-
Notifications
You must be signed in to change notification settings - Fork 0
/
dns.go
151 lines (134 loc) · 4.09 KB
/
dns.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
package packemon
import (
"bytes"
"encoding/binary"
"strings"
)
const PORT_DNS = 0x0035 // 53
// TODO: 雑にFlagsを定義しちゃってる。ほんとはビット単位
const (
DNS_REQUEST = 0x0100
DNS_RESPONSE = 0x8180
)
const (
DNS_QUERY_TYPE_A = 0x0001
DNS_QUERY_TYPE_AAAA = 0x001c
)
const (
DNS_QUERY_CLASS_IN = 0x0001
)
// https://atmarkit.itmedia.co.jp/ait/articles/1601/29/news014.html
// 上記とパケットキャプチャ見てイメージがつく、domain
type DNS struct {
TransactionID uint16
Flags uint16 // TODO: ここにビット単位で意味があるから、structにして管理したい
Questions uint16
AnswerRRs uint16
AuthorityRRs uint16
AdditionalRRs uint16
Queries *Queries
Answers []*Answer
}
// TODO: 個別にQueryで定義してスライスで持つようにする
type Queries struct {
Domain []uint8
Typ uint16
Class uint16
Ttl uint32
DataLength uint16
}
type Answer struct {
Name uint16
Typ uint16
Class uint16
Ttl uint32
DataLength uint16
Address uint32
}
func ParsedDNSRequest(payload []byte) *DNS {
flags := binary.BigEndian.Uint16(payload[2:4])
qCnt := binary.BigEndian.Uint16(payload[4:6])
anCnt := binary.BigEndian.Uint16(payload[6:8])
auCnt := binary.BigEndian.Uint16(payload[8:10])
adCnt := binary.BigEndian.Uint16(payload[10:12])
// 一旦Questionsは1固定で進める
// また、domainは、0x00 までとなる。そういう判定処理
offset := bytes.IndexByte(payload[12:], 0x00) + 12 + 1
q := &Queries{
Domain: payload[12:offset],
Typ: binary.BigEndian.Uint16(payload[offset : offset+2]),
Class: binary.BigEndian.Uint16(payload[offset+2 : offset+4]),
}
return &DNS{
TransactionID: binary.BigEndian.Uint16(payload[0:2]),
Flags: flags,
Questions: qCnt,
AnswerRRs: anCnt,
AuthorityRRs: auCnt,
AdditionalRRs: adCnt,
Queries: q,
}
}
func ParsedDNSResponse(payload []byte) *DNS {
flags := binary.BigEndian.Uint16(payload[2:4])
qCnt := binary.BigEndian.Uint16(payload[4:6])
anCnt := binary.BigEndian.Uint16(payload[6:8])
auCnt := binary.BigEndian.Uint16(payload[8:10])
adCnt := binary.BigEndian.Uint16(payload[10:12])
// 一旦Questionsは1固定として進める
// また、domainは、0x00 までとなる。そういう判定処理
offset := bytes.IndexByte(payload[12:], 0x00) + 12 + 1
q := &Queries{
Domain: payload[12:offset],
Typ: binary.BigEndian.Uint16(payload[offset : offset+2]),
Class: binary.BigEndian.Uint16(payload[offset+2 : offset+4]),
}
// 一旦Answersは1固定として進める
offsetOfAns := offset + 4
a := &Answer{
Name: binary.BigEndian.Uint16(payload[offsetOfAns : offsetOfAns+2]),
Typ: binary.BigEndian.Uint16(payload[offsetOfAns+2 : offsetOfAns+4]),
Class: binary.BigEndian.Uint16(payload[offsetOfAns+4 : offsetOfAns+6]),
Ttl: binary.BigEndian.Uint32(payload[offsetOfAns+6 : offsetOfAns+10]),
DataLength: binary.BigEndian.Uint16(payload[offsetOfAns+10 : offsetOfAns+12]),
Address: binary.BigEndian.Uint32(payload[offsetOfAns+12 : offsetOfAns+16]),
}
return &DNS{
TransactionID: binary.BigEndian.Uint16(payload[0:2]),
Flags: flags,
Questions: qCnt,
AnswerRRs: anCnt,
AuthorityRRs: auCnt,
AdditionalRRs: adCnt,
Queries: q,
Answers: []*Answer{a},
}
}
func (d *DNS) Domain(domain string) {
splited := strings.Split(domain, ".")
buf := make([]uint8, len(domain)+2)
cnt := 0
for _, s := range splited {
buf[cnt] = uint8(len(s))
cnt++
for _, c := range s {
buf[cnt] = uint8(rune(c)) // ドメインに絵文字とか使えた気が。そうするとバグるはず
cnt++
}
}
buf[len(domain)+1] = 0x00
d.Queries.Domain = buf
}
func (d *DNS) Bytes() []byte {
buf := &bytes.Buffer{}
WriteUint16(buf, d.TransactionID)
WriteUint16(buf, d.Flags)
WriteUint16(buf, d.Questions)
WriteUint16(buf, d.AnswerRRs)
WriteUint16(buf, d.AuthorityRRs)
WriteUint16(buf, d.AdditionalRRs)
buf.Write(d.Queries.Domain)
WriteUint16(buf, d.Queries.Typ)
WriteUint16(buf, d.Queries.Class)
return buf.Bytes()
}