DNS客户端协议详解

这个DNS系列现在有以下几篇文章
DNS EDNS DNSSEC DNS over HTTPS 完整代码请看DNS

DNS Header

                                1  1  1  1  1  1
  0  1  2  3  4  5  6  7  8  9  0  1  2  3  4  5
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
|                      ID                       |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
|QR|   Opcode  |AA|TC|RD|RA|   Z    |   RCODE   |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
|                    QDCOUNT                    |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
|                    ANCOUNT                    |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
|                    NSCOUNT                    |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
|                    ARCOUNT                    |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+

header在dns请求和应答中相同的,查询中有Query Section,应答中有answer section.

• ID: 2字节,应答中也有ID,可以用来判断是否为我们请求的应答
• QR：1bit,请求时为0,应答时为1
• Opcode：4bit 通常值为0（标准查询），其他值为1（反向查询）和2（服务器状态请求）,[3,15]保留值
• AA：1bit authoritative answer,在应答中才有效
• TC：1bit 表示可截断
• RD：1bit 期望使用递归查询
• RA：1bit 在应答中返回,返回服务器是否支持递归查询
• Z： Reserved for future use.
• RCODE：4bit,应答码,代表返回的状态
  • 0 No Error
  • 1 Format error 格式错误
  • 2 Server failure 服务器失败
  • 3 Name Error 查询域名错误
  • 4 Not Implemented 未实现的查询方式
  • 5 Refused 拒绝
  • 6-15 Reserved for future use.
• QDCOUNT 请求的个数
• ANCOUNT 应答的个数
• NSCOUNT 无符号16bit整数表示报文授权段中的授权记录数。
• ARCOUNT 无符号16bit整数表示报文附加段中的附加记录数。

查询

                                1  1  1  1  1  1
  0  1  2  3  4  5  6  7  8  9  0  1  2  3  4  5
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
|                                               |
/                     QNAME                     /
/                                               /
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
|                     QTYPE                     |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
|                     QCLASS                    |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+

• QNAME：不定长,格式为域名以点分割的长度,末尾以0结尾,例如:

  www.google.com -> 3www6google3com0

• QTYPE:查询的类型
  常用的我们需要知道A为IPV4,AAAA为IPV6

  TYPE            value and meaning
  A               1 a host address
  NS              2 an authoritative name server
  MD              3 a mail destination (Obsolete - use MX)
  MF              4 a mail forwarder (Obsolete - use MX)
  CNAME           5 the canonical name for an alias
  SOA             6 marks the start of a zone of authority
  MB              7 a mailbox domain name (EXPERIMENTAL)
  MG              8 a mail group member (EXPERIMENTAL)
  MR              9 a mail rename domain name (EXPERIMENTAL)
  NULL            10 a null RR (EXPERIMENTAL)
  WKS             11 a well known service description
  PTR             12 a domain name pointer
  HINFO           13 host information
  MINFO           14 mailbox or mail list information
  MX              15 mail exchange
  TXT             16 text strings
  
  AAAA            28 <- https://www.ietf.org/rfc/rfc3596.txt

• QCLASS：无符号16bit整数表示查询的类,比如，IN代表Internet.

现在我们来完成生成请求的代码
使用全局变量来存储请求的类型

type reqType [2]byte

var (
    A     = reqType{0b00000000, 0b00000001} // 1
    NS    = reqType{0b00000000, 0b00000010} // 2
    MD    = reqType{0b00000000, 0b00000011} // 3
    MF    = reqType{0b00000000, 0b00000100} // 3
    CNAME = reqType{0b00000000, 0b00000101} // 5
    SOA   = reqType{0b00000000, 0b00000110} // 6
    MB    = reqType{0b00000000, 0b00000111} // 7
    MG    = reqType{0b00000000, 0b00001000} // 8
    MR    = reqType{0b00000000, 0b00001001} // 9
    NULL  = reqType{0b00000000, 0b00001010} // 10
    WKS   = reqType{0b00000000, 0b00001011} // 11
    PTR   = reqType{0b00000000, 0b00001100} // 12
    HINFO = reqType{0b00000000, 0b00001101} // 13
    MINFO = reqType{0b00000000, 0b00001110} // 14
    MX    = reqType{0b00000000, 0b00001111} // 15
    TXT   = reqType{0b00000000, 0b00010000} // 16
    AAAA  = reqType{0b00000000, 0b00011100} // 28 https://www.ietf.org/rfc/rfc3596.txt
    // for req
    AXFR = reqType{0b00000000, 0b11111100} // 252
    ANY  = reqType{0b00000000, 0b11111111} // 255
)

这里需要注意有些字段是以位的大小来存储的,需要使用移位运算符来计算(在完成这个协议前,我写了socks5,因为socks5中全部为字节的大小,可能有人会出现与我相同的错误,所以需要注意一下)

func creatRequest(domain string, reqType reqType) []byte {
    id := []byte{byte(rand.Intn(255)), byte(rand.Intn(255))} // id:
    qr := byte(0b0)                                          // qr 0
    opCode := byte(0b0000)                                   // opcode 0000
    aa := byte(0b0)                                          // aa 0
    tc := byte(0b0)                                          // tc 0
    rd := byte(0b1)                                          // rd 1
    ra := byte(0b0)                                          // ra 0
    z := byte(0b000)                                         // z 000
    rCode := byte(0b0000)                                    // rCode 0000
    qr2rCode := []byte{qr<<7 + opCode<<3 + aa<<2 + tc<<1 + rd, ra<<7 + z<<4 + rCode}
    qdCount := []byte{0b00000000, 0b00000001} // request number => bit: 00000000 00000001 -> 01
    anCount := []byte{0b00000000, 0b00000000} // answer number(no use for req) => bit: 00000000 00000000
    nsCount := []byte{0b00000000, 0b00000000} //(no use for req) => bit: 00000000 00000000
    arCount := []byte{0b00000000, 0b00000000} //(no use for req) => bit: 00000000 00000000

    var qName []byte
    for _, x := range strings.Split(domain, ".") {
        qName = append(qName, byte(len(x)))
        qName = append(qName, []byte(x)...)
    }
    qName = append(qName, 0b00000000) // add the 0 for last of domain

    qType := []byte{reqType[0], reqType[1]}  // type:
    qClass := []byte{0b00000000, 0b00000001} // 1 -> from internet

    return bytes.Join([][]byte{id, qr2rCode, qdCount, anCount, nsCount, arCount, qName, qType, qClass}, []byte{})
}

这里我们已经得到了完整的请求字节数组,然后使用UDP协议发起请求就行了：

// 此处以www.google.com及1111 DNS为例
req := creatRequest("www.google.com", A)
conn, err := net.DialTimeout("udp", "1.1.1.1:53", 5*time.Second)
if err != nil {
    return nil, err
}
defer conn.Close()
if _, err = conn.Write(req); err != nil {
    return nil, err
}
_ = conn.SetDeadline(time.Now().Add(5 * time.Second))
n, err := conn.Read(b[:])
if err != nil {
    return nil, err
}

接下来我们就需要解析应答请求了,来获取我们需要的数据.

应答

应答数据中具有header和请求字段,所以我们可以先写一个resovle header来分析header.
之前我们完成了域名编码的代码,就是3www6google3com0这个,这里我们还需要完成一个解析的.

func getName(c []byte, all []byte) (name string, x []byte) {
    for {
        if c[0]&128 == 128 && c[0]&64 == 64 { // <- 这里的这个会在下面的answer section中解释
            l := c[1]
            c = c[2:]
            tmp, _ := getName(all[l:], all)
            name += tmp
            //log.Println(c, name)
            break
        }
        name += string(c[1:int(c[0])+1]) + "."
        c = c[int(c[0])+1:]
        if c[0] == 0 {
            c = c[1:] // lastOfDomain: one byte 0
            break
        }
    }
    return name, c
}

之后就可以来分析header了：

func resolveHeader(req []byte, answer []byte) (anCount int, answerSection []byte, err error) {
    // resolve answer
    if answer[0] != req[0] || answer[1] != req[1] { // compare id
        // not the answer
        return 0, nil, errors.New("id not same")
    }

    if answer[2]&8 != 0 { // check the QR is 1(Answer)
        return 0, nil, errors.New("the qr is not 1(Answer)")
    }

    rCode := fmt.Sprintf("%08b", answer[3])[4:] // check Response code(rCode)
    switch rCode {
    case "0000": // no error
        break
    case "0001": // Format error
        return 0, nil, errors.New("request format error")
    case "0010": //Server failure
        return 0, nil, errors.New("dns Server failure")
    case "0011": //Name Error
        return 0, nil, errors.New("no such name")
    case "0100": // Not Implemented
        return 0, nil, errors.New("dns server not support this request")
    case "0101": //Refused
        return 0, nil, errors.New("dns server Refuse")
    default: // Reserved for future use.
        return 0, nil, errors.New("other error")
    }

    //qdCountA := []byte{b[4], b[5]}  // no use, for request
    //anCountA := []byte{answer[6], answer[7]}
    anCount = int(answer[6])<<8 + int(answer[7])
    //nsCount2arCountA := []byte{b[8], b[9], b[10], b[11]} // no use

    c := answer[12:]

    var x string
    x, c = getName(c, answer)
    log.Println(x)
    
    log.Println("qType:", c[:2])
    c = c[2:]
    log.Println("qClass:", c[:2])
    c = c[2:]

    return anCount, c, nil
}

之后就是我们真正需要的数据,Answer section

                               1  1  1  1  1  1
  0  1  2  3  4  5  6  7  8  9  0  1  2  3  4  5
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
|                                               |
/                                               /
/                      NAME                     /
|                                               |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
|                      TYPE                     |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
|                     CLASS                     |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
|                      TTL                      |
|                                               |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
|                   RDLENGTH                    |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--|
/                     RDATA                     /
/                                               /
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+

• NAME：不定长与之前QNAME相同,这里会使用省略字段：前两bit为11表示压缩格式，而后面跟的14bit表示的是Name所在的位置相对于DNS首部的偏移值
  如：之前的header数组中出现过3www6google3com0,且处的位置为12,这里就可以用192 12两个字节来省略(192是因为11000000,前两位为11)
• QTYPE：与之前的TYPE相同
• CLASS：与之前的QCLASS相同
• TTL: 就是TTL 可以使用搜索引擎查询一下
• RDLENGTH: RDATA的长度

这个Answer section与之前的header不同,并不是只出现一次,与header中ANCOUNT有关,如果ANCOUNT不为1,后面就会出现多个,要使用循环来获取所有应答数据

// resolve answer
anCount, c, err := resolveHeader(req, b[:n])
if err != nil {
    return nil, err
}

// answer section
log.Println()
log.Println("Answer section:")

var x string
for anCount != 0 {
    x, c = getName(c, b[:n])
    log.Println(x)

    tYPE := reqType{c[0], c[1]}
    log.Println("type:", c[0], c[1])
    c = c[2:] // type
    log.Println("class:", c[0], c[1])
    c = c[2:] // class
    log.Println("ttl:", c[0], c[1], c[2], c[3])
    c = c[4:] // ttl 4byte
    sum := int(c[0])<<8 + int(c[1])
    log.Println("rdlength", sum)
    c = c[2:] // RDLENGTH  跳过总和，因为总和不包括计算域名的长度 2+int(c[0])<<8+int(c[1])

    switch tYPE {
    case A:
        DNS = append(DNS, c[0:4])
        c = c[4:] // 4 byte ip addr
    case AAAA:
        DNS = append(DNS, c[0:16])
        c = c[16:] // 16 byte ip addr
    case NS:
        fallthrough
    case MD:
        fallthrough
    case MF:
        fallthrough
    case CNAME:
        fallthrough
    case SOA:
        fallthrough
    case MG:
        fallthrough
    case MB:
        fallthrough
    case MR:
        fallthrough
    case NULL:
        fallthrough
    case WKS:
        fallthrough
    case PTR:
        fallthrough
    case HINFO:
        fallthrough
    case MINFO:
        fallthrough
    case MX:
        fallthrough
    case TXT:
        fallthrough
    default:
        log.Println("rdata", c[:sum])
        c = c[sum:] // RDATA
    }
    anCount -= 1
}

虽然这里我只处理了A,和AAAA的请求类型,但是每个类型的数据格式在rfc1035都有详细记录,想要自己实现并不难,毕竟我们已经完成的大部分的数据解析,剩下的一点也应该问题不大.

---

rfc1035
rfc3596