pdns/dnsgram.cc

   1 /*
   2  * This file is part of PowerDNS or dnsdist.
   3  * Copyright -- PowerDNS.COM B.V. and its contributors
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of version 2 of the GNU General Public License as
   7  * published by the Free Software Foundation.
   8  *
   9  * In addition, for the avoidance of any doubt, permission is granted to
  10  * link this program with OpenSSL and to (re)distribute the binaries
  11  * produced as the result of such linking.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  * GNU General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * along with this program; if not, write to the Free Software
  20  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  21  */
  22 #define __FAVOR_BSD
  23 #ifdef HAVE_CONFIG_H
  24 #include "config.h"
  25 #endif
  26 #include "statbag.hh"
  27 #include "dnspcap.hh"
  28 #include "dnsrecords.hh"
  29 #include "dnsparser.hh"
  30 #include <map>
  31 #include <set>
  32 #include <fstream>
  33 #include <algorithm>
  34 #include "anadns.hh"
  35
  36 #include "namespaces.hh"
  37 #include "namespaces.hh"
  38
  39 StatBag S;
  40
  41 static struct tm* pdns_localtime_r(const uint32_t* then, struct tm* tm)
  42 {
  43   time_t t = *then;
  44
  45   return localtime_r(&t, tm);
  46 }
  47
  48 int32_t g_clientQuestions, g_clientResponses, g_serverQuestions, g_serverResponses, g_skipped;
  49 struct pdns_timeval g_lastanswerTime, g_lastquestionTime;
  50
  51 static void makeReport(const struct pdns_timeval& tv)
  52 {
  53   int64_t clientdiff = g_clientQuestions - g_clientResponses;
  54   int64_t serverdiff = g_serverQuestions - g_serverResponses;
  55
  56   if(clientdiff > 1 && clientdiff > 0.02*g_clientQuestions) {
  57     char tmp[80];
  58     struct tm tm=*pdns_localtime_r(&tv.tv_sec, &tm);
  59     strftime(tmp, sizeof(tmp) - 1, "%F %H:%M:%S", &tm);
  60
  61     cout << tmp << ": Resolver dropped too many questions ("
  62          << g_clientQuestions <<" vs " << g_clientResponses << "), diff: " <<clientdiff<<endl;
  63
  64     tm=*pdns_localtime_r(&g_lastanswerTime.tv_sec, &tm);
  65     strftime(tmp, sizeof(tmp) - 1, "%F %H:%M:%S", &tm);
  66
  67     cout<<"Last answer: "<<tmp<<"."<<g_lastanswerTime.tv_usec/1000000.0<<endl;
  68
  69     tm=*pdns_localtime_r(&g_lastquestionTime.tv_sec, &tm);
  70     strftime(tmp, sizeof(tmp) - 1, "%F %H:%M:%S", &tm);
  71
  72     cout<<"Last question: "<<tmp<<"."<<g_lastquestionTime.tv_usec/1000000.0<<endl;
  73   }
  74
  75   if(serverdiff > 1 && serverdiff > 0.02*g_serverQuestions) {
  76     char tmp[80];
  77     struct tm tm=*pdns_localtime_r(&tv.tv_sec, &tm);
  78     strftime(tmp, sizeof(tmp) - 1, "%F %H:%M:%S", &tm);
  79
  80     cout << tmp << ": Auth server dropped too many questions ("
  81          << g_serverQuestions <<" vs " << g_serverResponses << "), diff: " <<serverdiff<<endl;
  82
  83     tm=*pdns_localtime_r(&g_lastanswerTime.tv_sec, &tm);
  84     strftime(tmp, sizeof(tmp) - 1, "%F %H:%M:%S", &tm);
  85
  86     cout<<"Last answer: "<<tmp<<"."<<g_lastanswerTime.tv_usec/1000000.0<<endl;
  87
  88     tm=*pdns_localtime_r(&g_lastquestionTime.tv_sec, &tm);
  89     strftime(tmp, sizeof(tmp) - 1, "%F %H:%M:%S", &tm);
  90
  91     cout<<"Last question: "<<tmp<<"."<<g_lastquestionTime.tv_usec/1000000.0<<endl;
  92   }
  93 //  cout <<"Recursive questions: "<<g_clientQuestions<<", recursive responses: " << g_clientResponses<<
  94 //    ", server questions: "<<g_serverQuestions<<", server responses: "<<g_serverResponses<<endl;
  95
  96
  97 //  cerr << tv.tv_sec << " " <<g_clientQuestions<<" " << g_clientResponses<< " "<<g_serverQuestions<<" "<<g_serverResponses<<" "<<g_skipped<<endl;
  98   g_clientQuestions=g_clientResponses=g_serverQuestions=g_serverResponses=0;
  99   g_skipped=0;
 100 }
 101
 102 static void usage() {
 103   cerr<<"syntax: dnsgram INFILE..."<<endl;
 104 }
 105
 106 int main(int argc, char** argv)
 107 try
 108 {
 109   // Parse possible options
 110   if (argc == 1) {
 111     usage();
 112     return EXIT_SUCCESS;
 113   }
 114
 115   for(int n=1 ; n < argc; ++n) {
 116     if ((string) argv[n] == "--help") {
 117       usage();
 118       return EXIT_SUCCESS;
 119     }
 120
 121     if ((string) argv[n] == "--version") {
 122       cerr<<"dnsgram "<<VERSION<<endl;
 123       return EXIT_SUCCESS;
 124     }
 125   }
 126
 127   reportAllTypes();
 128   for(int n=1 ; n < argc; ++n) {
 129     cout<<argv[n]<<endl;
 130     unsigned int parseErrors=0, totalQueries=0, skipped=0;
 131     PcapPacketReader pr(argv[n]);
 132     //    PcapPacketWriter pw(argv[n]+string(".out"), pr);
 133     /* four sorts of packets:
 134        "rd": question from a client pc
 135        "rd qr": answer to a client pc
 136        "": question from the resolver
 137        "qr": answer to the resolver */
 138
 139     /* what are interesting events to note? */
 140     /* we measure every 60 seconds, each interval with 10% less answers than questions is interesting */
 141     /* report chunked */
 142
 143     struct pdns_timeval lastreport;
 144
 145     typedef set<pair<DNSName, uint16_t> > queries_t;
 146     queries_t questions, answers;
 147
 148     //    unsigned int count = 50000;
 149
 150     map<pair<DNSName, uint16_t>, int> counts;
 151
 152     map<double, int> rdqcounts, rdacounts;
 153
 154     while(pr.getUDPPacket()) {
 155       if((ntohs(pr.d_udp->uh_dport)==5300 || ntohs(pr.d_udp->uh_sport)==5300 ||
 156           ntohs(pr.d_udp->uh_dport)==53   || ntohs(pr.d_udp->uh_sport)==53) &&
 157          pr.d_len > 12) {
 158         try {
 159           MOADNSParser mdp(false, (const char*)pr.d_payload, pr.d_len);
 160
 161           if(lastreport.tv_sec == 0) {
 162             lastreport = pr.d_pheader.ts;
 163           }
 164
 165           if(mdp.d_header.rd && !mdp.d_header.qr) {
 166             rdqcounts[pr.d_pheader.ts.tv_sec + 0.01*(pr.d_pheader.ts.tv_usec/10000.0)]++;
 167             g_lastquestionTime=pr.d_pheader.ts;
 168             g_clientQuestions++;
 169             totalQueries++;
 170             counts[pair(mdp.d_qname, mdp.d_qtype)]++;
 171             questions.emplace(mdp.d_qname, mdp.d_qtype);
 172           }
 173           else if(mdp.d_header.rd && mdp.d_header.qr) {
 174             rdacounts[pr.d_pheader.ts.tv_sec + 0.01*(pr.d_pheader.ts.tv_usec/10000.0)]++;
 175             g_lastanswerTime=pr.d_pheader.ts;
 176             g_clientResponses++;
 177             answers.emplace(mdp.d_qname, mdp.d_qtype);
 178           }
 179           else if(!mdp.d_header.rd && !mdp.d_header.qr) {
 180             g_lastquestionTime=pr.d_pheader.ts;
 181             g_serverQuestions++;
 182             counts[pair(mdp.d_qname, mdp.d_qtype)]++;
 183             questions.emplace(mdp.d_qname, mdp.d_qtype);
 184             totalQueries++;
 185           }
 186           else if(!mdp.d_header.rd && mdp.d_header.qr) {
 187             answers.emplace(mdp.d_qname, mdp.d_qtype);
 188             g_serverResponses++;
 189           }
 190
 191           if(pr.d_pheader.ts.tv_sec - lastreport.tv_sec >= 1) {
 192             makeReport(pr.d_pheader.ts);
 193             lastreport = pr.d_pheader.ts;
 194           }
 195         }
 196         catch(const MOADNSException &mde) {
 197           //        cerr<<"error parsing packet: "<<mde.what()<<endl;
 198           parseErrors++;
 199           continue;
 200         }
 201         catch(std::exception& e) {
 202           cerr << e.what() << endl;
 203           continue;
 204         }
 205       }
 206     }
 207
 208     map<double, pair<int, int>> splot;
 209
 210     for(auto& a : rdqcounts) {
 211       splot[a.first].first = a.second;
 212     }
 213     for(auto& a : rdacounts) {
 214       splot[a.first].second = a.second;
 215     }
 216
 217     cerr<<"Writing out sub-second rd query/response stats to ./rdqaplot"<<endl;
 218     ofstream plot("rdqaplot");
 219     plot<<std::fixed;
 220     for(auto& a : splot) {
 221       plot << a.first<<"\t"<<a.second.first<<"\t"<<a.second.second<<endl;
 222     }
 223     cerr<<"Parse errors: "<<parseErrors<<", total queries: "<<totalQueries<<endl;
 224     typedef vector<queries_t::value_type> diff_t;
 225     diff_t diff;
 226     set_difference(questions.begin(), questions.end(), answers.begin(), answers.end(), back_inserter(diff));
 227     cerr<<questions.size()<<" different rd questions, "<< answers.size()<<" different rd answers, diff: "<<diff.size()<<endl;
 228     cerr<<skipped<<" skipped\n";
 229
 230     cerr<<"Generating 'failed' file with failed queries and counts\n";
 231     ofstream failed("failed");
 232     failed<<"name\ttype\tnumber\n";
 233     for(diff_t::const_iterator i = diff.begin(); i != diff.end() ; ++i) {
 234       failed << i->first << "\t" << DNSRecordContent::NumberToType(i->second) << "\t"<< counts[pair(i->first, i->second)]<<"\n";
 235     }
 236
 237     diff.clear();
 238
 239     set_difference(answers.begin(), answers.end(), questions.begin(), questions.end(), back_inserter(diff));
 240     cerr<<diff.size()<<" answers w/o questions\n";
 241
 242     cerr<<"Generating 'succeeded' file with all unique answers and counts\n";
 243     ofstream succeeded("succeeded");
 244     succeeded<<"name\ttype\tnumber\n";
 245     for(queries_t::const_iterator i = answers.begin(); i != answers.end() ; ++i) {
 246       succeeded << i->first << "\t" <<DNSRecordContent::NumberToType(i->second) << "\t" << counts[pair(i->first, i->second)]<<"\n";
 247     }
 248   }
 249 }
 250 catch(std::exception& e)
 251 {
 252   cerr<<"Fatal: "<<e.what()<<endl;
 253 }