Zeek 脚本“错误字段缺失值”

Question

我正在尝试编写一个 Zeek 脚本来将 dns 流量分成两个日志文件（查询和回复） 错误是 dns_query_reply 事件中代码 $TTL=c$dns$TTLs 的“字段缺失值”。 我不明白此错误的原因，因为 dns.log 文件正确包含该值。

代码如下：

 module DnsFeatureExtractor;

export{

    redef enum Log::ID += {QueryDNS};
    redef enum Log::ID += {ReplyDNS};


    type InfoQuery: record{
        uid:                string              &log;
        id:                 conn_id             &log;
        domain:             string              &log    &optional;
        query_type:         string              &log    &optional;
        timestamp:          time                &log;
    };


    type InfoReply: record{
        uid:                string              &log;
        id:                 conn_id             &log;
        response_code:      count               &log    &optional;
        TTL:                vector of interval  &log    &optional;
        resolved_IP:        vector of string    &log    &optional;
        timestamp:          time                &log;
    };  
}

event zeek_init(){

    Log::create_stream(QueryDNS, [$columns=InfoQuery, $path="QueryDNS"]);
    Log::create_stream(ReplyDNS, [$columns=InfoReply, $path="ReplyDNS"]);
}

event dns_request(c: connection, msg: dns_msg, query: string, qtype: count, qclass: count){

    local name_qtype = DNS::query_types[qtype];

    local rec: DnsFeatureExtractor::InfoQuery = [$uid=c$uid, $id=c$id, $domain=query, $query_type=name_qtype, $timestamp=c$start_time];
    Log::write(DnsFeatureExtractor::QueryDNS, rec);
}

event dns_query_reply(c: connection, msg: dns_msg, query: string, qtype: count, qclass: count){

    local rec_r: DnsFeatureExtractor::InfoReply = [$uid=c$uid, $id=c$id, $response_code=msg$rcode, $TTL=c$dns$TTLs, $resolved_IP=c$dns$answers, $timestamp=c$start_time];
    Log::write(DnsFeatureExtractor::ReplyDNS, rec_r);
}

Answer 1

这个很微妙：你看到了一个排序问题。 dns_query_reply 事件处理程序在实际填充 TTL 的事件（例如 dns_A_reply）之前调用。

有问题的c$dns 字段填充在DNS::do_reply hook 中，因此最好的办法是确保添加到钩子中。如果您使用默认优先级，它将在填充字段的优先级之后运行。试试这个而不是 dns_query_reply 处理程序：

hook DNS::do_reply(c: connection, msg: dns_msg, ans: dns_answer, reply: string) {
    local rec_r: DnsFeatureExtractor::InfoReply = [$uid=c$uid, $id=c$id, $response_code=msg$rcode, $TTL=c$dns$TTLs, $resolved_IP=c$dns$answers, $timestamp=c$start_time];
    Log::write(DnsFeatureExtractor::ReplyDNS, rec_r);
}

请注意，您仍在处理可选的记录值，因此尽管有上述情况，您仍然可能看不到所有字段值。为了防止这种情况，您可以检查是否实际定义了可选值，并仅在这种情况下复制它们：

hook DNS::do_reply(c: connection, msg: dns_msg, ans: dns_answer, reply: string)
{
    local rec_r: DnsFeatureExtractor::InfoReply = [$uid=c$uid, $id=c$id, $response_code=msg$rcode, $timestamp=c$start_time];

    if ( c$dns?$TTLs )
        rec_r$TTL = c$dns$TTLs;
    if ( c$dns?$answers )
        rec_r$resolved_IP = c$dns$answers;

    Log::write(DnsFeatureExtractor::ReplyDNS, rec_r);
}