search

kapetan / dns

A DNS library written in C#
MIT License
418 stars 127 forks source link

Parsing exception for UDP DNS Packet #60

Open secana opened 5 years ago

secana commented 5 years ago

Hi, very nice project!

I ran into the following behavior:

Request.FromArray(udpPacket.PayloadData) throws an exception for the following payload

[0]: 0x71
    [1]: 0x2e
    [2]: 0x28
    [3]: 0x00
    [4]: 0x00
    [5]: 0x01
    [6]: 0x00
    [7]: 0x01
    [8]: 0x00
    [9]: 0x03
    [10]: 0x00
    [11]: 0x00
    [12]: 0x05
    [13]: 0x67
    [14]: 0x64
    [15]: 0x61
    [16]: 0x74
    [17]: 0x61
    [18]: 0x02
    [19]: 0x64
    [20]: 0x65
    [21]: 0x00
    [22]: 0x00
    [23]: 0x06
    [24]: 0x00
    [25]: 0x01
    [26]: 0x0a
    [27]: 0x49
    [28]: 0x44
    [29]: 0x2d
    [30]: 0x43
    [31]: 0x48
    [32]: 0x2d
    [33]: 0x30
    [34]: 0x33
    [35]: 0x30
    [36]: 0x34
    [37]: 0x05
    [38]: 0x67
    [39]: 0x64
    [40]: 0x61
    [41]: 0x74
    [42]: 0x61
    [43]: 0x02
    [44]: 0x64
    [45]: 0x65
    [46]: 0x00
    [47]: 0x00
    [48]: 0x05
    [49]: 0x00
    [50]: 0xfe
    [51]: 0x00
    [52]: 0x00
    [53]: 0x00
    [54]: 0x00
    [55]: 0x00
    [56]: 0x00
    [57]: 0xc0
    [58]: 0x1a
    [59]: 0x00
    [60]: 0x1c
    [61]: 0x00
    [62]: 0xff
    [63]: 0x00
    [64]: 0x00
    [65]: 0x00
    [66]: 0x00
    [67]: 0x00
    [68]: 0x00
    [69]: 0xc0
    [70]: 0x1a
    [71]: 0x00
    [72]: 0x01
    [73]: 0x00
    [74]: 0xff
    [75]: 0x00
    [76]: 0x00
    [77]: 0x00
    [78]: 0x00
    [79]: 0x00
    [80]: 0x00
    [81]: 0xc0
    [82]: 0x1a
    [83]: 0x00
    [84]: 0x01
    [85]: 0x00
    [86]: 0x01
    [87]: 0x00
    [88]: 0x00
    [89]: 0x04
    [90]: 0xb0
    [91]: 0x00
    [92]: 0x04
    [93]: 0x0a
    [94]: 0x32
    [95]: 0x04
    [96]: 0x1f

The UDPPacket itself has the following information attached:

{[UDPPacket: SourcePort=51027, DestinationPort=53]}
    Bytes: {byte[0x00000069]}
    BytesHighPerformance: {[ByteArraySegment: Length=105, Bytes.Length=139, BytesLength=139, Offset=34, NeedsCopyForActualBytes=True]}
    Checksum: 0x1939
    Color: "\u001b[1;32m"
    DestinationPort: 0x0035
    Header: {[ByteArraySegment: Length=8, Bytes.Length=139, BytesLength=139, Offset=34, NeedsCopyForActualBytes=True]}
    HeaderData: {byte[0x00000008]}
    Length: 0x00000069
    ParentPacket: {[IPv4Packet: SourceAddress=10.50.4.31, DestinationAddress=10.10.0.100, HeaderLength=5, Protocol=UDP, TimeToLive=128][UDPPacket: SourcePort=51027, DestinationPort=53]}
    PayloadData: {byte[0x00000061]}
    PayloadPacket: null
    PayloadPacketOrData: ThreadSafetyMode=null, IsValueCreated=true, IsValueFaulted=false, Value={PacketDotNet.PacketOrByteArraySegment}
    SharesMemoryWithSubPackets: true
    SourcePort: 0xc753
    TotalPacketLength: 0x00000069
    ValidChecksum: false
    ValidUDPChecksum: false

I'm not sure if the payload is really just invalid and I have to "try-catch" that, or that the parser runs into an error for a valid UDP DNS packet.

Regards secana

kapetan commented 4 years ago

This seems to be a DNS update packet, RFC2136. There a some differences in the packet structure which are not supported at the moment.

The parsed payload:

{
  Header={
    Id=28974, 
    QuestionCount=1, 
    AnswerRecordCount=1, 
    AuthorityRecordCount=3, 
    AdditionalRecordCount=0, 
    Response=False, 
    OperationCode=Update, 
    AuthorativeServer=False, 
    Truncated=False, 
    RecursionDesired=False, 
    RecursionAvailable=False, 
    AuthenticData=False, 
    CheckingDisabled=False, 
    ResponseCode=NoError
  }, 
  Questions=[
    {
      Name=gdata.de, 
      Type=SOA, 
      Class=IN
    }
  ], 
  AnswerRecords=[
    {
      Name=ID-CH-0304.gdata.de, 
      Type=CNAME, 
      Class=254, 
      TimeToLive=00:00:00, 
      DataLength=0
    }
  ], 
  AuthorityRecords=[
    {
      Name=ID-CH-0304.gdata.de, 
      Type=AAAA, 
      Class=ANY, 
      TimeToLive=00:00:00, 
      DataLength=0
    }, 
    {
      Name=ID-CH-0304.gdata.de, 
      Type=A, 
      Class=ANY, 
      TimeToLive=00:00:00, 
      DataLength=0
    }, 
    {
      Name=ID-CH-0304.gdata.de, 
      Type=A, 
      Class=IN, 
      TimeToLive=00:20:00, 
      DataLength=4
    }
  ], 
  AdditionalRecords=[]
}

The raw packet:

0x71 0x2e 0x28 0x00 0x00 0x01 0x00 0x01
0x00 0x03 0x00 0x00 0x05 0x67 0x64 0x61
0x74 0x61 0x02 0x64 0x65 0x00 0x00 0x06
0x00 0x01 0x0a 0x49 0x44 0x2d 0x43 0x48
0x2d 0x30 0x33 0x30 0x34 0x05 0x67 0x64
0x61 0x74 0x61 0x02 0x64 0x65 0x00 0x00
0x05 0x00 0xfe 0x00 0x00 0x00 0x00 0x00
0x00 0xc0 0x1a 0x00 0x1c 0x00 0xff 0x00
0x00 0x00 0x00 0x00 0x00 0xc0 0x1a 0x00
0x01 0x00 0xff 0x00 0x00 0x00 0x00 0x00
0x00 0xc0 0x1a 0x00 0x01 0x00 0x01 0x00
0x00 0x04 0xb0 0x00 0x04 0x0a 0x32 0x04
0x1f