Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Decode() silently ignoring too large frames #41

Open
eest opened this issue Nov 14, 2021 · 2 comments
Open

Decode() silently ignoring too large frames #41

eest opened this issue Nov 14, 2021 · 2 comments

Comments

@eest
Copy link

eest commented Nov 14, 2021

Hello,

I have been using this library to parse dnstap files via NewDecoder() and Decode(). I noticed Decode() is documented like so:

Decode silently discards data frames larger than the Decoder's configured maxSize.

Is there a reason it was designed like that? It seems to me silently ignoring things means I can not trust that I decoded all of the dnstap entries in a file. Should I check for this some other way?

@cmikk
Copy link
Contributor

cmikk commented Nov 15, 2021

In practice, a dnstap message contains small metadata on top of a single DNS message, and the latter is limited to 64KiB, so a buffer size of 96KiB (used elsewhere in the golang-dnstap code base) should contain any non-malformed dnstap frame.

That said, I will consider changing the API to return rather than eat the "frame too large" error message.

@eest
Copy link
Author

eest commented Nov 17, 2021

I am currently initialising my decoder via dnstap.NewDecoder(r, int(dnstap.MaxPayloadSize)) in order to get that 96KiB buffer size that you mention, so it is not really that I expect to be skipping frames. It's just that since I could be parsing a dnstap file generated from an unknown source it seems reasonable to expect the unexpected.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants