Administrace komentářů

Ahoj, mam za ukol z DNS paketu (krom jineho) vytisknout nasledujici informace z DNS headeru:

obsah dotazu (queries) – name, type, class
obsah odpovědí (answers) – name, type, class, TTL, address

Asi by to melo vypadat nejak takto :

    Transaction ID: 0x241a

   Questions: 1
    Answer RRs: 3
    Authority RRs: 0
    Additional RRs: 0
    Queries
        www.google.com: type A, class IN
            Name: www.google.com
            Type: A (Host address)
            Class: IN (0x0001)
    Answers
        www.google.com: type CNAME, class IN, cname www.l.google.com
            Name: www.google.com
            Type: CNAME (Canonical name for an alias)
            Class: IN (0x0001)
            Time to live: 3 days, 21 hours, 52 minutes, 57 seconds
            Data length: 18
            Primary name: www.l.google.com
        www.l.google.com: type A, class IN, addr 66.249.89.99
            Name: www.l.google.com
            Type: A (Host address)
            Class: IN (0x0001)
            Time to live: 3 minutes, 47 seconds
            Data length: 4
            Addr: 66.249.89.99
        www.l.google.com: type A, class IN, addr 66.249.89.104
            Name: www.l.google.com
            Type: A (Host address)
            Class: IN (0x0001)
            Time to live: 3 minutes, 47 seconds
            Data length: 4
            Addr: 66.249.89.104

Priznam se, ze tomu zatim moc nerozumim, z toho, co jsem si nastudoval jsem schopny dat dohromady jen zakladni info, typ, class, TTL, adresu. Zatim nechpu jak ziskat jmeno, jak rozlisit dns pakety (query nebo answer). Nejak se tomu nemuzu dostat pod kuzi. Zatim jsem napsal fci na tisknuti packetu, vyuzivajici pcap, ktera dostava z main funkce packet (prikladam jeste dalsi pomocne fce, ktere fuknce print_packet() vyuziva:

void print_mac(unsigned char* mac){
	int i;
	for(i=0; i<6; i++){
		if(i!=0) printf(":");
		printf("%X",mac[i]);
	}
}

char* print_url(char data[]){
	int i=0;
	int toread = data[0];
	int start = 0;
	i++;

	while(toread != 0){
		//printf(".");
		// print everything bettween the dots
		for(; i<=start+toread; i++)
			printf("%c",data[i]);	
		// next chunk
		toread = data[i];
		start = i;
		i++;
	}
	// return a char* to the first non-url char
	return &data[i];
}



int sizeofUrl(char data[]){
	int i = 0;
	int toskip = data[0];

	// skip each set of chars until (0) at the end
	while(toskip!=0){
		i += toskip+1;
		toskip = data[i];
	}
	// return the length of the array including the (0) at the end
	return i+1;
}

void printRRType(int i){
	switch(i){
		case 1:
			printf("IPv4 address record");
			break;
		case 15:
			printf("MX mail exchange record");
			break;
		case 18:
			printf("AFS database record");
			break;
		case 28:
			printf("IPv6 address record");
			break;
		default:
			printf("unknown (%d)",i);
	}
}

void print_packet(void *pack) {
    char *tab = "   ";
    // listening with an eth header	
    packet_desc* pd = (packet_desc*) pack;

    int numRRs = ntohs(pd->dns.qdcount) + ntohs(pd->dns.ancount) + ntohs(pd->dns.nscount) + ntohs(pd->dns.arcount);
    int i;
	
    for (i = 0; i < numRRs; i++) {
        static_RR *RRd = (static_RR*) ((void*) pd->data + sizeofUrl(pd->data));
        int type = ntohs(RRd->type);
        int clas = ntohs(RRd->clas);
        int ttl = (uint32_t) ntohl(RRd->ttl);
        uint8_t *rd = (void*) (&RRd->rdlength + sizeof (uint16_t));

        printf("L2(MAC):\n");
        
        printf("%ssource MAC:", tab);
        print_mac(pd->eth.shost);
        printf("\n");
        printf("%sdestination MAC:",tab);
        print_mac(pd->eth.dhost);   
        printf("\n");
        
        printf("L3(IP):\n");
        printf("%ssource:%s\n", tab, inet_ntoa(pd->ip.src));
        printf("%sdest:%s\n", tab, inet_ntoa(pd->ip.dst));

        printf("L4:(UDP)\n");
        printf("%ssource port:%d\n", tab, ntohs(pd->udp.sport));
        printf("%sdest port:%d\n", tab, ntohs(pd->udp.dport));

        printf("DNS:\n");
        printf("%sid:%d\n", tab, ntohs(pd->dns.id));
        printf("%s# questions:%d\n", tab, ntohs(pd->dns.qdcount));
        printf("%s# answers:%d\n", tab, ntohs(pd->dns.ancount));

        printf("RESOURCE RECORDS\n");
                
        printf("\n");
        printf("%stype(%d):", tab, type);
        //printf("%sflags:%d\n", tab, ntohs(pd->dns.flags));
        printRRType(ntohs(RRd->type));
        printf("\n");
        printf("%sclass:%d\n", tab, clas);
        printf("%sTTL:%d\n", tab, ttl);
        printf("%saddress:", tab);
        printf("%d.%d.%d.%d\n", rd[0], rd[1], rd[2], rd[3]);

        printf("+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\n");

    }

}

Pro zpracovani packetu mam nasledujici struktury, jakozto hlavicky headeru jednotlivych vrstev sitove logiky:

#define ETHER_ADDR_LEN	6

typedef u_int tcp_seq;

struct ether_header {
    unsigned char dhost[ETHER_ADDR_LEN]; // Destination host address
    unsigned char shost[ETHER_ADDR_LEN]; // Source host address
    unsigned short type; // IP? ARP? RARP? etc
};

struct ip_header {
    unsigned char vhl; // version << 4 | header length >> 2
    unsigned char tos; // type of service
    unsigned short len; // total length
    unsigned short id; // identification
    unsigned short off; // fragment offset field
    unsigned char ttl; // time to live
    unsigned char prot; // protocol
    unsigned short sum; // checksum
    struct in_addr src;
    struct in_addr dst; // source and dest address 
};

struct udp_header {
    unsigned short sport; // source port
    unsigned short dport; // destination port
    unsigned short length; // udp length
    unsigned short checksum; // udp checksum
};

struct dns_header {
    unsigned short id;
    unsigned short flags;
    unsigned short qdcount;
    unsigned short ancount;
    unsigned short nscount;
    unsigned short arcount;
};

typedef struct {
    uint16_t type;
    uint16_t clas;
    uint32_t ttl;
    uint16_t rdlength;
} static_RR;

typedef struct {
    struct ether_header eth;
    struct ip_header ip;
    struct udp_header udp;
    struct dns_header dns;
    char data[0];
} packet_desc;

#endif

Potrebuji tedy nejak vydolovat hostname z jednotlivych packetu a rozlisit je podle toho, zda jsou query, nebo answer a jejich obsah vypsat, jak bylo uvedeno na zacatku.

Moz by me pomohla jakaloliv rada, protoz ted jsme v tom hodne zamotany a nevim jak dal. Snad nejak upravit struktury?