Getting IPs from a DNS response - c

Question

I'm trying to write a program that will scrape one IP address out of a DNS reply without using any DNS functions in c. For some reason this code works but only for google, facebook and imgur.com. As in, if I enter in "www.facebook.com" it gives the right IP address and same with the other two sites but any other site entered gives a wrong IP address. Does anyone know what I'm doing wrong?
#include <stdio.h>
#include <sys/socket.h>
#include <arpa/inet.h>
#include <string.h>
#include <stdlib.h>
#define PORT 53
#define SITEMAXLEN 40
#define QUERYMAXLEN SITEMAXLEN + 16
#define DNSRESULTMAXLEN 100
#define IPARRAYLEN 20
typedef unsigned char char_type;
void enter_record(char_type* query, char_type* site, int* let_set);
void print_query(char_type* query, int len);
void send_query(char_type* query, char_type* result, int len, int* answer_set);
char_type* parse_result(char_type* result, int query_len, char_type* ip);
void print_ip(int* ip);
int sock;
struct sockaddr_in server_addr;
struct sockaddr_in from_addr;
int main(int argc, char_type** argv) {
char_type* site;
char_type* query;
char_type* dns_result;
char_type* ip;
int query_len;
int answer_len;
site = (char_type*)malloc(SITEMAXLEN * sizeof(char_type));
query = (char_type*)malloc((QUERYMAXLEN) * sizeof(char_type));
dns_result = (char_type*)malloc(DNSRESULTMAXLEN * sizeof(char_type));
ip = (char_type*)malloc(IPARRAYLEN * sizeof(char_type));
if((sock = socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP)) < 0) {
fprintf(stderr, "error creating socket to the name server\n");
return 1;
}
memset(&server_addr, 0, sizeof(server_addr));
server_addr.sin_family = AF_INET;
server_addr.sin_addr.s_addr = inet_addr("208.67.220.220");
server_addr.sin_port = htons(PORT);
printf("enter in website name\n");
scanf("%s", site);
enter_record(query, site, &query_len);
print_query(query, query_len);
send_query(query, dns_result, query_len, &answer_len);
printf("\n\nresult is\n");
print_query(dns_result, answer_len);
parse_result(dns_result, query_len, ip);
printf("\n\nip address is: %s", ip);
return 0;
}
void enter_record(char_type* query, char_type* site, int* len_set) {
char_type* loc;
char_type* len;
char_type* tld;
int query_end;
loc = strchr(site, '.'); //. after www
len = strchr(loc + 1, '.'); //. after the hostname
*loc = (char_type)(len - loc - 1);
*len = (char_type)0x0003;
query[0] = 'B';
query[1] = 'L';
query[2] = (char_type)0x0001;
query[3] = (char_type)0x0000;
query[4] = (char_type)0x0000;
query[5] = (char_type)0x0001;
query[6] = (char_type)0x0000;
query[7] = (char_type)0x0000;
query[8] = (char_type)0x0000;
query[9] = (char_type)0x0000;
query[10] = (char_type)0x0000;
query[11] = (char_type)0x0000;
query[12] = (char_type)0x0003;
strncat(query + 13, site, strlen(site));
query_end = 13 + strlen(site);
query[query_end] = 0x0000;
query[query_end + 1] = 0x0000;
query[query_end + 2] = 0x0001;
query[query_end + 3] = 0x0000;
query[query_end + 4] = 0x0001;
*len_set = query_end + 5;
}
void print_query(char_type* query, int len) {
int i;
printf("in hex\n");
for(i = 0; i < len; i++) {
printf("%02hhX ", query[i]);
if(i % 16 == 0 && i != 0) {
printf("\n");
}
}
printf("\nin ascii\n");
for(i = 0; i < len; i++) {
printf("%c ", query[i] < (char_type)0x21 ? '.' : query[i]);
if(i % 16 == 0 && i != 0) {
printf("\n");
}
}
printf("\n");
}
void send_query(char_type* query, char_type* result, int len, int* set_len) {
int from_size;
int response_len;
if(sendto(sock, query, len, 0,
(struct sockaddr*)&server_addr, sizeof(server_addr)) != len) {
//message couldn't be sent
fprintf(stderr, "couldn't send the query\n");
return;
}
from_size = sizeof(from_addr);
while((response_len = recvfrom(sock, result, DNSRESULTMAXLEN, 0,
(struct sockaddr*)&from_addr, &from_size)) < 0) {
}
//null terminate the buffer
//printf("%d\n", response_len);
//result[response_len] = '\0';
*set_len = response_len;
}
char_type* parse_result(char_type* result, int query_len, char_type* ip) {
/*int offset = -1;
//offset = query_len + 32;
int count = 0;
while(count < 3) {
offset++;
if(result[offset] == 0x00C0) {
count++;
}
}
offset += 32;*/
int offset = -1;
int found = 0;
while(found == 0) {
offset++;
if(result[offset] == 0x00C0) {
if(result[offset + 3] == 0x0001 && result[offset + 2] == 0x0000) {
offset = offset + result[offset + 1];
found = 1;
}
}
}
sprintf(ip, "%d.%d.%d.%d\n",
result[offset], result[offset + 1],
result[offset + 2], result[offset + 3]);
return ip;
}

Answer 1

In parse_result() instead of jumping result[offset + 1] bytes, jump 12 bytes.
if(result[offset + 3] == 0x0001 && result[offset + 2] == 0x0000) {
/* ********
offset = offset + result[offset + 1];
******** */
offset = offset + 12;
found = 1;
}
The value at result[offset + 1] is the offset from the beginning of the message to a name, not an ip address. In the case of yahoo, the offset ultimately points to "any-fp.wa1.b.yahoo.com".
It worked for facebook (and others) because the offset to the name in the answer is 12. The offset is 12 when the name in the question is the same as the name in the answer.
Update
Not all DNS answers start each answer section with a pointer (0xC0 0x??). They may have a label instead and your program will fail miserably. Even the pointer's first byte is not required to be 0xC0: the requirement is to have the first 2 bits set.