dns_monitor/section.cpp at main · Eteriss/dns_monitor · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
/**
 * @file section.cpp
 * @brief Implementation file for the Section class.
 * @author Adam Pastierik
 * login: xpasti00
 */

#include <arpa/inet.h>
#include "section.hpp"

Section::Section(const u_char *startOfSection, const u_char *headerPtr, bool isQuestion)
{
    currentPtr = startOfSection;
    domain = parse_domain(currentPtr, headerPtr);

    type = ntohs(*(uint16_t *)currentPtr);
    currentPtr += 2;

    dnsClass = ntohs(*(uint16_t *)currentPtr);
    currentPtr += 2;

    if (!isQuestion)
    {
        ttl = ntohl(*(uint32_t *)currentPtr);
        currentPtr += 4;

        dataLen = ntohs(*(uint16_t *)currentPtr);
        currentPtr += 2;
    }
}

std::string Section::parse_domain(const u_char *dnsPacket, const u_char *headerPtr)
{
    std::string domainName;
    int length = get_domain_length(dnsPacket);
    const u_char *currentPtr = dnsPacket;

    while (*currentPtr != 0)
    {
        // check if the domain name is compressed
        if ((*currentPtr & 0xC0) == 0xC0)
        {
            int offset = ((*currentPtr & 0x3F) << 8); // get first number after C in the pointer
            currentPtr += 1;
            offset |= *currentPtr;           // add the next byte to the offset
            currentPtr = headerPtr + offset; // move the pointer to the offset
        }
        else
        {
            int labelLength = *currentPtr;
            currentPtr += 1;
            domainName.append((const char *)(currentPtr), labelLength);
            currentPtr += labelLength;
            domainName.append(".");
        }
    }

    Section::currentPtr += length;
    return domainName;
}

int Section::get_domain_length(const u_char *dnsPacket)
{
    const u_char *currentPtr = dnsPacket;
    int labelLen;
    int len = 0;

    while (*currentPtr != 0)
    {
        // check if the domain name is compressed
        if ((*currentPtr & 0xC0) == 0xC0)
            return len + 2;

        labelLen = *currentPtr;
        len += labelLen + 1;
        currentPtr += labelLen + 1;
    }

    return len + 1;
}