summaryrefslogtreecommitdiffstats
path: root/src/detection/dns/dns_windows.c
blob: b28eefb9e10af2943864161d11dccc39ee495418 (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
#include "detection/dns/dns.h"
#include "common/netif.h"
#include "common/mallocHelper.h"

#include <ws2tcpip.h>
#include <iphlpapi.h>

const char* ffDetectDNS(FFDNSOptions* options, FFlist* results) {
    IP_ADAPTER_ADDRESSES* FF_AUTO_FREE adapter_addresses = NULL;

    // Multiple attempts in case interfaces change while
    // we are in the middle of querying them.
    DWORD adapter_addresses_buffer_size = 0;
    for (int attempts = 0;; ++attempts) {
        if (adapter_addresses_buffer_size) {
            adapter_addresses = (IP_ADAPTER_ADDRESSES*) realloc(adapter_addresses, adapter_addresses_buffer_size);
            assert(adapter_addresses);
        }

        DWORD error = GetAdaptersAddresses(
            options->showType & FF_DNS_TYPE_IPV4_BIT
                ? options->showType & FF_DNS_TYPE_IPV6_BIT ? AF_UNSPEC : AF_INET
                : AF_INET6,
            GAA_FLAG_SKIP_UNICAST | GAA_FLAG_SKIP_ANYCAST | GAA_FLAG_SKIP_MULTICAST | GAA_FLAG_SKIP_FRIENDLY_NAME,
            NULL,
            adapter_addresses,
            &adapter_addresses_buffer_size);

        if (error == ERROR_SUCCESS) {
            break;
        } else if (ERROR_BUFFER_OVERFLOW == error && attempts < 4) {
            continue;
        } else {
            return "GetAdaptersAddresses() failed";
        }
    }

    uint32_t defaultRouteIfIndex = ffNetifGetDefaultRouteV4()->ifIndex;
    // Iterate through all of the adapters
    for (IP_ADAPTER_ADDRESSES* adapter = adapter_addresses; adapter; adapter = adapter->Next) {
        if (adapter->IfIndex != defaultRouteIfIndex) {
            continue;
        }
        if (adapter->OperStatus != IfOperStatusUp) {
            continue;
        }

        for (IP_ADAPTER_DNS_SERVER_ADDRESS_XP* ifa = adapter->FirstDnsServerAddress; ifa; ifa = ifa->Next) {
            FFstrbuf* item = FF_LIST_ADD(FFstrbuf, *results);
            if (ifa->Address.lpSockaddr->sa_family == AF_INET) {
                SOCKADDR_IN* ipv4 = (SOCKADDR_IN*) ifa->Address.lpSockaddr;
                ffStrbufInitA(item, INET_ADDRSTRLEN);
                item->length = (uint32_t) (RtlIpv4AddressToStringA(&ipv4->sin_addr, item->chars) - item->chars);
            } else if (ifa->Address.lpSockaddr->sa_family == AF_INET6) {
                SOCKADDR_IN6* ipv6 = (SOCKADDR_IN6*) ifa->Address.lpSockaddr;
                ffStrbufInitA(item, INET6_ADDRSTRLEN);
                item->length = (uint32_t) (RtlIpv6AddressToStringA(&ipv6->sin6_addr, item->chars) - item->chars);
            }
        }
        break;
    }
    return NULL;
}