axa  1.2.1
Farsight Security Advanced Exchange Access (AXA)
axa_dns_walk

Detailed Description

dns_walk facility takes a DNS packet or rdata field, additional information if required, and a set of functions that should be applied to parts of the packet or rdata.

The functions usually make decisions based on the contents (i.e.. filter it). Domains are assembled by combining fragments of "compressed" domains. Parts that are uninteresting for filter, such as MX precedence values, are skipped.

Data Structures

struct  axa_walk_ops
 List of DNS callback Functions. More...
 

Typedefs

typedef const uint8_t axa_walkb_t
 A pointer to DNS data. More...
 
typedef const char axa_walks_t
 DNS section name. More...
 
typedef const struct axa_walk_ops axa_walk_ops_t
 list of callback functions More...
 
typedef void( axa_walk_error_t) (void *ctxt, const char *p, va_list args)
 Callback function to deal with an error encountered while parsing a DNS packet or rdata, usually by printing or logging a message. More...
 
typedef bool( axa_walk_ip_t) (void *ctxt, const axa_walkb_t *ip, size_t ip_len, axa_walks_t *sec)
 Callback function for an IP address found while walking over a DNS packet or rdata. More...
 
typedef bool( axa_walk_domain_t) (void *ctxt, axa_walkb_t *name, size_t name_len, axa_walk_dom_t dtype, uint rtype, axa_walks_t *sec)
 Callback function for a domain found while walking over a DNS packet or rdata. More...
 
typedef bool( axa_walk_rdata_t) (void *ctxt, axa_walk_ops_t *ops, axa_walkb_t *oname, size_t oname_len, axa_walkb_t *pkt_base, axa_walkb_t *pkt_lim, axa_walkb_t *rdata, size_t rdlength, uint rtype, axa_walks_t *sec)
 Examine or walk over an owner name and its rdata. More...
 

Enumerations

enum  axa_walk_dom_t
 The context of a domain. More...
 

Functions

void axa_walk_dns (void *ctxt, axa_walk_ops_t *ops, axa_walkb_t *pkt_base, size_t pkt_len)
 Walk over or examine a DNS packet. More...
 

Variables

axa_walk_rdata_t axa_walk_rdata
 Generic rdata callback that calls axa_walk_ops_t->error, ->ip, or ->domain as it walks over rdata. More...
 
axa_walk_rdata_t axa_skip_rdata
 Generic callback to skip rdata for uses that do not care about an rdata field. More...
 

Typedef Documentation

typedef const uint8_t axa_walkb_t

A pointer to DNS data.

typedef const char axa_walks_t

DNS section name.

typedef const struct axa_walk_ops axa_walk_ops_t

list of callback functions

typedef void( axa_walk_error_t) (void *ctxt, const char *p, va_list args)

Callback function to deal with an error encountered while parsing a DNS packet or rdata, usually by printing or logging a message.

Parameters
[in]ctxtDNS Walk caller's context
[in]pprintf message pattern describing the error
[in]argsvalues for p
typedef bool( axa_walk_ip_t) (void *ctxt, const axa_walkb_t *ip, size_t ip_len, axa_walks_t *sec)

Callback function for an IP address found while walking over a DNS packet or rdata.

Parameters
[in]ctxtcaller's context
[in]ipfound IP address
[in]ip_lenlength of IP and so either 4 or 16
[in]secname of the DNS section where the IP address was found
Return values
truecontinue walking
falsestop walking or parsing after an error or because a filtering decision has been made
typedef bool( axa_walk_domain_t) (void *ctxt, axa_walkb_t *name, size_t name_len, axa_walk_dom_t dtype, uint rtype, axa_walks_t *sec)

Callback function for a domain found while walking over a DNS packet or rdata.

Parameters
[in]ctxtcaller's context
[in]namefound domain in wire format
[in]name_lenlength of name
[in]dtypecontext in which name was found
[in]rtypertype of owned or containing rdata
[in]secname of the DNS section where the domain was found
Return values
truecontinue walking
falsestop walking or parsing after an error or because a filtering decision has been made
typedef bool( axa_walk_rdata_t) (void *ctxt, axa_walk_ops_t *ops, axa_walkb_t *oname, size_t oname_len, axa_walkb_t *pkt_base, axa_walkb_t *pkt_lim, axa_walkb_t *rdata, size_t rdlength, uint rtype, axa_walks_t *sec)

Examine or walk over an owner name and its rdata.

Parameters
[in]ctxtcaller's context
[in]opslist of callback functions
[in]onameowner name if known or NULL if unknown
[in]oname_lenlength of owner name
[in]pkt_basestart of DNS packet or NULL for isolated rdata
[in]pkt_limend + 1 of DNS packet or end of rdata+1
[in]rdataresource data or rdata to walk or examine
[in]rdlengthrdata length
[in]rtyperesource type or rtype of rdata
[in]secsection name
Return values
truecontinue walking
falsestop walking or parsing after an error or because a filtering decision has been made

Enumeration Type Documentation

The context of a domain.

Enumerator
AXA_WALK_DOM_QUESTION 

DNS question.

AXA_WALK_DOM_OWNER 

rdata owner domain

AXA_WALK_DOM_RDATA1 

1st or only domain in rdata

AXA_WALK_DOM_RDATA2 

2nd rdata domain in such as SOA

Function Documentation

void axa_walk_dns ( void *  ctxt,
axa_walk_ops_t ops,
axa_walkb_t pkt_base,
size_t  pkt_len 
)

Walk over or examine a DNS packet.

Parameters
[in]ctxtcaller's context given callback functions
[in]opslist of callback functions
[in]pkt_basestart of the DNS packet
[in]pkt_lenlength of the DNS packet

Variable Documentation

axa_walk_rdata_t axa_walk_rdata

Generic rdata callback that calls axa_walk_ops_t->error, ->ip, or ->domain as it walks over rdata.

This function can be used in axa_walk_ops_t explicitly or by setting axa_walk_ops_t->rdata==NULL or called by the function specified in axa_walk_ops_t->rdata. That is useful when external criteria determine whether an rdata field should be examined or skipped.

axa_walk_rdata_t axa_skip_rdata

Generic callback to skip rdata for uses that do not care about an rdata field.