diff --git a/protos/dns/dns.go b/protos/dns/dns.go index 3f8f5a8bc8a..135b63cd12f 100644 --- a/protos/dns/dns.go +++ b/protos/dns/dns.go @@ -786,8 +786,6 @@ func (dns *Dns) messageParser(s *DnsStream) *layers.DNS { dnsData, err := decodeDnsData(s.data) if err != nil { - logp.Debug("dns", "Failed to decode this : %s", s.data) - logp.Debug("dns", "Decoded : %s", dnsData) return nil } diff --git a/protos/dns/dns_test.go b/protos/dns/dns_test.go index 7fe6fdc7c37..a752e9ce6b5 100644 --- a/protos/dns/dns_test.go +++ b/protos/dns/dns_test.go @@ -3,7 +3,7 @@ // The byte array test data was generated from pcap files using the gopacket // test_creator.py script contained in the gopacket repository. The script was // modified to drop the Ethernet, IP, and UDP headers from the byte arrays -// (skip the first 42 bytes). +// (skip the first 42 bytes for UDP packets and the first 54 bytes for TCP packets). // // TODO: // * Add test validation for responsetime to make sure unit conversion @@ -68,6 +68,12 @@ var ( githubPtr, sophosTxt, } + messagesTcp = []DnsTestMessage{ + elasticATcp, + zoneAxfrTcp, + githubPtrTcp, + sophosTxtTcp, + } elasticA = DnsTestMessage{ id: 8529, @@ -91,39 +97,33 @@ var ( } elasticATcp = DnsTestMessage{ - id: 16929, - opcode: "QUERY", - flags: []string{"qr", "rd", "ra"}, - rcode: "NOERROR", - q_class: "IN", - q_type: "A", - q_name: "elastic.co", - answers: []string{"54.201.204.244", "54.200.185.88"}, + id: 11674, + opcode: "QUERY", + flags: []string{"rd", "ra"}, + rcode: "NOERROR", + q_class: "IN", + q_type: "A", + q_name: "elastic.co", + answers: []string{"54.201.204.244", "54.200.185.88"}, + authorities: []string{"NS-835.AWSDNS-40.NET", "NS-1183.AWSDNS-19.ORG", "NS-2007.AWSDNS-58.CO.UK", "NS-66.AWSDNS-08.COM"}, request: []byte{ - 0x00, 0x25, 0x90, 0xd6, 0xc6, 0x86, 0x42, 0x56, 0xe2, 0x2b, 0xb5, 0x1a, 0x08, 0x00, 0x45, 0x00, - 0x00, 0x46, 0x7a, 0x36, 0x40, 0x00, 0x40, 0x06, 0x39, 0x60, 0xc0, 0xa8, 0x02, 0xd0, 0xc0, 0xa8, - 0x02, 0xfb, 0xd2, 0xaf, 0x00, 0x35, 0x6a, 0x5a, 0x79, 0xc9, 0x37, 0xd5, 0x23, 0x0e, 0x50, 0x18, - 0x72, 0x10, 0x87, 0x54, 0x00, 0x00, 0x00, 0x1c, 0x2d, 0x9a, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x07, 0x65, 0x6c, 0x61, 0x73, 0x74, 0x69, 0x63, 0x02, 0x63, 0x6f, 0x00, - 0x00, 0x01, 0x00, 0x01, + 0x00, 0x1c, 0x2d, 0x9a, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0x65, + 0x6c, 0x61, 0x73, 0x74, 0x69, 0x63, 0x02, 0x63, 0x6f, 0x00, 0x00, 0x01, 0x00, 0x01, }, response: []byte{ - 0x42, 0x56, 0xe2, 0x2b, 0xb5, 0x1a, 0x00, 0x25, 0x90, 0xd6, 0xc6, 0x86, 0x08, 0x00, 0x45, 0x00, - 0x00, 0xf1, 0x4d, 0x86, 0x40, 0x00, 0x40, 0x06, 0x65, 0x65, 0xc0, 0xa8, 0x02, 0xfb, 0xc0, 0xa8, - 0x02, 0xd0, 0x00, 0x35, 0xd2, 0xaf, 0x37, 0xd5, 0x23, 0x0e, 0x6a, 0x5a, 0x79, 0xe7, 0x50, 0x18, - 0x72, 0x10, 0xdd, 0x98, 0x00, 0x00, 0x00, 0xc7, 0x2d, 0x9a, 0x81, 0x80, 0x00, 0x01, 0x00, 0x02, - 0x00, 0x04, 0x00, 0x00, 0x07, 0x65, 0x6c, 0x61, 0x73, 0x74, 0x69, 0x63, 0x02, 0x63, 0x6f, 0x00, - 0x00, 0x01, 0x00, 0x01, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x3c, 0x00, 0x04, - 0x36, 0xc8, 0xb9, 0x58, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x3c, 0x00, 0x04, - 0x36, 0xc9, 0xcc, 0xf4, 0xc0, 0x0c, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x16, 0x82, 0x00, 0x16, - 0x06, 0x4e, 0x53, 0x2d, 0x38, 0x33, 0x35, 0x09, 0x41, 0x57, 0x53, 0x44, 0x4e, 0x53, 0x2d, 0x34, - 0x30, 0x03, 0x4e, 0x45, 0x54, 0x00, 0xc0, 0x0c, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x16, 0x82, - 0x00, 0x17, 0x07, 0x4e, 0x53, 0x2d, 0x31, 0x31, 0x38, 0x33, 0x09, 0x41, 0x57, 0x53, 0x44, 0x4e, - 0x53, 0x2d, 0x31, 0x39, 0x03, 0x4f, 0x52, 0x47, 0x00, 0xc0, 0x0c, 0x00, 0x02, 0x00, 0x01, 0x00, - 0x00, 0x16, 0x82, 0x00, 0x19, 0x07, 0x4e, 0x53, 0x2d, 0x32, 0x30, 0x30, 0x37, 0x09, 0x41, 0x57, - 0x53, 0x44, 0x4e, 0x53, 0x2d, 0x35, 0x38, 0x02, 0x43, 0x4f, 0x02, 0x55, 0x4b, 0x00, 0xc0, 0x0c, - 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x16, 0x82, 0x00, 0x15, 0x05, 0x4e, 0x53, 0x2d, 0x36, 0x36, - 0x09, 0x41, 0x57, 0x53, 0x44, 0x4e, 0x53, 0x2d, 0x30, 0x38, 0x03, 0x43, 0x4f, 0x4d, 0x00, + 0x00, 0xc7, 0x2d, 0x9a, 0x81, 0x80, 0x00, 0x01, 0x00, 0x02, 0x00, 0x04, 0x00, 0x00, 0x07, 0x65, + 0x6c, 0x61, 0x73, 0x74, 0x69, 0x63, 0x02, 0x63, 0x6f, 0x00, 0x00, 0x01, 0x00, 0x01, 0xc0, 0x0c, + 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x3c, 0x00, 0x04, 0x36, 0xc8, 0xb9, 0x58, 0xc0, 0x0c, + 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x3c, 0x00, 0x04, 0x36, 0xc9, 0xcc, 0xf4, 0xc0, 0x0c, + 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x16, 0x82, 0x00, 0x16, 0x06, 0x4e, 0x53, 0x2d, 0x38, 0x33, + 0x35, 0x09, 0x41, 0x57, 0x53, 0x44, 0x4e, 0x53, 0x2d, 0x34, 0x30, 0x03, 0x4e, 0x45, 0x54, 0x00, + 0xc0, 0x0c, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x16, 0x82, 0x00, 0x17, 0x07, 0x4e, 0x53, 0x2d, + 0x31, 0x31, 0x38, 0x33, 0x09, 0x41, 0x57, 0x53, 0x44, 0x4e, 0x53, 0x2d, 0x31, 0x39, 0x03, 0x4f, + 0x52, 0x47, 0x00, 0xc0, 0x0c, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x16, 0x82, 0x00, 0x19, 0x07, + 0x4e, 0x53, 0x2d, 0x32, 0x30, 0x30, 0x37, 0x09, 0x41, 0x57, 0x53, 0x44, 0x4e, 0x53, 0x2d, 0x35, + 0x38, 0x02, 0x43, 0x4f, 0x02, 0x55, 0x4b, 0x00, 0xc0, 0x0c, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, + 0x16, 0x82, 0x00, 0x15, 0x05, 0x4e, 0x53, 0x2d, 0x36, 0x36, 0x09, 0x41, 0x57, 0x53, 0x44, 0x4e, + 0x53, 0x2d, 0x30, 0x38, 0x03, 0x43, 0x4f, 0x4d, 0x00, }, } @@ -163,6 +163,35 @@ var ( }, } + zoneAxfrTcp = DnsTestMessage{ + id: 0, + opcode: "QUERY", + rcode: "NOERROR", + q_class: "IN", + q_type: "AXFR", + q_name: "etas.com", + answers: []string{"training2003p", "training2003p", "1.1.1.1", "training2003p"}, + request: []byte{ + 0x00, 0x1c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x65, + 0x74, 0x61, 0x73, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0xfc, 0x00, 0x01, 0x4d, 0x53, + }, + response: []byte{ + 0x00, 0xc3, 0x00, 0x00, 0x80, 0x80, 0x00, 0x01, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x04, 0x65, + 0x74, 0x61, 0x73, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0xfc, 0x00, 0x01, 0xc0, 0x0c, 0x00, 0x06, + 0x00, 0x01, 0x00, 0x00, 0x0e, 0x10, 0x00, 0x2f, 0x0d, 0x74, 0x72, 0x61, 0x69, 0x6e, 0x69, 0x6e, + 0x67, 0x32, 0x30, 0x30, 0x33, 0x70, 0x00, 0x0a, 0x68, 0x6f, 0x73, 0x74, 0x6d, 0x61, 0x73, 0x74, + 0x65, 0x72, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x3c, 0x00, 0x00, 0x02, 0x58, 0x00, + 0x01, 0x51, 0x80, 0x00, 0x00, 0x0e, 0x10, 0xc0, 0x0c, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x0e, + 0x10, 0x00, 0x0f, 0x0d, 0x74, 0x72, 0x61, 0x69, 0x6e, 0x69, 0x6e, 0x67, 0x32, 0x30, 0x30, 0x33, + 0x70, 0x00, 0x07, 0x77, 0x65, 0x6c, 0x63, 0x6f, 0x6d, 0x65, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, + 0x00, 0x00, 0x0e, 0x10, 0x00, 0x04, 0x01, 0x01, 0x01, 0x01, 0xc0, 0x0c, 0x00, 0x06, 0x00, 0x01, + 0x00, 0x00, 0x0e, 0x10, 0x00, 0x2f, 0x0d, 0x74, 0x72, 0x61, 0x69, 0x6e, 0x69, 0x6e, 0x67, 0x32, + 0x30, 0x30, 0x33, 0x70, 0x00, 0x0a, 0x68, 0x6f, 0x73, 0x74, 0x6d, 0x61, 0x73, 0x74, 0x65, 0x72, + 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x3c, 0x00, 0x00, 0x02, 0x58, 0x00, 0x01, 0x51, + 0x80, 0x00, 0x00, 0x0e, 0x10, + }, + } + githubPtr = DnsTestMessage{ id: 344, opcode: "QUERY", @@ -203,6 +232,35 @@ var ( }, } + githubPtrTcp = DnsTestMessage{ + id: 6766, + opcode: "QUERY", + flags: []string{"rd", "ra"}, + rcode: "NOERROR", + q_class: "IN", + q_type: "PTR", + q_name: "131.252.30.192.in-addr.arpa", + answers: []string{"github.com"}, + authorities: []string{"ns1.p16.dynect.net", "ns3.p16.dynect.net", "ns4.p16.dynect.net", "ns2.p16.dynect.net"}, + request: []byte{ + 0x00, 0x2d, 0x1a, 0x6e, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x31, + 0x33, 0x31, 0x03, 0x32, 0x35, 0x32, 0x02, 0x33, 0x30, 0x03, 0x31, 0x39, 0x32, 0x07, 0x69, 0x6e, + 0x2d, 0x61, 0x64, 0x64, 0x72, 0x04, 0x61, 0x72, 0x70, 0x61, 0x00, 0x00, 0x0c, 0x00, 0x01, + }, + response: []byte{ + 0x00, 0x9b, 0x1a, 0x6e, 0x81, 0x80, 0x00, 0x01, 0x00, 0x01, 0x00, 0x04, 0x00, 0x00, 0x03, 0x31, + 0x33, 0x31, 0x03, 0x32, 0x35, 0x32, 0x02, 0x33, 0x30, 0x03, 0x31, 0x39, 0x32, 0x07, 0x69, 0x6e, + 0x2d, 0x61, 0x64, 0x64, 0x72, 0x04, 0x61, 0x72, 0x70, 0x61, 0x00, 0x00, 0x0c, 0x00, 0x01, 0xc0, + 0x0c, 0x00, 0x0c, 0x00, 0x01, 0x00, 0x00, 0x0e, 0x07, 0x00, 0x0c, 0x06, 0x67, 0x69, 0x74, 0x68, + 0x75, 0x62, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0xc0, 0x10, 0x00, 0x02, 0x00, 0x01, 0x00, 0x01, 0x51, + 0x77, 0x00, 0x14, 0x03, 0x6e, 0x73, 0x31, 0x03, 0x70, 0x31, 0x36, 0x06, 0x64, 0x79, 0x6e, 0x65, + 0x63, 0x74, 0x03, 0x6e, 0x65, 0x74, 0x00, 0xc0, 0x10, 0x00, 0x02, 0x00, 0x01, 0x00, 0x01, 0x51, + 0x77, 0x00, 0x06, 0x03, 0x6e, 0x73, 0x33, 0xc0, 0x55, 0xc0, 0x10, 0x00, 0x02, 0x00, 0x01, 0x00, + 0x01, 0x51, 0x77, 0x00, 0x06, 0x03, 0x6e, 0x73, 0x34, 0xc0, 0x55, 0xc0, 0x10, 0x00, 0x02, 0x00, + 0x01, 0x00, 0x01, 0x51, 0x77, 0x00, 0x06, 0x03, 0x6e, 0x73, 0x32, 0xc0, 0x55, + }, + } + sophosTxt = DnsTestMessage{ id: 8238, opcode: "QUERY", @@ -248,6 +306,52 @@ var ( 0x6f, 0x73, 0x78, 0x6c, 0x03, 0x6e, 0x65, 0x74, 0x00, 0x00, 0x10, 0x00, 0x01, }, } + + sophosTxtTcp = DnsTestMessage{ + id: 35009, + opcode: "QUERY", + flags: []string{"rd", "ra"}, + rcode: "NXDOMAIN", + q_class: "IN", + q_type: "TXT", + q_name: "3.1o19ss00s2s17s4qp375sp49r830n2n4n923s8839052s7p7768s53365226pp3.659p1r741os37393" + + "648s2348o762q1066q53rq5p4614r1q4781qpr16n809qp4.879o3o734q9sns005o3pp76q83.2q65qns3spns" + + "1081s5rn5sr74opqrqnpq6rn3ro5.i.00.mac.sophosxl.net", + request: []byte{ + 0x00, 0xed, 0x88, 0xc1, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x33, + 0x3f, 0x31, 0x6f, 0x31, 0x39, 0x73, 0x73, 0x30, 0x30, 0x73, 0x32, 0x73, 0x31, 0x37, 0x73, 0x34, + 0x71, 0x70, 0x33, 0x37, 0x35, 0x73, 0x70, 0x34, 0x39, 0x72, 0x38, 0x33, 0x30, 0x6e, 0x32, 0x6e, + 0x34, 0x6e, 0x39, 0x32, 0x33, 0x73, 0x38, 0x38, 0x33, 0x39, 0x30, 0x35, 0x32, 0x73, 0x37, 0x70, + 0x37, 0x37, 0x36, 0x38, 0x73, 0x35, 0x33, 0x33, 0x36, 0x35, 0x32, 0x32, 0x36, 0x70, 0x70, 0x33, + 0x3f, 0x36, 0x35, 0x39, 0x70, 0x31, 0x72, 0x37, 0x34, 0x31, 0x6f, 0x73, 0x33, 0x37, 0x33, 0x39, + 0x33, 0x36, 0x34, 0x38, 0x73, 0x32, 0x33, 0x34, 0x38, 0x6f, 0x37, 0x36, 0x32, 0x71, 0x31, 0x30, + 0x36, 0x36, 0x71, 0x35, 0x33, 0x72, 0x71, 0x35, 0x70, 0x34, 0x36, 0x31, 0x34, 0x72, 0x31, 0x71, + 0x34, 0x37, 0x38, 0x31, 0x71, 0x70, 0x72, 0x31, 0x36, 0x6e, 0x38, 0x30, 0x39, 0x71, 0x70, 0x34, + 0x1a, 0x38, 0x37, 0x39, 0x6f, 0x33, 0x6f, 0x37, 0x33, 0x34, 0x71, 0x39, 0x73, 0x6e, 0x73, 0x30, + 0x30, 0x35, 0x6f, 0x33, 0x70, 0x70, 0x37, 0x36, 0x71, 0x38, 0x33, 0x28, 0x32, 0x71, 0x36, 0x35, + 0x71, 0x6e, 0x73, 0x33, 0x73, 0x70, 0x6e, 0x73, 0x31, 0x30, 0x38, 0x31, 0x73, 0x35, 0x72, 0x6e, + 0x35, 0x73, 0x72, 0x37, 0x34, 0x6f, 0x70, 0x71, 0x72, 0x71, 0x6e, 0x70, 0x71, 0x36, 0x72, 0x6e, + 0x33, 0x72, 0x6f, 0x35, 0x01, 0x69, 0x02, 0x30, 0x30, 0x03, 0x6d, 0x61, 0x63, 0x08, 0x73, 0x6f, + 0x70, 0x68, 0x6f, 0x73, 0x78, 0x6c, 0x03, 0x6e, 0x65, 0x74, 0x00, 0x00, 0x10, 0x00, 0x01, + }, + response: []byte{ + 0x00, 0xed, 0x88, 0xc1, 0x81, 0x83, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x33, + 0x3f, 0x31, 0x6f, 0x31, 0x39, 0x73, 0x73, 0x30, 0x30, 0x73, 0x32, 0x73, 0x31, 0x37, 0x73, 0x34, + 0x71, 0x70, 0x33, 0x37, 0x35, 0x73, 0x70, 0x34, 0x39, 0x72, 0x38, 0x33, 0x30, 0x6e, 0x32, 0x6e, + 0x34, 0x6e, 0x39, 0x32, 0x33, 0x73, 0x38, 0x38, 0x33, 0x39, 0x30, 0x35, 0x32, 0x73, 0x37, 0x70, + 0x37, 0x37, 0x36, 0x38, 0x73, 0x35, 0x33, 0x33, 0x36, 0x35, 0x32, 0x32, 0x36, 0x70, 0x70, 0x33, + 0x3f, 0x36, 0x35, 0x39, 0x70, 0x31, 0x72, 0x37, 0x34, 0x31, 0x6f, 0x73, 0x33, 0x37, 0x33, 0x39, + 0x33, 0x36, 0x34, 0x38, 0x73, 0x32, 0x33, 0x34, 0x38, 0x6f, 0x37, 0x36, 0x32, 0x71, 0x31, 0x30, + 0x36, 0x36, 0x71, 0x35, 0x33, 0x72, 0x71, 0x35, 0x70, 0x34, 0x36, 0x31, 0x34, 0x72, 0x31, 0x71, + 0x34, 0x37, 0x38, 0x31, 0x71, 0x70, 0x72, 0x31, 0x36, 0x6e, 0x38, 0x30, 0x39, 0x71, 0x70, 0x34, + 0x1a, 0x38, 0x37, 0x39, 0x6f, 0x33, 0x6f, 0x37, 0x33, 0x34, 0x71, 0x39, 0x73, 0x6e, 0x73, 0x30, + 0x30, 0x35, 0x6f, 0x33, 0x70, 0x70, 0x37, 0x36, 0x71, 0x38, 0x33, 0x28, 0x32, 0x71, 0x36, 0x35, + 0x71, 0x6e, 0x73, 0x33, 0x73, 0x70, 0x6e, 0x73, 0x31, 0x30, 0x38, 0x31, 0x73, 0x35, 0x72, 0x6e, + 0x35, 0x73, 0x72, 0x37, 0x34, 0x6f, 0x70, 0x71, 0x72, 0x71, 0x6e, 0x70, 0x71, 0x36, 0x72, 0x6e, + 0x33, 0x72, 0x6f, 0x35, 0x01, 0x69, 0x02, 0x30, 0x30, 0x03, 0x6d, 0x61, 0x63, 0x08, 0x73, 0x6f, + 0x70, 0x68, 0x6f, 0x73, 0x78, 0x6c, 0x03, 0x6e, 0x65, 0x74, 0x00, 0x00, 0x10, 0x00, 0x01, + }, + } ) // Request and response addresses. @@ -749,7 +853,6 @@ func TestParseTcp_requestPacket(t *testing.T) { assert.Nil(t, <-client.Channel, "No result should have been published.") } -/* // Verify that the lone response packet is parsed and that an error // result is published. func TestParseTcp_responseOnly(t *testing.T) { @@ -763,7 +866,7 @@ func TestParseTcp_responseOnly(t *testing.T) { m := expectResult(t, dns) assert.Equal(t, "tcp", mapValue(t, m, "transport")) assert.Nil(t, mapValue(t, m, "bytes_in")) - assert.Equal(t, len(q.response), mapValue(t, m, "bytes_out")) + assert.Equal(t, len(q.response)-2, mapValue(t, m, "bytes_out")) assert.Nil(t, mapValue(t, m, "responsetime")) assert.Equal(t, common.ERROR_STATUS, mapValue(t, m, "status")) assert.Equal(t, OrphanedResponseMsg, mapValue(t, m, "notes")) @@ -788,7 +891,7 @@ func TestParseTcp_duplicateRequests(t *testing.T) { m := expectResult(t, dns) assert.Equal(t, "tcp", mapValue(t, m, "transport")) - assert.Equal(t, len(q.request), mapValue(t, m, "bytes_in")) + assert.Equal(t, len(q.request)-2, mapValue(t, m, "bytes_in")) assert.Nil(t, mapValue(t, m, "bytes_out")) assert.Nil(t, mapValue(t, m, "responsetime")) assert.Equal(t, common.ERROR_STATUS, mapValue(t, m, "status")) @@ -810,8 +913,8 @@ func parseTcpRequestResponse(t testing.TB, dns *Dns, q DnsTestMessage) { m := expectResult(t, dns) assert.Equal(t, "tcp", mapValue(t, m, "transport")) - assert.Equal(t, len(q.request), mapValue(t, m, "bytes_in")) - assert.Equal(t, len(q.response), mapValue(t, m, "bytes_out")) + assert.Equal(t, len(q.request)-2, mapValue(t, m, "bytes_in")) + assert.Equal(t, len(q.response)-2, mapValue(t, m, "bytes_out")) assert.NotNil(t, mapValue(t, m, "responsetime")) if assert.ObjectsAreEqual("NOERROR", mapValue(t, m, "dns.response_code")) { @@ -827,12 +930,12 @@ func parseTcpRequestResponse(t testing.TB, dns *Dns, q DnsTestMessage) { // Verify that the split lone request packet is parsed. func TestParseTcpSplitRequest(t *testing.T) { dns := newDns(testing.Verbose()) - stream := &DnsStream{data: sophosTxt.request[:10], message: new(DnsMessage)} + stream := &DnsStream{data: sophosTxtTcp.request[2:10], message: new(DnsMessage)} data := dns.messageParser(stream) assert.Nil(t, data, "Not expecting a complete message yet") - stream.data = append(stream.data, sophosTxt.request[10:]...) + stream.data = append(stream.data, sophosTxtTcp.request[10:]...) data = dns.messageParser(stream) assert.NotNil(t, data, "Message should be complete") @@ -840,8 +943,8 @@ func TestParseTcpSplitRequest(t *testing.T) { func TestGap(t *testing.T) { dns := newDns(testing.Verbose()) - q := sophosTxt.request - r := sophosTxt.response[:10] + q := sophosTxtTcp.request + r := sophosTxtTcp.response[:10] packet := newPacket(forward, q) tcptuple := testTcpTuple() @@ -870,10 +973,10 @@ func TestParseTcp_requestResponse(t *testing.T) { parseTcpRequestResponse(t, newDns(testing.Verbose()), elasticATcp) } -// Verify all DNS test messages are parsed correctly. +// Verify all DNS TCP test messages are parsed correctly. func TestParseTcp_allTestMessages(t *testing.T) { dns := newDns(testing.Verbose()) - for _, q := range messages { + for _, q := range messagesTcp { t.Logf("Testing with query for %s", q.q_name) parseTcpRequestResponse(t, dns, q) } @@ -900,16 +1003,16 @@ func benchmarkTcp(b *testing.B, q DnsTestMessage) { // Benchmark Tcp parsing against each test message. func BenchmarkTcpElasticA(b *testing.B) { benchmarkTcp(b, elasticATcp) } -func BenchmarkTcpZoneIxfr(b *testing.B) { benchmarkTcp(b, zoneIxfr) } -func BenchmarkTcpGithubPtr(b *testing.B) { benchmarkTcp(b, githubPtr) } -func BenchmarkTcpSophosTxt(b *testing.B) { benchmarkTcp(b, sophosTxt) } +func BenchmarkTcpZoneIxfr(b *testing.B) { benchmarkTcp(b, zoneAxfrTcp) } +func BenchmarkTcpGithubPtr(b *testing.B) { benchmarkTcp(b, githubPtrTcp) } +func BenchmarkTcpSophosTxt(b *testing.B) { benchmarkTcp(b, sophosTxtTcp) } // Benchmark that runs with parallelism to help find concurrency related // issues. To run with parallelism, the 'go test' cpu flag must be set // greater than 1, otherwise it just runs concurrently but not in parallel. func BenchmarkParallelTcpParse(b *testing.B) { rand.Seed(22) - numMessages := len(messages) + numMessages := len(messagesTcp) dns := newDns(false) client := dns.results.(publisher.ChanClient) @@ -928,7 +1031,7 @@ func BenchmarkParallelTcpParse(b *testing.B) { // Each iteration parses one message, either a request or a response. // The request and response could be parsed on different goroutines. for pb.Next() { - q := messages[rand.Intn(numMessages)] + q := messagesTcp[rand.Intn(numMessages)] var packet *protos.Packet var tcptuple *common.TcpTuple var private protos.ProtocolData @@ -948,4 +1051,3 @@ func BenchmarkParallelTcpParse(b *testing.B) { defer close(client.Channel) } -*/