Improved DNS response decoding

The first decoded address is now reported by ndpiReader

1 files changed, 15 insertions, 7 deletions

diff --git a/src/lib/protocols/dns.c b/src/lib/protocols/dns.c
index 473ff1753..b9b98aa81 100644
--- a/src/lib/protocols/dns.c
+++ b/src/lib/protocols/dns.c
@@ -175,17 +175,25 @@ static int search_valid_dns(struct ndpi_detection_module_struct *ndpi_struct,
 	  if((x+12) <= flow->packet.payload_packet_len) {
 	    x += 6;
 	    data_len = get16(&x, flow->packet.payload);
-
-	    if(((x + data_len) <= flow->packet.payload_packet_len)
-	       && (((rsp_type == 0x1) && (data_len == 4)) /* A */
+	    
+	    if((x + data_len) <= flow->packet.payload_packet_len) {
+	      // printf("[rsp_type: %u][data_len: %u]\n", rsp_type, data_len);
+
+	      if(rsp_type == 0x05 /* CNAME */) {
+		x += data_len;
+		continue; /* Skip CNAME */
+	      }
+	      
+	      if((((rsp_type == 0x1) && (data_len == 4)) /* A */
 #ifdef NDPI_DETECTION_SUPPORT_IPV6
-		   || ((rsp_type == 0x1c) && (data_len == 16)) /* AAAA */
+		  || ((rsp_type == 0x1c) && (data_len == 16)) /* AAAA */
 #endif
-		   )) {
-	      memcpy(&flow->protos.dns.rsp_addr, flow->packet.payload + x, data_len);
+		  )) {
+		memcpy(&flow->protos.dns.rsp_addr, flow->packet.payload + x, data_len);
+	      }
 	    }
 	  }
-
+	  
 	  break;
 	}
       }