Graylog2 / Graylog2/graylog2-server

Lookup tables / Data Adapters: DNS Lookup for TXT records

Open
#7,652 0 comments 0 reactions 0 assignees View on GitHub
bug triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

When configuring a lookup table for DNS TXT records the multi_value result is effectively unusable

## Expected Behavior
According to the documentation within the online interface the result for such a lookup should be something like:

```
{
"single_value": null,
"multi_value": {
"results": [
{
"value": "Some text value that lives in a TXT DNS",
"dns_ttl": 300
},
{
"value": "v=spf1 include:some-email-domain.org ~all.",
"dns_ttl": 200
}
]
},
"ttl": 200000
}
```

## Current Behavior
Currently a lookup results in a multi_value with a key of "raw_results" instead of "results", making it unusable in pipelines when using the lookup() function because that functions seems to expect a "results" field.

```
{
"single_value": null,
"multi_value": {
"raw_results": [
{
"value": "Some text value that lives in a TXT DNS",
"dns_ttl": 300
},
{
"value": "v=spf1 include:some-email-domain.org ~all.",
"dns_ttl": 200
}
]
},
"ttl": 200000
}
```

## Possible Solution
Maybe?

```
diff --git a/graylog2-server/src/main/java/org/graylog2/lookup/adapters/DnsLookupDataAdapter.java b/graylog2-server/src/main/java/org/graylog2/lookup/adapters/DnsLookupDataAdapter.java
index 684a792e4..2a072bd07 100644
--- a/graylog2-server/src/main/java/org/graylog2/lookup/adapters/DnsLookupDataAdapter.java
+++ b/graylog2-server/src/main/java/org/graylog2/lookup/adapters/DnsLookupDataAdapter.java
@@ -358,7 +358,7 @@ public class DnsLookupDataAdapter extends LookupDataAdapter {

if (CollectionUtils.isNotEmpty(txtDnsAnswers)) {
final LookupResult.Builder builder = LookupResult.builder();
- builder.multiValue(Collections.singletonMap(RAW_RESULTS_FIELD, txtDnsAnswers))
+ builder.multiValue(Collections.singletonMap(RESULTS_FIELD, txtDnsAnswers))
.stringListValue(TxtDnsAnswer.convertToStringListValue(txtDnsAnswers));
assignMinimumTTL(txtDnsAnswers, builder);

```

## Steps to Reproduce (for bugs)

1. Create a Data Adapter with Data Adapter Type "DNS Lookup"
2. Choose DNS Lookup Type to be "Text Lookup (TXT)" and fill out all other fields
3. Create a Lookup Table using the newly added adapter
4. Do a test lookup for any TXT DNS record (I assume something like gmail.com should work)

## Context
I want to use this to add additional information for other DNS based (read RBL-style) decisions done in a pipeline. If I misinterpret anything I would be grateful to have this pointed out...

## Your Environment

* Graylog Version: 3.1.3 but current source seems to have the problem as well
* Elasticsearch Version: NA
* MongoDB Version: NA
* Operating System: Ubuntu Server
* Browser version: NA

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.