1

最近（1月）开始学习golang。我正在尝试重现我们内部用 Go 语言编写的 Python 工具。

所以我有这个工具完全可以用于 DNS 的 UDP 解码，但是我已经努力了一周试图获得基于 TCP 的 DNS 解码。我的目标是为到达我们的 DNS 服务器的每个数据包记录 DNS 源、目标、查询和答案。与dnstap的做法类似，但是我们有一个内部解决方案，目前使用 Python 来适应我们内部的自定义日志记录和事件关联系统。

    func Listen(h *pcap.Handle, c *Config, logger chan<- *dnslog) {
        qType := decodeQuery()
        OpCode := decodeOpCode()
        parser := gopacket.NewDecodingLayerParser(
            layers.LayerTypeEthernet,
            &eth,
            &ip4,
            &ip6,
            &tcp,
            &udp,
            &dns,
            )

            decoded := make([]gopacket.LayerType, 0, 10)

        for {
            data, _, err := h.ZeroCopyReadPacketData()
            if err != nil {
                log.Println("Error reading packet data ", err)
                continue
            }

            dnslog := &dnslog{}

            err = parser.DecodeLayers(data, &decoded)
            for _, layer := range decoded {
                switch layer {
                case layers.LayerTypeIPv4:
                    dnslog.Dst = ip4.DstIP.String()
                    dnslog.Src = ip4.SrcIP.String()
                case layers.LayerTypeIPv6:
                    dnslog.Dst = ip6.DstIP.String()
                    dnslog.Src = ip6.SrcIP.String()
                case layers.LayerTypeTCP:
                    dnslog.Srcport = fmt.Sprintf("%d", tcp.SrcPort)
                    dnslog.Dstport = fmt.Sprintf("%d", tcp.DstPort)
                case layers.LayerTypeUDP:
                    dnslog.Srcport = fmt.Sprintf("%d", udp.SrcPort)
                    dnslog.Dstport = fmt.Sprintf("%d", udp.DstPort)
                case layers.LayerTypeDNS:
                    dnslog.Truncated = dns.TC
                    for _, q := range dns.Questions {
                        dnslog.OpCode = OpCode[uint8(dns.OpCode)]
                        dnslog.QueryCount = dns.QDCount
                        dnslog.AnswerCount = dns.ANCount
                        }
                    }
            }
        logger <- dnslog
    }

我试图将层/tcp.go 中的 NextLayerType 强制为 DNS Layertype 等，以试图找到我所缺少的。到目前为止还没有运气。任何建议都是王牌。我们使用 UDP 看到的是以下输出。（pprint json 编码输出）

[{ "src": "172.10.56.23", "src_port": "52464", "dst": "172.10.16.120", "dst_port": "53", "bytes": 63, "transport": "UDP", "reply_code": "Query", "query_count": 1, "answer_count": 0, "question": ["helposx.apple.com"], "query_type": "A", "answer": null, "truncated": false }, { "src": "172.10.16.120", "src_port": "53", "dst": "172.10.56.23", "dst_port": "52464", "bytes": 156, "transport": "UDP", "reply_code": "Query", "query_count": 1, "answer_count": 3, "question": ["helposx.apple.com"], "query_type": "A", "answer": [{ "response-name": "helposx.apple.com", "response-query_type": "CNAME", "response-ttl": 4607, "response-bytes": 31, "response-cname": "helposx.apple.com.edgekey.net", "response-soa": {}, "response-srv": {}, "response-mx": {} }, { "response-name": "helposx.apple.com.edgekey.net", "response-query_type": "CNAME", "response-ttl": 33, "response-bytes": 22, "response-cname": "e3167.e9.akamaiedge.net", "response-soa": {}, "response-srv": {}, "response-mx": {} }, { "response-name": "e3167.e9.akamaiedge.net", "response-query_type": "A", "response-ttl": 13, "response-bytes": 4, "response-ip": "104.98.20.77", "response-soa": {}, "response-srv": {}, "response-mx": {} }], "truncated": false }]

如果我现在使用 dig +tcp（强制 TCP）执行完全相同的查询，我会得到以下输出。

[{ "src": "172.10.56.23", "src_port": "57188", "dst": "172.10.16.120", "dst_port": "53", "bytes": 64, "transport": "TCP", "reply_code": "", "query_count": 0, "answer_count": 0, "question": null, "query_type": "", "answer": null, "truncated": false }, { "src": "172.10.16.120", "src_port": "53", "dst": "172.10.56.23", "dst_port": "57188", "bytes": 60, "transport": "TCP", "reply_code": "", "query_count": 0, "answer_count": 0, "question": null, "query_type": "", "answer": null, "truncated": false }, { "src": "172.10.56.23", "src_port": "57188", "dst": "172.10.16.120", "dst_port": "53", "bytes": 52, "transport": "TCP", "reply_code": "", "query_count": 0, "answer_count": 0, "question": null, "query_type": "", "answer": null, "truncated": false }, { "src": "172.10.56.23", "src_port": "57188", "dst": "172.10.16.120", "dst_port": "53", "bytes": 86, "transport": "TCP", "reply_code": "", "query_count": 0, "answer_count": 0, "question": null, "query_type": "", "answer": null, "truncated": false }, { "src": "172.10.16.120", "src_port": "53", "dst": "172.10.56.23", "dst_port": "57188", "bytes": 102, "transport": "TCP", "reply_code": "", "query_count": 0, "answer_count": 0, "question": null, "query_type": "", "answer": null, "truncated": false }, { "src": "172.10.56.23", "src_port": "57188", "dst": "172.10.16.120", "dst_port": "53", "bytes": 52, "transport": "TCP", "reply_code": "", "query_count": 0, "answer_count": 0, "question": null, "query_type": "", "answer": null, "truncated": false }] 通过查看 Wireshark 中的相同数据包，我可以看到这些不同的数据包是 TCP 握手，然后是响应。哪个没有解码。

当我在 for _, layer := range 解码行之后添加 fmt.Println(layer) 时，我得到以下信息。

以太网 IPv4 TCP << 上面的 JSON 输出。

VS

以太网 IPv4 UDP DNS

如您所见，基于 TCP 的 DNS 永远不会有下一个解码器。它只是停在 TCP 上。我不确定解决方案是什么。阅读上游库看起来应该可以工作。然而事实并非如此，我对我应该去哪里感到困惑。作为 Go 的新手，它让我陷入循环。

4

1 回答 1

1

我请求支持通过 TCP 支持 DNS，但最终我自己实现了它。

它还不支持 TCP 段的分段，但对于我的用例（目前）来说已经足够了。

于 2016-11-16T14:34:34.220 回答