diff --git a/probe/endpoint/dns_snooper.go b/probe/endpoint/dns_snooper.go index b07cc7367..11f5ce6b8 100644 --- a/probe/endpoint/dns_snooper.go +++ b/probe/endpoint/dns_snooper.go @@ -98,7 +98,9 @@ func newPcapHandle() (*pcap.Handle, error) { // obtained while snooping A-record queries func (s *DNSSnooper) CachedNamesForIP(ip string) []string { result := []string{} - + if s == nil { + return result + } domains, err := s.reverseDNSCache.Get(ip) if err != nil { return result @@ -201,14 +203,14 @@ func (s *DNSSnooper) processDNSMessage(dns *layers.DNS) { } } - log.Debugf("DNSSnooper: caught DNS lookup: %s -> %v", string(domainQueried), ips) // Update cache - // TODO: Be smarter about the expiration of IPs with multiple reverse-domains newDomain := string(domainQueried) + log.Debugf("DNSSnooper: caught DNS lookup: %s -> %v", newDomain, ips) for ip := range ips { if existingDomains, err := s.reverseDNSCache.Get(ip); err != nil { s.reverseDNSCache.Set(ip, map[string]struct{}{newDomain: {}}) } else { + // TODO: Be smarter about the expiration of entries with pre-existing associated domains existingDomains.(map[string]struct{})[newDomain] = struct{}{} } } diff --git a/probe/endpoint/reporter_test.go b/probe/endpoint/reporter_test.go index e62307266..7a6f4e948 100644 --- a/probe/endpoint/reporter_test.go +++ b/probe/endpoint/reporter_test.go @@ -69,7 +69,7 @@ func TestSpyNoProcesses(t *testing.T) { ) scanner := procspy.FixedScanner(fixConnections) - reporter := endpoint.NewReporter(nodeID, nodeName, false, false, false, "", scanner) + reporter := endpoint.NewReporter(nodeID, nodeName, false, false, false, "", scanner, nil) r, _ := reporter.Report() //buf, _ := json.MarshalIndent(r, "", " ") //t.Logf("\n%s\n", buf) @@ -86,7 +86,7 @@ func TestSpyWithProcesses(t *testing.T) { ) scanner := procspy.FixedScanner(fixConnectionsWithProcesses) - reporter := endpoint.NewReporter(nodeID, nodeName, true, false, true, "", scanner) + reporter := endpoint.NewReporter(nodeID, nodeName, true, false, true, "", scanner, nil) r, _ := reporter.Report() // buf, _ := json.MarshalIndent(r, "", " ") ; t.Logf("\n%s\n", buf)