capture DNS request payloads

[iapaddler]

When running a payload capture when using curl we only capture the response of DNS requests, but not the requests.

To reproduce:

run the following command
SCOPE_PAYLOAD_ENABLE=true ./scope curl -v --http1.1 https://cdn.cribl.io/dl/latest

Look at the files that are produced in /tmp for the process

Notice that there is 24778_127.0.0.53:53:0.in but no corresponding .out file

See below for an example of how the request looks like

/tmp$ ls -lha 24778_*
-rw-rw-r-- 1 ledion ledion 146 Jan 7 10:00 24778_127.0.0.53:53:0.in
-rw-rw-r-- 1 ledion ledion 6.4K Jan 7 10:00 24778_99.84.198.43:443:44844.in
-rw-rw-r-- 1 ledion ledion 797 Jan 7 10:00 24778_99.84.198.43:44844:443.out

[iapaddler]

DNS requests made by getaddrinfo, gethosbyname/1/2/3/4 result in DNS events for request and receive. however, the UDP traffic for the query is not emitted in payload data. the DNS answer is exported in payload data.

glibc uses __sendmsg for DNS queries. if a virtual circuit (VC) is required, the DNS response is larger than the max UDP size of 64k, then it will send the request a second time using TCP by means of writev (not __writev).

currently, libscope will see the VC queries as it interposes writev. the UDP queries are not tracked due to the use of the private glibc function __sendmsg.

for completeness sake, note that at this time, a net connection event does not include UDP as these are not considered connections. that can be changed, of course. this means that, if we decide to interpose __sendmsg, the DNS traffic will be exposed in payload traffic and not events.

[iapaddler]

We are getting the DNS query packet in payload data.

From Wireshark after converting the payload data to a pcap:
No. Time Source Destination Protocol Length Info
1 0.000000 10.1.1.1 10.2.2.2 DNS 78 Standard query 0x75fe A wttr.in OPT

0000 0a 02 02 02 02 02 0a 02 02 02 02 01 08 00 45 00 ..............E.
0010 00 40 12 34 00 00 ff 11 92 73 0a 01 01 01 0a 02 .@.4.....s......
0020 02 02 00 00 00 35 00 2c 16 06 75 fe 01 20 00 01 .....5.,..u.. ..
0030 00 00 00 00 00 01 04 77 74 74 72 02 69 6e 00 00 .......wttr.in..
0040 01 00 01 00 00 29 04 b0 00 00 00 00 00 00 .....)........

Note that src & dst IPs are inserted when converting the payload to pcap. We have the IP addrs. They are used in the path name. I just didn't use them when creating the pcap.

The hex dump of the payload file: (the 75fe defines this as a std A DNS query)
00000000 75 fe 01 20 00 01 00 00 00 00 00 01 04 77 74 74 |u.. .........wtt|
00000010 72 02 69 6e 00 00 01 00 01 00 00 29 04 b0 00 00 |r.in.......)....|
00000020 00 00 00 00 |....|

[iapaddler]

The files created with payload data for the command curl https://wttr.in/Amesusing the default /tmp dir.

• 76686_127.0.0.53:0:53.out
  DNS query
  36 bytes

• 76686_127.0.0.53:53:0.in
  DNS response
  88 bytes

• 76686_5.9.243.187:41854:80.out
  HTTP request
  75 bytes

• 76686_5.9.243.187:80:41854.in
  HTTP response
  8939 bytes

• 76686_af_int_err:0:0.out
  1 byte

[iapaddler]

DNS Response

Queries
wttr.in: type A, class IN
Answers
wttr.in: type A, class IN, addr 5.9.243.187

0000 0a 02 02 02 02 02 0a 02 02 02 02 01 08 00 45 00 ..............E.
0010 00 74 12 34 00 00 ff 11 92 3f 0a 01 01 01 0a 02 .t.4.....?......
0020 02 02 00 35 00 00 00 60 0b 63 39 cc 81 80 00 01 ...5...`.c9.....
0030 00 01 00 00 00 01 04 77 74 74 72 02 69 6e 00 00 .......wttr.in..
0040 01 00 01 c0 0c 00 01 00 01 00 00 11 96 00 04 05 ................
0050 09 f3 bb 00 00 29 ff d6 00 00 00 00 00 00 6a 3b .....)........j;
0060 81 80 00 01 00 00 00 00 00 01 04 77 74 74 72 02 ...........wttr.
0070 69 6e 00 00 1c 00 01 00 00 29 ff d6 00 00 00 00 in.......)......
0080 00 00 ..

[iapaddler]

HTTPS Request

0000 16 03 01 02 00 01 00 01 fc 03 03 5e 01 c6 9b 6a ...........^...j
0010 75 8b 37 8c a2 23 dc 67 14 73 60 8c c3 bd a1 5e u.7..#.g.s....^ 0020 8b b2 28 8c 1a 0f 0d 67 bf c6 e1 20 78 af a3 bd ..(....g... x... 0030 b3 1e 7d 10 cb 6b be 52 6a 0e 73 9b ec 9c 73 5b ..}..k.Rj.s...s[ 0040 d2 62 f1 e5 62 13 2b a3 2b 45 9f 3e 00 3e 13 02 .b..b.+.+E.>.>.. 0050 13 03 13 01 c0 2c c0 30 00 9f cc a9 cc a8 cc aa .....,.0........ 0060 c0 2b c0 2f 00 9e c0 24 c0 28 00 6b c0 23 c0 27 .+./...$.(.k.#.' 0070 00 67 c0 0a c0 14 00 39 c0 09 c0 13 00 33 00 9d .g.....9.....3.. 0080 00 9c 00 3d 00 3c 00 35 00 2f 00 ff 01 00 01 75 ...=.<.5./.....u 0090 00 00 00 0c 00 0a 00 00 07 77 74 74 72 2e 69 6e .........wttr.in 00a0 00 0b 00 04 03 00 01 02 00 0a 00 0c 00 0a 00 1d ................ 00b0 00 17 00 1e 00 19 00 18 33 74 00 00 00 10 00 0e ........3t...... 00c0 00 0c 02 68 32 08 68 74 74 70 2f 31 2e 31 00 16 ...h2.http/1.1.. 00d0 00 00 00 17 00 00 00 31 00 00 00 0d 00 2a 00 28 .......1.....*.( 00e0 04 03 05 03 06 03 08 07 08 08 08 09 08 0a 08 0b ................ 00f0 08 04 08 05 08 06 04 01 05 01 06 01 03 03 03 01 ................ 0100 03 02 04 02 05 02 06 02 00 2b 00 05 04 03 04 03 .........+...... 0110 03 00 2d 00 02 01 01 00 33 00 26 00 24 00 1d 00 ..-.....3.&.$... 0120 20 0e 3d 56 45 9d c1 d2 fb 7b 39 7c 31 d2 54 79 .=VE....{9|1.Ty 0130 7d f4 5b 0c 2e 23 36 40 6a e4 a4 d4 4b 03 a1 e5 }.[..#6@j...K... 0140 66 00 15 00 c0 00 00 00 00 00 00 00 00 00 00 00 f............... 0150 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0160 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0170 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0180 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 01a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 01b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 01c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 01d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 01e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 01f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0200 00 00 00 00 00 16 03 03 00 25 10 00 00 21 20 40 .........%...! @ 0210 8e e8 11 50 ef 3f 8f 5e 4f fd 97 b7 f3 de 8d a6 ...P.?.^O....... 0220 76 c3 6c 32 05 28 3d 92 ff 5e 4f a2 56 3e 04 14 v.l2.(=..^O.V>.. 0230 03 03 00 01 01 16 03 03 00 28 61 25 9f a6 63 f8 .........(a%..c. 0240 67 74 f0 4f cf c7 ce b4 95 42 7a e2 9a f3 5c bd gt.O.....Bz...\. 0250 22 69 ab 1a bc d4 90 02 9e a0 77 e3 65 72 28 a4 "i........w.er(. 0260 dd 87 17 03 03 00 63 61 25 9f a6 63 f8 67 75 e9 ......ca%..c.gu. 0270 3d d5 60 17 51 86 99 09 3c a5 dd aa ed c4 14 74 =..Q...<......t
0280 1d ee 4a 91 cb 0f ea 6f 78 26 b9 41 e1 07 98 ff ..J....ox&.A....
0290 2e fa 03 cf a0 e3 32 39 e8 36 98 f0 36 bc 4e c6 ......29.6..6.N.
02a0 30 0f 7b c2 4a 93 4e e5 03 be 66 6c 29 1f 62 86 0.{.J.N...fl).b.
02b0 15 91 a6 02 de 8c e7 2b 8b ef 03 4e 8e 67 43 e5 .......+...N.gC.
02c0 0f 7c 4d 7d 53 3b 57 b7 0b 57 47 45 54 20 2f 41 .|M}S;W..WGET /A
02d0 6d 65 73 20 48 54 54 50 2f 31 2e 31 0d 0a 48 6f mes HTTP/1.1..Ho
02e0 73 74 3a 20 77 74 74 72 2e 69 6e 0d 0a 55 73 65 st: wttr.in..Use
02f0 72 2d 41 67 65 6e 74 3a 20 63 75 72 6c 2f 37 2e r-Agent: curl/7.
0300 36 38 2e 30 0d 0a 41 63 63 65 70 74 3a 20 2a 2f 68.0..Accept: */
0310 2a 0d 0a 0d 0a 15 03 03 00 1a 61 25 9f a6 63 f8 *.........a%..c.
0320 67 76 f0 f2 a2 05 7c a1 6a a5 89 3c db e7 5d 1b gv....|.j..<..].
0330 ac 7c a2 df .|..

[iapaddler]

a DNS response event emits the domain name and duration for the query/response.
proposing to add the resolved IP addr to the response event while we have DNS cracked open.

for the command curl https://wttr.in/Ames from the rr value in the answer:
the entire rr data values:
wttr.in. 49m45s IN A 5.9.243.187

propose to add this to the DNS response event:
"addr":"5.9.243.187"