#include <netdb.h>
#include <sys/socket.h>
#include <arpa/inet.h>

/* High-level: getaddrinfo() — handles DNS + IPv4/IPv6 */
struct addrinfo hints = {0}, *res;
hints.ai_family   = AF_UNSPEC;     /* IPv4 or IPv6 */
hints.ai_socktype = SOCK_STREAM;   /* TCP */

int rc = getaddrinfo("www.google.com", "443", &hints, &res);
if (rc != 0) {
    fprintf(stderr, "DNS error: %s\n", gai_strerror(rc));
    return -1;
}

/* Iterate through returned addresses (may have both A and AAAA) */
for (struct addrinfo *p = res; p; p = p->ai_next) {
    char ipstr[INET6_ADDRSTRLEN];
    void *addr;
    if (p->ai_family == AF_INET) {
        struct sockaddr_in *s = (struct sockaddr_in *)p->ai_addr;
        addr = &s->sin_addr;
    } else {
        struct sockaddr_in6 *s = (struct sockaddr_in6 *)p->ai_addr;
        addr = &s->sin6_addr;
    }
    inet_ntop(p->ai_family, addr, ipstr, sizeof(ipstr));
    printf("Resolved: %s\n", ipstr);
}
freeaddrinfo(res);

/* Low-level: res_query() for custom DNS queries */
#include <resolv.h>
uint8_t answer[512];
int n = res_query("google.com", C_IN, T_MX, answer, sizeof(answer));
/* Parse answer manually using ns_initparse / ns_parserr */

/* Wire format of "www.google.com" in DNS */
\x03 w  w  w          # length=3, then "www"
\x06 g  o  o  g  l  e # length=6, then "google"
\x03 c  o  m           # length=3, then "com"
\x00                   # null terminator = root

Total: 1+3 + 1+6 + 1+3 + 1 = 16 bytes

/* DNS compression — avoid repeating names */
/* A pointer (2 bytes starting with bits 11) points to a prior occurrence */
\xc0 \x0c  # 0xC0 = 11000000 (pointer marker), 0x0c = offset 12 in message
/* "The name at offset 12 in this message" */
/* Greatly reduces packet size when multiple RRs share domain names */

/* Parse domain name in C */
int parse_name(const uint8_t *msg, int msg_len, int offset, char *out) {
    int out_pos = 0;
    while (offset < msg_len && msg[offset] != 0) {
        uint8_t len = msg[offset++];
        if ((len & 0xC0) == 0xC0) {          /* pointer */
            uint16_t ptr = ((len & 0x3F) << 8) | msg[offset];
            offset = ptr;
            continue;
        }
        if (out_pos > 0) out[out_pos++] = '.';
        memcpy(out + out_pos, msg + offset, len);
        out_pos += len; offset += len;
    }
    out[out_pos] = '\0';
    return offset + 1;
}

/* SPF — Sender Policy Framework (RFC 7208) */
/* TXT record listing authorised mail servers for a domain */
google.com. TXT "v=spf1 include:_spf.google.com ~all"
# ~all = softfail (mark but deliver), -all = fail (reject), +all = pass all
# NGFW checks: does sending server's IP match SPF? If not → suspicious

/* DKIM — DomainKeys Identified Mail (RFC 6376) */
/* TXT record holding public key for email signature verification */
google._domainkey.google.com. TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqh..."
# Sending server signs email header/body with private key
# Receiver verifies signature using public key from DNS
# NGFW can verify DKIM signatures on inbound email

/* DMARC — Domain-based Message Authentication, Reporting and Conformance */
_dmarc.google.com. TXT "v=DMARC1; p=reject; rua=mailto:dmarc@google.com"
# p=none/quarantine/reject — what to do with SPF/DKIM failures
# rua = aggregate report destination
# NGFW enforces DMARC policy for inbound email from external domains

/* Negative caching (RFC 2308) */
Query:   www.doesnotexist.example.com A
Response: RCODE=3 (NXDOMAIN)

Negative TTL: taken from SOA minimum field (often 300–3600 seconds)
Resolver caches: "www.doesnotexist.example.com A → NXDOMAIN" for TTL seconds

/* Why this matters for NGFW */
# Malware C2 domains often use DGA (Domain Generation Algorithms)
# Generates thousands of random domains per day
# Only the attacker's active C2 domain resolves — rest return NXDOMAIN
# Unusually high NXDOMAIN rate from a host = potential DGA/malware indicator

/* NGFW DNS analytics: track per-client NXDOMAIN rate */
# Normal: 0–5% NXDOMAIN rate
# Suspicious: >20% NXDOMAIN from single host in 1 minute
# DGA malware: hundreds of NXDOMAIN per minute, all random names

/* DNS sinkhole architecture */

Normal:
  Client → DNS: "what is malware-c2.com?"
  Resolver → Authoritative: real answer → 185.x.x.x (C2 server)
  Client → TCP connection to 185.x.x.x → malware beacons home

With sinkhole:
  Client → DNS: "what is malware-c2.com?"
  NGFW intercepts query (transparent DNS proxy on UDP 53)
  NGFW checks: malware-c2.com is in threat feed → BLOCK
  NGFW returns: NXDOMAIN  (or sinkhole IP 10.0.0.254)
  Client: can't resolve domain → malware can't phone home
  NGFW logs: "host 10.0.0.5 queried known-malicious domain malware-c2.com"

/* Implementation approaches */

1. Transparent DNS proxy (most common)
   NGFW intercepts all UDP/TCP port 53 traffic
   Checks query against threat feed (bihash lookup)
   Modifies response or drops query

2. RPZ (Response Policy Zones) — RFC 8020, BIND/Unbound feature
   Operator configures "fake" DNS zone with override records
   zone "rpz.local" { type master; ... }
   Any query matching RPZ zone gets overridden response

3. DNS Firewall (inline)
   Full NGFW DNS proxy — receives queries, applies policy, forwards to upstream
   Can apply category filtering (block all "gambling", "adult content" domains)
   Can enforce SafeSearch DNS (redirect Google/YouTube to safe variants)

/* Threat intelligence feeds for DNS */
Malware domains:     abuse.ch URLhaus, Malware Domain List
C2 infrastructure:   Emerging Threats, Talos
Phishing:            PhishTank, OpenPhish, APWG
Botnet C2:           Bambenek Consulting, Feodo Tracker
Ad/tracking:         Pi-hole blocklists, AdGuard DNS Filter