TSG-8088: 修复解析NSEC类型DNS应答导致段错误的问题，正确解析bitmapv2.0.17

增加部分测试用例

17 files changed, 873 insertions, 90 deletions

diff --git a/include/dns.h b/include/dns.h
index 9e048ff..fbc8441 100644
--- a/include/dns.h
+++ b/include/dns.h
@@ -53,6 +53,7 @@ typedef unsigned int u_int32_t;
 #define	DNS_TYPE_DNSKEY		48
 #define	DNS_TYPE_NSEC3		50
 #define	DNS_TYPE_NSEC3PARAM	51
+#define	DNS_TYPE_HTTPS		65
 #define DNS_QTYPE_AXFR		252
 #define DNS_QTYPE_MAILB		253
 #define DNS_QTYPE_MAILA		254
diff --git a/src/dns.cpp b/src/dns.cpp
index 4042540..4b581fd 100644
--- a/src/dns.cpp
+++ b/src/dns.cpp
@@ -107,11 +107,64 @@ const unsigned char PCAP_FILE_HEAD[24] = {0xD4, 0xC3, 0xB2, 0xA1, 0x02, 0x00, 0x
 								 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 								 0xFF, 0xFF, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00};
 
+static int str2hex(unsigned char *source, int s_len, char *dest, int d_len)
+{
+	int i=0,used_len=0;
+	
+	for(i=0; i<s_len && i<d_len/2; i++)
+	{
+		used_len+=snprintf(dest+used_len, d_len-used_len, "%02x", source[i]);
+	}
+
+	return 0;
+}
+
+int dissect_type_bitmap(unsigned char *buff, int rr_len, unsigned char *maps_buff, unsigned short *maps_len)
+{
+	int cur_offset=0;
+	int i=0, rr_type=0;
+	unsigned char bits=0;
+	int mask=0, blockbase=0, blocksize=0;
+	
+	while (rr_len!=0) 
+	{
+		blockbase = buff[cur_offset];
+		blocksize = buff[cur_offset+1];
+		
+		maps_buff[(*maps_len)++]=buff[cur_offset];		
+		maps_buff[(*maps_len)++]=buff[cur_offset+1];
+		
+		cur_offset += 2;
+		rr_len -= 2;
+
+		rr_type = blockbase * 256;
+		for( ; blocksize; blocksize-- ) 
+		{
+			maps_buff[(*maps_len)++]=buff[cur_offset];
+			bits=buff[cur_offset];
+			mask = 1<<7;
+			for (i = 0; i < 8; i++)
+			{
+				if (bits & mask) 
+				{
+				}
+				mask >>= 1;
+				rr_type++;
+			}
+			cur_offset += 1;
+			rr_len     -= 1;
+		}
+	}
+
+	return cur_offset;
+}
+
 
 int get_rr_str2json(cJSON *object, dns_info_t *dns_info, int *dns_sec)
 {
 	int i=0;
 	char ip_str[128];
+	char tmp_buff[4096]={0};
 	dns_rr_t *dns_rr=NULL;
 	cJSON *one_rr_object=NULL;
 	cJSON *dns_rr_array=NULL;
@@ -196,8 +249,10 @@ int get_rr_str2json(cJSON *object, dns_info_t *dns_info, int *dns_sec)
 			case DNS_TYPE_WKS:
 				cJSON_AddStringToObject(one_rr_object, "addr", ip_str);
 				cJSON_AddNumberToObject(one_rr_object, "protocol", dns_rr->rdata.wks.protocol);
-				cJSON_AddStringToObject(one_rr_object, "bitmap", (const char *)(dns_rr->rdata.wks.bitmap));
 				cJSON_AddNumberToObject(one_rr_object, "size", dns_rr->rdata.wks.size);
+				
+				str2hex(dns_rr->rdata.wks.bitmap, dns_rr->rdata.wks.size, tmp_buff, sizeof(tmp_buff));					
+				cJSON_AddStringToObject(one_rr_object, "bitmap", tmp_buff);
 				break;
 			case DNS_TYPE_PTR:
 				cJSON_AddStringToObject(one_rr_object, "ptr", (const char *)(dns_rr->rdata.ptr));
@@ -233,7 +288,9 @@ int get_rr_str2json(cJSON *object, dns_info_t *dns_info, int *dns_sec)
 				cJSON_AddNumberToObject(one_rr_object, "key_tag", dns_rr->rdata.ds.key_tag);
 				cJSON_AddNumberToObject(one_rr_object, "algo", dns_rr->rdata.ds.algo);
 				cJSON_AddNumberToObject(one_rr_object, "digest_type", dns_rr->rdata.ds.digest_type);
-				cJSON_AddStringToObject(one_rr_object, "digest", (char *)(dns_rr->rdata.ds.digest));
+				
+				str2hex(dns_rr->rdata.ds.digest, dns_rr->rdata.ds.digest_len, tmp_buff, sizeof(tmp_buff));					
+				cJSON_AddStringToObject(one_rr_object, "digest", tmp_buff);
 				break;
 			case DNS_TYPE_RRSIG:
 				*dns_sec = 2;
@@ -245,19 +302,25 @@ int get_rr_str2json(cJSON *object, dns_info_t *dns_info, int *dns_sec)
 				cJSON_AddNumberToObject(one_rr_object, "sig_inception", dns_rr->rdata.rrsig.sig_inception);
 				cJSON_AddNumberToObject(one_rr_object, "key_tag", dns_rr->rdata.rrsig.key_tag);
 				cJSON_AddStringToObject(one_rr_object, "signer_name", (const char *)(dns_rr->rdata.rrsig.signer_name));
-				cJSON_AddStringToObject(one_rr_object, "signature", (char *)(dns_rr->rdata.rrsig.signature));
+
+				str2hex(dns_rr->rdata.rrsig.signature, dns_rr->rdata.rrsig.signature_len, tmp_buff, sizeof(tmp_buff));				
+				cJSON_AddStringToObject(one_rr_object, "signature", tmp_buff);
 				break;
 			case DNS_TYPE_NSEC:
 				*dns_sec = 2;
 				cJSON_AddStringToObject(one_rr_object, "next_domain", (const char *)(dns_rr->rdata.nsec.next_domain));
-				cJSON_AddStringToObject(one_rr_object, "type_bit_maps", (char *)(dns_rr->rdata.nsec.type_bit_maps));
+				
+				str2hex(dns_rr->rdata.nsec.type_bit_maps, dns_rr->rdata.nsec.maps_len, tmp_buff, sizeof(tmp_buff));					
+				cJSON_AddStringToObject(one_rr_object, "type_bit_maps", tmp_buff);
 				break;
 			case DNS_TYPE_DNSKEY:
 				*dns_sec = 2;
 				cJSON_AddNumberToObject(one_rr_object, "flags", dns_rr->rdata.dnskey.flags);
 				cJSON_AddNumberToObject(one_rr_object, "protocol", dns_rr->rdata.dnskey.protocol);
 				cJSON_AddNumberToObject(one_rr_object, "algo", dns_rr->rdata.dnskey.algo);
-				cJSON_AddStringToObject(one_rr_object, "public_key", (char *)(dns_rr->rdata.dnskey.public_key));
+				
+				str2hex(dns_rr->rdata.dnskey.public_key, dns_rr->rdata.dnskey.public_key_len, tmp_buff, sizeof(tmp_buff));					
+				cJSON_AddStringToObject(one_rr_object, "public_key", tmp_buff);
 				break;
 			case DNS_TYPE_NSEC3:
 				*dns_sec = 2;
@@ -266,16 +329,24 @@ int get_rr_str2json(cJSON *object, dns_info_t *dns_info, int *dns_sec)
 				cJSON_AddNumberToObject(one_rr_object, "iteration", dns_rr->rdata.nsec3.iteration);
 				cJSON_AddNumberToObject(one_rr_object, "salt_len", dns_rr->rdata.nsec3.salt_len);
 				cJSON_AddNumberToObject(one_rr_object, "hash_len", dns_rr->rdata.nsec3.hash_len);
-				cJSON_AddStringToObject(one_rr_object, "salt_value", (char *)(dns_rr->rdata.nsec3.salt_value));
+
+				str2hex(dns_rr->rdata.nsec3.salt_value, dns_rr->rdata.nsec3.salt_len, tmp_buff, sizeof(tmp_buff));
+				cJSON_AddStringToObject(one_rr_object, "salt_value", tmp_buff);
+				
+				str2hex(dns_rr->rdata.nsec3.next_hash_owner, dns_rr->rdata.nsec3.hash_len, tmp_buff, sizeof(tmp_buff));					
 				cJSON_AddStringToObject(one_rr_object, "next_hash_owner", (char *)(dns_rr->rdata.nsec3.next_hash_owner));
-				cJSON_AddStringToObject(one_rr_object, "type_bit_maps", (char *)(dns_rr->rdata.nsec3.type_bit_maps));
+				
+				str2hex(dns_rr->rdata.nsec3.type_bit_maps, dns_rr->rdata.nsec3.maps_len, tmp_buff, sizeof(tmp_buff));					
+				cJSON_AddStringToObject(one_rr_object, "type_bit_maps", tmp_buff);
 				break;
 			case DNS_TYPE_NSEC3PARAM:
 				cJSON_AddNumberToObject(one_rr_object, "hash_algo", dns_rr->rdata.nsec3param.hash_algo);
 				cJSON_AddNumberToObject(one_rr_object, "flags", dns_rr->rdata.nsec3param.flags);
 				cJSON_AddNumberToObject(one_rr_object, "iteration", dns_rr->rdata.nsec3param.iteration);
 				cJSON_AddNumberToObject(one_rr_object, "salt_len", dns_rr->rdata.nsec3param.salt_len);
-				cJSON_AddStringToObject(one_rr_object, "salt_value", (char *)(dns_rr->rdata.nsec3param.salt_value));
+				
+				str2hex(dns_rr->rdata.nsec3param.salt_value, dns_rr->rdata.nsec3param.salt_len, tmp_buff, sizeof(tmp_buff));
+				cJSON_AddStringToObject(one_rr_object, "salt_value", tmp_buff);
 				break;
 			case DNS_QTYPE_AXFR:
 				break;
@@ -459,7 +530,6 @@ int get_rr_content2buf(dns_rr_t *rr, int rr_count, char *rr_buf, int buflen, int
 										dns_rr->rdata.rrsig.key_tag, dns_rr->rdata.rrsig.signer_name, tmp_buf);
 				break;
 			case DNS_TYPE_NSEC:
-				break;
 				*dns_sec = 2;
 				len = 0;				
 				tmp_len=MIN(dns_rr->rdata.nsec.maps_len*2, sizeof(tmp_buf)-2)/2;
@@ -482,7 +552,6 @@ int get_rr_content2buf(dns_rr_t *rr, int rr_count, char *rr_buf, int buflen, int
 							dns_rr->rdata.dnskey.flags, dns_rr->rdata.dnskey.protocol, dns_rr->rdata.dnskey.algo, tmp_buf);
 				break;
 			case DNS_TYPE_NSEC3:
-				break;
 				*dns_sec = 2;
 				memset(tmp_buf, 0, sizeof(tmp_buf));
 				memset(maps, 0, sizeof(maps));
@@ -1298,8 +1367,7 @@ int get_dns_query_question(char *msg, char **ptr, dns_query_question_t *q, char
 
 int get_one_resource_record(char * msg, char ** ptr, dns_rr_t * rr,  char * end)
 {	
-	//int salt_len = 0, hash_len = 0;
-	unsigned int len = 0, byte = 0;
+	unsigned int len=0;
 	unsigned char *original_ptr = NULL;
 	
 	switch(rr->type) 
@@ -1463,33 +1531,9 @@ int get_one_resource_record(char * msg, char ** ptr, dns_rr_t * rr,  char * end)
 			{
 				return -1;
 			}
-
-			*ptr = (char *)original_ptr+rr->rdlength;
-			break;
 			
-			if((original_ptr+rr->rdlength != (unsigned char*)*ptr) && (*ptr != NULL))
-			{
-				NS_GET16(len, *ptr);
-				byte = MIN(DNS_MAX_MAPS-1, len);
-				memcpy(rr->rdata.nsec.type_bit_maps, *ptr, byte);
-				rr->rdata.nsec.type_bit_maps[byte]='\0';
-				*ptr += len;
-				rr->rdata.nsec.maps_len = len;
-				len = byte;
-
-				byte = ((unsigned char *)ptr)[0];
-				if((byte&0xFF) == 0xFF || byte == 128)
-				{
-					*ptr += 1;	/* jump 0xFF */
-					byte = ((unsigned char *)*ptr)[0];
-					*ptr += 1;	/* jump 1 byte of len */
-					len = MIN(DNS_MAX_MAPS-1-len, byte);
-					memcpy(rr->rdata.nsec.type_bit_maps+rr->rdata.nsec.maps_len, *ptr, len);
-					(rr->rdata.nsec.type_bit_maps+rr->rdata.nsec.maps_len)[len]='\0';
-					*ptr += byte;	/* jump  byte */
-					rr->rdata.nsec.maps_len += len;
-				}
-			}
+			dissect_type_bitmap((unsigned char*)*ptr, rr->rdlength-len, (rr->rdata.nsec.type_bit_maps), &(rr->rdata.nsec.maps_len));
+			*ptr = (char *)original_ptr+rr->rdlength;			
 			break;
 		case DNS_TYPE_DNSKEY:
 			if(* ptr + 4 > end) return 0;			
@@ -1508,32 +1552,11 @@ int get_one_resource_record(char * msg, char ** ptr, dns_rr_t * rr,  char * end)
 			//salt_len = *(unsigned char *)(*ptr+4);	/* salt length */
 			//hash_len = *(salt_len + (unsigned char *)(*ptr+5));	/* hash length */
 			get_rr_type_nsec3(ptr, &(rr->rdata.nsec3), end);
-			*ptr = (char *)original_ptr+rr->rdlength;
-			break;
 
-			if((original_ptr+rr->rdlength != (unsigned char*)*ptr) && (*ptr != NULL))
-			{
-				NS_GET16(len, *ptr);
-				byte = MIN(DNS_MAX_MAPS-1, len);
-				memcpy( rr->rdata.nsec3.type_bit_maps, *ptr, byte);
-				rr->rdata.nsec3.type_bit_maps[byte]='\0';
-				*ptr += len;
-				rr->rdata.nsec3.maps_len = byte;
-				len = byte;
-
-				byte = ((unsigned char *)*ptr)[0];
-				if((byte&0xFF) == 0xFF || byte == 128)
-				{
-					*ptr += 1;	/* jump 0xFF */
-					byte = ((unsigned char *)*ptr)[0];
-					*ptr += 1;	/* jump 1 byte of len */
-					len = MIN(DNS_MAX_MAPS-1-len, byte);
-					memcpy(rr->rdata.nsec3.type_bit_maps+rr->rdata.nsec3.maps_len, *ptr, len);
-					(rr->rdata.nsec3.type_bit_maps+rr->rdata.nsec3.maps_len)[len]='\0';
-					*ptr += byte;	/* jump  byte */
-					rr->rdata.nsec3.maps_len += len;
-				}
-			}
+			len=((char *)*ptr)-(char *)original_ptr;
+			dissect_type_bitmap((unsigned char*)*ptr, rr->rdlength-len, (rr->rdata.nsec3.type_bit_maps), &(rr->rdata.nsec3.maps_len));
+
+			*ptr = (char *)original_ptr+rr->rdlength;			
 			break;
 		case DNS_TYPE_NSEC3PARAM:
 			rr->rdata.nsec3param.hash_algo = *(unsigned char *)*ptr;
diff --git a/test/CMakeLists.txt b/test/CMakeLists.txt
index 75279cf..fcf1011 100644
--- a/test/CMakeLists.txt
+++ b/test/CMakeLists.txt
@@ -37,4 +37,9 @@ set_target_properties(${lib_name}_test_plug  PROPERTIES PREFIX "")
 
 add_test(NAME COPY_QUIC_SO COMMAND sh -c "cp ${CMAKE_BINARY_DIR}/${lib_name}.so ${PROTO_TEST_RUN_DIR}/plug/protocol/${lib_name}/${lib_name}.so")
 add_test(NAME COPY_TEST_SO COMMAND sh -c "cp ${CMAKE_CURRENT_BINARY_DIR}/${lib_name}_test_plug.so ${PROTO_TEST_RUN_DIR}/plug/business/${lib_name}_test_plug/${lib_name}_test_plug.so")
-add_test(NAME RUN_TEST COMMAND proto_test_main ${CMAKE_CURRENT_SOURCE_DIR}/${lib_name}_result.json -f "find ${CMAKE_CURRENT_SOURCE_DIR}/pcap/ -name *.pcap|sort -V" WORKING_DIRECTORY ${PROTO_TEST_RUN_DIR})
\ No newline at end of file
+add_test(NAME DNS_QUERY COMMAND proto_test_main ${CMAKE_CURRENT_SOURCE_DIR}/pcap/query/query_result.json -f "find ${CMAKE_CURRENT_SOURCE_DIR}/pcap/query/ -name *.pcap|sort -V" WORKING_DIRECTORY ${PROTO_TEST_RUN_DIR})
+add_test(NAME DNS_CNAME COMMAND proto_test_main ${CMAKE_CURRENT_SOURCE_DIR}/pcap/cname/cname_result.json -f "find ${CMAKE_CURRENT_SOURCE_DIR}/pcap/cname/ -name *.pcap|sort -V" WORKING_DIRECTORY ${PROTO_TEST_RUN_DIR})
+add_test(NAME DNS_NSEC COMMAND proto_test_main ${CMAKE_CURRENT_SOURCE_DIR}/pcap/nsec/nsec_result.json -f "find ${CMAKE_CURRENT_SOURCE_DIR}/pcap/nsec/ -name *.pcap|sort -V" WORKING_DIRECTORY ${PROTO_TEST_RUN_DIR})
+add_test(NAME DNS_PTR COMMAND proto_test_main ${CMAKE_CURRENT_SOURCE_DIR}/pcap/ptr/ptr_result.json -f "find ${CMAKE_CURRENT_SOURCE_DIR}/pcap/ptr/ -name *.pcap|sort -V" WORKING_DIRECTORY ${PROTO_TEST_RUN_DIR})
+add_test(NAME DNS_SRV COMMAND proto_test_main ${CMAKE_CURRENT_SOURCE_DIR}/pcap/srv/srv_result.json -f "find ${CMAKE_CURRENT_SOURCE_DIR}/pcap/srv/ -name *.pcap|sort -V" WORKING_DIRECTORY ${PROTO_TEST_RUN_DIR})
+add_test(NAME DNS_TXT COMMAND proto_test_main ${CMAKE_CURRENT_SOURCE_DIR}/pcap/txt/txt_result.json -f "find ${CMAKE_CURRENT_SOURCE_DIR}/pcap/txt/ -name *.pcap|sort -V" WORKING_DIRECTORY ${PROTO_TEST_RUN_DIR})
diff --git a/test/dns_test_plug.cpp b/test/dns_test_plug.cpp
index e12cf95..47cc3d5 100644
--- a/test/dns_test_plug.cpp
+++ b/test/dns_test_plug.cpp
@@ -41,32 +41,10 @@ extern "C" unsigned char DNS_TEST_PLUG_ENTRY(stSessionInfo *session_info, void *
     cJSON_AddNumberToObject(ctx, "dns_opcode", (double)dns_info->hdr_info.opcode);
     cJSON_AddNumberToObject(ctx, "dns_rd", (double)dns_info->hdr_info.rd);
 
-	cJSON *item=NULL;
-    cJSON *cname_array=cJSON_CreateArray();
-    dns_rr_t *rr=NULL;
-	for(int i=0; i<dns_info->rr_count && dns_info->rr != NULL; i++)
-	{
-		rr = &dns_info->rr[i];
-		if(rr!=NULL && rr->type==DNS_TYPE_CNAME)
-		{
-			if(rr->rdata.cname != NULL)
-			{
-				item=cJSON_CreateString((const char *)rr->rdata.cname);
-				cJSON_AddItemToArray(cname_array, item);
-			}
-		}
-	}
-
-    if(cJSON_GetArraySize(cname_array) > 0)
-    {
-        cJSON_AddItemToObject(ctx, "dns_cnames", cname_array);
-    }
-    else
-    {
-        cJSON_Delete(cname_array);
-	    cname_array=NULL;
-    }
-
+	int dns_sec=0;
+	cJSON *rr_object=cJSON_CreateObject();
+	get_rr_str2json(rr_object, dns_info, &dns_sec);
+	cJSON_AddItemToObject(ctx, "rr", rr_object);
 
     char result_name[16] = "";
     sprintf(result_name, "DNS_RESULT_%d", g_result_count);
diff --git a/test/pcap/cname/1-dns-query-type-CNAME.pcap b/test/pcap/cname/1-dns-query-type-CNAME.pcap
new file mode 100644
index 0000000..4599a03
--- /dev/null
+++ b/test/pcap/cname/1-dns-query-type-CNAME.pcap
diff --git a/test/pcap/cname/cname_result.json b/test/pcap/cname/cname_result.json
new file mode 100644
index 0000000..e45f919
--- /dev/null
+++ b/test/pcap/cname/cname_result.json
@@ -0,0 +1,21 @@
+[{
+		"Tuple4":	"36.250.92.233.46916>114.114.114.114.53",
+		"dns_qname":	"img.soulapp.cn",
+		"dns_qtype":	5,
+		"dns_qclass":	1,
+		"dns_qr":	0,
+		"dns_opcode":	0,
+		"dns_rd":	1,
+		"rr":	{
+			"rr":	[{
+					"name":	"",
+					"type":	41,
+					"udp_payload":	1280,
+					"rcode":	0,
+					"version":	0,
+					"Z":	0,
+					"rdlength":	0
+				}]
+		},
+		"name":	"DNS_RESULT_1"
+}]
diff --git a/test/pcap/dns_long_rr.zip b/test/pcap/dns_long_rr.zip
new file mode 100644
index 0000000..f366251
--- /dev/null
+++ b/test/pcap/dns_long_rr.zip
diff --git a/test/pcap/nsec/1-dns_long_response.pcap b/test/pcap/nsec/1-dns_long_response.pcap
new file mode 100644
index 0000000..6c4972c
--- /dev/null
+++ b/test/pcap/nsec/1-dns_long_response.pcap
diff --git a/test/pcap/nsec/nsec_result.json b/test/pcap/nsec/nsec_result.json
new file mode 100644
index 0000000..3c8dc3f
--- /dev/null
+++ b/test/pcap/nsec/nsec_result.json
@@ -0,0 +1,543 @@
+[{
+		"Tuple4":	"98.254.85.75.3074>222.17.192.247.53",
+		"dns_qname":	"paypal.com",
+		"dns_qtype":	255,
+		"dns_qclass":	1,
+		"dns_qr":	1,
+		"dns_opcode":	0,
+		"dns_rd":	1,
+		"rr":	{
+			"rr":	[{
+					"name":	"paypal.com",
+					"type":	1,
+					"class":	1,
+					"ttl":	49,
+					"rdlength":	4,
+					"a":	"64.4.250.36"
+				}, {
+					"name":	"paypal.com",
+					"type":	1,
+					"class":	1,
+					"ttl":	49,
+					"rdlength":	4,
+					"a":	"64.4.250.37"
+				}, {
+					"name":	"paypal.com",
+					"type":	47,
+					"class":	1,
+					"ttl":	294,
+					"rdlength":	57,
+					"next_domain":	"0cd20b6fe61233e4a24bf70f30c9ba46.paypal.com",
+					"type_bit_maps":	"000762018000000380010140"
+				}, {
+					"name":	"paypal.com",
+					"type":	6,
+					"class":	1,
+					"ttl":	294,
+					"rdlength":	45,
+					"mname":	"ppns1.phx.paypal.com",
+					"rname":	"hostmaster.paypal.com",
+					"serial":	2012301931,
+					"refresh":	7200,
+					"retry":	600,
+					"cname":	1209600,
+					"minimum":	300
+				}, {
+					"name":	"paypal.com",
+					"type":	48,
+					"class":	1,
+					"ttl":	50,
+					"rdlength":	264,
+					"flags":	257,
+					"protocol":	3,
+					"algo":	5,
+					"public_key":	"03010001d56d982eb23906f4fb9313e5ecc2f4626c09bd745a4544d6a3006e2940379299d3fc090fee0fd7f581edcb570b44671231f356b2a62ec17345bde6a48f709b471fe6937c04731255f743a7272337219b332ec4289efb3ce0fb9528a6268b8cc794e9f8741a259794d0c9d7264478a9a02f4a1af988db556a8a4eb885d07d10e72dd0e8c444f0f57a6520bf709297b5816e6e40d93e161cb83d1c9ff9ee728608998de9a6462103247f85c425007fc655fb11d2bae716298dd5d6d1217a9b5d51a2006e70860d61936e2f7389a8ba4ab2f346bac37889b09b8d8f9310f971444c5aa1d02017c42650c1fa4a2a58f9bbdec0cf3253e0a01532c5bff0e4914b57e7"
+				}, {
+					"name":	"paypal.com",
+					"type":	48,
+					"class":	1,
+					"ttl":	50,
+					"rdlength":	136,
+					"flags":	256,
+					"protocol":	3,
+					"algo":	5,
+					"public_key":	"03010001cffbafbc3aa84839f6fcf27dc2a0226ecade1e37b6094a3898e81722b9971865d9eeef87c0b0be3ddcc0a40771cb2f5aebc02b4ba69934b2b31653d09260c3c824848186899eb73094dc6e87037b3819880feae1e8e98ddae3dbb82ce6608702cc82f41015662cac7c8c2ab5116c3f41a38af358cc873aa865805dc00928b2d7"
+				}, {
+					"name":	"paypal.com",
+					"type":	46,
+					"class":	1,
+					"ttl":	102,
+					"rdlength":	158,
+					"type_covered":	1,
+					"algo":	5,
+					"labels":	2,
+					"original_ttl":	300,
+					"sig_expiration":	1635227563,
+					"sig_inception":	1632634805,
+					"key_tag":	11811,
+					"signer_name":	"paypal.com",
+					"signature":	"1a9448ee34c445f9865e38cd66b3d555cfffe2a2e04515005245f32280000796ff889bdc400eada1e19659d25cf6f0060dd06e6fecbc1269f093b383e00be88d0c06969d37d449676461a268762661d1c2478ee5b7053d97bee870fdc2d064793fd48b4ac025518cc0437ad94c142b0946a37bd6fd5cb9c84389dc13e0c37e39"
+				}, {
+					"name":	"paypal.com",
+					"type":	257,
+					"class":	1,
+					"ttl":	700,
+					"rdlength":	25
+				}, {
+					"name":	"paypal.com",
+					"type":	257,
+					"class":	1,
+					"ttl":	700,
+					"rdlength":	19
+				}, {
+					"name":	"paypal.com",
+					"type":	257,
+					"class":	1,
+					"ttl":	700,
+					"rdlength":	19
+				}, {
+					"name":	"paypal.com",
+					"type":	15,
+					"class":	1,
+					"ttl":	696,
+					"rdlength":	19,
+					"exchange":	"mx2.paypalcorp.com",
+					"preference":	10
+				}, {
+					"name":	"paypal.com",
+					"type":	15,
+					"class":	1,
+					"ttl":	696,
+					"rdlength":	8,
+					"exchange":	"mx1.paypalcorp.com",
+					"preference":	10
+				}, {
+					"name":	"paypal.com",
+					"type":	46,
+					"class":	1,
+					"ttl":	86095,
+					"rdlength":	183,
+					"type_covered":	43,
+					"algo":	8,
+					"labels":	2,
+					"original_ttl":	86400,
+					"sig_expiration":	1633580133,
+					"sig_inception":	1632971133,
+					"key_tag":	39343,
+					"signer_name":	"com",
+					"signature":	"af49968e9f965cf128611bce9c7c90c6e47c2974976491270f3c2c7407439549a50e7d55026ae1ab16c3c56621e2f8f4a0e2af8da6a7c959be9c7e052035ba1d5ce50715c342a41f7455cd01eaff65bcf4c6bd0ee82aab3738582a8bfeee7e8bcf8519f5cef2daec8b6dbac52f3d446302c66bbcc7125be0189a4fa5226f09202322286f543cf0d9842b86d200713fe5e9d0b36f1d667a0cf08bdcfb2088b918"
+				}, {
+					"name":	"paypal.com",
+					"type":	43,
+					"class":	1,
+					"ttl":	86095,
+					"rdlength":	36,
+					"key_tag":	21037,
+					"algo":	5,
+					"digest_type":	2,
+					"digest":	"0df17b28554954d819e0ceeab98fcfcd56572a4cf4f551f0a9be6d04db2f65c3"
+				}, {
+					"name":	"paypal.com",
+					"type":	46,
+					"class":	1,
+					"ttl":	3402,
+					"rdlength":	158,
+					"type_covered":	257,
+					"algo":	5,
+					"labels":	2,
+					"original_ttl":	3600,
+					"sig_expiration":	1634811814,
+					"sig_inception":	1632217986,
+					"key_tag":	11811,
+					"signer_name":	"paypal.com",
+					"signature":	"67d69f20731812dba88c94b5d96d0771f362179998b07d6ce0061532348d7cb796808b4e72929276834e43596462a9c4a633fa178c477042e9a69bc375a05432a4fd1fb5461c3fe33ffff0ff583702a03c6f3393688f74fe707db82fd1757c25b5092e18045b2853a82c2ef07ba0561795b261062d869b4e7456f691a6446ba9"
+				}, {
+					"name":	"paypal.com",
+					"type":	46,
+					"class":	1,
+					"ttl":	402,
+					"rdlength":	158,
+					"type_covered":	48,
+					"algo":	5,
+					"labels":	2,
+					"original_ttl":	600,
+					"sig_expiration":	1635136648,
+					"sig_inception":	1632542501,
+					"key_tag":	11811,
+					"signer_name":	"paypal.com",
+					"signature":	"29bb0cb74b22af3dba99367b25b078f7e8ff976b4d598c7e8e7d7d21729d6b505b6bd79811f9c25da40ef08c4e176954fc2625e2aacba25cfed5fcf2031b16ad4aba1c147cad5e53b145581b32a382cf5ce7b268fd9439bf16960f1b202a59e61ed6a4caad8f9175d1e552c47db6e6b6a3a5a6c1f1228444a13eddb6f8addf67"
+				}, {
+					"name":	"paypal.com",
+					"type":	46,
+					"class":	1,
+					"ttl":	402,
+					"rdlength":	286,
+					"type_covered":	48,
+					"algo":	5,
+					"labels":	2,
+					"original_ttl":	600,
+					"sig_expiration":	1635136648,
+					"sig_inception":	1632542501,
+					"key_tag":	21037,
+					"signer_name":	"paypal.com",
+					"signature":	"14e65e068797c7eda6d43936d3cdb41546076a1e83dbd91df766115c56a3e6d1fa5ac043bdfc215f1ff8c5f78e7086c20eb16f1e00b33269a936b2b67918feeea560ed892b6a4a5e461744a6332058aea97c7f98e6a0f8d463c1557c9d131305d3be8598a2c968eb6a5a530b395ed7dcc3b3c1fc4037a4f5306e064f9ec446d698bb1a851b0ad04ea6613da967a8e4fdad14d8d34c66a5b4a4eb609e067c6f72682a4c8296d0e6b2f83492d0b4e76225f72ae16ba3ec5b9853ae92d1a57f3918d2c789cdc21cce51e1e87e90595e83ea3a69c024d011e58581161b1130d5a800fe743b2eebb590377dacc82251d0900371b9078f72e7820687b93c563d2635d5"
+				}, {
+					"name":	"paypal.com",
+					"type":	46,
+					"class":	1,
+					"ttl":	294,
+					"rdlength":	158,
+					"type_covered":	47,
+					"algo":	5,
+					"labels":	2,
+					"original_ttl":	300,
+					"sig_expiration":	1635389589,
+					"sig_inception":	1632794998,
+					"key_tag":	11811,
+					"signer_name":	"paypal.com",
+					"signature":	"7176a00d8700689c1adf145e5fac07344800603003989f38f4285eab81c429a3e8df7791389e0024814027dc2f5e71af4a54a2ae6b8a6a93c8a7676d8c50d19b07b3da559e7e5ac8c090658dfde1fa2316c04f8902fd5749e9c05b8bb08038205aca7b9bdadda7a9f232b689e3fbb8ce92777c2c268ff76945af88d36bf61889"
+				}, {
+					"name":	"paypal.com",
+					"type":	46,
+					"class":	1,
+					"ttl":	102,
+					"rdlength":	158,
+					"type_covered":	16,
+					"algo":	5,
+					"labels":	2,
+					"original_ttl":	300,
+					"sig_expiration":	1634782028,
+					"sig_inception":	1632186783,
+					"key_tag":	11811,
+					"signer_name":	"paypal.com",
+					"signature":	"47d1d025a0425dbb4cf6078b3f5cfd89d8ffbc7540fe5808c89b9412d88d436f5f80164ac4795bc888479bbc9a1f5e591bee20b71145978bb034546cc70b0d485fa089dcf1f80eb65af86b9c1c782b981b0ed9f5d5694693775cdf01d81fab8b571c8ea0dcec6a7370a73bcc7bdaba2ad835ac7eb17aba8092f32a496195547e"
+				}, {
+					"name":	"paypal.com",
+					"type":	46,
+					"class":	1,
+					"ttl":	3402,
+					"rdlength":	158,
+					"type_covered":	15,
+					"algo":	5,
+					"labels":	2,
+					"original_ttl":	3600,
+					"sig_expiration":	1634757474,
+					"sig_inception":	1632163454,
+					"key_tag":	11811,
+					"signer_name":	"paypal.com",
+					"signature":	"18a292822241eb924112987fbd88f0c7ba32413dc85cff4271cea273b9f048553f64fa9f30d8f92c6c267b0e3d30346ca3c3f66ac8f8f842ef6b82715ef659fbd7172d9e055af57d7ef5413c321f079785dc4ac0cf5599e885101aa0008c319e35a5a308c9d42612688b51339729ea132dfa78be2f977644e400e89a5a84bebd"
+				}, {
+					"name":	"paypal.com",
+					"type":	46,
+					"class":	1,
+					"ttl":	294,
+					"rdlength":	158,
+					"type_covered":	6,
+					"algo":	5,
+					"labels":	2,
+					"original_ttl":	300,
+					"sig_expiration":	1635650618,
+					"sig_inception":	1633055018,
+					"key_tag":	11811,
+					"signer_name":	"paypal.com",
+					"signature":	"27e610ebe0c337d24136294885909db576a61911d593212bb2fd7740d999dfa5a998aa3c39432766025a64803016cd5e2e4d7b6c183acd88f408ec579cbb1895852187832fc02b4b08ed6f4371ad82a22a10db0c201cae553ab09deabcf9285b81637b74793bcba4ceb08366ea964058f1c08443278d1ab08c84d6045882dd26"
+				}, {
+					"name":	"paypal.com",
+					"type":	46,
+					"class":	1,
+					"ttl":	294,
+					"rdlength":	158,
+					"type_covered":	2,
+					"algo":	5,
+					"labels":	2,
+					"original_ttl":	300,
+					"sig_expiration":	1635156818,
+					"sig_inception":	1632563118,
+					"key_tag":	11811,
+					"signer_name":	"paypal.com",
+					"signature":	"211edec16ca058012e8396cef732869b3b343286f20a10f10919c15513990f6cf46f1d9a87704a1b7e9070c427d21a1b016bd80940af675605cb351f301d204080dff7c0db068847accc28bdece9d739bcb7696dd646164f47066c63a0ba4ef6acbedea637ead554342c429552516d9663bca8eb367a84f25bc70332fdf51872"
+				}, {
+					"name":	"com",
+					"type":	2,
+					"class":	1,
+					"ttl":	72900,
+					"rdlength":	20,
+					"ns":	"j.gtld-servers.net"
+				}, {
+					"name":	"com",
+					"type":	2,
+					"class":	1,
+					"ttl":	72900,
+					"rdlength":	4,
+					"ns":	"e.gtld-servers.net"
+				}, {
+					"name":	"com",
+					"type":	2,
+					"class":	1,
+					"ttl":	72900,
+					"rdlength":	4,
+					"ns":	"l.gtld-servers.net"
+				}, {
+					"name":	"com",
+					"type":	2,
+					"class":	1,
+					"ttl":	72900,
+					"rdlength":	4,
+					"ns":	"f.gtld-servers.net"
+				}, {
+					"name":	"com",
+					"type":	2,
+					"class":	1,
+					"ttl":	72900,
+					"rdlength":	4,
+					"ns":	"c.gtld-servers.net"
+				}, {
+					"name":	"com",
+					"type":	2,
+					"class":	1,
+					"ttl":	72900,
+					"rdlength":	4,
+					"ns":	"i.gtld-servers.net"
+				}, {
+					"name":	"com",
+					"type":	2,
+					"class":	1,
+					"ttl":	72900,
+					"rdlength":	4,
+					"ns":	"d.gtld-servers.net"
+				}, {
+					"name":	"com",
+					"type":	2,
+					"class":	1,
+					"ttl":	72900,
+					"rdlength":	4,
+					"ns":	"b.gtld-servers.net"
+				}, {
+					"name":	"com",
+					"type":	2,
+					"class":	1,
+					"ttl":	72900,
+					"rdlength":	4,
+					"ns":	"g.gtld-servers.net"
+				}, {
+					"name":	"com",
+					"type":	2,
+					"class":	1,
+					"ttl":	72900,
+					"rdlength":	4,
+					"ns":	"k.gtld-servers.net"
+				}, {
+					"name":	"com",
+					"type":	2,
+					"class":	1,
+					"ttl":	72900,
+					"rdlength":	4,
+					"ns":	"h.gtld-servers.net"
+				}, {
+					"name":	"com",
+					"type":	2,
+					"class":	1,
+					"ttl":	72900,
+					"rdlength":	4,
+					"ns":	"a.gtld-servers.net"
+				}, {
+					"name":	"com",
+					"type":	2,
+					"class":	1,
+					"ttl":	72900,
+					"rdlength":	4,
+					"ns":	"m.gtld-servers.net"
+				}, {
+					"name":	"j.gtld-servers.net",
+					"type":	1,
+					"class":	1,
+					"ttl":	24,
+					"rdlength":	4,
+					"a":	"192.48.79.30"
+				}, {
+					"name":	"e.gtld-servers.net",
+					"type":	1,
+					"class":	1,
+					"ttl":	50201,
+					"rdlength":	4,
+					"a":	"192.12.94.30"
+				}, {
+					"name":	"g.gtld-servers.net",
+					"type":	1,
+					"class":	1,
+					"ttl":	13379,
+					"rdlength":	4,
+					"a":	"192.42.93.30"
+				}, {
+					"name":	"m.gtld-servers.net",
+					"type":	1,
+					"class":	1,
+					"ttl":	164224,
+					"rdlength":	4,
+					"a":	"192.55.83.30"
+				}, {
+					"name":	"k.gtld-servers.net",
+					"type":	1,
+					"class":	1,
+					"ttl":	9591,
+					"rdlength":	4,
+					"a":	"192.52.178.30"
+				}, {
+					"name":	"i.gtld-servers.net",
+					"type":	1,
+					"class":	1,
+					"ttl":	1012,
+					"rdlength":	4,
+					"a":	"192.43.172.30"
+				}, {
+					"name":	"h.gtld-servers.net",
+					"type":	1,
+					"class":	1,
+					"ttl":	27539,
+					"rdlength":	4,
+					"a":	"192.54.112.30"
+				}, {
+					"name":	"c.gtld-servers.net",
+					"type":	1,
+					"class":	1,
+					"ttl":	74369,
+					"rdlength":	4,
+					"a":	"192.26.92.30"
+				}, {
+					"name":	"l.gtld-servers.net",
+					"type":	1,
+					"class":	1,
+					"ttl":	4078,
+					"rdlength":	4,
+					"a":	"192.41.162.30"
+				}, {
+					"name":	"d.gtld-servers.net",
+					"type":	1,
+					"class":	1,
+					"ttl":	6886,
+					"rdlength":	4,
+					"a":	"192.31.80.30"
+				}, {
+					"name":	"f.gtld-servers.net",
+					"type":	1,
+					"class":	1,
+					"ttl":	21484,
+					"rdlength":	4,
+					"a":	"192.35.51.30"
+				}, {
+					"name":	"a.gtld-servers.net",
+					"type":	1,
+					"class":	1,
+					"ttl":	80825,
+					"rdlength":	4,
+					"a":	"192.5.6.30"
+				}, {
+					"name":	"b.gtld-servers.net",
+					"type":	1,
+					"class":	1,
+					"ttl":	76063,
+					"rdlength":	4,
+					"a":	"192.33.14.30"
+				}, {
+					"name":	"j.gtld-servers.net",
+					"type":	28,
+					"class":	1,
+					"ttl":	8232,
+					"rdlength":	16,
+					"aaaa":	"2001:502:7094::30"
+				}, {
+					"name":	"e.gtld-servers.net",
+					"type":	28,
+					"class":	1,
+					"ttl":	14895,
+					"rdlength":	16,
+					"aaaa":	"2001:502:1ca1::30"
+				}, {
+					"name":	"g.gtld-servers.net",
+					"type":	28,
+					"class":	1,
+					"ttl":	24249,
+					"rdlength":	16,
+					"aaaa":	"2001:503:eea3::30"
+				}, {
+					"name":	"m.gtld-servers.net",
+					"type":	28,
+					"class":	1,
+					"ttl":	169791,
+					"rdlength":	16,
+					"aaaa":	"2001:501:b1f9::30"
+				}, {
+					"name":	"k.gtld-servers.net",
+					"type":	28,
+					"class":	1,
+					"ttl":	13204,
+					"rdlength":	16,
+					"aaaa":	"2001:503:d2d::30"
+				}, {
+					"name":	"i.gtld-servers.net",
+					"type":	28,
+					"class":	1,
+					"ttl":	5983,
+					"rdlength":	16,
+					"aaaa":	"2001:503:39c1::30"
+				}, {
+					"name":	"h.gtld-servers.net",
+					"type":	28,
+					"class":	1,
+					"ttl":	16702,
+					"rdlength":	16,
+					"aaaa":	"2001:502:8cc::30"
+				}, {
+					"name":	"c.gtld-servers.net",
+					"type":	28,
+					"class":	1,
+					"ttl":	57281,
+					"rdlength":	16,
+					"aaaa":	"2001:503:83eb::30"
+				}, {
+					"name":	"l.gtld-servers.net",
+					"type":	28,
+					"class":	1,
+					"ttl":	16251,
+					"rdlength":	16,
+					"aaaa":	"2001:500:d937::30"
+				}, {
+					"name":	"d.gtld-servers.net",
+					"type":	28,
+					"class":	1,
+					"ttl":	31236,
+					"rdlength":	16,
+					"aaaa":	"2001:500:856e::30"
+				}, {
+					"name":	"f.gtld-servers.net",
+					"type":	28,
+					"class":	1,
+					"ttl":	11292,
+					"rdlength":	16,
+					"aaaa":	"2001:503:d414::30"
+				}, {
+					"name":	"a.gtld-servers.net",
+					"type":	28,
+					"class":	1,
+					"ttl":	35359,
+					"rdlength":	16,
+					"aaaa":	"2001:503:a83e::2:30"
+				}, {
+					"name":	"b.gtld-servers.net",
+					"type":	28,
+					"class":	1,
+					"ttl":	22350,
+					"rdlength":	16,
+					"aaaa":	"2001:503:231d::2:30"
+				}, {
+					"name":	"",
+					"type":	41,
+					"udp_payload":	4096,
+					"rcode":	0,
+					"version":	0,
+					"Z":	0,
+					"rdlength":	0
+				}]
+		},
+		"name":	"DNS_RESULT_1"
+}]
diff --git a/test/pcap/ptr/1-dns-query-type-PTR.pcap b/test/pcap/ptr/1-dns-query-type-PTR.pcap
new file mode 100644
index 0000000..403820d
--- /dev/null
+++ b/test/pcap/ptr/1-dns-query-type-PTR.pcap
diff --git a/test/pcap/ptr/ptr_result.json b/test/pcap/ptr/ptr_result.json
new file mode 100644
index 0000000..1fd4722
--- /dev/null
+++ b/test/pcap/ptr/ptr_result.json
@@ -0,0 +1,21 @@
+[{
+		"Tuple4":	"175.43.16.118.51870>211.138.145.194.53",
+		"dns_qname":	"9.8.0.1.4.9.7.e.1.0.0.0.1.0.0.0.1.e.3.d.0.2.0.5.4.3.9.8.9.0.4.2.ip6.arpa",
+		"dns_qtype":	12,
+		"dns_qclass":	1,
+		"dns_qr":	0,
+		"dns_opcode":	0,
+		"dns_rd":	0,
+		"rr":	{
+			"rr":	[{
+					"name":	"",
+					"type":	41,
+					"udp_payload":	1432,
+					"rcode":	0,
+					"version":	0,
+					"Z":	1,
+					"rdlength":	0
+				}]
+		},
+		"name":	"DNS_RESULT_1"
+}]
diff --git a/test/pcap/1-dns_10_query.pcap b/test/pcap/query/1-dns_10_query.pcap
index 3a79f92..3a79f92 100644
--- a/test/pcap/1-dns_10_query.pcap
+++ b/test/pcap/query/1-dns_10_query.pcap
diff --git a/test/pcap/query/query_result.json b/test/pcap/query/query_result.json
new file mode 100644
index 0000000..81bbd1e
--- /dev/null
+++ b/test/pcap/query/query_result.json
@@ -0,0 +1,177 @@
+[{
+		"Tuple4":	"109.194.160.4.57766>95.211.92.14.53",
+		"dns_qname":	"picslife.ru",
+		"dns_qtype":	1,
+		"dns_qclass":	1,
+		"dns_qr":	0,
+		"dns_opcode":	0,
+		"dns_rd":	0,
+		"rr":	{
+			"rr":	[{
+					"name":	"",
+					"type":	41,
+					"udp_payload":	4096,
+					"rcode":	0,
+					"version":	0,
+					"Z":	1,
+					"rdlength":	0
+				}]
+		},
+		"name":	"DNS_RESULT_1"
+	}, {
+		"Tuple4":	"109.60.128.2.61396>95.211.92.15.53",
+		"dns_qname":	"finance.vtomske.ru",
+		"dns_qtype":	1,
+		"dns_qclass":	1,
+		"dns_qr":	0,
+		"dns_opcode":	0,
+		"dns_rd":	0,
+		"rr":	{
+			"rr":	[]
+		},
+		"name":	"DNS_RESULT_2"
+	}, {
+		"Tuple4":	"208.69.33.21.18984>95.211.92.15.53",
+		"dns_qname":	"mail.guru-net.com",
+		"dns_qtype":	28,
+		"dns_qclass":	1,
+		"dns_qr":	0,
+		"dns_opcode":	0,
+		"dns_rd":	0,
+		"rr":	{
+			"rr":	[{
+					"name":	"",
+					"type":	41,
+					"udp_payload":	1410,
+					"rcode":	0,
+					"version":	0,
+					"Z":	0,
+					"rdlength":	0
+				}]
+		},
+		"name":	"DNS_RESULT_3"
+	}, {
+		"Tuple4":	"80.70.96.161.18784>95.211.92.14.53",
+		"dns_qname":	"xage.ru",
+		"dns_qtype":	28,
+		"dns_qclass":	1,
+		"dns_qr":	0,
+		"dns_opcode":	0,
+		"dns_rd":	0,
+		"rr":	{
+			"rr":	[]
+		},
+		"name":	"DNS_RESULT_4"
+	}, {
+		"Tuple4":	"77.37.251.74.22422>95.211.92.14.53",
+		"dns_qname":	"oknakonsalt.ru",
+		"dns_qtype":	1,
+		"dns_qclass":	1,
+		"dns_qr":	0,
+		"dns_opcode":	0,
+		"dns_rd":	0,
+		"rr":	{
+			"rr":	[{
+					"name":	"",
+					"type":	41,
+					"udp_payload":	4096,
+					"rcode":	0,
+					"version":	0,
+					"Z":	1,
+					"rdlength":	0
+				}]
+		},
+		"name":	"DNS_RESULT_5"
+	}, {
+		"Tuple4":	"37.9.88.84.5301>95.211.92.14.53",
+		"dns_qname":	"73dom.com",
+		"dns_qtype":	1,
+		"dns_qclass":	1,
+		"dns_qr":	0,
+		"dns_opcode":	0,
+		"dns_rd":	0,
+		"rr":	{
+			"rr":	[{
+					"name":	"",
+					"type":	41,
+					"udp_payload":	4096,
+					"rcode":	0,
+					"version":	0,
+					"Z":	1,
+					"rdlength":	0
+				}]
+		},
+		"name":	"DNS_RESULT_6"
+	}, {
+		"Tuple4":	"109.60.128.2.17115>95.211.92.15.53",
+		"dns_qname":	"pogoda.vtomske.ru",
+		"dns_qtype":	1,
+		"dns_qclass":	1,
+		"dns_qr":	0,
+		"dns_opcode":	0,
+		"dns_rd":	0,
+		"rr":	{
+			"rr":	[]
+		},
+		"name":	"DNS_RESULT_7"
+	}, {
+		"Tuple4":	"5.45.192.86.5301>95.211.92.14.53",
+		"dns_qname":	"rpp.nashaucheba.ru",
+		"dns_qtype":	1,
+		"dns_qclass":	1,
+		"dns_qr":	0,
+		"dns_opcode":	0,
+		"dns_rd":	0,
+		"rr":	{
+			"rr":	[{
+					"name":	"",
+					"type":	41,
+					"udp_payload":	4096,
+					"rcode":	0,
+					"version":	0,
+					"Z":	1,
+					"rdlength":	0
+				}]
+		},
+		"name":	"DNS_RESULT_8"
+	}, {
+		"Tuple4":	"173.252.79.126.21760>95.211.92.14.53",
+		"dns_qname":	"mail.yarisvet.com",
+		"dns_qtype":	1,
+		"dns_qclass":	1,
+		"dns_qr":	0,
+		"dns_opcode":	0,
+		"dns_rd":	0,
+		"rr":	{
+			"rr":	[{
+					"name":	"",
+					"type":	41,
+					"udp_payload":	4096,
+					"rcode":	0,
+					"version":	0,
+					"Z":	1,
+					"rdlength":	0
+				}]
+		},
+		"name":	"DNS_RESULT_9"
+	}, {
+		"Tuple4":	"194.9.70.2.56818>95.211.92.14.53",
+		"dns_qname":	"kuklazine.ru",
+		"dns_qtype":	1,
+		"dns_qclass":	1,
+		"dns_qr":	0,
+		"dns_opcode":	0,
+		"dns_rd":	0,
+		"rr":	{
+			"rr":	[{
+					"name":	"",
+					"type":	41,
+					"udp_payload":	4096,
+					"rcode":	0,
+					"version":	0,
+					"Z":	1,
+					"rdlength":	0
+				}]
+		},
+		"name":	"DNS_RESULT_10"
+}]
diff --git a/test/pcap/srv/1-dns-query-type-SRV.pcap b/test/pcap/srv/1-dns-query-type-SRV.pcap
new file mode 100644
index 0000000..3559cfc
--- /dev/null
+++ b/test/pcap/srv/1-dns-query-type-SRV.pcap
diff --git a/test/pcap/srv/srv_result.json b/test/pcap/srv/srv_result.json
new file mode 100644
index 0000000..5da4062
--- /dev/null
+++ b/test/pcap/srv/srv_result.json
@@ -0,0 +1,13 @@
+[{
+		"Tuple4":	"36.251.139.34.51235>114.114.114.114.53",
+		"dns_qname":	"_http._tcp.(null)",
+		"dns_qtype":	33,
+		"dns_qclass":	1,
+		"dns_qr":	0,
+		"dns_opcode":	0,
+		"dns_rd":	1,
+		"rr":	{
+			"rr":	[]
+		},
+		"name":	"DNS_RESULT_1"
+}]
diff --git a/test/pcap/txt/1-dns-query-type-TXT.pcap b/test/pcap/txt/1-dns-query-type-TXT.pcap
new file mode 100644
index 0000000..1208373
--- /dev/null
+++ b/test/pcap/txt/1-dns-query-type-TXT.pcap
diff --git a/test/pcap/txt/txt_result.json b/test/pcap/txt/txt_result.json
new file mode 100644
index 0000000..fe51488
--- /dev/null
+++ b/test/pcap/txt/txt_result.json
@@ -0,0 +1 @@
+[]