pdns icon indicating copy to clipboard operation
pdns copied to clipboard

Add User-Agent: logging data to dnstap

Open johnhtodd opened this issue 4 years ago • 4 comments

  • Program: dnsdist
  • Issue type: Feature request

Short description

Create an addition to dnstap (and/or pdns protobuf format) that includes the User-Agent: string for remote logging and analysis.

Usecase

There are now many DoH clients, and more arriving every day. While some may not include User-Agent, some will. It is a useful data point to understand what is the volume of client requests coming from sources that include User-Agent, and what those User-Agent strings are set to if they are complete. Including this in the dnstap data would allow for external analysis.

Description

Optional inclusion of User-Agent: string contents from DoH requests in dnstap messages. This may be a one-to-many model, since the DoH socket will remain open with many requests. The reported User-Agent string should be included in each dnstap logging event. The string should be limited to some reasonable length before insertion to prevent logging overload.

It will probably be the case that some key model needs to be implemented in the dnstap extension field, as User-Agent may only be the first of several different components of extension in the data stream. Habbie suggested json as an encoding model.

Reference: dnstap extension fields: https://github.com/dnstap/dnstap.pb/blob/master/dnstap.proto#L40

johnhtodd avatar May 13 '20 22:05 johnhtodd