dns: log flags field

This adds dns header's flags in eve
log.

Signed-off-by: Eric Leblond <eric@regit.org>

diff --git a/src/app-layer-dns-common.h b/src/app-layer-dns-common.h
index 51f3763de07038a254569fc33116996a56f32ccc..21e32077145d3405b8407353c87288957309f494 100644 (file)
--- a/src/app-layer-dns-common.h
+++ b/src/app-layer-dns-common.h
@@ -194,6 +194,7 @@ typedef struct DNSAnswerEntry_ {
 typedef struct DNSTransaction_ {
     uint16_t tx_num;                                /**< internal: id */
     uint16_t tx_id;                                 /**< transaction id */
+    uint16_t flags;                                 /**< dns flags */
     uint32_t logged;                                /**< flags for loggers done logging */
     uint8_t replied;                                /**< bool indicating request is
                                                          replied to. */

diff --git a/src/app-layer-dns-udp.c b/src/app-layer-dns-udp.c
index 29a89b4955d31040cceee437c894a681c91773c0..cf13cd6eb7fc4d678c4f7af6a15c2d73bff22c0e 100644 (file)
--- a/src/app-layer-dns-udp.c
+++ b/src/app-layer-dns-udp.c
@@ -316,6 +316,7 @@ static int DNSUDPResponseParse(Flow *f, void *dstate,
             tx->recursion_desired = 1;
         }
 
+        tx->flags = ntohs(dns_header->flags);
         tx->replied = 1;
     }
     if (f != NULL) {

diff --git a/src/output-json-dns.c b/src/output-json-dns.c
index 74840fdccaf2b8ba3a7544fe0d2eeaf0c2dcde77..3e2aae735d713c37683ad9bdf28e81d0ac465e55 100644 (file)
--- a/src/output-json-dns.c
+++ b/src/output-json-dns.c
@@ -465,6 +465,11 @@ static void OutputAnswer(LogDnsLogThread *aft, json_t *djs,
     /* id */
     json_object_set_new(js, "id", json_integer(tx->tx_id));
 
+    /* dns */
+    char flags[7] = "";
+    snprintf(flags, sizeof(flags), "0x%4x", tx->flags);
+    json_object_set_new(js, "flags", json_string(flags));
+
     /* rcode */
     char rcode[16] = "";
     DNSCreateRcodeString(tx->rcode, rcode, sizeof(rcode));