From 0703ab5ac558857319c2ed4a1673444006f915f8 Mon Sep 17 00:00:00 2001 From: Luca Deri Date: Tue, 4 Feb 2020 22:16:54 +0100 Subject: Improved DNS response decoding The first decoded address is now reported by ndpiReader --- src/lib/protocols/dns.c | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-) (limited to 'src') diff --git a/src/lib/protocols/dns.c b/src/lib/protocols/dns.c index 473ff1753..b9b98aa81 100644 --- a/src/lib/protocols/dns.c +++ b/src/lib/protocols/dns.c @@ -175,17 +175,25 @@ static int search_valid_dns(struct ndpi_detection_module_struct *ndpi_struct, if((x+12) <= flow->packet.payload_packet_len) { x += 6; data_len = get16(&x, flow->packet.payload); - - if(((x + data_len) <= flow->packet.payload_packet_len) - && (((rsp_type == 0x1) && (data_len == 4)) /* A */ + + if((x + data_len) <= flow->packet.payload_packet_len) { + // printf("[rsp_type: %u][data_len: %u]\n", rsp_type, data_len); + + if(rsp_type == 0x05 /* CNAME */) { + x += data_len; + continue; /* Skip CNAME */ + } + + if((((rsp_type == 0x1) && (data_len == 4)) /* A */ #ifdef NDPI_DETECTION_SUPPORT_IPV6 - || ((rsp_type == 0x1c) && (data_len == 16)) /* AAAA */ + || ((rsp_type == 0x1c) && (data_len == 16)) /* AAAA */ #endif - )) { - memcpy(&flow->protos.dns.rsp_addr, flow->packet.payload + x, data_len); + )) { + memcpy(&flow->protos.dns.rsp_addr, flow->packet.payload + x, data_len); + } } } - + break; } } -- cgit v1.2.3