feat(dns): emit multi_question event when qdcount>1
Packets with multiple questions were silently parsed at q0 only; the extra questions were invisible. Now emits multi_question at severity=5 with the qdcount and q0 qname, then falls through and answers q0 normally.
This commit is contained in:
@@ -672,6 +672,10 @@ def _handle(data: bytes, src_ip: str, src_port: int, transport: str) -> bytes |
|
||||
qtype_name = _TYPE_NAMES.get(qtype, str(qtype))
|
||||
qclass_name = _CLASS_NAMES.get(qclass, str(qclass))
|
||||
|
||||
if qdcount > 1:
|
||||
_log("multi_question", severity=5, src=src_ip, src_port=src_port,
|
||||
transport=transport, qdcount=qdcount, qname=qname.rstrip("."))
|
||||
|
||||
# Flood check runs on every packet (including CHAOS / transfer probes)
|
||||
_check_flood(src_ip, qtype_name)
|
||||
|
||||
|
||||
Reference in New Issue
Block a user