Question

我最近（1月）开始学习golang。我试图重现我们内部用Go用Python编写的工具。

所以我让这个工具完全用于DNS的UDP解码，但是我一直在努力试图获得基于TCP的DNS解码一周。我的目标是记录命中DNS服务器的每个数据包的DNS源，目标，查询和答案。与dnstap的方式类似，但我们目前使用Python的内部解决方案适合我们内部的自定义日志记录和事件关联系统。

    func Listen(h *pcap.Handle, c *Config, logger chan<- *dnslog) {
        qType := decodeQuery()
        OpCode := decodeOpCode()
        parser := gopacket.NewDecodingLayerParser(
            layers.LayerTypeEthernet,
            &eth,
            &ip4,
            &ip6,
            &tcp,
            &udp,
            &dns,
            )

            decoded := make([]gopacket.LayerType, 0, 10)

        for {
            data, _, err := h.ZeroCopyReadPacketData()
            if err != nil {
                log.Println("Error reading packet data ", err)
                continue
            }

            dnslog := &dnslog{}

            err = parser.DecodeLayers(data, &decoded)
            for _, layer := range decoded {
                switch layer {
                case layers.LayerTypeIPv4:
                    dnslog.Dst = ip4.DstIP.String()
                    dnslog.Src = ip4.SrcIP.String()
                case layers.LayerTypeIPv6:
                    dnslog.Dst = ip6.DstIP.String()
                    dnslog.Src = ip6.SrcIP.String()
                case layers.LayerTypeTCP:
                    dnslog.Srcport = fmt.Sprintf("%d", tcp.SrcPort)
                    dnslog.Dstport = fmt.Sprintf("%d", tcp.DstPort)
                case layers.LayerTypeUDP:
                    dnslog.Srcport = fmt.Sprintf("%d", udp.SrcPort)
                    dnslog.Dstport = fmt.Sprintf("%d", udp.DstPort)
                case layers.LayerTypeDNS:
                    dnslog.Truncated = dns.TC
                    for _, q := range dns.Questions {
                        dnslog.OpCode = OpCode[uint8(dns.OpCode)]
                        dnslog.QueryCount = dns.QDCount
                        dnslog.AnswerCount = dns.ANCount
                        }
                    }
            }
        logger <- dnslog
    }

我试图将layers / tcp.go中的NextLayerType强制转换为DNS Layertype等，以试图找到我所缺少的内容。到目前为止没有运气。任何建议都是王牌。我们用UDP看到的是以下输出。（pprint json编码输出）

[{ "src": "172.10.56.23", "src_port": "52464", "dst": "172.10.16.120", "dst_port": "53", "bytes": 63, "transport": "UDP", "reply_code": "Query", "query_count": 1, "answer_count": 0, "question": ["helposx.apple.com"], "query_type": "A", "answer": null, "truncated": false }, { "src": "172.10.16.120", "src_port": "53", "dst": "172.10.56.23", "dst_port": "52464", "bytes": 156, "transport": "UDP", "reply_code": "Query", "query_count": 1, "answer_count": 3, "question": ["helposx.apple.com"], "query_type": "A", "answer": [{ "response-name": "helposx.apple.com", "response-query_type": "CNAME", "response-ttl": 4607, "response-bytes": 31, "response-cname": "helposx.apple.com.edgekey.net", "response-soa": {}, "response-srv": {}, "response-mx": {} }, { "response-name": "helposx.apple.com.edgekey.net", "response-query_type": "CNAME", "response-ttl": 33, "response-bytes": 22, "response-cname": "e3167.e9.akamaiedge.net", "response-soa": {}, "response-srv": {}, "response-mx": {} }, { "response-name": "e3167.e9.akamaiedge.net", "response-query_type": "A", "response-ttl": 13, "response-bytes": 4, "response-ip": "104.98.20.77", "response-soa": {}, "response-srv": {}, "response-mx": {} }], "truncated": false }]

如果我现在使用dig + tcp（强制TCP）执行完全相同的查询，我会得到以下输出。

[{ "src": "172.10.56.23", "src_port": "57188", "dst": "172.10.16.120", "dst_port": "53", "bytes": 64, "transport": "TCP", "reply_code": "", "query_count": 0, "answer_count": 0, "question": null, "query_type": "", "answer": null, "truncated": false }, { "src": "172.10.16.120", "src_port": "53", "dst": "172.10.56.23", "dst_port": "57188", "bytes": 60, "transport": "TCP", "reply_code": "", "query_count": 0, "answer_count": 0, "question": null, "query_type": "", "answer": null, "truncated": false }, { "src": "172.10.56.23", "src_port": "57188", "dst": "172.10.16.120", "dst_port": "53", "bytes": 52, "transport": "TCP", "reply_code": "", "query_count": 0, "answer_count": 0, "question": null, "query_type": "", "answer": null, "truncated": false }, { "src": "172.10.56.23", "src_port": "57188", "dst": "172.10.16.120", "dst_port": "53", "bytes": 86, "transport": "TCP", "reply_code": "", "query_count": 0, "answer_count": 0, "question": null, "query_type": "", "answer": null, "truncated": false }, { "src": "172.10.16.120", "src_port": "53", "dst": "172.10.56.23", "dst_port": "57188", "bytes": 102, "transport": "TCP", "reply_code": "", "query_count": 0, "answer_count": 0, "question": null, "query_type": "", "answer": null, "truncated": false }, { "src": "172.10.56.23", "src_port": "57188", "dst": "172.10.16.120", "dst_port": "53", "bytes": 52, "transport": "TCP", "reply_code": "", "query_count": 0, "answer_count": 0, "question": null, "query_type": "", "answer": null, "truncated": false }] 通过查看wireshark中的相同数据包，我可以看到那些不同的数据包是TCP握手，然后是响应。哪个没有解码。

当我在for _，layer：=范围解码行之后添加fmt.Println（图层）时，我得到以下内容。

以太网 IPv4的 TCP ＆LT;＆LT; JSON OUTPUT ABOVE。

VS

以太网 IPv4的 UDP DNS

正如您所看到的，基于TCP的DNS永远不会有下一个解码器。它只是停在TCP。我不确定解决方案是什么。读取上游库看起来应该可行。然而它没有，我很困惑，我应该在哪里看。作为Go的新手，它正在向我发送循环。

Answer 1

我requested support for support for DNS over TCP但最终implementing it myself in the end。

它还不支持TCP片段的碎片化，但它对我的用例来说已经足够了（现在）。

学习Golang使用gopacket作为首发

1 个答案: