Adding field qlabel_count as the count of the number of labels in the query

kdrenard · jelu · commit b3b970d9b94e · 2022-04-05T09:48:19.000+02:00
diff --git a/FIELDS.md b/FIELDS.md
@@ -34,6 +34,7 @@ the dns table, presented as JSON identifiers.
       { "name": "ar_count","type": "int" },
       { "name": "qtype","type": "int" },
       { "name": "qclass","type": "int" },
+      { "name": "qlabel_count","type": "int" },
       { "name": "atype","type": "int" },
       { "name": "aclass","type": "int" },
       { "name": "attl","type": "int" },
diff --git a/src/dns.cpp b/src/dns.cpp
@@ -88,6 +88,7 @@ void Parse_dns::add_packet_columns()
     add_packet_column("ar_count", "", Coltype::_int, COLUMN_AR_COUNT);
     add_packet_column("qtype", "", Coltype::_int, COLUMN_QTYPE);
     add_packet_column("qclass", "", Coltype::_int, COLUMN_QCLASS);
+    add_packet_column("qlabel_count", "", Coltype::_int, COLUMN_QLABEL_COUNT);
     add_packet_column("atype", "", Coltype::_int, COLUMN_ATYPE);
     add_packet_column("aclass", "", Coltype::_int, COLUMN_ACLASS);
     add_packet_column("attl", "", Coltype::_int, COLUMN_ATTL);
@@ -239,6 +240,7 @@ void Parse_dns::on_table_created(Table* table, const std::vector<int>& columns)
     acc_ar_count       = table->get_accessor<int_column>("ar_count");
     acc_qtype          = table->get_accessor<int_column>("qtype");
     acc_qclass         = table->get_accessor<int_column>("qclass");
+    acc_qlabel_count   = table->get_accessor<int_column>("qlabel_count");
     acc_atype          = table->get_accessor<int_column>("atype");
     acc_aclass         = table->get_accessor<int_column>("aclass");
     acc_attl           = table->get_accessor<int_column>("attl");
@@ -367,6 +369,10 @@ Packet::ParseResult Parse_dns::parse(Packet& packet, const std::vector<int>& col
             acc_qclass.value(r) = message.m_questions[0].qclass;
             break;
 
+        case COLUMN_QLABEL_COUNT:
+            acc_qlabel_count.value(r) = message.m_questions[0].label_cnt;
+            break;
+
         case COLUMN_QNAME:
             acc_qname.value(r) = RefCountString::construct(message.m_questions[0].qname);
             break;
diff --git a/src/dns.h b/src/dns.h
@@ -114,17 +114,19 @@ class DNSMessage {
         char qname[0x2000];
         int  qtype;
         int  qclass;
+        int  label_cnt;
 
         Question()
         {
             qname[0] = 0;
             qtype    = 0;
             qclass   = 0;
+            label_cnt = 0;
         }
 
         int parse(DNSMessage& m, int offs)
         {
-            offs  = m.parse_dname(qname, sizeof(qname), offs);
+            offs  = m.parse_dname(qname, sizeof(qname), &label_cnt, offs);
             qtype = m.get_ushort(offs);
             offs += 2;
             qclass = m.get_ushort(offs);
@@ -154,7 +156,7 @@ class DNSMessage {
 
         int parse(DNSMessage& m, int offs)
         {
-            offs = m.parse_dname(name, sizeof(name), offs);
+            offs = m.parse_dname(name, sizeof(name), NULL, offs);
             type = m.get_ushort(offs);
             if (type == 41) {
                 m.m_opt_rr     = this;
@@ -220,18 +222,21 @@ class DNSMessage {
 
         parse();
     }
-    int parse_dname(char* out, int size, int offs)
+    int parse_dname(char* out, int size, int *label_cnt_p, int offs)
     {
         int p         = 0;
         int savedoffs = 0;
         int n         = get_ubyte(offs++);
+        int label_cnt = 0;
         if (n == 0)
             out[p++] = '.';
 
         while (n > 0) {
+            label_cnt++;
             while (n >= 192) {
                 if (savedoffs) {
                     out[p++] = 0;
+                    if (label_cnt_p != NULL) *label_cnt_p = label_cnt;
                     return savedoffs;
                 }
                 savedoffs = offs + 1;
@@ -262,6 +267,7 @@ class DNSMessage {
         if (savedoffs)
             offs = savedoffs;
         out[p++] = 0;
+        if (label_cnt_p != NULL) *label_cnt_p = label_cnt;
         return offs;
     }
     void parse_opt_rr()
@@ -438,6 +444,7 @@ class Parse_dns : public Packet_handler {
         COLUMN_AR_COUNT,
         COLUMN_QTYPE,
         COLUMN_QCLASS,
+        COLUMN_QLABEL_COUNT,
         COLUMN_ATYPE,
         COLUMN_ACLASS,
         COLUMN_ATTL,
@@ -489,6 +496,7 @@ class Parse_dns : public Packet_handler {
     Int_accessor  acc_ar_count;
     Int_accessor  acc_qtype;
     Int_accessor  acc_qclass;
+    Int_accessor  acc_qlabel_count;
     Int_accessor  acc_atype;
     Int_accessor  acc_aclass;
     Int_accessor  acc_attl;
