Skip to content

Commit

Permalink
Rewrite, v1.99.1
Browse files Browse the repository at this point in the history
- Rewrote `drool` into command modules: `drool <command> ...`
  - Remove `drool.conf`
  - Remove functionality `backend`, both `input` and `output`
  - Remove functionality `log` and `nolog` (see Issue #112)
  - Remove functionality `input` and `filter` (see Issue #113)
  - Remove functionality `max_clients` and `max_reuse_clients` (`client_pool`)
  - Remove timing mode `best_effort`
  - Remove statistics: dropped, ignored, total
  - Add statistics: finish, sent, received, responses, timeouts, errors
  - Add `--csv` to output statistics as CSV
  - Add `--json` to output statistics as JSON
- Add command module `replay`
  - Add timing mode `fixed=<nanoseconds>`
- Up version to 1.99.1
  • Loading branch information
jelu committed Jul 3, 2018
1 parent 9048bec commit 2ace2d4
Show file tree
Hide file tree
Showing 23 changed files with 1,163 additions and 1,541 deletions.
3 changes: 1 addition & 2 deletions .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -28,9 +28,8 @@ src/stamp-h1
build

# Project specific files
src/drool
src/drool.1
src/drool.conf.5
src/drool-replay.1
src/test/test-suite.log
src/test/test*.sh.log
src/test/test*.sh.trs
Expand Down
30 changes: 8 additions & 22 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -25,38 +25,24 @@ efficacy of subsequent bug fixes.
## Usage example

Send all DNS queries twice as fast as found in the PCAP file to localhost
using UDP:
using UDP.

```shell
drool -vv \
-c 'text:timing multiply 0.5; client_pool target "127.0.0.1" "53"; client_pool sendas udp;' \
-r file.pcap
drool replay --timing multiply=0.5 --no-tcp file.pcap 127.0.0.1 53
```

Only look for DNS queries in TCP traffic and send it to localhost:
Send all DNS queries over TCP to localhost as they were recorded.

```shell
drool -vv \
-c 'text:filter "tcp"; client_pool target "127.0.0.1" "53";' \
-r file.pcap
drool replay --timing keep --no-udp file.pcap 127.0.0.1 53
```

Listen for DNS queries on eth0 and send them to an (assuming) internal server:
Take all DNS queries found in the PCAP file and send them as fast as possible
over UDP to localhost by ignoring both timings, replies and starting 3 threads
that will simultaneously send queries.

```shell
drool -vv \
-c 'text:filter "port 53"; client_pool target "172.16.1.2" "53";' \
-i eth0
```

Take all UDP DNS queries found in the PCAP file and send them as fast as
possible to localhost by ignoring both timings, replies and starting 5
contexts (threads) that will simultaneously send queries:

```shell
drool -vv \
-c 'text:filter "udp"; timing ignore; context client_pools 5; client_pool target "127.0.0.1" "53"; client_pool skip_reply;' \
-r file.pcap
drool replay --no-tcp --no-responses --threads --udp-threads 3 file.pcap 127.0.0.1 53
```

## Dependencies
Expand Down
4 changes: 2 additions & 2 deletions configure.ac
Original file line number Diff line number Diff line change
Expand Up @@ -34,9 +34,9 @@
# POSSIBILITY OF SUCH DAMAGE.

AC_PREREQ(2.61)
AC_INIT([drool], [1.99.0], [admin@dns-oarc.net], [drool], [https://github.com/DNS-OARC/drool/issues])
AC_INIT([drool], [1.99.1], [admin@dns-oarc.net], [drool], [https://github.com/DNS-OARC/drool/issues])
AM_INIT_AUTOMAKE([-Wall -Werror foreign subdir-objects])
AC_CONFIG_SRCDIR([src/main.lua])
AC_CONFIG_SRCDIR([src/drool.in])
AC_CONFIG_MACRO_DIR([m4])

# Checks for programs.
Expand Down
28 changes: 12 additions & 16 deletions src/Makefile.am
Original file line number Diff line number Diff line change
Expand Up @@ -34,38 +34,34 @@
# POSSIBILITY OF SUCH DAMAGE.

MAINTAINERCLEANFILES = $(srcdir)/Makefile.in
CLEANFILES = drool drool.1 drool.conf.5
CLEANFILES = drool \
drool.1 \
drool-replay.1

SUBDIRS = test

EXTRA_DIST = drool.in \
drool.1.in \
drool.conf.5.in \
drool.conf.example
drool.1in \
drool-replay.1in

bin_SCRIPTS = drool
dist_pkgdata_DATA = conf.lua log.lua run.lua main.lua
droollibdir = $(pkglibdir)/drool
dist_droollib_DATA = lib/drool/replay.lua

man1_MANS = drool.1
man5_MANS = drool.conf.5
man1_MANS = drool.1 \
drool-replay.1

drool: drool.in Makefile
sed -e 's,[@]PACKAGE_NAME[@],$(PACKAGE_NAME),g' \
-e 's,[@]PACKAGE_VERSION[@],$(PACKAGE_VERSION),g' \
-e 's,[@]PACKAGE_URL[@],$(PACKAGE_URL),g' \
-e 's,[@]PACKAGE_BUGREPORT[@],$(PACKAGE_BUGREPORT),g' \
-e 's,[@]pkgdatadir[@],$(pkgdatadir),g' \
-e 's,[@]pkglibdir[@],$(pkglibdir),g' \
< "$(srcdir)/drool.in" > drool
chmod +x drool

drool.1: drool.1.in Makefile
.1in.1:
sed -e 's,[@]PACKAGE_VERSION[@],$(PACKAGE_VERSION),g' \
-e 's,[@]PACKAGE_URL[@],$(PACKAGE_URL),g' \
-e 's,[@]PACKAGE_BUGREPORT[@],$(PACKAGE_BUGREPORT),g' \
< "$(srcdir)/drool.1.in" > drool.1

drool.conf.5: drool.conf.5.in Makefile
sed -e 's,[@]PACKAGE_VERSION[@],$(PACKAGE_VERSION),g' \
-e 's,[@]PACKAGE_URL[@],$(PACKAGE_URL),g' \
-e 's,[@]PACKAGE_BUGREPORT[@],$(PACKAGE_BUGREPORT),g' \
< "$(srcdir)/drool.conf.5.in" > drool.conf.5
< "$<" > "$@"
70 changes: 0 additions & 70 deletions src/conf.lua

This file was deleted.

160 changes: 160 additions & 0 deletions src/drool-replay.1in
Original file line number Diff line number Diff line change
@@ -0,0 +1,160 @@
.\" DNS Reply Tool (drool)
.\"
.\" Copyright (c) 2017-2018, OARC, Inc.
.\" Copyright (c) 2017, Comcast Corporation
.\" All rights reserved.
.\"
.\" Redistribution and use in source and binary forms, with or without
.\" modification, are permitted provided that the following conditions
.\" are met:
.\"
.\" 1. Redistributions of source code must retain the above copyright
.\" notice, this list of conditions and the following disclaimer.
.\"
.\" 2. Redistributions in binary form must reproduce the above copyright
.\" notice, this list of conditions and the following disclaimer in
.\" the documentation and/or other materials provided with the
.\" distribution.
.\"
.\" 3. Neither the name of the copyright holder nor the names of its
.\" contributors may be used to endorse or promote products derived
.\" from this software without specific prior written permission.
.\"
.\" THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
.\" "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
.\" LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
.\" FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
.\" COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
.\" BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
.\" CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
.\" ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
.\" POSSIBILITY OF SUCH DAMAGE.
.\"
.TH drool 1 "@PACKAGE_VERSION@" "DNS Replay Tool"
.SH NAME
drool \- DNS Replay Tool
.SH SYNOPSIS
.B drool replay
[
.I options
]
.B file
.B host
.B port
.SH DESCRIPTION
\fBdrool\fR can replay DNS traffic from packet capture (PCAP) files and send
it to a specified server, with options such as to manipulate the timing
between packets, as well as loop packets infinitely or for a set number
of iterations.
This tool's goal is to be able to produce a high amount of UDP packets per
second and TCP sessions per second on common hardware.

The purpose can be to simulate Distributed Denial of Service (DDoS) attacks
on the DNS and measure normal DNS querying.
For example, the tool could enable you to take a snapshot of a DDoS and be
able to replay it later to test if new code or hardening techniques are
useful, safe & effective.
Another example is to be able to replay a packet stream for a bug that is
sequence- and/or timing-related in order to validate the efficacy of
subsequent bug fixes.
.SH OPTIONS
These options are specific for the
.B replay
command, see
.IR drool (1)
for generic options.
.TP
.B \-D
Show DNS queries and responses as processing goes.
.TP
.B \-n \-\-no\-responses
Do not wait for responses before sending next request.
.TP
.B \-\-no\-tcp
Do not use TCP.
.TP
.B \-\-no\-udp
Do not use UDP.
.TP
.B \-T \-\-threads
Use threads.
.TP
.B \-\-tcp\-threads N
Set the number of TCP threads to use, default 2.
.TP
.B \-\-udp\-threads N
Set the number of UDP threads to use, default 4.
.TP
.B \-\-timeout N.N
Set timeout for waiting on responses [seconds.nanoseconds], default 10.0.
.TP
.B \-t \-\-timing mode[=option]
Set the timing mode, see TIMING MODES.
.SH EXAMPLES
.TP
.B drool replay \-\-timing multiply=0.5 \-\-no\-tcp file.pcap 127.0.0.1 53

Send all DNS queries twice as fast as found in the PCAP file to localhost
using UDP.
.TP
.B drool replay \-\-timing keep \-\-no\-udp file.pcap 127.0.0.1 53

Send all DNS queries over TCP to localhost as they were recorded.
.TP
.B drool replay \-\-no\-tcp \-\-no\-responses \-\-threads \-\-udp\-threads 3 file.pcap 127.0.0.1 53

Take all DNS queries found in the PCAP file and send them as fast as possible
over UDP to localhost by ignoring both timings, replies and starting 3 threads
that will simultaneously send queries.
.SH TIMING MODES
.TP
.B ignore
Set the timing mode to ignore all timings and try to send traffic as fast
as possible (default).
.TP
.B keep
Set the timing mode to try and keep up with interval between the traffic
received.
.TP
.B add=<nanoseconds>
Set the timing mode to add the given nanoseconds to the interval between
the traffic received.
.TP
.B reduce=<nanoseconds>
Set the timing mode to reduce the interval between the traffic received
with the given nanoseconds.
.TP
.B multiply=<float>
Set the timing mode to multiply the interval between the traffic received,
this can be thought as percent with 1.00 being 100% of the interval, 2.00
being 200%, 0.10 being 10% and so on.
.TP
.B fixed=<nanoseconds>
Set the timing between packets to the given nanoseconds.
.SH SEE ALSO
drool(1)
.SH AUTHORS
Jerry Lundström, DNS-OARC
.LP
Maintained by DNS-OARC
.LP
.RS
.I https://www.dns-oarc.net/
.RE
.LP
.SH BUGS
For issues and feature requests please use:
.LP
.RS
\fI@PACKAGE_URL@\fP
.RE
.LP
For question and help please use:
.LP
.RS
\fI@PACKAGE_BUGREPORT@\fP
.RE
.LP
Loading

0 comments on commit 2ace2d4

Please sign in to comment.