From c496c7975f5d95fb4e1b9774c3592713cda78206 Mon Sep 17 00:00:00 2001
From: emanuele-f <black.silver@hotmail.it>
Date: Fri, 29 Mar 2019 19:58:10 +0100
Subject: Add DNS response address

---
 src/lib/protocols/dns.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

(limited to 'src/lib/protocols')

diff --git a/src/lib/protocols/dns.c b/src/lib/protocols/dns.c
index d17acd2bd..b99e5a5da 100644
--- a/src/lib/protocols/dns.c
+++ b/src/lib/protocols/dns.c
@@ -186,6 +186,22 @@ void ndpi_search_dns(struct ndpi_detection_module_struct *ndpi_struct, struct nd
 
 		rsp_type = get16(&x, flow->packet.payload);
 		flow->protos.dns.rsp_type = rsp_type;
+
+		/* here x points to the response "class" field */
+		if((x+12) < flow->packet.payload_packet_len) {
+		  x += 6;
+		  data_len = get16(&x, flow->packet.payload);
+
+		  if(((x + data_len) < flow->packet.payload_packet_len)
+		    && (((rsp_type == 0x1) && (data_len == 4)) /* A */
+#ifdef NDPI_DETECTION_SUPPORT_IPV6
+		       || ((rsp_type == 0x1c) && (data_len == 16)) /* AAAA */
+#endif
+		  )) {
+		    memcpy(&flow->protos.dns.rsp_addr, flow->packet.payload + x, data_len);
+		  }
+		}
+
 		break;
 	      }
 	    }
-- 
cgit v1.2.3