ip == nil then
obj_ip = obj:cast_to(object.IP6)
end
obj_udp = obj:cast_to(object.UDP)
obj_pl = obj:cast_to(object.PAYLOAD)
obj_pcap_in = obj:cast_to(object.PCAP)
if obj_ip ~= nil and obj_udp ~= nil and obj_pl ~= nil and obj_pcap_in ~= nil then
-- UDP header length is 8 bytes and is included in the ulen field below.
if obj_pl ~= nil and obj_pl.len <= 65535 and obj_pl:prev().obj_type == UDP_ID then
-- RFC 1035 framing has just the DNS message size as two bytes (big-endian).
put_uint16_be(tmpbuf, 0, obj_udp.ulen - 8)
put_uint16_be(tmpbuf, 0, obj_pl.len)
io.stdout:write(ffi.string(tmpbuf, 2))
io.stdout:write(ffi.string(obj_pl.payload, obj_pl.len))
npacketsout = npacketsout + 1
else
npacketsskip = npacketsskip + 1
end
end
log:info(string.format("processed %d packets", npacketsin))
log:info(string.format("%d packets copied, %d skipped", npacketsout, npacketsskip))