void ExampleSetup()
{
_dpd.registerPreproc("dynamic_example", ExampleInit, 0, 0, 0);
DEBUG_WRAP(_dpd.debugMsg(DEBUG_PLUGIN, "Preprocessor: Example is setup\n"););
void ParseDNSResponseMessage(SFSnortPacket *p, DNSSessionData *dnsSessionData)
{
u_int16_t bytes_unused = p->payload_size;
int i;
unsigned char *data = p->payload;
while (bytes_unused)
{
/* Parse through the DNS Header */
if (dnsSessionData->state < DNS_RESP_STATE_QUESTION)
{
/* Length only applies on a TCP packet, skip to header ID
* if at beginning of a UDP Response.
*/
if ((dnsSessionData->state == DNS_RESP_STATE_LENGTH) &&
(p->udp_header))
{
dnsSessionData->state = DNS_RESP_STATE_HDR_ID;
}
bytes_unused = ParseDNSHeader(data, bytes_unused, dnsSessionData);
if (bytes_unused > 0)
{
data = p->payload + (p->payload_size - bytes_unused);
}
else
{
/* No more data */
return;
}
dnsSessionData->curr_rec_state = DNS_RESP_STATE_Q_NAME;
dnsSessionData->curr_rec = 0;
}
/* Print out the header (but only once -- when we're ready to parse the Questions */
#ifdef DEBUG
if ((dnsSessionData->curr_rec_state == DNS_RESP_STATE_Q_NAME) &&
(dnsSessionData->curr_rec == 0))
{
_dpd.debugMsg(DEBUG_DNS,
"DNS Header: length %d, id 0x%x, flags 0x%x, "
"questions %d, answers %d, authorities %d, additionals %d\n",
dnsSessionData->length, dnsSessionData->hdr.id,
dnsSessionData->hdr.flags, dnsSessionData->hdr.questions,
dnsSessionData->hdr.answers,
dnsSessionData->hdr.authorities,
dnsSessionData->hdr.additionals);
}
#endif
if (!(dnsSessionData->hdr.flags & DNS_HDR_FLAG_RESPONSE))
{
/* Not a response */
return;
}
/* Handle the DNS Queries */
if (dnsSessionData->state == DNS_RESP_STATE_QUESTION)
{
/* Skip over the 4 byte question records... */
for (i=dnsSessionData->curr_rec; i< dnsSessionData->hdr.questions; i++)
{
bytes_unused = ParseDNSQuestion(data, p->payload_size, bytes_unused, dnsSessionData);
if (dnsSessionData->curr_rec_state == DNS_RESP_STATE_Q_COMPLETE)
{
DEBUG_WRAP(
_dpd.debugMsg(DEBUG_DNS,
"DNS Question %d: type %d, class %d\n",
i, dnsSessionData->curr_q.type,
dnsSessionData->curr_q.dns_class);
);
dnsSessionData->curr_rec_state = DNS_RESP_STATE_Q_NAME;
dnsSessionData->curr_rec++;
}
if (bytes_unused > 0)
{
data = p->payload + (p->payload_size - bytes_unused);
}
else
{
/* No more data */
return;
}
}
dnsSessionData->state = DNS_RESP_STATE_ANS_RR;
dnsSessionData->curr_rec_state = DNS_RESP_STATE_RR_NAME_SIZE;
dnsSessionData->curr_rec = 0;
}
