Skip to content

Commit

Permalink
feature(dnscache): add alt tree implementation
Browse files Browse the repository at this point in the history
Add an alternative implementation for the dns cache using an indexed
tree to organize DNS answers.

After review either this or the original implementatiom will be
discarded.

A test is given to demo the implementation with logs.
  • Loading branch information
NDStrahilevitz committed Nov 20, 2023
1 parent cd797f5 commit 77dd275
Show file tree
Hide file tree
Showing 4 changed files with 287 additions and 0 deletions.
8 changes: 8 additions & 0 deletions pkg/dnscache/events
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
{"timestamp":3399319014234770100,"threadStartTime":3399319006836545726,"processorId":4,"processId":2546510,"cgroupId":145296,"threadId":2546511,"parentProcessId":2546328,"hostProcessId":2546510,"hostThreadId":2546511,"hostParentProcessId":2546328,"userId":1000,"mountNamespace":4026531841,"pidNamespace":4026531836,"processName":"isc-net-0000","executable":{"path":""},"hostName":"ip-172-31-75-17","containerId":"","container":{},"kubernetes":{},"eventId":"2006","eventName":"net_packet_dns","matchedPolicies":[""],"argsNum":5,"returnValue":0,"syscall":"sendmmsg","stackAddresses":[0],"contextFlags":{"containerStarted":false,"isCompat":false},"threadEntityId":458119841,"processEntityId":1413552547,"parentEntityId":3216664721,"args":[{"name":"src","type":"const char*","value":"127.0.0.1"},{"name":"dst","type":"const char*","value":"127.0.0.53"},{"name":"src_port","type":"u16","value":56900},{"name":"dst_port","type":"u16","value":53},{"name":"proto_dns","type":"trace.ProtoDNS","value":{"ID":20274,"QR":0,"opCode":"query","AA":0,"TC":0,"RD":1,"RA":0,"Z":0,"responseCode":"no error","QDCount":1,"ANCount":0,"NSCount":0,"ARCount":0,"questions":[{"name":"uol.com","type":"CNAME","class":"IN"}],"answers":[],"authorities":[],"additionals":[]}}]}
{"timestamp":3399319014363298501,"threadStartTime":3399319006836545726,"processorId":1,"processId":2546510,"cgroupId":145296,"threadId":2546511,"parentProcessId":2546328,"hostProcessId":2546510,"hostThreadId":2546511,"hostParentProcessId":2546328,"userId":1000,"mountNamespace":4026531841,"pidNamespace":4026531836,"processName":"isc-net-0000","executable":{"path":""},"hostName":"ip-172-31-75-17","containerId":"","container":{},"kubernetes":{},"eventId":"2006","eventName":"net_packet_dns","matchedPolicies":[""],"argsNum":5,"returnValue":0,"syscall":"","stackAddresses":[0],"contextFlags":{"containerStarted":false,"isCompat":false},"threadEntityId":458119841,"processEntityId":1413552547,"parentEntityId":3216664721,"args":[{"name":"src","type":"const char*","value":"127.0.0.53"},{"name":"dst","type":"const char*","value":"127.0.0.1"},{"name":"src_port","type":"u16","value":53},{"name":"dst_port","type":"u16","value":56900},{"name":"proto_dns","type":"trace.ProtoDNS","value":{"ID":20274,"QR":1,"opCode":"query","AA":0,"TC":0,"RD":1,"RA":1,"Z":0,"responseCode":"no error","QDCount":1,"ANCount":1,"NSCount":0,"ARCount":0,"questions":[{"name":"uol.com","type":"CNAME","class":"IN"}],"answers":[{"name":"uol.com","type":"CNAME","class":"IN","TTL":3600,"IP":"","NS":"","CNAME":"d3so3xb2gvtwlo.cloudfront.net","PTR":"","TXTs":[],"SOA":{"MName":"","RName":"","serial":0,"refresh":0,"retry":0,"expire":0,"minimum":0},"SRV":{"priority":0,"weight":0,"port":0,"name":""},"MX":{"preference":0,"name":""},"OPT":[],"URI":{"priority":0,"weight":0,"target":""},"TXT":""}],"authorities":[],"additionals":[]}}]}
{"timestamp":3399319021297982617,"threadStartTime":3399319006836545726,"processorId":5,"processId":2546510,"cgroupId":145296,"threadId":2546511,"parentProcessId":2546328,"hostProcessId":2546510,"hostThreadId":2546511,"hostParentProcessId":2546328,"userId":1000,"mountNamespace":4026531841,"pidNamespace":4026531836,"processName":"isc-net-0000","executable":{"path":""},"hostName":"ip-172-31-75-17","containerId":"","container":{},"kubernetes":{},"eventId":"2006","eventName":"net_packet_dns","matchedPolicies":[""],"argsNum":5,"returnValue":0,"syscall":"sendmmsg","stackAddresses":[0],"contextFlags":{"containerStarted":false,"isCompat":false},"threadEntityId":458119841,"processEntityId":1413552547,"parentEntityId":3216664721,"args":[{"name":"src","type":"const char*","value":"127.0.0.1"},{"name":"dst","type":"const char*","value":"127.0.0.53"},{"name":"src_port","type":"u16","value":57585},{"name":"dst_port","type":"u16","value":53},{"name":"proto_dns","type":"trace.ProtoDNS","value":{"ID":1707,"QR":0,"opCode":"query","AA":0,"TC":0,"RD":1,"RA":0,"Z":0,"responseCode":"no error","QDCount":1,"ANCount":0,"NSCount":0,"ARCount":0,"questions":[{"name":"d3so3xb2gvtwlo.cloudfront.net","type":"A","class":"IN"}],"answers":[],"authorities":[],"additionals":[]}}]}
{"timestamp":3399319021303322761,"threadStartTime":3399319006836545726,"processorId":1,"processId":2546510,"cgroupId":145296,"threadId":2546511,"parentProcessId":2546328,"hostProcessId":2546510,"hostThreadId":2546511,"hostParentProcessId":2546328,"userId":1000,"mountNamespace":4026531841,"pidNamespace":4026531836,"processName":"isc-net-0000","executable":{"path":""},"hostName":"ip-172-31-75-17","containerId":"","container":{},"kubernetes":{},"eventId":"2006","eventName":"net_packet_dns","matchedPolicies":[""],"argsNum":5,"returnValue":0,"syscall":"","stackAddresses":[0],"contextFlags":{"containerStarted":false,"isCompat":false},"threadEntityId":458119841,"processEntityId":1413552547,"parentEntityId":3216664721,"args":[{"name":"src","type":"const char*","value":"127.0.0.53"},{"name":"dst","type":"const char*","value":"127.0.0.1"},{"name":"src_port","type":"u16","value":53},{"name":"dst_port","type":"u16","value":57585},{"name":"proto_dns","type":"trace.ProtoDNS","value":{"ID":1707,"QR":1,"opCode":"query","AA":0,"TC":0,"RD":1,"RA":1,"Z":0,"responseCode":"no error","QDCount":1,"ANCount":4,"NSCount":0,"ARCount":0,"questions":[{"name":"d3so3xb2gvtwlo.cloudfront.net","type":"A","class":"IN"}],"answers":[{"name":"d3so3xb2gvtwlo.cloudfront.net","type":"A","class":"IN","TTL":60,"IP":"18.160.41.95","NS":"","CNAME":"","PTR":"","TXTs":[],"SOA":{"MName":"","RName":"","serial":0,"refresh":0,"retry":0,"expire":0,"minimum":0},"SRV":{"priority":0,"weight":0,"port":0,"name":""},"MX":{"preference":0,"name":""},"OPT":[],"URI":{"priority":0,"weight":0,"target":""},"TXT":""},{"name":"d3so3xb2gvtwlo.cloudfront.net","type":"A","class":"IN","TTL":60,"IP":"18.160.41.66","NS":"","CNAME":"","PTR":"","TXTs":[],"SOA":{"MName":"","RName":"","serial":0,"refresh":0,"retry":0,"expire":0,"minimum":0},"SRV":{"priority":0,"weight":0,"port":0,"name":""},"MX":{"preference":0,"name":""},"OPT":[],"URI":{"priority":0,"weight":0,"target":""},"TXT":""},{"name":"d3so3xb2gvtwlo.cloudfront.net","type":"A","class":"IN","TTL":60,"IP":"18.160.41.110","NS":"","CNAME":"","PTR":"","TXTs":[],"SOA":{"MName":"","RName":"","serial":0,"refresh":0,"retry":0,"expire":0,"minimum":0},"SRV":{"priority":0,"weight":0,"port":0,"name":""},"MX":{"preference":0,"name":""},"OPT":[],"URI":{"priority":0,"weight":0,"target":""},"TXT":""},{"name":"d3so3xb2gvtwlo.cloudfront.net","type":"A","class":"IN","TTL":60,"IP":"18.160.41.122","NS":"","CNAME":"","PTR":"","TXTs":[],"SOA":{"MName":"","RName":"","serial":0,"refresh":0,"retry":0,"expire":0,"minimum":0},"SRV":{"priority":0,"weight":0,"port":0,"name":""},"MX":{"preference":0,"name":""},"OPT":[],"URI":{"priority":0,"weight":0,"target":""},"TXT":""}],"authorities":[],"additionals":[]}}]}
{"timestamp":3399319024978841794,"threadStartTime":3399319006836545726,"processorId":3,"processId":2546510,"cgroupId":145296,"threadId":2546511,"parentProcessId":2546328,"hostProcessId":2546510,"hostThreadId":2546511,"hostParentProcessId":2546328,"userId":1000,"mountNamespace":4026531841,"pidNamespace":4026531836,"processName":"isc-net-0000","executable":{"path":""},"hostName":"ip-172-31-75-17","containerId":"","container":{},"kubernetes":{},"eventId":"2006","eventName":"net_packet_dns","matchedPolicies":[""],"argsNum":5,"returnValue":0,"syscall":"sendmmsg","stackAddresses":[0],"contextFlags":{"containerStarted":false,"isCompat":false},"threadEntityId":458119841,"processEntityId":1413552547,"parentEntityId":3216664721,"args":[{"name":"src","type":"const char*","value":"127.0.0.1"},{"name":"dst","type":"const char*","value":"127.0.0.53"},{"name":"src_port","type":"u16","value":60698},{"name":"dst_port","type":"u16","value":53},{"name":"proto_dns","type":"trace.ProtoDNS","value":{"ID":27028,"QR":0,"opCode":"query","AA":0,"TC":0,"RD":1,"RA":0,"Z":0,"responseCode":"no error","QDCount":1,"ANCount":0,"NSCount":0,"ARCount":0,"questions":[{"name":"d3so3xb2gvtwlo.cloudfront.net","type":"AAAA","class":"IN"}],"answers":[],"authorities":[],"additionals":[]}}]}
{"timestamp":3399319024983948654,"threadStartTime":3399319006836545726,"processorId":4,"processId":2546510,"cgroupId":145296,"threadId":2546511,"parentProcessId":2546328,"hostProcessId":2546510,"hostThreadId":2546511,"hostParentProcessId":2546328,"userId":1000,"mountNamespace":4026531841,"pidNamespace":4026531836,"processName":"isc-net-0000","executable":{"path":""},"hostName":"ip-172-31-75-17","containerId":"","container":{},"kubernetes":{},"eventId":"2006","eventName":"net_packet_dns","matchedPolicies":[""],"argsNum":5,"returnValue":0,"syscall":"","stackAddresses":[0],"contextFlags":{"containerStarted":false,"isCompat":false},"threadEntityId":458119841,"processEntityId":1413552547,"parentEntityId":3216664721,"args":[{"name":"src","type":"const char*","value":"127.0.0.53"},{"name":"dst","type":"const char*","value":"127.0.0.1"},{"name":"src_port","type":"u16","value":53},{"name":"dst_port","type":"u16","value":60698},{"name":"proto_dns","type":"trace.ProtoDNS","value":{"ID":27028,"QR":1,"opCode":"query","AA":0,"TC":0,"RD":1,"RA":1,"Z":0,"responseCode":"no error","QDCount":1,"ANCount":8,"NSCount":0,"ARCount":0,"questions":[{"name":"d3so3xb2gvtwlo.cloudfront.net","type":"AAAA","class":"IN"}],"answers":[{"name":"d3so3xb2gvtwlo.cloudfront.net","type":"AAAA","class":"IN","TTL":60,"IP":"2600:9000:24f2:fa00:b:8c7a:5300:93a1","NS":"","CNAME":"","PTR":"","TXTs":[],"SOA":{"MName":"","RName":"","serial":0,"refresh":0,"retry":0,"expire":0,"minimum":0},"SRV":{"priority":0,"weight":0,"port":0,"name":""},"MX":{"preference":0,"name":""},"OPT":[],"URI":{"priority":0,"weight":0,"target":""},"TXT":""},{"name":"d3so3xb2gvtwlo.cloudfront.net","type":"AAAA","class":"IN","TTL":60,"IP":"2600:9000:24f2:3c00:b:8c7a:5300:93a1","NS":"","CNAME":"","PTR":"","TXTs":[],"SOA":{"MName":"","RName":"","serial":0,"refresh":0,"retry":0,"expire":0,"minimum":0},"SRV":{"priority":0,"weight":0,"port":0,"name":""},"MX":{"preference":0,"name":""},"OPT":[],"URI":{"priority":0,"weight":0,"target":""},"TXT":""},{"name":"d3so3xb2gvtwlo.cloudfront.net","type":"AAAA","class":"IN","TTL":60,"IP":"2600:9000:24f2:6200:b:8c7a:5300:93a1","NS":"","CNAME":"","PTR":"","TXTs":[],"SOA":{"MName":"","RName":"","serial":0,"refresh":0,"retry":0,"expire":0,"minimum":0},"SRV":{"priority":0,"weight":0,"port":0,"name":""},"MX":{"preference":0,"name":""},"OPT":[],"URI":{"priority":0,"weight":0,"target":""},"TXT":""},{"name":"d3so3xb2gvtwlo.cloudfront.net","type":"AAAA","class":"IN","TTL":60,"IP":"2600:9000:24f2:a200:b:8c7a:5300:93a1","NS":"","CNAME":"","PTR":"","TXTs":[],"SOA":{"MName":"","RName":"","serial":0,"refresh":0,"retry":0,"expire":0,"minimum":0},"SRV":{"priority":0,"weight":0,"port":0,"name":""},"MX":{"preference":0,"name":""},"OPT":[],"URI":{"priority":0,"weight":0,"target":""},"TXT":""},{"name":"d3so3xb2gvtwlo.cloudfront.net","type":"AAAA","class":"IN","TTL":60,"IP":"2600:9000:24f2:9800:b:8c7a:5300:93a1","NS":"","CNAME":"","PTR":"","TXTs":[],"SOA":{"MName":"","RName":"","serial":0,"refresh":0,"retry":0,"expire":0,"minimum":0},"SRV":{"priority":0,"weight":0,"port":0,"name":""},"MX":{"preference":0,"name":""},"OPT":[],"URI":{"priority":0,"weight":0,"target":""},"TXT":""},{"name":"d3so3xb2gvtwlo.cloudfront.net","type":"AAAA","class":"IN","TTL":60,"IP":"2600:9000:24f2:4200:b:8c7a:5300:93a1","NS":"","CNAME":"","PTR":"","TXTs":[],"SOA":{"MName":"","RName":"","serial":0,"refresh":0,"retry":0,"expire":0,"minimum":0},"SRV":{"priority":0,"weight":0,"port":0,"name":""},"MX":{"preference":0,"name":""},"OPT":[],"URI":{"priority":0,"weight":0,"target":""},"TXT":""},{"name":"d3so3xb2gvtwlo.cloudfront.net","type":"AAAA","class":"IN","TTL":60,"IP":"2600:9000:24f2:3800:b:8c7a:5300:93a1","NS":"","CNAME":"","PTR":"","TXTs":[],"SOA":{"MName":"","RName":"","serial":0,"refresh":0,"retry":0,"expire":0,"minimum":0},"SRV":{"priority":0,"weight":0,"port":0,"name":""},"MX":{"preference":0,"name":""},"OPT":[],"URI":{"priority":0,"weight":0,"target":""},"TXT":""},{"name":"d3so3xb2gvtwlo.cloudfront.net","type":"AAAA","class":"IN","TTL":60,"IP":"2600:9000:24f2:e800:b:8c7a:5300:93a1","NS":"","CNAME":"","PTR":"","TXTs":[],"SOA":{"MName":"","RName":"","serial":0,"refresh":0,"retry":0,"expire":0,"minimum":0},"SRV":{"priority":0,"weight":0,"port":0,"name":""},"MX":{"preference":0,"name":""},"OPT":[],"URI":{"priority":0,"weight":0,"target":""},"TXT":""}],"authorities":[],"additionals":[]}}]}
{"timestamp":3399319035090102784,"threadStartTime":3399319006836545726,"processorId":5,"processId":2546510,"cgroupId":145296,"threadId":2546511,"parentProcessId":2546328,"hostProcessId":2546510,"hostThreadId":2546511,"hostParentProcessId":2546328,"userId":1000,"mountNamespace":4026531841,"pidNamespace":4026531836,"processName":"isc-net-0000","executable":{"path":""},"hostName":"ip-172-31-75-17","containerId":"","container":{},"kubernetes":{},"eventId":"2006","eventName":"net_packet_dns","matchedPolicies":[""],"argsNum":5,"returnValue":0,"syscall":"sendmmsg","stackAddresses":[0],"contextFlags":{"containerStarted":false,"isCompat":false},"threadEntityId":458119841,"processEntityId":1413552547,"parentEntityId":3216664721,"args":[{"name":"src","type":"const char*","value":"127.0.0.1"},{"name":"dst","type":"const char*","value":"127.0.0.53"},{"name":"src_port","type":"u16","value":45484},{"name":"dst_port","type":"u16","value":53},{"name":"proto_dns","type":"trace.ProtoDNS","value":{"ID":54587,"QR":0,"opCode":"query","AA":0,"TC":0,"RD":1,"RA":0,"Z":0,"responseCode":"no error","QDCount":1,"ANCount":0,"NSCount":0,"ARCount":0,"questions":[{"name":"google.com","type":"A","class":"IN"}],"answers":[],"authorities":[],"additionals":[]}}]}
{"timestamp":3399319035092776716,"threadStartTime":3399319006836545726,"processorId":6,"processId":2546510,"cgroupId":145296,"threadId":2546511,"parentProcessId":2546328,"hostProcessId":2546510,"hostThreadId":2546511,"hostParentProcessId":2546328,"userId":1000,"mountNamespace":4026531841,"pidNamespace":4026531836,"processName":"isc-net-0000","executable":{"path":""},"hostName":"ip-172-31-75-17","containerId":"","container":{},"kubernetes":{},"eventId":"2006","eventName":"net_packet_dns","matchedPolicies":[""],"argsNum":5,"returnValue":0,"syscall":"","stackAddresses":[0],"contextFlags":{"containerStarted":false,"isCompat":false},"threadEntityId":458119841,"processEntityId":1413552547,"parentEntityId":3216664721,"args":[{"name":"src","type":"const char*","value":"127.0.0.53"},{"name":"dst","type":"const char*","value":"127.0.0.1"},{"name":"src_port","type":"u16","value":53},{"name":"dst_port","type":"u16","value":45484},{"name":"proto_dns","type":"trace.ProtoDNS","value":{"ID":54587,"QR":1,"opCode":"query","AA":0,"TC":0,"RD":1,"RA":1,"Z":0,"responseCode":"no error","QDCount":1,"ANCount":6,"NSCount":0,"ARCount":0,"questions":[{"name":"google.com","type":"A","class":"IN"}],"answers":[{"name":"google.com","type":"A","class":"IN","TTL":111,"IP":"142.251.163.101","NS":"","CNAME":"","PTR":"","TXTs":[],"SOA":{"MName":"","RName":"","serial":0,"refresh":0,"retry":0,"expire":0,"minimum":0},"SRV":{"priority":0,"weight":0,"port":0,"name":""},"MX":{"preference":0,"name":""},"OPT":[],"URI":{"priority":0,"weight":0,"target":""},"TXT":""},{"name":"google.com","type":"A","class":"IN","TTL":111,"IP":"142.251.163.100","NS":"","CNAME":"","PTR":"","TXTs":[],"SOA":{"MName":"","RName":"","serial":0,"refresh":0,"retry":0,"expire":0,"minimum":0},"SRV":{"priority":0,"weight":0,"port":0,"name":""},"MX":{"preference":0,"name":""},"OPT":[],"URI":{"priority":0,"weight":0,"target":""},"TXT":""},{"name":"google.com","type":"A","class":"IN","TTL":111,"IP":"142.251.163.102","NS":"","CNAME":"","PTR":"","TXTs":[],"SOA":{"MName":"","RName":"","serial":0,"refresh":0,"retry":0,"expire":0,"minimum":0},"SRV":{"priority":0,"weight":0,"port":0,"name":""},"MX":{"preference":0,"name":""},"OPT":[],"URI":{"priority":0,"weight":0,"target":""},"TXT":""},{"name":"google.com","type":"A","class":"IN","TTL":111,"IP":"142.251.163.113","NS":"","CNAME":"","PTR":"","TXTs":[],"SOA":{"MName":"","RName":"","serial":0,"refresh":0,"retry":0,"expire":0,"minimum":0},"SRV":{"priority":0,"weight":0,"port":0,"name":""},"MX":{"preference":0,"name":""},"OPT":[],"URI":{"priority":0,"weight":0,"target":""},"TXT":""},{"name":"google.com","type":"A","class":"IN","TTL":111,"IP":"142.251.163.138","NS":"","CNAME":"","PTR":"","TXTs":[],"SOA":{"MName":"","RName":"","serial":0,"refresh":0,"retry":0,"expire":0,"minimum":0},"SRV":{"priority":0,"weight":0,"port":0,"name":""},"MX":{"preference":0,"name":""},"OPT":[],"URI":{"priority":0,"weight":0,"target":""},"TXT":""},{"name":"google.com","type":"A","class":"IN","TTL":111,"IP":"142.251.163.139","NS":"","CNAME":"","PTR":"","TXTs":[],"SOA":{"MName":"","RName":"","serial":0,"refresh":0,"retry":0,"expire":0,"minimum":0},"SRV":{"priority":0,"weight":0,"port":0,"name":""},"MX":{"preference":0,"name":""},"OPT":[],"URI":{"priority":0,"weight":0,"target":""},"TXT":""}],"authorities":[],"additionals":[]}}]}
79 changes: 79 additions & 0 deletions pkg/dnscache/node.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,79 @@
package dnscache

import (
"fmt"

"golang.org/x/exp/slices"

"github.com/aquasecurity/tracee/types/trace"
)

type nodeType int

const (
InvalidNode nodeType = iota
DNS
IP
)

type dnsQueryNode struct {
value string
nodeType nodeType
previous *dnsQueryNode
next []*dnsQueryNode
}

type nodeCacheQuery struct {
dnsResults []string
ipResults []string
}

// made a cache node from a DNS answer. node may return nil, this case must be handled
func makeNodeFromAnswer(parent *dnsQueryNode, answer *trace.ProtoDNSResourceRecord) *dnsQueryNode {
nodeType := DNS
value := ""
switch answer.Type {
case "CNAME":
value = answer.CNAME
case "A", "AAAA":
value = answer.IP
nodeType = IP
case "MX":
value = answer.MX.Name
case "SRV":
value = answer.SRV.Name
default:
return nil
}
return &dnsQueryNode{
value, nodeType, parent, nil,
}
}

func appendOrPrepend[T any](slice *[]T, value T, isPrepend bool) {
if isPrepend {
*slice = slices.Insert(*slice, 0, value)
} else {
*slice = append(*slice, value)
}
}

func addNodeToQuery(node *dnsQueryNode, query *nodeCacheQuery, isParent bool) error {
addNodeToQuerySingle(node, query, isParent)
for _, child := range node.next {
addNodeToQuery(child, query, isParent)
}
return nil
}

func addNodeToQuerySingle(node *dnsQueryNode, query *nodeCacheQuery, isParent bool) error {
switch node.nodeType {
case DNS:
appendOrPrepend(&query.dnsResults, node.value, isParent)
case IP:
appendOrPrepend(&query.ipResults, node.value, isParent)
default:
return fmt.Errorf("invalid node type")
}
return nil
}
Loading

0 comments on commit 77dd275

Please sign in to comment.