Add DNS support to pcap (#100)

* begin adding dns pcap functionality * improve question formatting * work on capturing answers as well * finalize DNS printing * increase subfield limits * add FlagContainer type * prettier DNS printing
2026-08-20 14:39:02 +00:00 · 2026-04-24 19:41:10 -03:00
parent b2c3d11c4c
commit 198db3789b
8 changed files with 401 additions and 23 deletions
@@ -384,14 +384,14 @@ func (pc *PacketBreakdown) CaptureICMPv4(dst []Frame, pkt []byte, bitOffset int)
 	}

 	finfo := reclaimFrame(&dst, "ICMP", bitOffset, baseICMPv4Fields[:])
-
+	tp := ifrm.Type()
 	// Add type-specific fields.
-	switch ifrm.Type() {
+	switch tp {
 	case icmpv4.TypeEcho, icmpv4.TypeEchoReply:
 		finfo.Fields = append(finfo.Fields, icmpv4EchoFields[:]...)
 		if len(icmpData) > 8 {
 			finfo.Fields = append(finfo.Fields, FrameField{
-				Name:           "Data",
+				Name:           tp.String(),
 				Class:          FieldClassPayload,
 				FrameBitOffset: 8 * octet,
 				BitLength:      (len(icmpData) - 8) * octet,
@@ -439,26 +439,202 @@ func (pc *PacketBreakdown) CaptureDNS(dst []Frame, pkt []byte, bitOffset int) ([
 	}
 	dnsData := pkt[bitOffset/8:]
 	pc.dmsg.LimitResourceDecoding(4, 4, 4, 4)
-	off, incomplete, err := pc.dmsg.Decode(dnsData)
+	_, incomplete, err := pc.dmsg.Decode(dnsData)
 	if err != nil && !incomplete {
 		return dst, err
 	}
 	debuglog("pcap:dns-decode")
-	finfo := reclaimFrame(&dst, "DNS", bitOffset, nil)
+	hdr, _ := dns.NewFrame(dnsData)
+	finfo := reclaimFrame(&dst, "DNS", bitOffset, baseDNSFields[:])
 	if incomplete {
 		finfo.Errors = append(finfo.Errors, ErrLimitExceeded)
 	}
-	field := internal.SliceReclaim(&finfo.Fields)
-	*field = FrameField{
-		Name:           "Data",
-		FrameBitOffset: 0,
-		BitLength:      int(off) * octet,
-		SubFields:      field.SubFields[:0], // Reuse subfields.
+	if pc.SubfieldLimit <= 0 {
+		debuglog("pcap:dns-done")
+		return dst, nil
 	}
+
+	wireOff := dns.SizeHeader
+
+	// Questions section: walk all QDCount wire records to keep wireOff correct,
+	// but only emit SubFields for the decoded ones.
+	nq := int(hdr.QDCount())
+	if nq > 0 {
+		sectionStart := wireOff
+		qfield := internal.SliceReclaim(&finfo.Fields)
+		*qfield = FrameField{Name: "Questions", Class: fieldClassDNSResource, SubFields: qfield.SubFields[:0], Flags: FlagContainer}
+		decoded := pc.dmsg.Questions
+		for i := range nq {
+			nameStart := wireOff
+			wireOff, err = dnsSkipName(dnsData, wireOff)
+			if err != nil {
+				break
+			}
+			nameEnd := wireOff
+			wireOff += 4 // Type(2) + Class(2)
+			if i < len(decoded) && len(qfield.SubFields)+3 <= pc.SubfieldLimit {
+				qfield.SubFields = append(qfield.SubFields, FrameField{
+					Name:           "Name",
+					Class:          FieldClassDNSName,
+					FrameBitOffset: nameStart * octet,
+					BitLength:      (nameEnd - nameStart) * octet,
+				}, FrameField{
+					Name:           "Type",
+					Class:          FieldClassOperation,
+					FrameBitOffset: nameEnd * octet,
+					BitLength:      2 * octet,
+				}, FrameField{
+					Name:           "Class",
+					Class:          FieldClassOperation,
+					FrameBitOffset: (nameEnd + 2) * octet,
+					BitLength:      2 * octet,
+				})
+			}
+		}
+		qfield.FrameBitOffset = sectionStart * octet
+		qfield.BitLength = (wireOff - sectionStart) * octet
+	}
+
+	wireOff = pc.appendDNSResources(finfo, "Answers", dnsData, pc.dmsg.Answers, int(hdr.ANCount()), wireOff)
+	wireOff = pc.appendDNSResources(finfo, "Authorities", dnsData, pc.dmsg.Authorities, int(hdr.NSCount()), wireOff)
+	wireOff = pc.appendDNSResources(finfo, "Additionals", dnsData, pc.dmsg.Additionals, int(hdr.ARCount()), wireOff)
+	_ = wireOff
+
 	debuglog("pcap:dns-done")
 	return dst, nil
 }

+// appendDNSResources adds a section FrameField with per-record SubFields to finfo.
+// It walks all `total` wire records to keep wireOff accurate, but only emits SubFields
+// for the decoded slice entries while nFields < pc.SubfieldLimit.
+func (pc *PacketBreakdown) appendDNSResources(finfo *Frame, name string, dnsData []byte, decoded []dns.Resource, total, wireOff int) int {
+	if total == 0 {
+		return wireOff
+	}
+	var err error
+	sectionStart := wireOff
+	rfield := internal.SliceReclaim(&finfo.Fields)
+	*rfield = FrameField{Name: name, Class: fieldClassDNSResource, SubFields: rfield.SubFields[:0], Flags: FlagContainer}
+	for i := range total {
+		nameStart := wireOff
+		wireOff, err = dnsSkipName(dnsData, wireOff)
+		if err != nil || wireOff+10 > len(dnsData) {
+			break
+		}
+		nameEnd := wireOff
+		dataLen := int(binary.BigEndian.Uint16(dnsData[nameEnd+8:]))
+		wireOff += 10 + dataLen // Type(2)+Class(2)+TTL(4)+Length(2)+Data
+		if wireOff > len(dnsData) {
+			break
+		}
+		if i < len(decoded) && len(rfield.SubFields)+6 <= pc.SubfieldLimit {
+			rfield.SubFields = append(rfield.SubFields, FrameField{
+				Name:           "Name",
+				Class:          FieldClassDNSName,
+				FrameBitOffset: nameStart * octet,
+				BitLength:      (nameEnd - nameStart) * octet,
+			}, FrameField{
+				Name:           "Type",
+				Class:          FieldClassOperation,
+				FrameBitOffset: nameEnd * octet,
+				BitLength:      2 * octet,
+			}, FrameField{
+				Name:           "Class",
+				Class:          FieldClassOperation,
+				FrameBitOffset: (nameEnd + 2) * octet,
+				BitLength:      2 * octet,
+			}, FrameField{
+				Name:           "TTL",
+				Class:          FieldClassID,
+				FrameBitOffset: (nameEnd + 4) * octet,
+				BitLength:      4 * octet,
+			}, FrameField{
+				Name:           "Length",
+				Class:          FieldClassSize,
+				FrameBitOffset: (nameEnd + 8) * octet,
+				BitLength:      2 * octet,
+			}, FrameField{
+				Name:           "Data",
+				Class:          FieldClassAddress,
+				FrameBitOffset: (nameEnd + 10) * octet,
+				BitLength:      dataLen * octet,
+			})
+		}
+	}
+	rfield.FrameBitOffset = sectionStart * octet
+	rfield.BitLength = (wireOff - sectionStart) * octet
+	if err != nil {
+		finfo.Errors = append(finfo.Errors, err)
+	}
+	return wireOff
+}
+
+// dnsAppendDottedName walks a DNS name in wire format starting at off within
+// dnsMsg, follows compression pointers, and appends the dotted representation
+// (e.g. "example.com") to dst. Returns dst unchanged on error.
+func dnsAppendDottedName(dst, dnsMsg []byte, off int) []byte {
+	// TODO: somehow move this to dns package. dns.Name.Append ? dns.Name is the wire format...
+	first := true
+	for ptr := 0; off < len(dnsMsg) && ptr <= 10; {
+		c := dnsMsg[off]
+		off++
+		switch c & 0xc0 {
+		case 0x00:
+			if c == 0 {
+				return dst // null terminator: done
+			}
+			end := off + int(c)
+			if end > len(dnsMsg) {
+				return dst
+			}
+			if !first {
+				dst = append(dst, '.')
+			}
+			dst = append(dst, dnsMsg[off:end]...)
+			off = end
+			first = false
+		case 0xc0:
+			if off >= len(dnsMsg) {
+				return dst
+			}
+			off = int(c&0x3f)<<8 | int(dnsMsg[off])
+			ptr++ // guard against pointer loops
+		default:
+			return dst // reserved label type
+		}
+	}
+	return dst
+}
+
+// dnsSkipName advances off past a DNS name in wire format without allocating.
+// Compression pointers are followed and consume 2 bytes, terminating the name.
+func dnsSkipName(b []byte, off int) (int, error) {
+	for {
+		if off >= len(b) {
+			return off, lneto.ErrTruncatedFrame
+		}
+		c := b[off]
+		off++
+		switch c & 0xc0 {
+		case 0x00:
+			if c == 0 {
+				return off, nil // null terminator
+			}
+			off += int(c) // skip label bytes
+			if off > len(b) {
+				return off, lneto.ErrTruncatedFrame
+			}
+		case 0xc0:
+			if off >= len(b) {
+				return off, lneto.ErrTruncatedFrame
+			}
+			return off + 1, nil // compression pointer: 2 bytes total, always terminal
+		default:
+			return off, lneto.ErrInvalidField // reserved label type
+		}
+	}
+}
+
 func (pc *PacketBreakdown) CaptureNTP(dst []Frame, pkt []byte, bitOffset int) ([]Frame, error) {
 	if bitOffset%8 != 0 {
 		return dst, errNotByteAligned
@@ -656,6 +832,9 @@ type Flags uint32
 const (
 	FlagRightAligned Flags = 1 << iota
 	FlagLegacy
+	// FlagContainer is used for [FrameField]s whose SubFields represent
+	// the entirety of the FrameField's data. i.e: DNS Questions/Answers.
+	FlagContainer
 )

 func (ff Flags) IsLegacy() bool       { return ff&FlagLegacy != 0 }
@@ -855,10 +1034,13 @@ const (
 	FieldClassBinaryText // binary-text
 	FieldClassOperation  // op
 	FieldClassTimestamp  // timestamp
+	FieldClassDNSName    // dns name
 )

 const octet = 8

+const fieldClassDNSResource = fieldClassUndefined
+
 var baseEthernetFields = [...]FrameField{
 	{
 		Class:          FieldClassDst,
@@ -10,6 +10,7 @@ import (

 	"github.com/soypat/lneto"
 	"github.com/soypat/lneto/dhcpv4"
+	"github.com/soypat/lneto/dns"
 	"github.com/soypat/lneto/ethernet"
 	"github.com/soypat/lneto/http/httpraw"
 	"github.com/soypat/lneto/internal/ltesto"
@@ -486,9 +487,91 @@ func ExampleFormatter_dhcp() {
 	// 	(Hostname string)="myhost"
 }

-func writeOpt(dst []byte, opt dhcpv4.OptNum, data ...byte) int {
-	dst[0] = byte(opt)
-	dst[1] = byte(len(data))
-	copy(dst[2:], data)
-	return 2 + len(data)
+func ExampleFormatter_dns() {
+	const (
+		ethSize  = 14
+		ipv4Size = 20
+		udpSize  = 8
+	)
+
+	// Build a DNS query for "example.com" A record.
+	var msg dns.Message
+	msg.Questions = []dns.Question{
+		{Name: dns.MustNewName("example.com"), Type: dns.TypeA, Class: dns.ClassINET},
+		{Name: dns.MustNewName("temu.com"), Type: dns.TypeAAAA, Class: dns.ClassANY},
+	}
+	msg.Answers = []dns.Resource{
+		dns.NewResource(dns.MustNewName("abc.com"), dns.TypeALL, dns.ClassANY, 64, []byte{10, 0, 11, 1}),
+		dns.NewResource(dns.MustNewName("123.com"), dns.TypeA, dns.ClassINET, 64, []byte{20, 0, 22, 2}),
+	}
+
+	dnsPayload, err := msg.AppendTo(nil, 0x1234, dns.NewClientHeaderFlags(dns.OpCodeQuery, true))
+	if err != nil {
+		fmt.Println("dns encode error:", err)
+		return
+	}
+
+	pkt := make([]byte, ethSize+ipv4Size+udpSize+len(dnsPayload))
+
+	efrm, _ := ethernet.NewFrame(pkt)
+	*efrm.DestinationHardwareAddr() = [6]byte{0x00, 0x00, 0x00, 0x00, 0x00, 0x01}
+	*efrm.SourceHardwareAddr() = [6]byte{0x00, 0x00, 0x00, 0x00, 0x00, 0x02}
+	efrm.SetEtherType(ethernet.TypeIPv4)
+
+	ifrm, _ := ipv4.NewFrame(pkt[ethSize:])
+	ifrm.SetVersionAndIHL(4, 5)
+	ifrm.SetTTL(64)
+	ifrm.SetProtocol(lneto.IPProtoUDP)
+	ifrm.SetTotalLength(uint16(ipv4Size + udpSize + len(dnsPayload)))
+	ifrm.SetCRC(ifrm.CalculateHeaderCRC())
+
+	ufrm, _ := udp.NewFrame(pkt[ethSize+ipv4Size:])
+	ufrm.SetSourcePort(58200)
+	ufrm.SetDestinationPort(dns.ServerPort)
+	ufrm.SetLength(uint16(udpSize + len(dnsPayload)))
+
+	copy(pkt[ethSize+ipv4Size+udpSize:], dnsPayload)
+
+	var cap PacketBreakdown
+	cap.SubfieldLimit = 20
+	frames, err := cap.CaptureEthernet(nil, pkt, 0)
+	if err != nil {
+		fmt.Println("capture error:", err)
+		return
+	}
+
+	var fmtr Formatter
+	fmtr.SubfieldLimit = cap.SubfieldLimit
+	fmtr.FrameSep = "\n"
+	fmtr.FieldSep = "; "
+	fmtr.SubfieldSep = "\n\t"
+	out, err := fmtr.FormatFrames(nil, frames, pkt)
+	if err != nil {
+		fmt.Println("format error:", err)
+		return
+	}
+	fmt.Println(string(out))
+	// Output:
+	// Ethernet len=14; destination=00:00:00:00:00:01; source=00:00:00:00:00:02; protocol=0x0800
+	// IPv4 len=20; version=0x04; (Header Length)=5; (Type of Service)=0x00; (Total Length)=117; identification=0x0000; flags=0x0000; (Time to live)=0x40; protocol=0x11; checksum=0x7a79; source=0.0.0.0; destination=0.0.0.0
+	// UDP len=8; (Source port)=58200; (Destination port)=53; size=97; checksum=0x0000
+	// DNS len=89; identification=0x1234; flags=0x0100; Questions=2; Answers=2; Authorities=0; Additionals=0; Questions
+	// 	Name=example.com
+	// 	Type=1
+	// 	Class=1
+	// 	Name=temu.com
+	// 	Type=28
+	// 	Class=255; Answers
+	// 	Name=abc.com
+	// 	Type=255
+	// 	Class=255
+	// 	TTL=0x00000040
+	// 	Length=4
+	// 	Data=10.0.11.1
+	// 	Name=123.com
+	// 	Type=1
+	// 	Class=1
+	// 	TTL=0x00000040
+	// 	Length=4
+	// 	Data=20.0.22.2
 }
@@ -105,12 +105,12 @@ func (f *Formatter) FormatFrame(dst []byte, frm Frame, pkt []byte) (_ []byte, er
 }

 func (f *Formatter) filterField(field FrameField) bool {
-	return f.FilterClasses != nil && !slices.Contains(f.FilterClasses, field.Class) ||
+	return f.FilterClasses != nil && field.Flags&FlagContainer == 0 && !slices.Contains(f.FilterClasses, field.Class) ||
 		(field.Flags.IsLegacy() && !f.DisableLegacyFilter)
 }

 func (f *Formatter) FormatField(dst []byte, pktStartOff int, field FrameField, pkt []byte) (_ []byte, err error) {
-	printOnlySubfields := field.Class == FieldClassOptions && len(field.SubFields) > 0
+	printOnlySubfields := (field.Flags&FlagContainer != 0 || field.Class == FieldClassOptions) && len(field.SubFields) > 0
 	if !printOnlySubfields {
 		dst, err = f.formatField(dst, pktStartOff, field, pkt)
 	} else {
@@ -119,7 +119,10 @@ func (f *Formatter) FormatField(dst []byte, pktStartOff int, field FrameField, p
 	if f.SubfieldLimit > 0 && len(field.SubFields) > 0 {
 		sep := f.subfieldSep()
 		lim := min(len(field.SubFields), f.SubfieldLimit)
-		for i := 0; err == nil && i < lim && !f.filterField(field.SubFields[i]); i++ {
+		for i := 0; err == nil && i < lim; i++ {
+			if f.filterField(field.SubFields[i]) {
+				continue
+			}
 			dst = append(dst, sep...)
 			// Notice we only format subfields one level low
 			dst, err = f.formatField(dst, pktStartOff, field.SubFields[i], pkt)
@@ -143,9 +146,13 @@ func (f *Formatter) formatField(dst []byte, pktStartOff int, field FrameField, p
 		dst = append(dst, ')')
 	}
 	if field.BitLength == 0 {
+		// We do not print empty nor container fields.
 		return dst, nil
 	}
 	dst = append(dst, '=')
+	if field.Flags&FlagContainer != 0 {
+		return dst, nil
+	}
 	f.mubuf.Lock()
 	defer f.mubuf.Unlock()
 	f.buf, err = appendField(f.buf[:0], pkt, field.FrameBitOffset+pktStartOff, field.BitLength, field.Flags.IsRightAligned())
@@ -177,6 +184,12 @@ func (f *Formatter) formatField(dst []byte, pktStartOff int, field FrameField, p
 			dst = strconv.AppendQuote(dst, unsafe.String(&f.buf[0], len(f.buf)))
 		}
 		debuglog("pcap:fmtfield:text-done")
+	case FieldClassDNSName:
+		// Walk the DNS message from pktStartOff to resolve the name, following
+		// compression pointers that reference earlier bytes in the DNS message.
+		dnsMsg := pkt[pktStartOff/8:]
+		nameOff := field.FrameBitOffset / 8
+		dst = dnsAppendDottedName(dst, dnsMsg, nameOff)
 	case FieldClassDst, FieldClassSrc, FieldClassSize, FieldClassAddress, FieldClassOperation:
 		// IP, MAC addresses and ports.
 		if field.BitLength <= 16 {
@@ -221,7 +234,7 @@ func (f *Formatter) fieldSep() string {
 func (f *Formatter) subfieldSep() string {
 	sep := f.SubfieldSep
 	if sep == "" {
-		sep = "_" // default sub-field separator
+		sep = "," // default sub-field separator
 	}
 	return sep
 }