Du kannst nicht mehr als 25 Themen auswählen
Themen müssen entweder mit einem Buchstaben oder einer Ziffer beginnen. Sie können Bindestriche („-“) enthalten und bis zu 35 Zeichen lang sein.
247 Zeilen
5.2 KiB
Go
247 Zeilen
5.2 KiB
Go
// based on https://github.com/aler9/landiscover/blob/main/layer-nbns.go (MIT License)
|
|
|
|
package layer_nbns
|
|
|
|
import (
|
|
"encoding/binary"
|
|
"fmt"
|
|
"strings"
|
|
|
|
"github.com/google/gopacket"
|
|
"github.com/google/gopacket/layers"
|
|
)
|
|
|
|
type layerNbns struct {
|
|
layers.BaseLayer
|
|
TransactionID uint16
|
|
IsResponse bool
|
|
Opcode uint8
|
|
Truncated bool
|
|
Recursion bool
|
|
Broadcast bool
|
|
Questions []nbnsQuestion
|
|
Answers []nbnsAnswer
|
|
AuthorityCount uint16
|
|
AdditionalCount uint16
|
|
}
|
|
|
|
func NewLayerNbns() *layerNbns {
|
|
return &layerNbns{}
|
|
}
|
|
|
|
type nbnsQuestion struct {
|
|
Query string
|
|
Type uint16
|
|
Class uint16
|
|
}
|
|
|
|
type nbnsAnswer struct {
|
|
Query string
|
|
Type uint16
|
|
Class uint16
|
|
TTL uint32
|
|
Names []nbnsAnswerName
|
|
}
|
|
|
|
type nbnsAnswerName struct {
|
|
Name string
|
|
Type uint8
|
|
Flags uint16
|
|
}
|
|
|
|
func (l *layerNbns) DecodeFromBytes(data []byte) error {
|
|
l.BaseLayer = layers.BaseLayer{Contents: data}
|
|
|
|
if len(data) < 12 {
|
|
return fmt.Errorf("invalid packet")
|
|
}
|
|
|
|
l.TransactionID = binary.BigEndian.Uint16(data[0:2])
|
|
l.IsResponse = (data[3] >> 7) == 0x01
|
|
l.Opcode = (data[3] >> 3) & 0x0F
|
|
l.Truncated = (data[3] >> 1) == 0x01
|
|
l.Recursion = data[3] == 0x01
|
|
l.Broadcast = (data[4] >> 4) == 0x01
|
|
questionCount := binary.BigEndian.Uint16(data[4:6])
|
|
answerCount := binary.BigEndian.Uint16(data[6:8])
|
|
l.AuthorityCount = binary.BigEndian.Uint16(data[8:10])
|
|
l.AdditionalCount = binary.BigEndian.Uint16(data[10:12])
|
|
pos := 12
|
|
|
|
if questionCount > 0 {
|
|
return fmt.Errorf("is question, unsupported")
|
|
}
|
|
|
|
l.Questions = nil
|
|
for i := uint16(0); i < questionCount; i++ {
|
|
q := nbnsQuestion{}
|
|
|
|
var read int
|
|
q.Query, read = dnsQueryDecode(data, pos)
|
|
if read <= 0 {
|
|
return fmt.Errorf("invalid string")
|
|
}
|
|
pos += read
|
|
|
|
q.Type = binary.BigEndian.Uint16(data[pos+0 : pos+2])
|
|
q.Class = binary.BigEndian.Uint16(data[pos+2 : pos+4])
|
|
pos += 4
|
|
l.Questions = append(l.Questions, q)
|
|
}
|
|
|
|
l.Answers = nil
|
|
for i := uint16(0); i < answerCount; i++ {
|
|
a := nbnsAnswer{}
|
|
|
|
var read int
|
|
a.Query, read = dnsQueryDecode(data, pos)
|
|
if read <= 0 {
|
|
return fmt.Errorf("invalid string")
|
|
}
|
|
pos += read
|
|
|
|
a.Type = binary.BigEndian.Uint16(data[pos+0 : pos+2])
|
|
a.Class = binary.BigEndian.Uint16(data[pos+2 : pos+4])
|
|
a.TTL = binary.BigEndian.Uint32(data[pos+4 : pos+8])
|
|
dataLen := binary.BigEndian.Uint16(data[pos+8 : pos+10])
|
|
pos += 10
|
|
|
|
if a.Type == 0x21 { // NB_STAT
|
|
pos2 := pos
|
|
nameCount := data[pos2]
|
|
pos2++
|
|
|
|
for j := uint8(0); j < nameCount; j++ {
|
|
a.Names = append(a.Names, nbnsAnswerName{
|
|
Name: strings.TrimSuffix(string(data[pos2:pos2+15]), " "),
|
|
Type: data[pos2+15],
|
|
Flags: binary.BigEndian.Uint16(data[pos2+16 : pos2+18]),
|
|
})
|
|
pos2 += 18
|
|
}
|
|
}
|
|
|
|
pos += int(dataLen)
|
|
l.Answers = append(l.Answers, a)
|
|
}
|
|
|
|
// TODO: Decode Authorities and Additional Information
|
|
|
|
return nil
|
|
}
|
|
|
|
func (l *layerNbns) SerializeTo(b gopacket.SerializeBuffer) error {
|
|
data, err := b.AppendBytes(12)
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
|
|
binary.BigEndian.PutUint16(data[0:2], l.TransactionID)
|
|
if l.IsResponse {
|
|
data[3] |= 0x01 << 7
|
|
}
|
|
data[3] |= l.Opcode << 3
|
|
if l.Truncated {
|
|
data[3] |= 0x01 << 1
|
|
}
|
|
if l.Recursion {
|
|
data[3] |= 0x01
|
|
}
|
|
if l.Broadcast {
|
|
data[4] |= 0x01 << 4
|
|
}
|
|
binary.BigEndian.PutUint16(data[4:6], uint16(len(l.Questions)))
|
|
binary.BigEndian.PutUint16(data[6:8], uint16(len(l.Answers)))
|
|
binary.BigEndian.PutUint16(data[8:10], l.AuthorityCount)
|
|
binary.BigEndian.PutUint16(data[10:12], l.AdditionalCount)
|
|
|
|
for _, q := range l.Questions {
|
|
enc := dnsQueryEncode(q.Query)
|
|
|
|
data, err := b.AppendBytes(len(enc) + 4)
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
|
|
copy(data[:len(enc)], enc)
|
|
data = data[len(enc):]
|
|
binary.BigEndian.PutUint16(data[0:2], q.Type)
|
|
binary.BigEndian.PutUint16(data[2:4], q.Class)
|
|
}
|
|
|
|
// TODO: encode answers, authorities and additional informations
|
|
|
|
return nil
|
|
}
|
|
|
|
// Source: https://github.com/aler9/landiscover/blob/main/utils.go
|
|
// <size>part<size>part
|
|
func dnsQueryDecode(data []byte, start int) (string, int) {
|
|
var read []byte
|
|
toread := uint8(0)
|
|
pos := start
|
|
|
|
for ; true; pos++ {
|
|
if pos >= len(data) { // decoding terminated before null character
|
|
return "", -1
|
|
}
|
|
if data[pos] == 0x00 {
|
|
if toread > 0 { // decoding terminated before part parsing
|
|
return "", -1
|
|
}
|
|
break // query correctly decoded
|
|
}
|
|
|
|
if toread == 0 { // we need a size or pointer
|
|
if len(read) > 0 { // add separator
|
|
read = append(read, '.')
|
|
}
|
|
|
|
if (data[pos] & 0xC0) == 0xC0 { // pointer
|
|
ptr := int(binary.BigEndian.Uint16(data[pos:pos+2]) & 0x3FFF)
|
|
pos++ // skip next byte
|
|
|
|
substr, subread := dnsQueryDecode(data, ptr)
|
|
if subread <= 0 {
|
|
return "", -1
|
|
}
|
|
read = append(read, []byte(substr)...)
|
|
break // query correctly decoded
|
|
} else { // size
|
|
toread = data[pos]
|
|
}
|
|
} else { // byte inside part
|
|
read = append(read, data[pos])
|
|
toread--
|
|
}
|
|
}
|
|
return string(read), pos + 1 - start
|
|
}
|
|
|
|
func dnsQueryEncode(in string) []byte {
|
|
tmp := strings.Split(in, ".")
|
|
|
|
l := 0
|
|
for _, part := range tmp {
|
|
bpart := []byte(part)
|
|
l++
|
|
l += len(bpart)
|
|
}
|
|
l++
|
|
|
|
ret := make([]byte, l)
|
|
i := 0
|
|
|
|
for _, part := range tmp {
|
|
bpart := []byte(part)
|
|
ret[i] = uint8(len(bpart))
|
|
i++
|
|
copy(ret[i:], bpart)
|
|
i += len(bpart)
|
|
}
|
|
|
|
ret[i] = uint8(0)
|
|
|
|
return ret
|
|
}
|