syntax = "proto2";
package nmsg.base;
option go_package = "github.com/farsightsec/go-nmsg/nmsg_base";

message DnsQR {
    enum DnsQRType {
        UDP_INVALID = 0;
        UDP_QUERY_RESPONSE = 1;
        UDP_UNANSWERED_QUERY = 2;
        UDP_UNSOLICITED_RESPONSE = 3;
        TCP = 4;
        ICMP = 5;
        UDP_QUERY_ONLY = 6;
        UDP_RESPONSE_ONLY = 7;
    }

    enum UdpChecksum {
        ERROR = 0;
        ABSENT = 1;
        INCORRECT = 2;
        CORRECT = 3;
    }

    required DnsQRType          type = 1;

    // the 9-tuple

    required bytes              query_ip = 2;
    required bytes              response_ip = 3;
    required uint32             proto = 4;
    required uint32             query_port = 5;
    required uint32             response_port = 6;

    required uint32             id = 7;
    optional bytes              qname = 8;
    optional uint32             qtype = 9;
    optional uint32             qclass = 10;

    // rcode from the response

    optional uint32             rcode = 11;

    // packet data

    repeated bytes              query_packet = 12;
    repeated int64              query_time_sec = 13;
    repeated sfixed32           query_time_nsec = 14;

    repeated bytes              response_packet = 15;
    repeated int64              response_time_sec = 16;
    repeated sfixed32           response_time_nsec = 17;

    // only used if type = TCP

    optional bytes              tcp = 18;

    // only used if type = ICMP

    optional bytes              icmp = 19;

    // only set for UDP_UNANSWERED_QUERY

    optional double             timeout = 20;

    // the result of UDP checksum verification of the response datagram.
    // note that the query datagram isn't checksummed, since a) the relevant
    // information from the query is almost always included in the response,
    // b) when capturing from the perspective of an initiator, the outbound
    // query is commonly subject to UDP checksum offload and will be incorrect
    // anyway.

    optional UdpChecksum        udp_checksum = 21;

    // set if the address of the initiator was zeroed.

    optional bool               resolver_address_zeroed = 22;
}
