root/pm/trunk/deps/scapy-patches/dns.patch @ 5525

scapy/layers/dns.py

@@ -10 +10 @@
 from scapy.ansmachine import *
 from scapy.layers.inet import UDP
 
+def unroll(rrname):
+    ret = []
+    splitted = rrname.split('.')
+    for i in xrange(len(splitted) - 1):
+        yield '.'.join(splitted[0:i]), '.'.join(splitted[i:])
+
+def convert(x):
+    x = [k[:63] for k in x.split(".")] # Truncate chunks that cannont be encoded (more than 63 bytes..)
+    x = map(lambda y: chr(len(y))+y, x)
+    x = "".join(x)
+    if x[-1] != "\x00":
+        x += "\x00"
+    return x
+
 class DNSStrField(StrField):
     def i2m(self, pkt, x):
-        x = [k[:63] for k in x.split(".")] # Truncate chunks that cannont be encoded (more than 63 bytes..)
-        x = map(lambda y: chr(len(y))+y, x)
-        x = "".join(x)
-        if x[-1] != "\x00":
-            x += "\x00"
-        return x
+        return convert(x)
     def getfield(self, pkt, s):
         n = ""
         while 1:
@@ -45 +54 @@
             x = x.payload
             i += 1
         return i
-        
+
     def i2m(self, pkt, x):
         if x is None:
             x = self._countRR(pkt)
@@ -54 +63 @@
         if x is None:
             x = self._countRR(pkt)
         return x
-    
 
-def DNSgetstr(s,p):
+
+def DNSgetstr(s,p,off=12):
     name = ""
+    rawname = ""
+    compressed = False
     q = 0
     jpath = [p]
     while 1:
@@ -67 +78 @@
         l = ord(s[p])
         p += 1
         if l & 0xc0:
+            if not compressed:
+                rawname += s[p-1] + s[p]
+            compressed = True
             if not q:
                 q = p+1
             if p >= len(s):
                 warning("DNS incomplete jump token at (ofs=%i)" % p)
                 break
-            p = ((l & 0x3f) << 8) + ord(s[p]) - 12
+            p = ((l & 0x3f) << 8) + ord(s[p]) - off
             if p in jpath:
                 warning("DNS decompression loop detected")
                 break
             jpath.append(p)
             continue
         elif l > 0:
+            if not compressed:
+                rawname += s[p-1] + s[p:p+l]
             name += s[p:p+l]+"."
             p += l
             continue
         break
     if q:
         p = q
-    return name,p
-        
+    return name,p,compressed and rawname or ""
+
 
 class DNSRRField(StrField):
     holds_packets=1
@@ -98 +114 @@
         if x is None:
             return ""
         return str(x)
-    def decodeRR(self, name, s, p):
+
+    def decodeRR(self, name, origname, s, p):
         ret = s[p:p+10]
         type,cls,ttl,rdlen = struct.unpack("!HHIH", ret)
         p += 10
         rr = DNSRR("\x00"+ret+s[p:p+rdlen])
         if rr.type in [2, 3, 4, 5]:
-            rr.rdata = DNSgetstr(s,p)[0]
+            rr.rdata,_,rr.origrdata = DNSgetstr(s,p)
         del(rr.rdlen)
-        
+
         p += rdlen
-        
+
         rr.rrname = name
+        rr.origrrname = origname
         return rr,p
     def getfield(self, pkt, s):
         if type(s) is tuple :
@@ -123 +141 @@
             return s,""
         while c:
             c -= 1
-            name,p = DNSgetstr(s,p)
-            rr,p = self.decodeRR(name, s, p)
+            name,p,origname = DNSgetstr(s,p)
+            rr,p = self.decodeRR(name, origname, s, p)
             if ret is None:
                 ret = rr
             else:
                 ret.add_payload(rr)
+
         if self.passon:
             return (s,p),ret
         else:
             return s[p:],ret
-            
-            
+
+
 class DNSQRField(DNSRRField):
     holds_packets=1
-    def decodeRR(self, name, s, p):
+    def decodeRR(self, name, origname, s, p):
         ret = s[p:p+4]
         p += 4
         rr = DNSQR("\x00"+ret)
         rr.qname = name
         return rr,p
-        
-        
+
 
 class RDataField(StrLenField):
     def m2i(self, pkt, s):
@@ -155 +173 @@
             family = socket.AF_INET6
         elif pkt.type == 12:
             s = DNSgetstr(s, 0)[0]
-        if family is not None:    
+        if family is not None:
             s = inet_ntop(family, s)
         return s
     def i2m(self, pkt, s):
@@ -165 +183 @@
         elif pkt.type == 28:
             if s:
                 s = inet_pton(socket.AF_INET6, s)
-        elif pkt.type in [2,3,4,5]:
-            s = "".join(map(lambda x: chr(len(x))+x, s.split(".")))
-            if ord(s[-1]):
-                s += "\x00"
+        elif pkt.type in [2,3,4,5,12]:
+            s = convert(s)
         return s
 
+
 class RDLenField(Field):
     def __init__(self, name):
         Field.__init__(self, name, None, "H")
     def i2m(self, pkt, x):
         if x is None:
-            rdataf = pkt.get_field("rdata")
-            x = len(rdataf.i2m(pkt, pkt.rdata))
+            val = pkt.getfieldval('origrdata')
+            x = len(val)
+
+            if x == 0:
+                rdataf = pkt.get_field("rdata")
+                x = len(rdataf.i2m(pkt, pkt.rdata))
+
         return x
     def i2h(self, pkt, x):
         if x is None:
-            rdataf = pkt.get_field("rdata")
-            x = len(rdataf.i2m(pkt, pkt.rdata))
+            val = pkt.getfieldval('origrdata')
+            x = len(val)
+
+            if x == 0:
+                rdataf = pkt.get_field("rdata")
+                x = len(rdataf.i2m(pkt, pkt.rdata))
+
         return x
-    
+
 
 class DNS(Packet):
     name = "DNS"
@@ -210 +237 @@
                 and self.id == other.id
                 and self.qr == 1
                 and other.qr == 0)
-        
+
     def mysummary(self):
         type = ["Qry","Ans"][self.qr]
         name = ""
@@ -224 +251 @@
                 name = ' "%s"' % self.qd.qname
         return 'DNS %s%s ' % (type, name)
 
+    def do_build(self):
+        pay=""
+        cnames = {}
+
+        def addpointer(x, pos):
+            if x in cnames:
+                return
+
+            if x and x[-1] == '.':
+                x = x[:-1]
+
+            for f, d in unroll(x):
+                if d not in cnames:
+                    cnames[d] = pos + x.find(d)
+
+        def getpointer(x):
+            if x[-1] == '.':
+                x = x[:-1]
+            if x in cnames:
+                return cnames[x]
+            return -1
+
+        for f in self.fields_desc[:13]:
+            val = self.getfieldval(f.name)
+            if isinstance(val, RawVal):
+                pay += str(val)
+            else:
+                pay = f.addfield(self, pay, val)
+
+        for f in self.fields_desc[13:]:
+            try:
+                val = self.fields[f.name]
+            except KeyError:
+                continue
+
+            if not val:
+                continue
+
+            while not isinstance(val, NoPayload):
+                if isinstance(val, DNSQR):
+                    addpointer(val.getfieldval('qname'), len(pay))
+                    pay += str(val)
+                elif isinstance(val, DNSRR):
+                    oldpos = len(pay)
+
+                    rrname  = val.getfieldval('rrname')
+                    orrname = val.getfieldval('origrrname')
+                    drrname = orrname and \
+                        DNSgetstr(pay + orrname, len(pay), 0)[0] or None
+
+                    if drrname == rrname:
+                        pay += orrname
+                    else:
+                        compressed = False
+
+                        for first, domain in unroll(rrname):
+                            idx = getpointer(domain)
+
+                            if idx >= 0:
+                                pay += first and convert(first)[:-1] or ''
+                                pay += struct.pack("!H", 0xc000 | idx)
+                                compressed = True
+                                break
+
+                        if not compressed:
+                            pay = val.fields_desc[0].addfield(val, pay, rrname)
+
+                    addpointer(rrname, len(pay) - 1)
+                    oldpos = len(pay)
+
+                    interesting = False
+                    rdata = val.getfieldval('rdata')
+
+                    # First we try to compress the rdata and set origrdata field
+                    if val.getfieldval('type') in [2,3,4,5,12]:
+                        interesting = True
+
+                        packrdata = convert(rdata)
+                        ordata = val.getfieldval('origrdata')
+                        tmppay = pay + "\x00" * 10
+
+                        drdata = ordata and \
+                            DNSgetstr(tmppay + orrname, len(tmppay), 0)[0] or None
+
+                        if drdata == rdata:
+                            packrdata = ordata
+                            val.setfieldval('origrdata', packrdata)
+                        else:
+                            compressed = False
+
+                            for first, domain in unroll(rdata):
+                                idx = getpointer(domain)
+
+                                if idx >= 0:
+                                    packrdata = first and convert(first)[:-1] or ''
+                                    packrdata += struct.pack("!H", 0xc000 | idx)
+                                    val.setfieldval('origrdata', packrdata)
+                                    compressed = True
+                                    break
+
+                            if not compressed:
+                                val.setfieldval('origrdata', packrdata)
+
+                        addpointer(rdata, oldpos + 10)
+                    else:
+                        val.setfieldval('origrdata', '')
+
+                    # These fields could not be compressed
+                    for rrf in val.fields_desc[1:5]:
+                        rrval = val.getfieldval(rrf.name)
+
+                        if isinstance(rrval, RawVal):
+                            pay += str(rrval)
+                        else:
+                            pay = rrf.addfield(val, pay, rrval)
+
+                    if not interesting:
+                        pay = val.fields_desc[5].addfield(val, pay, val.getfieldval('rdata'))
+                    else:
+                        pay += packrdata
+
+                val = val.payload
+        return pay
+
 dnstypes = { 0:"ANY", 255:"ALL",
              1:"A", 2:"NS", 3:"MD", 4:"MD", 5:"CNAME", 6:"SOA", 7: "MB", 8:"MG",
              9:"MR",10:"NULL",11:"WKS",12:"PTR",13:"HINFO",14:"MINFO",15:"MX",16:"TXT",
              17:"RP",18:"AFSDB",28:"AAAA", 33:"SRV",38:"A6",39:"DNAME"}
 
+
 dnsqtypes = {251:"IXFR",252:"AXFR",253:"MAILB",254:"MAILA",255:"ALL"}
 dnsqtypes.update(dnstypes)
 dnsclasses =  {1: 'IN',  2: 'CS',  3: 'CH',  4: 'HS',  255: 'ANY'}
 
 
+class OriginalDataField(StrField):
+    def i2m(self, pkt, x):
+        return ''
+
 class DNSQR(Packet):
     name = "DNS Question Record"
     show_indent=0
     fields_desc = [ DNSStrField("qname",""),
                     ShortEnumField("qtype", 1, dnsqtypes),
                     ShortEnumField("qclass", 1, dnsclasses) ]
-                    
-                    
+
 
 class DNSRR(Packet):
     name = "DNS Resource Record"
@@ -251 +406 @@
                     ShortEnumField("rclass", 1, dnsclasses),
                     IntField("ttl", 0),
                     RDLenField("rdlen"),
-                    RDataField("rdata", "", length_from=lambda pkt:pkt.rdlen) ]
+                    RDataField("rdata", "", length_from=lambda pkt:pkt.rdlen),
+                    OriginalDataField("origrdata", ""),
+                    OriginalDataField("origrrname", "")]
 
 bind_layers( UDP,           DNS,           dport=53)
 bind_layers( UDP,           DNS,           sport=53)
@@ -275 +432 @@
         return r.getlayer(DNS).rcode
     else:
         return -1
-    
-    
-    
+
 
 @conf.commands.register
 def dyndns_del(nameserver, name, type="ALL", ttl=10):
@@ -297 +452 @@
         return r.getlayer(DNS).rcode
     else:
         return -1
-    
+
 
 class DNS_am(AnsweringMachine):
     function_name="dns_spoof"
@@ -312 +467 @@
 
     def is_request(self, req):
         return req.haslayer(DNS) and req.getlayer(DNS).qr == 0
-    
+
     def make_reply(self, req):
         ip = req.getlayer(IP)
         dns = req.getlayer(DNS)
@@ -322 +477 @@
                     an=DNSRR(rrname=dns.qd.qname, ttl=10, rdata=rdata))
         return resp
 
-