| 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051 |
- "badpacket" is a tool intended to test that a nameserver can cope with
- incorrectly-formatted DNS messages.
- This particular incarnation of the tool allows the flags field of a DNS message
- (the third and fourth bytes) to be set to any bit combination (including ones
- that invalid in a query). As well as setting the bits to a particular
- combination, it is possible to specify ranges for bit/field values; when this
- is done, the tool will send a set of packets so that each combination of flag
- bits is checked.
- To illustrate this, consider the following command:
- badpacket --address 192.0.2.21 --port 5301 --aa 0-1 --cd 1
- --rc 0-2 ftp.example.com
- (The command has been split across two lines for clarity.)
- The address and port flags are self-evident. The other flags specify settings
- for the AA bit (0 and 1), CD bit (always 1) and the RCODE field (0, 1, 2). (The
- remaining fields are not specified, so will always be zero.) There are six
- combinations of these values, so six packets will sent to the remote server with
- the following settings:
- AA RCODE CD Rest
- 0 0 1 0
- 0 1 1 0
- 0 2 1 0
- 1 0 1 0
- 1 1 1 0
- 1 2 1 0
- Each packet will cause a line to be output to stdout, which will have the
- following form:
- SUCCESS: (QR:0 OP:0 AA:0 TC:0 RD:0 RA:0 Z:0 AD:0 CD:1 RC:0)
- (qr:1 op:0 aa:0 tc:0 rd:0 ra:1 z:0 ad:0 cd:1 rc:0)
- (Again the text has been split across two lines for clarity.)
- Each lines contains a status (SUCCESS indicates that a response was received,
- regardless of the contents of the response), the state of the fields in the
- flags word of the packet sent (in upper-case letters) and the state of the
- fields in the flags word of the response (in lower-case letters).
- TODO: At the moment the tool is limited to just alerting the flags field.
- Future work should extend the program to other bad packets. Ideas are:
- * Flasify the values in the various count fields
- * Add data to sections that should be empty.
- * Deliberately mangle the names placed in the message sections (e.g. by altering
- the label count fields).
|
