dns报文解析-凯发app官方网站

凯发app官方网站-凯发k8官网下载客户端中心 | | 凯发app官方网站-凯发k8官网下载客户端中心

苦海澜石

凯发app官方网站首页　| 　博文目录　| 　关于我

khls27

  • 博客访问： 752875
  • 博文数量： 144
  • 博客积分： 0
  • 博客等级： 民兵
  • 技术积分： 1150
  • 用 户 组： 普通用户
  • 注册时间： 2014-03-17 14:32
个人简介

小公司研发总监，既当司令也当兵！

文章分类

全部博文（144）

推荐博文
相关博文
  • ·
  • ·
  • ·
  • ·
  • ·
  • ·
  • ·
  • ·
  • ·
  • ·
dns报文解析

分类： linux

2019-02-14 17:56:34

关于dns报文格式和一些基础知识本文不表，网上一堆。
https://blog.csdn.net/liao152/article/details/45252387

下面来点干货，是一个项目中，需要对请求的dns进行黑白名单划分，并且对解析结果（ip地址）同样进行黑白名单划分。
1， 系统中预置一个黑名单列表，一个白名单列表（采用字典树）；
2， 系统中预置一个黑名单ipset，一个白名单ipset；
3， 解析dns请求报文，并对解析的dns进行匹配，如果匹配黑名单，则重定向该域名请求到特定的dns服务器；同理，如果匹配到白名单，则重定向到另一个dns服务器。
4，解析dns的应答报文，对解析的dns进行匹配，如果匹配到黑/白名单，那么：1，如果应答记录中是cname，那么将此cname域名添加到对应的域名记录中；2，如果应答记录中是ip地址，那么将该ip地址添加到对应的ipset中。
5， 业务报文到达时，通过匹配黑白名单的ipset可以进行进一步分流。

下面的代码是该实现中，dns解析部分：
dns.c

点击(此处)折叠或打开

  1. /*********************************************************************************************
  2. * description: kernel module to parse dns request and replay packages
  3. *
  4. * author: husker <huskertang@gmail.com>
  5. *
  6. * date: 2019-2-12
  7. ***********************************************************************************************/

  9. #include <linux/fs.h>
  10. #include <linux/module.h>
  11. #include <linux/proc_fs.h>
  12. #include <linux/seq_file.h>
  13. #include <linux/types.h>
  14. #include <linux/version.h>
  15. #include <linux/timer.h>
  16. #include <linux/ip.h>
  17. #include <linux/slab.h>
  18. #include <linux/list.h>
  19. #include "dns.h"

  21. static struct kmem_cache* dns_pkg_cache; //__read_mostly;
  22. static struct kmem_cache* dns_query_cache; // __read_mostly;
  23. static struct kmem_cache* dns_record_cache; // __read_mostly;

  25. void dns_finit(void)
  26. {
  27.     if (dns_pkg_cache)
  28.     {
  29.         kmem_cache_destroy(dns_pkg_cache);
  30.     }
  31.     if (dns_query_cache)
  32.     {
  33.         kmem_cache_destroy(dns_query_cache);
  34.     }
  35.     if (dns_record_cache)
  36.     {
  37.         kmem_cache_destroy(dns_record_cache);
  38.     }
  39. }

  41. int dns_init(void)
  42. {
  43.     dns_pkg_cache = kmem_cache_create("dns_pkg_cache",
  44.      sizeof(struct dns_package),
  45.      0, 0, null);
  46.     if (dns_pkg_cache == null)
  47.     {
  48.         printk(kern_err "[dns] failed to create dns package cache\n");
  49.         goto error_out;
  50.     }
  51.     dns_query_cache = kmem_cache_create("dns_query_cache",
  52.      sizeof(struct dns_query),
  53.      0, 0, null);
  54.     if (dns_query_cache == null)
  55.     {
  56.         printk(kern_err "[dns] failed to create dns query node cache\n");
  57.         goto error_out;
  58.     }

  60.     dns_record_cache = kmem_cache_create("dns_record_cache",
  61.      sizeof(struct dns_resource),
  62.      0, 0, null);
  63.     if (dns_record_cache == null)
  64.     {
  65.         printk(kern_err "[dns] failed to create dns resource recorder cache\n");
  66.         goto error_out;
  67.     }
  68.     return 0;

  70. error_out:
  71.     dns_finit();
  72.     return -1;
  73. }


  76. static int parse_domain_name(uint8_t* pkg, uint16_t pkglen, uint8_t* pstart, uint8_t* name, uint16_t* nmlen)
  77. {
  78.     int ret;
  79.     uint8_t tnm[128] = {0};
  80.     uint16_t tnm_len = 128;
  81.     int cnt = 0;
  82.     int total = 0;
  83.     uint16_t offset = 0;

  85.     uint8_t* ptr;
  86.     uint16_t len = 0;

  88.     if (dns_hdr_len >= pkglen || pstart < pkg || pstart >= (pkg pkglen) || !name || !nmlen || *nmlen <= 0)
  89.     {
  90.         return -1;
  91.     }

  93.     total = pstart - pkg;
  94.     ptr = tnm;

  96.     while (*pstart != 0)
  97.     {
  98.         if (*pstart >= dns_commpress_flag)
  99.         {
  100.             offset = (*pstart) * 256 *(pstart 1) - 0xc000;
  101.             if (offset >= pkglen)
  102.             {
  103.                 return -1;
  104.             }

  106.             tnm_len -= len;
  107.             ret = parse_domain_name(pkg, pkglen, pkg offset, ptr, &tnm_len);
  108.             if (ret < 0 )
  109.             {
  110.                 return ret;
  111.             }
  112.             cnt = 2;
  113.             len = tnm_len;
  114.             goto success_out;
  115.         }
  116.         else
  117.         {
  118.             uint16_t dm_part_len = *pstart;

  120.             if ( (pstart dm_part_len >= pkg pkglen) || (128 - len <= 0))
  121.             {
  122.                 return -1;
  123.             }

  125.             memcpy(ptr, pstart 1, dm_part_len);
  126.             ptr = dm_part_len;
  127.             len = dm_part_len;

  129.             // add '.' to every part of domain
  130.             *ptr = '.';
  131.             ptr;
  132.             len;

  134.             cnt = dm_part_len 1;
  135.             pstart = dm_part_len 1;
  136.         }
  137.     }

  139.     if (*pstart == 0)
  140.     {
  141.         cnt;
  142.     }

  144. success_out:
  145.     if (tnm[len - 1] == '.' )
  146.     {
  147.         tnm[len - 1] = 0;
  148.         len--;
  149.     }
  150.     if (*nmlen <= len )
  151.     {
  152.         return -1;
  153.     }

  155.     memcpy(name, tnm, len);
  156.     name[len] = 0;
  157.     *nmlen = len;
  158.     return cnt;
  159. }

  161. static int parse_query(uint8_t* pkg, uint16_t pkglen, uint8_t* pstart, struct dns_query* query)
  162. {
  163.     int ret;
  164.     uint16_t nmlen = 128;
  165.     uint8_t* ptr = pstart;
  166.     int cnt = 0;

  168.     // parse name
  169.     ret = parse_domain_name(pkg, pkglen, ptr, query->name, &nmlen);
  170.     if (ret < 0 )
  171.     {
  172.         return ret;
  173.     }
  174.     ptr = ret;
  175.     cnt = ret;


  178.     // parse domain type
  179.     if (ptr 1 >= pkg pkglen )
  180.     {
  181.         return -1;
  182.     }
  183.     query->type = (*ptr) * 256 *(ptr 1);
  184.     ptr = 2;
  185.     cnt = 2;

  187.     // parse domain class
  188.     if (ptr 1 >= pkg pkglen )
  189.     {
  190.         return -1;
  191.     }
  192.     query->class = (*ptr) * 256 *(ptr 1);
  193.     ptr = 2;
  194.     cnt = 2;
  195.     return cnt;
  196. }

  198. static int parse_resource(uint8_t* pkg, uint16_t pkglen, uint8_t* pstart, struct dns_resource* res)
  199. {
  200.     int ret;
  201.     uint16_t nmlen = 128;
  202.     uint8_t* ptr = pstart;
  203.     int cnt = 0;

  205.     // parse name
  206.     ret = parse_domain_name(pkg, pkglen, ptr, res->name, &nmlen);
  207.     if (ret < 0 )
  208.     {
  209.         return ret;
  210.     }
  211.     ptr = ret;
  212.     cnt = ret;


  215.     // parse domain type
  216.     if (ptr 1 >= pkg pkglen )
  217.     {
  218.         return -1;
  219.     }
  220.     res->type = (*ptr) * 256 *(ptr 1);
  221.     ptr = 2;
  222.     cnt = 2;

  224.     // parse domain class
  225.     if (ptr 1 >= pkg pkglen )
  226.     {
  227.         return -1;
  228.     }
  229.     res->class = (*ptr) * 256 *(ptr 1);
  230.     ptr = 2;
  231.     cnt = 2;

  233.     // parse ttl
  234.     if (ptr 3 >= pkg pkglen )
  235.     {
  236.         return -1;
  237.     }
  238.     res->ttl = ((*ptr) << 24) (*(ptr 1) << 16) (*(ptr 2) << 8) (*(ptr 3));
  239.     ptr = 4;
  240.     cnt = 4;

  242.     // parse date len
  243.     if (ptr 1 >= pkg pkglen)
  244.     {
  245.         return -1;
  246.     }
  247.     res->data_len = (*ptr) * 256 *(ptr 1);
  248.     if (res->data_len > 256)
  249.     {
  250.         return -1;
  251.     }
  252.     ptr = 2;
  253.     cnt = 2;

  255.     // parse date
  256.     if (ptr res->data_len > pkg pkglen)
  257.     {
  258.         return -1;
  259.     }
  260.     if (res->type == type_cname)
  261.     {
  262.         uint16_t cnlen = 256;
  263.         int offset = 0;
  264.         offset = parse_domain_name(pkg, pkglen, ptr, res->data, &cnlen);
  265.         if (offset < 0)
  266.         {
  267.             return -1;
  268.         }
  269.         ptr = offset;
  270.         cnt = offset;
  271.     }
  272.     else
  273.     {
  274.         memcpy(res->data, ptr, res->data_len);
  275.         ptr = res->data_len;
  276.         cnt = res->data_len;
  277.     }
  278.     return cnt;
  279. }

  281. static void free_pkg_recoders(struct list_head* hd)
  282. {
  283.     struct dns_resource* rcd;
  284.     struct dns_resource* tmp;

  286.     if (list_empty(hd))
  287.     {
  288.         return;
  289.     }
  290.     list_for_each_entry_safe(rcd, tmp, hd, list)
  291.     {
  292.         list_del(&rcd->list);
  293.         kmem_cache_free(dns_record_cache, rcd);

  295.     }
  296. }
  297. static void free_pkg_querys(struct list_head* hd)
  298. {
  299.     struct dns_query* query;
  300.     struct dns_query* tmp;
  301.     if (list_empty(hd))
  302.     {
  303.         return;
  304.     }
  305.     list_for_each_entry_safe(query, tmp, hd, list)
  306.     {
  307.         list_del(&query->list);
  308.         kmem_cache_free(dns_query_cache, query);
  309.     }
  310. }

  312. void dns_free_package(struct dns_package* spkg)
  313. {
  314.     free_pkg_querys(&spkg->query_hd);
  315.     free_pkg_recoders(&spkg->answer_hd);
  316.     free_pkg_recoders(&spkg->auth_hd);
  317.     free_pkg_recoders(&spkg->addit_hd);
  318.     kmem_cache_free(dns_pkg_cache, spkg);
  319. }

  321. struct dns_package* dns_new_package(void)
  322. {
  323.     struct dns_package* spkg = null;
  324.     spkg = (struct dns_package*)kmem_cache_alloc(dns_pkg_cache, gfp_atomic);
  325.     if (null == spkg)
  326.     {
  327.         return null;
  328.     }
  329.     memset(spkg, 0, sizeof(struct dns_package));
  330.     init_list_head(&spkg->query_hd);
  331.     init_list_head(&spkg->answer_hd);
  332.     init_list_head(&spkg->auth_hd);
  333.     init_list_head(&spkg->addit_hd);
  334.     return spkg;
  335. }

  337. int dns_parse_package(uint8_t* pkg, uint16_t pkglen, struct dns_package* spkg)
  338. {
  339.     struct dns_header* dnshdr;
  340.     struct dns_query* query;
  341.     struct dns_resource* rcd;
  342.     uint8_t* ptr;
  343.     int offset = 0;
  344.     int i;

  346.     if (!pkg || pkglen <= dns_hdr_len)
  347.     {
  348.         return -1;
  349.     }

  351.     memcpy(&spkg->hdr, pkg, sizeof(struct dns_header));
  352.     dnshdr = &spkg->hdr;
  353.     dnshdr->id = ntohs(dnshdr->id);
  354.     dnshdr->q_count = ntohs(dnshdr->q_count);
  355.     dnshdr->ans_count = ntohs(dnshdr->ans_count);
  356.     dnshdr->auth_count = ntohs(dnshdr->auth_count);
  357.     dnshdr->add_count = ntohs(dnshdr->add_count);

  359.     if (dnshdr->q_count > 64 || dnshdr->add_count > 64 || dnshdr->ans_count > 64 || dnshdr->auth_count > 64)
  360.     {
  361.         printk( kern_debug "too much recoders, query<%u>, add<%u>, ans<%u>, auth<%u>\n",
  362.          dnshdr->q_count, dnshdr->add_count, dnshdr->ans_count, dnshdr->auth_count);
  363.         return -1;
  364.     }
  365.     ptr = pkg dns_hdr_len;

  367.     // parse querys
  368.     for(i = 0; i < dnshdr->q_count; i)
  369.     {
  370.         query = (struct dns_query*)kmem_cache_alloc(dns_query_cache, gfp_atomic);
  371.         if (null == query)
  372.         {
  373.             return -1;
  374.         }

  376.         offset = parse_query(pkg, pkglen, ptr, query);
  377.         if (offset <= 0 )
  378.         {
  379.             printk(kern_debug "fail to parse query recorder,err:%d, %d\n", offset, i);
  380.             return offset;
  381.         }
  382.         ptr = offset;
  383.         list_add(&query->list, &spkg->query_hd);
  384.     }

  386.     // parse answers
  387.     for (i = 0; i < dnshdr->ans_count; i)
  388.     {
  389.         rcd = (struct dns_resource*)kmem_cache_alloc(dns_record_cache, gfp_atomic);
  390.         if (null == rcd)
  391.         {
  392.             return -1;
  393.         }

  395.         offset = parse_resource(pkg, pkglen, ptr, rcd);
  396.         if (offset <= 0 )
  397.         {
  398.             printk(kern_debug "fail to parse answers, %d\n", i);
  399.             return offset;
  400.         }
  401.         ptr = offset;
  402.         list_add(&rcd->list, &spkg->answer_hd);
  403.     }

  405.     // parse auth
  406.     for (i = 0; i < dnshdr->auth_count; i)
  407.     {
  408.         rcd = (struct dns_resource*)kmem_cache_alloc(dns_record_cache, gfp_atomic);
  409.         if (null == rcd)
  410.         {
  411.             return -1;
  412.         }

  414.         offset = parse_resource(pkg, pkglen, ptr, rcd);
  415.         if (offset <= 0 )
  416.         {
  417.             printk(kern_debug "fail to parse auths, %d\n", i);
  418.             return offset;
  419.         }
  420.         ptr = offset;
  421.         list_add(&rcd->list, &spkg->auth_hd);
  422.     }

  424.     for (i = 0; i < dnshdr->add_count; i)
  425.     {
  426.         rcd = (struct dns_resource*)kmem_cache_alloc(dns_record_cache, gfp_atomic);
  427.         if (null == rcd)
  428.         {
  429.             return -1;
  430.         }
  431.         offset = parse_resource(pkg, pkglen, ptr, rcd);
  432.         if (offset <= 0 )
  433.         {
  434.             printk( kern_debug "fail to parse additions, %d\n", i);
  435.             return offset;
  436.         }
  437.         ptr = offset;
  438.         list_add(&rcd->list, &spkg->addit_hd);
  439.     }
  440.     return 0;
  441. }

dns.h

点击(此处)折叠或打开

  1. /*********************************************************************************************
  2. * description: kernel module to parse a dns request or replay
  3. *
  4. * author: husker <huskertang@gmail.com>
  5. *
  6. * date: 2018-10-8
  7. ***********************************************************************************************/

  9. #ifndef __dns_h__
  10. #define __dns_h__

  12. typedef enum
  13. {
  14.     type_a = 1,    // ipv4 address
  15.     type_ns = 2,    // authoritative name server
  16.     type_md        = 3,    // mail destination (obsolete - use mx)
  17.     type_mf        = 4,    // mail forwarder (obsolete - use mx)
  18.     type_cname = 5,    // canonical name for an alias
  19.     type_soa    = 6,    // marks the start of a zone of authority
  20.     type_mb        = 7,    // mailbox domain name (experimental)
  21.     type_ptr = 12,    // domain name pointer
  22.     type_mx = 15,    // mail server
  23.     type_txt = 16,
  24.     type_aaaa = 28,
  25.     type_srv = 33,
  26.     type_spf = 99,
  27. } qtype_t;

  29. #define dns_hdr_len 12
  30. #define dns_commpress_flag 0xc0

  32. #pragma pack(push, 1)
  33. struct dns_header
  34. {
  35.     uint16_t id;    // identification number
  36. #ifdef __big_endian
  37.     uint8_t qr: 1;
  38.     uint8_t opcode: 4;
  39.     uint8_t aa: 1;
  40.     uint8_t tc: 1;
  41.     uint8_t rd: 1;
  42.     uint8_t ra: 1;
  43.     uint8_t z: 3;
  44.     uint8_t rcode: 4;
  45. #else
  46.     uint8_t rd: 1;
  47.     uint8_t tc: 1;
  48.     uint8_t aa: 1;
  49.     uint8_t opcode: 4;
  50.     uint8_t qr: 1;
  51.     uint8_t rcode: 4;
  52.     uint8_t z: 3;
  53.     uint8_t ra: 1;
  54. #endif
  55.     uint16_t q_count;
  56.     uint16_t ans_count;
  57.     uint16_t auth_count;
  58.     uint16_t add_count;
  59. };
  60. #pragma pack(pop)

  62. struct dns_query
  63. {
  64.     struct list_head list;
  65.     uint8_t name[128];
  66.     uint16_t type;
  67.     uint16_t class;
  68. };

  70. struct dns_resource
  71. {
  72.     struct list_head list;
  73.     uint8_t name[128];
  74.     uint16_t type;
  75.     uint16_t class;
  76.     uint32_t ttl;
  77.     uint16_t data_len;
  78.     uint8_t data[256];
  79. };

  81. struct dns_package
  82. {
  83.     struct dns_header hdr;
  84.     struct list_head query_hd;
  85.     struct list_head answer_hd;
  86.     struct list_head auth_hd;
  87.     struct list_head addit_hd;
  88. };

  90. void dns_free_package(struct dns_package* spkg);
  91. struct dns_package* dns_new_package(void);
  92. int dns_parse_package(uint8_t* pkg, uint16_t pkglen, struct dns_package* spkg);
  93. int dns_init(void);
  94. void dns_finit(void);

  96. #endif /* _dns_h_ */

阅读(24048) | 评论(0) | 转发(0) |
2

上一篇：tire 做域名白名单

下一篇：hash 算法中的魔数常量

给主人留下些什么吧！~~
| | | | |

凯发app官方网站 copyright 2001-2010 chinaunix.net all rights reserved 北京皓辰网域网络信息技术有限公司. 凯发k8官网下载客户端中心的版权所有

感谢所有关心和支持过chinaunix的朋友们
")); function link(t){ var href= $(t).attr('href'); href ="?url=" encodeuricomponent(location.href); $(t).attr('href',href); //setcookie("returnouturl", location.href, 60, "/"); }
网站地图