Feature: performance test case

1 files changed, 108 insertions, 87 deletions

diff --git a/src/dns_decoder.cpp b/src/dns_decoder.cpp
index 70fba40..23a0ccf 100644
--- a/src/dns_decoder.cpp
+++ b/src/dns_decoder.cpp
@@ -1,19 +1,11 @@
-/*
-**********************************************************************************************
-*	File: dns_decoder.c
-*   Description:
-*	Authors: Liu XueLi <[email protected]>
-*	Date:    2024-02-07
-*   Copyright: (c) Since 2022 Geedge Networks, Ltd. All rights reserved.
-***********************************************************************************************
-*/
-
 #include <stdio.h>
 #include <string.h>
 #include <assert.h>
 #include <stdlib.h>
 
 #include "dns_decoder.h"
+#include "dns_resource_record.h"
+
 #include "toml/toml.h"
 #include "uthash/uthash.h"
 #include "uthash/utlist.h"
@@ -53,17 +45,23 @@ extern "C"
 #define	TAG_KEY_DNS_SECTION		"section"
 #define	TAG_KEY_DNS_QR			"qr"
 
-#define	TAG_KEY_IP_PROTOCOL	"ip_protocol"
-#define	TAG_VALUE_IP_PROTOCOL_TCP	"tcp"
-#define	TAG_VALUE_IP_PROTOCOL_UDP	"udp"
-
-#define	TAG_KEY_IP_VERSION	"ip_version"
-#define	TAG_VALUE_IP_VERSION_IPV4	"ipv4"
-#define	TAG_VALUE_IP_VERSION_IPV6	"ipv6"
+#define	TAG_KEY_IPPROTO	"ipproto"
+#define	TAG_VALUE_IPV4_TCP	"ipv4_tcp"
+#define	TAG_VALUE_IPV6_TCP	"ipv6_tcp"
+#define	TAG_VALUE_IPV4_UDP	"ipv4_udp"
+#define	TAG_VALUE_IPV6_UDP	"ipv6_udp"
+#define	TAG_VALUE_UNKNOWN	"unknown"
 
 #define DNS_MESSAGE_MAGIC	0x53535353
 #define	DNS_DECODER_TOML_PATH "./etc/dns/dns_decoder.toml"
 
+#define DNS_CLASS_UNKNOWN	0
+#define DNS_CLASS_IN		1
+#define DNS_CLASS_CS		2
+#define DNS_CLASS_CH		3
+#define DNS_CLASS_HS		4
+#define DNS_CLASS_ANY		255
+
 struct dns_message 
 {
 	int32_t magic;
@@ -222,7 +220,7 @@ int32_t dns_read_be_u16(uint8_t *payload, size_t payload_sz, size_t *payload_off
 	
 	if(value!=NULL)
 	{
-		*value=ntohs(*(uint16_t *)(payload+(*payload_offset)));
+		*value=((uint16_t)payload[*payload_offset] << 8) | (uint16_t)payload[*payload_offset+1];
 	}
 
 	(*payload_offset)+=2;
@@ -1156,8 +1154,8 @@ void dns_message_free(struct session *ss, void *expr_str, void *msg_free_arg)
 
 	msg->trans_identifier_id=0;
 	msg->decode_rr_status=DNS_RR_STATUS_INIT;
-	memset(&(msg->flag), 0, sizeof(struct dns_flag));
-	memset(&(msg->question), 0, sizeof(struct dns_query_question));
+	msg->flag={0};
+	//memset(&(msg->question), 0, sizeof(struct dns_query_question));
 
 	msg->rr_capacity_offset=0;
 }
@@ -1173,7 +1171,6 @@ void dns_decoder_session_transaction_del(struct dns_decoder_context *per_ss_ctx,
 {
 	if(per_ss_ctx->trans_list_head==NULL || current_trans==NULL)
 	{
-		assert(per_ss_ctx->trans_list_num==0);
 		return ;
 	}
 
@@ -1194,6 +1191,27 @@ void dns_message_transaction_publish(struct session *ss, enum dns_message_type t
 	session_mq_publish_message(ss, topic_id, msg);
 }
 
+const char *dns_decoder_ipproto_string_get(struct session *ss)
+{
+	enum session_addr_type addr_type=SESSION_ADDR_TYPE_UNKNOWN;
+	session_get0_addr(ss, &addr_type);
+	switch(addr_type)
+	{
+		case	SESSION_ADDR_TYPE_IPV4_TCP:
+			return TAG_VALUE_IPV4_TCP;
+		case	SESSION_ADDR_TYPE_IPV4_UDP:
+			return TAG_VALUE_IPV4_UDP;
+		case	SESSION_ADDR_TYPE_IPV6_TCP:
+			return TAG_VALUE_IPV6_TCP;
+		case	SESSION_ADDR_TYPE_IPV6_UDP:
+			return TAG_VALUE_IPV6_UDP;
+		default:
+			break;
+	}
+
+	return TAG_VALUE_UNKNOWN;
+}
+
 void dns_decoder_entry(struct session *ss, uint8_t *payload, size_t payload_sz, void *per_session_ctx, void *plugin_env_str)
 {
     struct dns_header dns_hdr={0};
@@ -1207,13 +1225,9 @@ void dns_decoder_entry(struct session *ss, uint8_t *payload, size_t payload_sz,
 
 	size_t payload_offset=DNS_HEADER_SIZE;
 	int32_t thread_id=session_get_current_thread_id(ss);
+	const char *ipproto=dns_decoder_ipproto_string_get(ss);
 	struct dns_decoder_plugin_env *plugin_env=(struct dns_decoder_plugin_env *)plugin_env_str;
 
-	enum session_addr_type addr_type=SESSION_ADDR_TYPE_UNKNOWN;
-    session_get0_addr(ss, &addr_type);
-	const char *ip_version=(addr_type==SESSION_ADDR_TYPE_IPV4_TCP || addr_type==SESSION_ADDR_TYPE_IPV4_UDP) ? TAG_VALUE_IP_VERSION_IPV4 : TAG_VALUE_IP_VERSION_IPV6;
-	const char *ip_protocol=(addr_type==SESSION_ADDR_TYPE_IPV4_TCP || addr_type==SESSION_ADDR_TYPE_IPV6_TCP) ? TAG_VALUE_IP_PROTOCOL_TCP : TAG_VALUE_IP_PROTOCOL_UDP;
-
 	struct dns_message *data_msg=&(plugin_env->per_thread_data_msg[thread_id]);
 	data_msg->ss=NULL;
 	data_msg->n_real_answer_rr=0;
@@ -1232,9 +1246,9 @@ void dns_decoder_entry(struct session *ss, uint8_t *payload, size_t payload_sz,
 
 	if(data_msg->n_question==1)
 	{
-		size_t tag_offset=4;
-		const char *tag_key[tag_offset]={TAG_KEY_IP_VERSION, TAG_KEY_IP_PROTOCOL, TAG_KEY_DNS_QR, TAG_KEY_DNS_SECTION};
-		const char *tag_value[tag_offset]={ip_version, ip_protocol, ((dns_hdr.qr==0) ? "query" : "response"), "question"};
+		size_t tag_offset=3;
+		const char *tag_key[tag_offset]={TAG_KEY_IPPROTO, TAG_KEY_DNS_QR, TAG_KEY_DNS_SECTION};
+		const char *tag_value[tag_offset]={ipproto, ((dns_hdr.qr==0) ? "query" : "response"), "question"};
 		ret=dns_query_question_decode(&(data_msg->question), payload, payload_sz, &payload_offset);
 		if(ret<DNS_DECODER_FALSE)
 		{
@@ -1246,6 +1260,7 @@ void dns_decoder_entry(struct session *ss, uint8_t *payload, size_t payload_sz,
 		dns_decoder_local_file_counter_incby(plugin_env, LOCAL_STAT_COUNTER_OK, tag_key, tag_value, tag_offset, 1, session_get_current_thread_id(ss));
 	}
 
+	int32_t current_trans_idx=0;
 	struct dns_transaction *current_trans=NULL;
 	struct dns_decoder_context *per_ss_ctx=(struct dns_decoder_context *)per_session_ctx;
 
@@ -1259,23 +1274,28 @@ void dns_decoder_entry(struct session *ss, uint8_t *payload, size_t payload_sz,
 		dns_decoder_session_transaction_del(per_ss_ctx, current_trans);
 		current_trans=NULL;
 		
-		size_t tag_offset=4;
-		const char *tag_key[tag_offset]={TAG_KEY_IP_VERSION, TAG_KEY_IP_PROTOCOL, TAG_KEY_MESSAGE_TYPE, TAG_KEY_MESSAGE_STATUS};
-		const char *tag_value[tag_offset]={ip_version, ip_protocol, "transaction_end", "duplicate"};
+		size_t tag_offset=3;
+		const char *tag_key[tag_offset]={TAG_KEY_IPPROTO, TAG_KEY_MESSAGE_TYPE, TAG_KEY_MESSAGE_STATUS};
+		const char *tag_value[tag_offset]={ipproto, "transaction_end", "duplicate"};
 		dns_decoder_local_file_counter_incby(plugin_env, LOCAL_STAT_COUNTER_SEND, tag_key, tag_value, tag_offset, 1, session_get_current_thread_id(ss));
 	}
 
 	if(current_trans==NULL)
 	{
-		current_trans=(struct dns_transaction *)CALLOC(struct dns_transaction, 1);
-		current_trans->trans_idx=(++per_ss_ctx->trans_count);
-		current_trans->message_id=message_id;
-		dns_decoder_session_transaction_add(per_ss_ctx, current_trans);
-		dns_message_transaction_publish(ss, DNS_MESSAGE_TRANSACTION_BEGIN, plugin_env->dns.topic_id, current_trans->trans_idx);
+		current_trans_idx=(++per_ss_ctx->trans_count);
+		if(msg_type==DNS_MESSAGE_QUERY)
+		{
+			current_trans=(struct dns_transaction *)CALLOC(struct dns_transaction, 1);
+			current_trans->trans_idx=current_trans_idx;
+			current_trans->message_id=message_id;
+			dns_decoder_session_transaction_add(per_ss_ctx, current_trans);
+		}
+		
+		dns_message_transaction_publish(ss, DNS_MESSAGE_TRANSACTION_BEGIN, plugin_env->dns.topic_id, current_trans_idx);
 
-		size_t tag_offset=4;
-		const char *tag_key[tag_offset]={TAG_KEY_IP_VERSION, TAG_KEY_IP_PROTOCOL, TAG_KEY_MESSAGE_TYPE, TAG_KEY_MESSAGE_STATUS};
-		const char *tag_value[tag_offset]={ip_version, ip_protocol, "transaction_begin", "normal"};
+		size_t tag_offset=3;
+		const char *tag_key[tag_offset]={TAG_KEY_IPPROTO, TAG_KEY_MESSAGE_TYPE, TAG_KEY_MESSAGE_STATUS};
+		const char *tag_value[tag_offset]={ipproto, "transaction_begin", "normal"};
 		dns_decoder_local_file_counter_incby(plugin_env, LOCAL_STAT_COUNTER_SEND, tag_key, tag_value, tag_offset, 1, session_get_current_thread_id(ss));
 	}
 
@@ -1285,24 +1305,24 @@ void dns_decoder_entry(struct session *ss, uint8_t *payload, size_t payload_sz,
 	data_msg->payload_sz=payload_sz;
 	data_msg->payload_offset=payload_offset;
 	data_msg->decode_rr_status=DNS_RR_STATUS_INIT;
-	data_msg->current_trans_idx=current_trans->trans_idx;
+	data_msg->current_trans_idx=current_trans_idx;
 
     session_mq_publish_message(ss, plugin_env->dns.topic_id, data_msg);
 
-	size_t tag_offset=4;
+	size_t tag_offset=3;
 	const char *type=((msg_type==DNS_MESSAGE_RESPONSE) ? "response" : "query");
-	const char *tag_key[tag_offset]={TAG_KEY_IP_VERSION, TAG_KEY_IP_PROTOCOL, TAG_KEY_MESSAGE_TYPE, TAG_KEY_MESSAGE_STATUS};
-	const char *tag_value[tag_offset]={ip_version, ip_protocol, type, "normal"};
+	const char *tag_key[tag_offset]={TAG_KEY_IPPROTO, TAG_KEY_MESSAGE_TYPE, TAG_KEY_MESSAGE_STATUS};
+	const char *tag_value[tag_offset]={ipproto, type, "normal"};
 	dns_decoder_local_file_counter_incby(plugin_env, LOCAL_STAT_COUNTER_SEND, tag_key, tag_value, tag_offset, 1, session_get_current_thread_id(ss));
 
 	if(msg_type==DNS_MESSAGE_RESPONSE)
 	{
-		dns_message_transaction_publish(ss, DNS_MESSAGE_TRANSACTION_END, plugin_env->dns.topic_id, current_trans->trans_idx);
+		dns_message_transaction_publish(ss, DNS_MESSAGE_TRANSACTION_END, plugin_env->dns.topic_id, current_trans_idx);
 		dns_decoder_session_transaction_del(per_ss_ctx, current_trans);
 
-		size_t tag_offset=4;
-		const char *tag_key[tag_offset]={TAG_KEY_IP_VERSION, TAG_KEY_IP_PROTOCOL, TAG_KEY_MESSAGE_TYPE, TAG_KEY_MESSAGE_STATUS};
-		const char *tag_value[tag_offset]={ip_version, ip_protocol, "transaction_end", "normal"};
+		size_t tag_offset=3;
+		const char *tag_key[tag_offset]={TAG_KEY_IPPROTO, TAG_KEY_MESSAGE_TYPE, TAG_KEY_MESSAGE_STATUS};
+		const char *tag_value[tag_offset]={ipproto, "transaction_end", "normal"};
 		dns_decoder_local_file_counter_incby(plugin_env, LOCAL_STAT_COUNTER_SEND, tag_key, tag_value, tag_offset, 1, session_get_current_thread_id(ss));
 	}
 
@@ -1312,9 +1332,9 @@ void dns_decoder_entry(struct session *ss, uint8_t *payload, size_t payload_sz,
 		dns_message_transaction_publish(ss, DNS_MESSAGE_TRANSACTION_END, plugin_env->dns.topic_id, current_trans->trans_idx);
 		dns_decoder_session_transaction_del(per_ss_ctx, current_trans);
 
-		size_t tag_offset=4;
-		const char *tag_key[tag_offset]={TAG_KEY_IP_VERSION, TAG_KEY_IP_PROTOCOL, TAG_KEY_MESSAGE_TYPE, TAG_KEY_MESSAGE_STATUS};
-		const char *tag_value[tag_offset]={ip_version, ip_protocol, "transaction_end", "terminate"};
+		size_t tag_offset=3;
+		const char *tag_key[tag_offset]={TAG_KEY_IPPROTO, TAG_KEY_MESSAGE_TYPE, TAG_KEY_MESSAGE_STATUS};
+		const char *tag_value[tag_offset]={ipproto, "transaction_end", "terminate"};
 		dns_decoder_local_file_counter_incby(plugin_env, LOCAL_STAT_COUNTER_SEND, tag_key, tag_value, tag_offset, 1, session_get_current_thread_id(ss));
 	}
 }
@@ -1327,17 +1347,13 @@ int dns_decoder_transaction_end_in_closing(struct session *ss, void *per_session
 		return DNS_DECODER_FALSE;
 	}
 
+	const char *ipproto=dns_decoder_ipproto_string_get(ss);
 	struct dns_decoder_context *per_ss_ctx=(struct dns_decoder_context *)per_session_ctx;
 	struct dns_decoder_plugin_env *plugin_env=(struct dns_decoder_plugin_env *)plugin_env_str;
 
-	enum session_addr_type addr_type=SESSION_ADDR_TYPE_UNKNOWN;
-    session_get0_addr(ss, &addr_type);
-	const char *ip_version=(addr_type==SESSION_ADDR_TYPE_IPV4_TCP || addr_type==SESSION_ADDR_TYPE_IPV4_UDP) ? TAG_VALUE_IP_VERSION_IPV4 : TAG_VALUE_IP_VERSION_IPV6;
-	const char *ip_protocol=(addr_type==SESSION_ADDR_TYPE_IPV4_TCP || addr_type==SESSION_ADDR_TYPE_IPV6_TCP) ? TAG_VALUE_IP_PROTOCOL_TCP : TAG_VALUE_IP_PROTOCOL_UDP;
-
-	size_t tag_offset=4;
-	const char *tag_key[tag_offset]={TAG_KEY_IP_VERSION, TAG_KEY_IP_PROTOCOL, TAG_KEY_MESSAGE_TYPE, TAG_KEY_MESSAGE_STATUS};
-	const char *tag_value[tag_offset]={ip_version, ip_protocol, "transaction_end", "closing"};
+	size_t tag_offset=3;
+	const char *tag_key[tag_offset]={TAG_KEY_IPPROTO, TAG_KEY_MESSAGE_TYPE, TAG_KEY_MESSAGE_STATUS};
+	const char *tag_value[tag_offset]={ipproto, "transaction_end", "closing"};
 	dns_decoder_local_file_counter_incby(plugin_env, LOCAL_STAT_COUNTER_SEND, tag_key, tag_value, tag_offset, per_ss_ctx->trans_list_num, session_get_current_thread_id(ss));
 
 	struct dns_transaction *current_trans=NULL, *tmp_trans=NULL;
@@ -1450,8 +1466,6 @@ void *dns_decoder_per_session_context_new(struct session *ss, void *plugin_env_s
         return NULL;
     }
 
-	const char *ip_version=NULL;
-	const char *ip_protocol=NULL;
 	uint16_t sport=0,dport=0;
     enum session_addr_type addr_type=SESSION_ADDR_TYPE_UNKNOWN;
     struct session_addr *addr=session_get0_addr(ss, &addr_type);
@@ -1462,15 +1476,11 @@ void *dns_decoder_per_session_context_new(struct session *ss, void *plugin_env_s
 		case	SESSION_ADDR_TYPE_IPV4_UDP:
 			sport=addr->ipv4.sport;
 			dport=addr->ipv4.dport;
-			ip_version=TAG_VALUE_IP_VERSION_IPV4;
-			ip_protocol=(addr_type==SESSION_ADDR_TYPE_IPV4_TCP) ? TAG_VALUE_IP_PROTOCOL_TCP : TAG_VALUE_IP_PROTOCOL_UDP;
 			break;
 		case	SESSION_ADDR_TYPE_IPV6_TCP:
 		case	SESSION_ADDR_TYPE_IPV6_UDP:
 			sport=addr->ipv6.sport;
 			dport=addr->ipv6.dport;
-			ip_version=TAG_VALUE_IP_VERSION_IPV6;
-			ip_protocol=(addr_type==SESSION_ADDR_TYPE_IPV6_TCP) ? TAG_VALUE_IP_PROTOCOL_TCP : TAG_VALUE_IP_PROTOCOL_UDP;
 			break;
 		default:
 			stellar_session_plugin_dettach_current_session(ss);
@@ -1482,9 +1492,11 @@ void *dns_decoder_per_session_context_new(struct session *ss, void *plugin_env_s
 	{
 		if((sport==plugin_env->net_port[i]) || (dport==plugin_env->net_port[i]))
 		{
-			const char *tag_key[3]={TAG_KEY_IP_VERSION, TAG_KEY_IP_PROTOCOL, "memory"};
-			const char *tag_value[3]={ip_version, ip_protocol, "ss_ctx"};
-			dns_decoder_local_file_counter_incby(plugin_env, LOCAL_STAT_COUNTER_NEW, tag_key, tag_value, 3, 1, session_get_current_thread_id(ss));
+			size_t tag_offset=2;
+			const char *tag_key[tag_offset]={TAG_KEY_IPPROTO, "memory"};
+			const char *ipproto=dns_decoder_ipproto_string_get(ss);
+			const char *tag_value[tag_offset]={ipproto, "ss_ctx"};
+			dns_decoder_local_file_counter_incby(plugin_env, LOCAL_STAT_COUNTER_NEW, tag_key, tag_value, tag_offset, 1, session_get_current_thread_id(ss));
 
 			return CALLOC(struct dns_decoder_context, 1);
 		}
@@ -1504,16 +1516,13 @@ void dns_decoder_per_session_context_free(struct session *ss, void *per_session_
 
 	FREE(per_session_ctx);
 	
-	enum session_addr_type addr_type=SESSION_ADDR_TYPE_UNKNOWN;
-    session_get0_addr(ss, &addr_type);
-	const char *ip_version=(addr_type==SESSION_ADDR_TYPE_IPV4_TCP || addr_type==SESSION_ADDR_TYPE_IPV4_UDP) ? TAG_VALUE_IP_VERSION_IPV4 : TAG_VALUE_IP_VERSION_IPV6;
-	const char *ip_protocol=(addr_type==SESSION_ADDR_TYPE_IPV4_TCP || addr_type==SESSION_ADDR_TYPE_IPV6_TCP) ? TAG_VALUE_IP_PROTOCOL_TCP : TAG_VALUE_IP_PROTOCOL_UDP;
-
-	const char *tag_key[3]={TAG_KEY_IP_VERSION, TAG_KEY_IP_PROTOCOL, "memory"};
-	const char *tag_value[3]={ip_version, ip_protocol, "ss_ctx"};
+	size_t tag_offset=2;
+	const char *tag_key[tag_offset]={TAG_KEY_IPPROTO, "memory"};
+	const char *ipproto=dns_decoder_ipproto_string_get(ss);
+	const char *tag_value[tag_offset]={ipproto, "ss_ctx"};
 	
 	struct dns_decoder_plugin_env *plugin_env=(struct dns_decoder_plugin_env *)plugin_env_str;
-	dns_decoder_local_file_counter_incby(plugin_env, LOCAL_STAT_COUNTER_FREE, tag_key, tag_value, 3, 1, session_get_current_thread_id(ss));
+	dns_decoder_local_file_counter_incby(plugin_env, LOCAL_STAT_COUNTER_FREE, tag_key, tag_value, tag_offset, 1, session_get_current_thread_id(ss));
 }
 
 int32_t dns_decoder_config_load(const char *cfg_path, struct dns_decoder_plugin_env *plugin_env)
@@ -1861,7 +1870,22 @@ struct dns_flag *dns_message_header_flag_get0(struct dns_message *msg)
 	return &(msg->flag);
 }
 
-void dns_message_question_get0(struct dns_message *msg, struct dns_query_question **question, uint16_t *n_question)
+const char *dns_query_question_qname_get0(struct dns_query_question *question)
+{
+	return ((question!=NULL) ?  (char *)(question->qname) : NULL);
+}
+
+int32_t dns_query_question_qtype_get0(struct dns_query_question *question)
+{
+	return ((question!=NULL) ? question->qtype : -1);
+}
+
+int32_t dns_query_question_qclass_get0(struct dns_query_question *question)
+{
+	return ((question!=NULL) ? question->qclass : -1);
+}
+
+void dns_message_query_question_get0(struct dns_message *msg, struct dns_query_question **question, uint16_t *n_question)
 {
 	if(msg==NULL || msg->magic!=DNS_MESSAGE_MAGIC || msg->type==DNS_MESSAGE_TRANSACTION_BEGIN || msg->type==DNS_MESSAGE_TRANSACTION_END || msg->n_question==0)
 	{
@@ -1905,16 +1929,13 @@ int32_t dns_message_resource_record_serialize(struct dns_message *msg)
 		return DNS_DECODER_FALSE;
 	}
 
-	enum session_addr_type addr_type=SESSION_ADDR_TYPE_UNKNOWN;
-    session_get0_addr(msg->ss, &addr_type);
-	const char *ip_version=(addr_type==SESSION_ADDR_TYPE_IPV4_TCP || addr_type==SESSION_ADDR_TYPE_IPV4_UDP) ? TAG_VALUE_IP_VERSION_IPV4 : TAG_VALUE_IP_VERSION_IPV6;
-	const char *ip_protocol=(addr_type==SESSION_ADDR_TYPE_IPV4_TCP || addr_type==SESSION_ADDR_TYPE_IPV6_TCP) ? TAG_VALUE_IP_PROTOCOL_TCP : TAG_VALUE_IP_PROTOCOL_UDP;
-	size_t tag_offset=4;
-	const char *tag_key[tag_offset]={TAG_KEY_IP_VERSION, TAG_KEY_IP_PROTOCOL, TAG_KEY_DNS_QR, TAG_KEY_DNS_SECTION};
+	const char *ipproto=dns_decoder_ipproto_string_get(msg->ss);
+	size_t tag_offset=3;
+	const char *tag_key[tag_offset]={TAG_KEY_IPPROTO, TAG_KEY_DNS_QR, TAG_KEY_DNS_SECTION};
 
 	if(msg->type==DNS_MESSAGE_TRANSACTION_BEGIN || msg->type==DNS_MESSAGE_TRANSACTION_END)
 	{
-		const char *tag_value[tag_offset]={ip_version, ip_protocol, ((msg->type==DNS_MESSAGE_TRANSACTION_BEGIN) ? "begin" : "end"), "none"};
+		const char *tag_value[tag_offset]={ipproto, ((msg->type==DNS_MESSAGE_TRANSACTION_BEGIN) ? "begin" : "end"), "none"};
 		dns_decoder_local_file_counter_incby(msg->plugin_env, LOCAL_STAT_COUNTER_ERROR, tag_key, tag_value, tag_offset, 1, session_get_current_thread_id(msg->ss));
 		return DNS_DECODER_FALSE;
 	}
@@ -1945,7 +1966,7 @@ int32_t dns_message_resource_record_serialize(struct dns_message *msg)
 
 	if(msg->n_answer_rr>0)
 	{
-		const char *tag_value[tag_offset]={ip_version, ip_protocol, ((msg->type==DNS_MESSAGE_QUERY) ? "query" : "response"), "answer"};
+		const char *tag_value[tag_offset]={ipproto, ((msg->type==DNS_MESSAGE_QUERY) ? "query" : "response"), "answer"};
 		dns_resource_record_buff_get0(msg->rr_capacity, msg->rr_capacity_sz, &(msg->rr_capacity_offset), &(msg->answer_rr), msg->n_answer_rr, &(msg->n_real_answer_rr));
 		int32_t ret=dns_resource_record_decode(msg->payload, msg->payload_sz, &(msg->payload_offset), msg->answer_rr, msg->n_real_answer_rr);
 		if(ret==DNS_DECODER_FALSE)
@@ -1963,7 +1984,7 @@ int32_t dns_message_resource_record_serialize(struct dns_message *msg)
 
 	if(msg->n_authority_rr>0)
 	{
-		const char *tag_value[tag_offset]={ip_version, ip_protocol, ((msg->type==DNS_MESSAGE_QUERY) ? "query" : "response"), "authority"};
+		const char *tag_value[tag_offset]={ipproto, ((msg->type==DNS_MESSAGE_QUERY) ? "query" : "response"), "authority"};
 		dns_resource_record_buff_get0(msg->rr_capacity, msg->rr_capacity_sz, &(msg->rr_capacity_offset), &(msg->authority_rr), msg->n_authority_rr, &(msg->n_real_authority_rr));
 		int32_t ret=dns_resource_record_decode(msg->payload, msg->payload_sz, &(msg->payload_offset), msg->authority_rr, msg->n_real_authority_rr);
 		if(ret==DNS_DECODER_FALSE)
@@ -1981,7 +2002,7 @@ int32_t dns_message_resource_record_serialize(struct dns_message *msg)
 
 	if(msg->n_additional_rr>0)
 	{
-		const char *tag_value[tag_offset]={ip_version, ip_protocol, ((msg->type==DNS_MESSAGE_QUERY) ? "query" : "response"), "additional"};
+		const char *tag_value[tag_offset]={ipproto, ((msg->type==DNS_MESSAGE_QUERY) ? "query" : "response"), "additional"};
 		dns_resource_record_buff_get0(msg->rr_capacity, msg->rr_capacity_sz, &(msg->rr_capacity_offset), &(msg->additional_rr), msg->n_additional_rr, &(msg->n_real_additional_rr));
 		int32_t ret=dns_resource_record_decode(msg->payload, msg->payload_sz, &(msg->payload_offset), msg->additional_rr, msg->n_real_additional_rr);
 		if(ret==DNS_DECODER_FALSE)