header

import "github.com/TheManticoreProject/Manticore/network/llmnr/message/header"

Index

Constants
type Flags
type Header

Constants

LLMNR Header Flags and fields.

Per RFC 4795 §2.1.1, the second 16-bit word of the LLMNR header reuses the DNS header layout (RFC 1035 §4.1.1) with LLMNR-specific bits. Using DNS bit numbering where bit 0 is the most significant bit of the 16-bit word:

0   1   2   3   4   5   6   7   8   9  10  11  12  13  14  15
	+--+----+----+----+----+--+--+--+--+--+--+--+----+----+----+----+
	|QR|         Opcode        | C|TC| T|      Z    |      RCODE     |
	+--+----+----+----+----+--+--+--+--+--+--+--+----+----+----+----+

  - QR      : bit 0             -> 1 << 15
  - Opcode  : bits 1-4  (4-bit) -> mask 0x7800, shift 11
  - C       : bit 5             -> 1 << 10
  - TC      : bit 6             -> 1 << 9
  - T       : bit 7             -> 1 << 8
  - Z       : bits 8-11 (4-bit) -> mask 0x00F0, shift 4 (reserved, MUST be 0)
  - RCODE   : bits 12-15 (4-bit) -> mask 0x000F

const (
    FlagQR Flags = 1 << 15 // Query/Response flag (bit 0)
    FlagC  Flags = 1 << 10 // Conflict flag (bit 5)
    FlagTC Flags = 1 << 9  // Truncation flag (bit 6)
    FlagT  Flags = 1 << 8  // Tentative flag (bit 7)

    // Field masks and shifts for the multi-bit Opcode, Z and RCODE fields.
    MaskOpcode  Flags = 0x7800 // Opcode field (bits 1-4)
    ShiftOpcode uint  = 11
    MaskZ       Flags = 0x00F0 // Z reserved field (bits 8-11)
    ShiftZ      uint  = 4
    MaskRCODE   Flags = 0x000F // RCODE field (bits 12-15)
)

Size of LLMNR message header in bytes

const HeaderSize = 12

type Flags

type Flags uint16

func (Flags) IsConflict

func (f Flags) IsConflict() bool

IsConflict returns true if the conflict flag is set.

func (Flags) IsQuery

func (f Flags) IsQuery() bool

IsQuery returns true if the flags are set for a query.

func (Flags) IsResponse

func (f Flags) IsResponse() bool

IsResponse returns true if the flags are set for a response.

func (Flags) IsTentative

func (f Flags) IsTentative() bool

IsTentative returns true if the tentative flag is set.

func (Flags) IsTruncation

func (f Flags) IsTruncation() bool

IsTruncation returns true if the truncation flag is set.

func (*Flags) Marshal

func (f *Flags) Marshal() ([]byte, error)

Marshal encodes the Flags into a 2-byte big-endian representation.

func (Flags) Opcode

func (f Flags) Opcode() uint8

Opcode returns the 4-bit Opcode field (bits 1-4) as a value in the range 0-15.

func (Flags) RCODE

func (f Flags) RCODE() uint8

RCODE returns the 4-bit RCODE field (bits 12-15) as a value in the range 0-15.

func (*Flags) SetOpcode

func (f *Flags) SetOpcode(opcode uint8)

SetOpcode sets the 4-bit Opcode field (bits 1-4). Only the low 4 bits of opcode are used; higher bits are ignored.

func (*Flags) SetRCODE

func (f *Flags) SetRCODE(rcode uint8)

SetRCODE sets the 4-bit RCODE field (bits 12-15). Only the low 4 bits of rcode are used; higher bits are ignored.

func (*Flags) SetZ

func (f *Flags) SetZ(z uint8)

SetZ sets the 4-bit Z reserved field (bits 8-11). Only the low 4 bits of z are used; higher bits are ignored. Conformant implementations should leave this at zero.

func (Flags) String

func (f Flags) String() string

String returns a string representation of the flags.

The QR label is emitted only when the QR bit is set (response), matching the convention used in DNS trace output. Query messages (QR=0) produce no QR label. The Opcode and RCODE fields are 4-bit values and are rendered as “OPCODE=n”/“RCODE=n” only when non-zero, so the common case (standard query, no error) stays terse.

func (*Flags) Unmarshal

func (f *Flags) Unmarshal(data []byte) (int, error)

Unmarshal decodes a 2-byte big-endian representation into the Flags receiver. It returns an error if the input slice is not exactly 2 bytes.

func (Flags) Z

func (f Flags) Z() uint8

Z returns the 4-bit Z reserved field (bits 8-11) as a value in the range 0-15. Per RFC 4795 §2.1.1 these bits MUST be zero in conformant queries and responses.

Header represents the LLMNR message header.

The header contains essential information about the LLMNR message, including the message ID, flags, and counts of various sections such as questions, answers, authority records, and additional records.

Fields:

Identifier: A 16-bit identifier assigned by the program that generates any kind of query. This identifier is copied to the corresponding reply and can be used by the requester to match up replies to outstanding queries.
Flags: A 16-bit field containing various flags that control the message flow and interpretation. These flags include the Query/Response flag (QR), Operation code (OP), Conflict flag (C), Truncation flag (TC), and Tentative flag (T).
QDCount: An unsigned 16-bit integer specifying the number of entries in the question section of the message.
ANCount: An unsigned 16-bit integer specifying the number of resource records in the answer section of the message.
NSCount: An unsigned 16-bit integer specifying the number of name server resource records in the authority records section of the message.
ARCount: An unsigned 16-bit integer specifying the number of resource records in the additional records section of the message.

Usage example:

header := Header{
    Identifier: 12345,
    Flags:   FlagQR,
    QDCount: 1,
    ANCount: 0,
    NSCount: 0,
    ARCount: 0,
}

type Header struct {
    Identifier uint16 `json:"identifier"`
    Flags      Flags  `json:"flags"`
    QDCount    uint16 `json:"qd_count"` // Question count
    ANCount    uint16 `json:"an_count"` // Answer count
    NSCount    uint16 `json:"ns_count"` // Authority count
    ARCount    uint16 `json:"ar_count"` // Additional count
}

func (h *Header) Describe(indent int)

Describe prints a detailed description of the Header struct. Parameters: - indent: An integer value specifying the indentation level for the output.

func (h *Header) Marshal() ([]byte, error)

Marshal encodes the Header into a 12-byte big-endian representation.

func (h *Header) Unmarshal(data []byte) (int, error)

Unmarshal decodes a 12-byte big-endian representation into the Header receiver. It returns an error if the input slice is not exactly 12 bytes.