Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

dns: parse and log soa data - v5 #5331

Closed
wants to merge 4 commits into from
Closed

dns: parse and log soa data - v5 #5331

wants to merge 4 commits into from

Conversation

simdugas
Copy link
Contributor

@simdugas simdugas commented Aug 27, 2020 •
edited
Loading

Make sure these boxes are signed before submitting your Pull Request -- thank you.

Link to redmine ticket:

Link to previous PR:

Link to suricata-verify PR:

Describe changes since last pull request:

  • Rebased master to use new JsonBuilder.
  • Fixed bug for missing js.close()? in dns_log_sshfp.

@simdugas
dns: refactor to handle more rdata formats
025b4cb 
Represent rdata as `DNSRData` enum variants instead of `Vec<u8>`.
This will allow parsing/logging of more complex formats like SOA.
@simdugas
dns: use nom's rest to take all remaining rdata
0d20868 
Using nom's `rest` combinator eliminates the need to call the do_parse
macro for parsing a single element.
@simdugas
dns: parse and log fields for SOA record type
c5d81e5 
Added `dns_parse_rdata_soa` to parse SOA fields into an `DNSRDataSOA`
struct.

Added logging for answer and authority SOA records in both version
1 & 2, as well as grouped formats.
@simdugas
doc: dns - document additional fields in eve event
f915f56 
Documentation of additional fields for soa and sshfp. Also some minor
doc fixes and updates.
@simdugas simdugas mentioned this pull request Aug 27, 2020
Closed
This was referenced Aug 28, 2020
Open
Open
@victorjulien victorjulien added this to the 6.0 milestone Sep 3, 2020
This was referenced Sep 4, 2020
Closed
Merged
@victorjulien
Copy link
Member

Merged in #5361, thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@jasonish jasonish jasonish approved these changes

@norg norg Awaiting requested review from norg

@victorjulien victorjulien Awaiting requested review from victorjulien

Assignees

@jasonish jasonish

Labels
None yet
Milestone
6.0
Development

Successfully merging this pull request may close these issues.
3 participants
@simdugas @victorjulien @jasonish