未绑定的DNS服务器,Python模块:检查​​响应消息元素

Question

目标

我想利用Unbound Python模块在将响应发送到客户端之前检查响应.首先,我;; ANSWER SECTION:对查询得到解决的IP地址感兴趣.

问题

看起来像是对logDnsMsg函数的一个微不足道的修改,结果是浏览的重要任务reply_info,rrset_ref以及ub_packed_rrset_key追求所需;; ANSWER SECTION:字节的结构.

原因是logDnsMsg函数不能按预期的方式运行A查询;; ANSWER SECTION:,而令人惊讶的是它;; AUTHORITY SECTION:在AAAA查询时按预期运行.

Lemme演示了Python实现的logDnsMsg函数和本机log_dns_msg函数之间的比较; 前者显示胡言乱语,后者表现完全符合预期.这两个函数都在Python模块上下文中调用,如下所示:

+++
def operate(id, event, qstate, qdata):
    log_info("pythonmod: operate called, id: %d, event:%s" % (id, strmodulevent(event)))
    if (qstate.return_msg):
        logDnsMsg(qstate)
        log_dns_msg("blackpie KARMMMMMM XXXXXXX", qstate.return_msg.qinfo, qstate.return_msg.rep)
+++

请注意,我更改了原始的logDnsMsg,因为它使用了日志框架print.输出是相同的,print但是在缓冲区的判断下分散在日志文件中.

dig 输出:

karm@localhost:~$ dig seznam.cz  @127.0.0.1 -p53535
; <<>> DiG 9.9.4-P2-RedHat-9.9.4-18.P2.fc20 <<>> seznam.cz @127.0.0.1 -p53535
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 38630
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;seznam.cz.     IN  A
;; ANSWER SECTION:
seznam.cz.    300 IN  A 77.75.76.3
;; Query time: 656 msec
;; SERVER: 127.0.0.1#53535(127.0.0.1)
;; WHEN: Sat Apr 25 16:04:32 CEST 2015
;; MSG SIZE  rcvd: 54

AAAA查询输出;; AUTHORITY SECTION:从logDnsMsg和log_dns_msg看起来都足够好:

[1429970672] unbound[14053:0] info: pythonmod: operate called, id: 1, event:module_event_moddone
[1429970672] unbound[14053:0] info: ------------------------------------------------------------------------------------------
[1429970672] unbound[14053:0] info: Query: e.root-servers.net., type: AAAA (28), class: IN (1) 
[1429970672] unbound[14053:0] info: ------------------------------------------------------------------------------------------
[1429970672] unbound[14053:0] info: Return    reply :: flags: 8080, QDcount: 1, Security:0, TTL=86400
[1429970672] unbound[14053:0] info:           qinfo :: qname: ['e', 'root-servers', 'net', ''] e.root-servers.net., qtype: AAAA, qclass: IN
[1429970672] unbound[14053:0] info: Reply:
[1429970672] unbound[14053:0] info: 0:['root-servers', 'net', ''] root-servers.net. flags: 0004
[1429970672] unbound[14053:0] info: type:SOA (6) class:IN (1)
[1429970672] unbound[14053:0] info:   0:TTL=3600000
[1429970672] unbound[14053:0] info: 
[1429970672] unbound[14053:0] info:        0x00 | 00 40 01 61 0C 72 6F 6F 74 2D 73 65 72 76 65 72 73 | . @ . a . r o o t - s e r v e r s 
       0x10 | 73 03 6E 65 74 00 05 6E 73 74 6C 64 0C 76 65 72 69 | s . n e t . . n s t l d . v e r i 
       0x20 | 69 73 69 67 6E 2D 67 72 73 03 63 6F 6D 00 78 0C E3 | i s i g n - g r s . c o m . x . . 
       0x30 | E3 24 00 00 38 40 00 00 1C 20 00 12 75 00 00 36 EE | . $ . . 8 @ . . .   . . u . . 6 . 
       0x40 | EE 80                                              | . . 
[1429970672] unbound[14053:0] info: ------------------------------------------------------------------------------------------
[1429970672] unbound[14053:0] info: blackpie KARMMMMMM XXXXXXX ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 0
;; flags: qr ra ; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 
;; QUESTION SECTION:
e.root-servers.net. IN  AAAA
;; ANSWER SECTION:
;; AUTHORITY SECTION:
root-servers.net. 3600000 IN  SOA a.root-servers.net. nstld.verisign-grs.com. 2014110500 14400 7200 1209600 3600000
;; ADDITIONAL SECTION:
;; MSG SIZE  rcvd: 96
[1429970672] unbound[14053:0] debug: mesh_run: python module exit state is module_finished

相反,对于A查询,;; ANSWER SECTION:就logDnsMsg来说是完全没用的:

[1429970672] unbound[14053:0] info: pythonmod: operate called, id: 1, event:module_event_moddone
[1429970672] unbound[14053:0] info: ------------------------------------------------------------------------------------------
[1429970672] unbound[14053:0] info: Query: seznam.cz., type: A (1), class: IN (1) 
[1429970672] unbound[14053:0] info: ------------------------------------------------------------------------------------------
[1429970672] unbound[14053:0] info: Return    reply :: flags: 8080, QDcount: 1, Security:0, TTL=300
[1429970672] unbound[14053:0] info:           qinfo :: qname: ['seznam', 'cz', ''] seznam.cz., qtype: A, qclass: IN
[1429970672] unbound[14053:0] info: Reply:
[1429970672] unbound[14053:0] info: 0:['seznam', 'cz', ''] seznam.cz. flags: 0000
[1429970672] unbound[14053:0] info: type:A (1) class:IN (1)
[1429970672] unbound[14053:0] info:   0:TTL=300
[1429970672] unbound[14053:0] info: 
[1429970672] unbound[14053:0] info:        0x00 | 00 04 4D 4B 4C 03                                  | . . M K L . 
[1429970672] unbound[14053:0] info: ------------------------------------------------------------------------------------------
[1429970672] unbound[14053:0] info: blackpie KARMMMMMM XXXXXXX ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 0
;; flags: qr ra ; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 
;; QUESTION SECTION:
seznam.cz.  IN  A
;; ANSWER SECTION:
seznam.cz.  300 IN  A 77.75.76.3
;; AUTHORITY SECTION:
;; ADDITIONAL SECTION:
;; MSG SIZE  rcvd: 43
[1429970672] unbound[14053:0] debug: mesh_run: python module exit state is module_finished

请注意00 04 4D 4B 4C 03错误地解释为ASCII 的字节.

题

在哪struct ub_packed_rrset_key** rrsets;一个找到所需的;; ANSWER SECTION:数据？(如果它确实是正确的地方.)

我一直在摆弄它已经有一段时间没有运气了.我检查了sldns_wire2str_pkt_scan内部用于解压缩wire二进制数据的函数,但我不是更明智的.

Answer 1

logDnsMsg()正在记录每个 DNS 资源记录内容的十六进制转储。它输出字节及其 ASCII 解释（其中.s 表示不可打印字节）。这意味着，如果数据包含 ASCII 字符串，这些字符串将在输出中可见，而其他类型的数据（如 IP 地址）将不会转换为有意义的文本。

数据的前两个字节是RDLENGTH字段，表示记录数据的长度。其余字节是RDATA正确的字段。这些字节的解释取决于记录类型。 A记录由单个 32 位 IP 地址组成，因此很容易解析。

以下示例代码打印A记录的内容：

def print_a_record(data):
    rdlength, rdata = data[:2], data[2:]
    assert rdlength == '\x00\x04'
    assert len(rdata) == 4
    addr_bytes = [ord(c) for c in rdata]
    print('{}.{}.{}.{}'.format(*addr_bytes))

更多信息：

• 域名系统,维基百科
• RFC 1035 - 域名 - 实施和规范，IETF