feat(dns): emit multi_question event when qdcount>1

Packets with multiple questions were silently parsed at q0 only; the extra
questions were invisible.  Now emits multi_question at severity=5 with the
qdcount and q0 qname, then falls through and answers q0 normally.
This commit is contained in:
2026-05-21 21:14:50 -04:00
parent db798f5a5b
commit 629f969eb6
2 changed files with 45 additions and 0 deletions

View File

@@ -672,6 +672,10 @@ def _handle(data: bytes, src_ip: str, src_port: int, transport: str) -> bytes |
qtype_name = _TYPE_NAMES.get(qtype, str(qtype))
qclass_name = _CLASS_NAMES.get(qclass, str(qclass))
if qdcount > 1:
_log("multi_question", severity=5, src=src_ip, src_port=src_port,
transport=transport, qdcount=qdcount, qname=qname.rstrip("."))
# Flood check runs on every packet (including CHAOS / transfer probes)
_check_flood(src_ip, qtype_name)