ntop / nDPI

Open Source Deep Packet Inspection Software Toolkit
http://www.ntop.org
GNU Lesser General Public License v3.0
3.86k stars 898 forks source link

DNS dissector do not proceed next paket when receice CNAME #2575

Open didgaudin opened 1 month ago

didgaudin commented 1 month ago

Describe the bug

When we receive 2 responses packets, if the first is cname, et second who contain de A record is not processed, and then flow->info do not contain protos.dns.rsp_addr.ipv4 value

Expected behavior

A clear and concise description of what you expected to happen.

Obtained behavior

A clear and concise description of what happening.

nDPI Environment (please complete the following information):

How to reproduce the reported bug

Reproducible using ndpiReader?

If applicable, the used ndpiReader options:

If your bug is reproducible using a pcap, please attach a pcap file (or a valid link to download it)

dns.pcap.gz

Example: dns.pcap.gz

Steps to reproduce the behavior:

  1. Run '...'
  2. Set '....'
  3. Do '....'
  4. See error

Additional context

Add any other context about the problem here.

IvanNardi commented 1 month ago

I acknowledge the problem. However it is a little bit more complex that "skip any answers up to A/AAAA record" because we must be sure to return request metadata and answer metadata of the SAME transaction.