Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

dns: parse and log soa data - v4 #4955

Closed
wants to merge 4 commits into from
Closed

dns: parse and log soa data - v4 #4955

wants to merge 4 commits into from

Conversation

simdugas
Copy link
Contributor

Make sure these boxes are signed before submitting your Pull Request -- thank you.

Link to redmine ticket:

Link to previous PR:

Link to suricata-verify PR:

Relavant resources:

Describe changes since last pull request:

  • Added one enum variant for each record type used in DNSRData.
  • Moved parsing of SSHFP fields from log.rs to parser.rs and added test case. The lua module now outputs the fingerprint without the algo and type bytes.
  • Changed rdata parsing functions to use rest instead of do_parse/take where appropriate.
  • Added EVE Json Output documentation for SOA record fields.
  • Updated documentation for SSHFP record fields and the outdated paragraph on the former custom field.

PRScript output (if applicable):

  • Passes on local docker buildbot.

@simdugas
dns: refactor to handle more rdata formats
4f1aa08 
Represent rdata as `DNSRData` enum variants instead of `Vec<u8>`.
This will allow parsing/logging of more complex formats like SOA.
@simdugas
dns: use nom's rest to take all remaining rdata
6694884 
Using nom's `rest` combinator eliminates the need to call the do_parse
macro for parsing a single element.
@simdugas
dns: parse and log fields for SOA record type
50af306 
Added `dns_parse_rdata_soa` to parse SOA fields into an `DNSRDataSOA`
struct.

Added logging for answer and authority SOA records in both version
1 & 2, as well as grouped formats.
@simdugas
doc: dns - document additional fields in eve event
73e05e2 
Documentation of additional fields for soa and sshfp. Also some minor
doc fixes and updates.
@simdugas simdugas mentioned this pull request May 19, 2020
Closed
@jasonish
Copy link
Member

jasonish commented Jul 7, 2020

@simdugas Do you have time to update this to use the new JsonBuilder added to DNS?

jasonish
jasonish requested changes Jul 10, 2020
View reviewed changes
Copy link
Member

@jasonish jasonish left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Requires rebase and migration to JsonBuilder.

@simdugas simdugas mentioned this pull request Aug 27, 2020
Closed
3 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@jasonish jasonish jasonish requested changes

@norg norg Awaiting requested review from norg

@victorjulien victorjulien Awaiting requested review from victorjulien

Assignees

@jasonish jasonish

Labels
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@simdugas @jasonish @victorjulien