DNSRR迭代

Question

如果我使用sr1发送www.google.com的DNSQR，则会得到多个DNSRR的答复，例如（使用完成ans[DNSRR].show()）：

###[ DNS Resource Record ]###
   rrname= 'www.google.com.'
   type= A
   rclass= IN
   ttl= 294
   rdlen= 4
   rdata= '173.194.35.176'
###[ DNS Resource Record ]###
   rrname= 'www.google.com.'
   type= A
   rclass= IN
   ttl= 294
   rdlen= 4
   rdata= '173.194.35.178'
###[ DNS Resource Record ]###
   ....

有没有一种巧妙的方法可以迭代这些DNSRR？我使用正则表达式和以下代码：

def get_ip_addr(s):
    pattern = r'[0-9]+(?:\.[0-9]+){3}'
    match = re.search(pattern, s)
    if match:
        return match.group()
    return None    

def resolve_host(host, nserver):
    print "resolving host: " + host + " (using nserver: " + nserver + ")"
    dns_pkt = IP(dst=nserver)/UDP()/DNS(rd=1, qd=DNSQR(qname=host))
    ans = sr1(dns_pkt)
    if ans:
        print "IP(s) for %s:" % (host)
        dnsrr_strings = repr(ans[DNSRR]).split("|")
        for dnsrr in dnsrr_strings :
            ip_addr = get_ip_addr(dnsrr)
            if ip_addr:
                print " %s"  % ip_addr
    else:
        sys.stderr.write("unable to lookup " + host)

Answer 1

如果我们使用 scapy 发送 dns 请求，我们可以得到 dns 响应，如下所示：

>>> dns.show()
###[ DNS ]###
id= 43223
qr= 1L
opcode= QUERY
aa= 0L
tc= 0L
rd= 1L
ra= 1L
z= 0L
rcode= ok
qdcount= 1
ancount= 3
nscount= 0
arcount= 0
\qd\
 |###[ DNS Question Record ]###
 |  qname= 'search.yahoo.com.'
 |  qtype= A
 |  qclass= IN
\an\
 |###[ DNS Resource Record ]###
 |  rrname= 'search.yahoo.com.'
 |  type= CNAME
 |  rclass= IN
 |  ttl= 5
 |  rdlen= 39
 |  rdata= 'ds-global.l7.search.ystg1.b.yahoo.com.'
 |###[ DNS Resource Record ]###
 |  rrname= 'ds-global.l7.search.ystg1.b.yahoo.com.'
 |  type= CNAME
 |  rclass= IN
 |  ttl= 96
 |  rdlen= 43
 |  rdata= 'ds-any-global.l7.search.ysta1.b.yahoo.com.'
 |###[ DNS Resource Record ]###
 |  rrname= 'ds-any-global.l7.search.ysta1.b.yahoo.com.'
 |  type= A
 |  rclass= IN
 |  ttl= 94
 |  rdlen= 4
 |  rdata= '188.125.66.104'
ns= None
ar= None

qdcount - 查询 dns 计数，
ancount - dns 答案计数，

dns.an[0]是第一个 DNSRR，
dns.an[1]是第二个 DNSRR，
...

我们可以用ancount解析 DNSRR ，这是我的演示代码：

#!/usr/bin/env python
# -*- coding: utf8 -*-

from scapy.all import *


# disable verbose mode
conf.verb = 0


def parse_dnspkt(pkt):
    """ parse dns request / response packet """
    if pkt and pkt.haslayer('UDP') and pkt.haslayer('DNS'):
        ip = pkt['IP']
        udp = pkt['UDP']
        dns = pkt['DNS']

        # dns query packet
        if int(udp.dport) == 53:
            qname = dns.qd.qname

            print "\n[*] request: %s:%d -> %s:%d : %s" % (
                ip.src, udp.sport,
                ip.dst, udp.dport,
                qname)

        # dns reply packet
        elif int(udp.sport) == 53:
            # dns DNSRR count (answer count)
            for i in range(dns.ancount):
                dnsrr = dns.an[i]
                print "[*] response: %s:%s <- %s:%d : %s - %s" % (
                    ip.dst, udp.dport,
                    ip.src, udp.sport,
                    dnsrr.rrname, dnsrr.rdata)


def sniffer():
    sniff(filter="udp port 53", prn=parse_dnspkt)


if __name__ == "__main__":
    sniffer()

在 shell 中执行nslookup search.yahoo.com和nslookup stackoverflow.com 。

root:scapy/ #  python scapy-dns_sniff.py
WARNING: No route found for IPv6 destination :: (no default route?)

[*] request: 192.168.1.108:59199 -> 192.168.1.1:53 : search.yahoo.com.
[*] response: 192.168.1.108:59199 <- 192.168.1.1:53 : search.yahoo.com. - ds-global.l7.search.ystg1.b.yahoo.com.
[*] response: 192.168.1.108:59199 <- 192.168.1.1:53 : ds-global.l7.search.ystg1.b.yahoo.com. - ds-any-global.l7.search.ysta1.b.yahoo.com.
[*] response: 192.168.1.108:59199 <- 192.168.1.1:53 : ds-any-global.l7.search.ysta1.b.yahoo.com. - 188.125.66.104

[*] request: 192.168.1.108:55391 -> 192.168.1.1:53 : stackoverflow.com.
[*] response: 192.168.1.108:55391 <- 192.168.1.1:53 : stackoverflow.com. - 198.252.206.16