Export icmp and dns data

module/dns.lua

@@ -0,0 +1,18 @@
+-- This Source Code Form is subject to the terms of the Mozilla Public
+-- License, v. 2.0. If a copy of the MPL was not distributed with this
+-- file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+local dns = require('protocol/dns')
+
+dns.install_udp_rule(53)
+
+haka.rule{
+	hook = dns.events.query,
+	eval = function (dns, query)
+		hakabana:insert('hakabana', 'dns', nil, {
+			['@timestamp'] = hakabana:timestamp(haka.network_time()),
+			query = query.question['name'],
+			flow = dns.flow.flowid
+		})
+	end
+}

module/init.lua

@@ -32,6 +32,7 @@ function module.initialize(config)
 		require('/misc/hakabana/packet')
 		require('/misc/hakabana/flow')
 		require('/misc/hakabana/http')
+		require('/misc/hakabana/dns')
 	else
 		error("missing elastic search config")
 	end

module/packet.lua

@@ -4,6 +4,7 @@
 
 local raw = require('protocol/raw')
 local ipv4 = require('protocol/ipv4')
+local icmp = require('protocol/icmp')
 local tcp = require('protocol/tcp')
 local udp = require('protocol/udp')
 
@@ -35,6 +36,14 @@ haka.rule{
 	end
 }
 
+haka.rule{
+	hook = icmp.events.receive_packet,
+	eval = function (pkt)
+		local data = pkt.ip.raw.data
+		data.type = 'icmp'
+	end
+}
+
 haka.rule{
 	hook = tcp.events.receive_packet,
 	eval = function (pkt)