1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
|
#pragma once
#include <cstdint>
#include <optional>
#include <span>
#include <string>
#include <utility>
#include "wireframe/byteio.hpp"
#include "wireframe/l7/dissector.hpp"
// Hand-rolled DNS message parsing: header + the first question record.
// Answer/authority/additional records aren't decoded (not needed for a
// one-line summary), so name-compression pointers there are never
// followed - a pointer in the question section itself is rejected
// rather than chased, keeping this a pure forward scan with no risk of
// a pointer loop.
namespace wireframe::net {
inline constexpr std::uint16_t kDnsPort = 53;
struct DnsHeader {
std::uint16_t id;
bool is_response;
std::uint8_t opcode;
std::uint8_t rcode;
std::uint16_t qdcount;
std::uint16_t ancount;
};
struct DnsQuestion {
std::string name;
std::uint16_t qtype;
};
struct DnsMessage {
DnsHeader header;
std::optional<DnsQuestion> question; // first question only
};
// Reads a (possibly multi-label) dotted name starting at offset.
// Returns the name and the offset just past it, or nullopt on
// truncation or a compression pointer (0xC0 prefix - valid in
// answer/authority records, not supported here).
inline std::optional<std::pair<std::string, std::size_t>> read_dns_name(
std::span<const unsigned char> bytes, std::size_t offset) {
std::string name;
while (true) {
if (offset >= bytes.size()) return std::nullopt;
std::uint8_t len = bytes[offset];
if (len == 0) {
++offset;
break;
}
if ((len & 0xC0) == 0xC0) return std::nullopt; // compression pointer: unsupported
++offset;
if (offset + len > bytes.size()) return std::nullopt;
if (!name.empty()) name += '.';
for (std::uint8_t i = 0; i < len; ++i) name += static_cast<char>(bytes[offset + i]);
offset += len;
}
return std::make_pair(std::move(name), offset);
}
inline std::optional<DnsMessage> parse_dns(std::span<const unsigned char> bytes) {
if (bytes.size() < 12) return std::nullopt;
DnsHeader header{};
header.id = read_be16(bytes, 0);
std::uint16_t flags = read_be16(bytes, 2);
header.is_response = (flags & 0x8000) != 0;
header.opcode = static_cast<std::uint8_t>((flags >> 11) & 0x0F);
header.rcode = static_cast<std::uint8_t>(flags & 0x0F);
header.qdcount = read_be16(bytes, 4);
header.ancount = read_be16(bytes, 6);
DnsMessage msg{header, std::nullopt};
if (header.qdcount >= 1) {
if (auto result = read_dns_name(bytes, 12)) {
auto& [name, next_offset] = *result;
if (next_offset + 4 <= bytes.size()) {
msg.question = DnsQuestion{std::move(name), read_be16(bytes, next_offset)};
}
}
}
return msg;
}
class DnsDissector : public L7Dissector {
public:
std::uint16_t port() const override { return kDnsPort; }
std::optional<std::string> summarize(std::span<const unsigned char> payload) const override {
auto msg = parse_dns(payload);
if (!msg) return std::nullopt;
std::string out = "DNS ";
out += msg->header.is_response ? "response" : "query";
out += " id=" + std::to_string(msg->header.id);
if (msg->header.is_response) out += " ancount=" + std::to_string(msg->header.ancount);
if (msg->question) {
out += " " + msg->question->name + " type=" + std::to_string(msg->question->qtype);
}
return out;
}
};
} // namespace wireframe::net
|