0

我正在尝试编写一个 Zeek 脚本来将 dns 流量划分为两个日志文件（查询和回复）。错误是事件中代码$TTL=c$dns$TTLs的“字段缺失值”。dns_query_reply我不明白此错误的原因，因为 dns.log 文件正确包含该值。

代码如下：

 module DnsFeatureExtractor;

export{

    redef enum Log::ID += {QueryDNS};
    redef enum Log::ID += {ReplyDNS};


    type InfoQuery: record{
        uid:                string              &log;
        id:                 conn_id             &log;
        domain:             string              &log    &optional;
        query_type:         string              &log    &optional;
        timestamp:          time                &log;
    };


    type InfoReply: record{
        uid:                string              &log;
        id:                 conn_id             &log;
        response_code:      count               &log    &optional;
        TTL:                vector of interval  &log    &optional;
        resolved_IP:        vector of string    &log    &optional;
        timestamp:          time                &log;
    };  
}

event zeek_init(){

    Log::create_stream(QueryDNS, [$columns=InfoQuery, $path="QueryDNS"]);
    Log::create_stream(ReplyDNS, [$columns=InfoReply, $path="ReplyDNS"]);
}

event dns_request(c: connection, msg: dns_msg, query: string, qtype: count, qclass: count){

    local name_qtype = DNS::query_types[qtype];

    local rec: DnsFeatureExtractor::InfoQuery = [$uid=c$uid, $id=c$id, $domain=query, $query_type=name_qtype, $timestamp=c$start_time];
    Log::write(DnsFeatureExtractor::QueryDNS, rec);
}

event dns_query_reply(c: connection, msg: dns_msg, query: string, qtype: count, qclass: count){

    local rec_r: DnsFeatureExtractor::InfoReply = [$uid=c$uid, $id=c$id, $response_code=msg$rcode, $TTL=c$dns$TTLs, $resolved_IP=c$dns$answers, $timestamp=c$start_time];
    Log::write(DnsFeatureExtractor::ReplyDNS, rec_r);
}
4

1 回答 1

1

这个很微妙：你看到了一个排序问题。在dns_query_reply实际填充 TTL 的事件（例如dns_A_reply）之前调用事件处理程序。

有问题的c$dns字段会填充到DNS::do_reply钩子中，所以最好的办法是确保添加到钩子中。如果您使用默认优先级，它将在填充字段的优先级之后运行。试试这个而不是dns_query_reply处理程序：

hook DNS::do_reply(c: connection, msg: dns_msg, ans: dns_answer, reply: string) {
    local rec_r: DnsFeatureExtractor::InfoReply = [$uid=c$uid, $id=c$id, $response_code=msg$rcode, $TTL=c$dns$TTLs, $resolved_IP=c$dns$answers, $timestamp=c$start_time];
    Log::write(DnsFeatureExtractor::ReplyDNS, rec_r);
}

请注意，您仍在处理可选的记录值，因此尽管有上述情况，您仍然可能看不到所有字段值。为了防止这种情况，您可以检查是否实际定义了可选值，并仅在这种情况下复制它们：

hook DNS::do_reply(c: connection, msg: dns_msg, ans: dns_answer, reply: string)
{
    local rec_r: DnsFeatureExtractor::InfoReply = [$uid=c$uid, $id=c$id, $response_code=msg$rcode, $timestamp=c$start_time];

    if ( c$dns?$TTLs )
        rec_r$TTL = c$dns$TTLs;
    if ( c$dns?$answers )
        rec_r$resolved_IP = c$dns$answers;

    Log::write(DnsFeatureExtractor::ReplyDNS, rec_r);
}
于 2020-05-01T07:34:10.127 回答