dns-logging-tcp.irule

# Author: Juergen Mang <juergen.mang@axians.de>
# Date: 2023-07-12
#
# DNS Request and response logging
# Uses the procs from the dns_parser iRule
# Disable local logging for production use!
#
# -------------------------------------------------------------------------
# See the file "LICENSE.md" for information on usage and redistribution
# of this file, and for a DISCLAIMER OF ALL WARRANTIES.
# -------------------------------------------------------------------------

# Request logging
when CLIENT_ACCEPTED priority 500 {
    TCP::collect
    set hsl [HSL::open -publisher $static::dns_log_target]
    set req_first_packet 1
}

when CLIENT_DATA priority 500 {
    if { $req_first_packet == 1 } {
        set req_log_prefix "client_ip=\"[IP::client_addr]\" target_ip=\"0.0.0.0\" v_server=\"[virtual]\""
        set req_first_packet 0
        # Read size of the DNS request and chop off the tcp length prefix
        if { [catch {
            binary scan [TCP::payload] S req_size
            if { $req_size > $static::dns_log_max_tcp_request_size } {
                # Do not process too large requests
                #HSL::send $hsl "$req_log_prefix error=\"Request is too large: $req_size\""
                #log local0. "$req_log_prefix error=\"Request is too large: $req_size\""
                set req_size -1
            }
        }] } {
            HSL::send $hsl "$req_log_prefix error=\"Could not read size of dns question: [subst \$::errorInfo]\""
            #log local0. "$req_log_prefix error=\"Could not read size of dns question: [subst \$::errorInfo]\""
            set req_size -1
            TCP::release
            return
        }
        set req_data [string range [TCP::payload] 2 end]
    } else {
        if { $req_size == -1 } {
            # Ignore packets if we do not know the request size or request is too big
            #log local0. "$req_log_prefix error=\"Ignoring dns packet\""
            TCP::release
            return
        }
        # Reassemble packets
        append req_data [TCP::payload]
    }
    
    if { $req_size > 0 and [string length $req_data] >= $req_size } {
        # Got full DNS request, parse it
        if { [catch {
            set req_log [call dns_parser::ReadQuestionPacket $req_data]
        }] } {
            set req_log "error=\"Could not parse DNS question: [subst \$::errorInfo]\""
        }
        HSL::send $hsl "$req_log_prefix $req_log"
        #log local0. "$req_log_prefix $req_log"
        # Reset state
        unset -nocomplain -- req_log req_data req_size
        set req_first_packet 1
    }
    # Start collecting again
    # There can be more than one dns query over a single tcp connection
    TCP::release
    TCP::collect
}

# Response logging
when SERVER_CONNECTED priority 500 {
    TCP::collect
    set resp_first_packet 1
}

when SERVER_DATA priority 500 {
    if { $resp_first_packet == 1 } {
        set resp_first_packet 0
        set resp_log_prefix "client_ip=\"[IP::client_addr]\" target_ip=\"[IP::server_addr]\" v_server=\"[virtual]\""
        # Read size of the DNS response and chop off the tcp length prefix
        if { [catch {
            binary scan [TCP::payload] S resp_size
            if { $resp_size > $static::dns_log_max_tcp_response_size } {
                # Do not process too large responses
                #HSL::send $hsl "$resp_log_prefix error=\"Response is too large: $resp_size\""
                #log local0. "$resp_log_prefix error=\"Response is too large: $resp_size\""
                set resp_size -1    
            }
        }] } {
            HSL::send $hsl "$resp_log_prefix error=\"Could not read size of dns answer: [subst \$::errorInfo]\""
            #log local0. "$resp_log_prefix error=\"Could not read size of dns answer: [subst \$::errorInfo]\""
            set resp_size -1
            TCP::release
            return
        }
        set resp_data [string range [TCP::payload] 2 end]
    } else {
        if { $resp_size == -1 } {
            # Ignore packets if we do not know the response size or response is too large
            #log local0. "$resp_log_prefix error=\"Ignoring dns packet\""
            TCP::release
            return
        }
        # Reassemble packets
        append resp_data [TCP::payload]
    }

    if { $resp_size > 0 and [string length $resp_data] >= $resp_size } {
        # Got full DNS response, parse it
        if { [catch {
            set resp_log [call dns_parser::ReadAnswerPacket $resp_data]
        }] } {
            set resp_log ""
            lappend resp_log "$resp_log_prefix error=\"Could not parse DNS answer: [subst \$::errorInfo]\""
        }
        foreach line $resp_log {
            HSL::send $hsl "$resp_log_prefix $line"
            #log local0. "$resp_log_prefix $line"
        }
        # Reset state
        unset -nocomplain -- line resp_log resp_data resp_size
        set resp_first_packet 1
    }
    # Start collecting again
    # There can be more than one dns response over a single tcp connection
    TCP::release
    TCP::collect
}