Example DNS parser #163
Example DNS parser #163
Conversation
| - match: udp dst port 53 | ||
| type: conn_handler | ||
| target: dns |
There was a problem hiding this comment.
Rule to handle all UDP traffic on port 53 with the new DNS handler
| con, err := net.DialUDP("udp", dstAddr, srcAddr) | ||
| if err != nil { | ||
| g.Logger.Error("failed to dial UDP connection", producer.ErrAttr(err)) | ||
| return | ||
| } | ||
| defer con.Close() | ||
| _, err = con.Write(response) | ||
| if err != nil { | ||
| g.Logger.Error("failed to send UDP response", producer.ErrAttr(err)) |
There was a problem hiding this comment.
We have to create a new outgoing connection. If we send through the UDP listener, we will have the wrong source port.
| @@ -15,13 +15,16 @@ import ( | |||
|
|
|||
| type TCPHandlerFunc func(ctx context.Context, conn net.Conn, md connection.Metadata) error | |||
|
|
|||
| type UDPHandlerFunc func(ctx context.Context, srcAddr, dstAddr *net.UDPAddr, data []byte, md connection.Metadata) error | |||
| type UDPHandlerFunc func(ctx context.Context, srcAddr, dstAddr *net.UDPAddr, data []byte, md connection.Metadata) ([]byte, error) | |||
There was a problem hiding this comment.
UDP handlers now return a byte slice as response to the client.
| last int64 | ||
| } | ||
|
|
||
| var throttle = map[string]throttleState{} |
There was a problem hiding this comment.
We don't want to become a UDP amplification service.
| Name: name, | ||
| Type: q.Type, | ||
| Class: q.Class, | ||
| TTL: 453, |
There was a problem hiding this comment.
We need to make this not fingerprintable
|
|
||
| switch q.Type { | ||
| case dnsmessage.TypeA: | ||
| answer.Body = &dnsmessage.AResource{A: [4]byte{127, 0, 0, 1}} |
There was a problem hiding this comment.
Should we actually do a DNS lookup instead of localhost? If we resolve anything, it's a dead giveaway.
| return nil, fmt.Errorf("failed to pack DNS response: %w", err) | ||
| } | ||
|
|
||
| if err := h.ProduceUDP("dns", srcAddr, dstAddr, md, data[:len(data)%1024], nil); err != nil { |
There was a problem hiding this comment.
We probably want to also report the structured message instead of just the raw payload.
No description provided.