Feature: export api -> dns_message_uuid_get0

2024-08-03 03:14:12 +00:00
parent da0a82039f
commit 256211094a
7 changed files with 488 additions and 31 deletions
--- a/deps/uuid_v4/endianness.h
+++ b/deps/uuid_v4/endianness.h
@@ -0,0 +1,157 @@
+#pragma once
+
+#if defined(__GLIBC__) || defined(__GNU_LIBRARY__) || defined(__ANDROID__)
+  #include <endian.h>
+#elif defined(__APPLE__) && defined(__MACH__)
+  #include <machine/endian.h>
+#elif defined(BSD) || defined(_SYSTYPE_BSD)
+  #if defined(__OpenBSD__)
+    #include <machine/endian.h>
+  #else
+    #include <sys/endian.h>
+  #endif
+#endif
+
+#if defined(__BYTE_ORDER)
+  #if defined(__BIG_ENDIAN) && (__BYTE_ORDER == __BIG_ENDIAN)
+    #define BIGENDIAN
+  #elif defined(__LITTLE_ENDIAN) && (__BYTE_ORDER == __LITTLE_ENDIAN)
+    #define LITTLEENDIAN
+  #endif
+#elif defined(_BYTE_ORDER)
+  #if defined(_BIG_ENDIAN) && (_BYTE_ORDER == _BIG_ENDIAN)
+    #define BIGENDIAN
+  #elif defined(_LITTLE_ENDIAN) && (_BYTE_ORDER == _LITTLE_ENDIAN)
+    #define LITTLEENDIAN
+  #endif
+#elif defined(__BIG_ENDIAN__)
+  #define BIGENDIAN
+#elif defined(__LITTLE_ENDIAN__)
+  #define LITTLEENDIAN
+#else
+  #if defined(__ARMEL__) || \
+      defined(__THUMBEL__) || \
+      defined(__AARCH64EL__) || \
+      defined(_MIPSEL) || \
+      defined(__MIPSEL) || \
+      defined(__MIPSEL__) || \
+      defined(__ia64__) || defined(_IA64) || \
+      defined(__IA64__) || defined(__ia64) || \
+      defined(_M_IA64) || defined(__itanium__) || \
+      defined(i386) || defined(__i386__) || \
+      defined(__i486__) || defined(__i586__) || \
+      defined(__i686__) || defined(__i386) || \
+      defined(_M_IX86) || defined(_X86_) || \
+      defined(__THW_INTEL__) || defined(__I86__) || \
+      defined(__INTEL__) || \
+      defined(__x86_64) || defined(__x86_64__) || \
+      defined(__amd64__) || defined(__amd64) || \
+      defined(_M_X64) || \
+      defined(__bfin__) || defined(__BFIN__) || \
+      defined(bfin) || defined(BFIN)
+
+      #define LITTLEENDIAN
+  #elif defined(__m68k__) || defined(M68000) || \
+        defined(__hppa__) || defined(__hppa) || defined(__HPPA__) || \
+        defined(__sparc__) || defined(__sparc) || \
+        defined(__370__) || defined(__THW_370__) || \
+        defined(__s390__) || defined(__s390x__) || \
+        defined(__SYSC_ZARCH__)
+
+      #define BIGENDIAN
+
+  #elif defined(__arm__) || defined(__arm64) || defined(__thumb__) || \
+        defined(__TARGET_ARCH_ARM) || defined(__TARGET_ARCH_THUMB) || \
+        defined(__ARM_ARCH) || \
+        defined(_M_ARM) || defined(_M_ARM64)
+
+      #if defined(_WIN32) || defined(_WIN64) || \
+          defined(__WIN32__) || defined(__TOS_WIN__) || \
+          defined(__WINDOWS__)
+
+        #define LITTLEENDIAN
+
+      #else
+        #error "Cannot determine system endianness."
+      #endif
+  #endif
+#endif
+
+
+#if defined(BIGENDIAN)
+  // Try to use compiler intrinsics
+  #if defined(__INTEL_COMPILER) || defined(__ICC)
+    #define betole16(x) _bswap16(x)
+    #define betole32(x) _bswap(x)
+    #define betole64(x) _bswap64(x)
+  #elif defined(__GNUC__) // GCC and CLANG
+    #define betole16(x) __builtin_bswap16(x)
+    #define betole32(x) __builtin_bswap32(x)
+    #define betole64(x) __builtin_bswap64(x)
+  #elif defined(_MSC_VER) // MSVC
+    #include <stdlib.h>
+    #define betole16(x) _byteswap_ushort(x)
+    #define betole32(x) _byteswap_ulong(x)
+    #define betole64(x) _byteswap_uint64(x)
+  #else
+    #define FALLBACK_SWAP
+    #define betole16(x) swap_u16(x)
+    #define betole32(x) swap_u32(x)
+    #define betole64(x) swap_u64(x)
+  #endif
+  #define betole128(x) swap_u128(x)
+  #define betole256(x) swap_u256(x)
+#else
+  #define betole16(x) (x)
+  #define betole32(x) (x)
+  #define betole64(x) (x)
+  #define betole128(x) (x)
+  #define betole256(x) (x)
+#endif // BIGENDIAN
+
+#if defined(BIGENDIAN)
+  #include <emmintrin.h>
+  #include <smmintrin.h>
+  #include <immintrin.h>
+  #include <tmmintrin.h>
+
+  inline __m128i swap_u128(__m128i value) {
+    const __m128i shuffle = _mm_set_epi64x(0x0001020304050607, 0x08090a0b0c0d0e0f);
+    return _mm_shuffle_epi8(value, shuffle);
+  }
+
+  inline __m256i swap_u256(__m256i value) {
+    const __m256i shuffle = _mm256_set_epi64x(0x0001020304050607, 0x08090a0b0c0d0e0f, 0x0001020304050607, 0x08090a0b0c0d0e0f);
+    return _mm256_shuffle_epi8(value, shuffle);
+  }
+#endif // BIGENDIAN
+
+#if defined(FALLBACK_SWAP)
+  #include <stdint.h>
+  inline uint16_t swap_u16(uint16_t value)
+  {
+    return
+        ((value & 0xFF00u) >>  8u) |
+        ((value & 0x00FFu) <<  8u);
+  }
+  inline uint32_t swap_u32(uint32_t value)
+  {
+    return
+        ((value & 0xFF000000u) >> 24u) |
+        ((value & 0x00FF0000u) >>  8u) |
+        ((value & 0x0000FF00u) <<  8u) |
+        ((value & 0x000000FFu) << 24u);
+  }
+  inline uint64_t swap_u64(uint64_t value)
+  {
+    return
+        ((value & 0xFF00000000000000u) >> 56u) |
+        ((value & 0x00FF000000000000u) >> 40u) |
+        ((value & 0x0000FF0000000000u) >> 24u) |
+        ((value & 0x000000FF00000000u) >>  8u) |
+        ((value & 0x00000000FF000000u) <<  8u) |
+        ((value & 0x0000000000FF0000u) << 24u) |
+        ((value & 0x000000000000FF00u) << 40u) |
+        ((value & 0x00000000000000FFu) << 56u);
+  }
+#endif // FALLBACK_SWAP
--- a/deps/uuid_v4/uuid_v4.h
+++ b/deps/uuid_v4/uuid_v4.h
@@ -0,0 +1,276 @@
+/*
+MIT License
+
+Copyright (c) 2018 Xavier "Crashoz" Launey
+*/
+
+#pragma once
+
+#include <random>
+#include <string>
+#include <limits>
+#include <iostream>
+#include <sstream>
+#include <cstdint>
+#include <memory>
+
+#include <emmintrin.h>
+#include <smmintrin.h>
+#include <immintrin.h>
+
+#include "endianness.h"
+
+namespace UUIDv4 {
+
+/*
+  Converts a 128-bits unsigned int to an UUIDv4 string representation.
+  Uses SIMD via Intel's AVX2 instruction set.
+ */
+void inline m128itos(__m128i x, char* mem) {
+  // Expand each byte in x to two bytes in res
+  // i.e. 0x12345678 -> 0x0102030405060708
+  // Then translate each byte to its hex ascii representation
+  // i.e. 0x0102030405060708 -> 0x3132333435363738
+  const __m256i mask = _mm256_set1_epi8(0x0F);
+  const __m256i add = _mm256_set1_epi8(0x06);
+  const __m256i alpha_mask = _mm256_set1_epi8(0x10);
+  const __m256i alpha_offset = _mm256_set1_epi8(0x57);
+
+  __m256i a = _mm256_castsi128_si256(x);
+  __m256i as = _mm256_srli_epi64(a, 4);
+  __m256i lo = _mm256_unpacklo_epi8(as, a);
+  __m128i hi = _mm256_castsi256_si128(_mm256_unpackhi_epi8(as, a));
+  __m256i c =  _mm256_inserti128_si256(lo, hi, 1);
+  __m256i d = _mm256_and_si256(c, mask);
+  __m256i alpha = _mm256_slli_epi64(_mm256_and_si256(_mm256_add_epi8(d, add), alpha_mask), 3);
+  __m256i offset = _mm256_blendv_epi8(_mm256_slli_epi64(add, 3), alpha_offset, alpha);
+  __m256i res = _mm256_add_epi8(d, offset);
+
+  // Add dashes between blocks as specified in RFC-4122
+  // 8-4-4-4-12
+  const __m256i dash_shuffle = _mm256_set_epi32(0x0b0a0908, 0x07060504, 0x80030201, 0x00808080, 0x0d0c800b, 0x0a090880, 0x07060504, 0x03020100);
+  const __m256i dash = _mm256_set_epi64x(0x0000000000000000ull, 0x2d000000002d0000ull, 0x00002d000000002d, 0x0000000000000000ull);
+
+  __m256i resd = _mm256_shuffle_epi8(res, dash_shuffle);
+  resd = _mm256_or_si256(resd, dash);
+
+  _mm256_storeu_si256((__m256i*)mem, betole256(resd));
+  *(uint16_t*)(mem+16) = betole16(_mm256_extract_epi16(res, 7));
+  *(uint32_t*)(mem+32) = betole32(_mm256_extract_epi32(res, 7));
+}
+
+/*
+  Converts an UUIDv4 string representation to a 128-bits unsigned int.
+  Uses SIMD via Intel's AVX2 instruction set.
+ */
+__m128i inline stom128i(const char* mem) {
+  // Remove dashes and pack hex ascii bytes in a 256-bits int
+  const __m256i dash_shuffle = _mm256_set_epi32(0x80808080, 0x0f0e0d0c, 0x0b0a0908, 0x06050403, 0x80800f0e, 0x0c0b0a09, 0x07060504, 0x03020100);
+
+  __m256i x = betole256(_mm256_loadu_si256((__m256i*)mem));
+  x = _mm256_shuffle_epi8(x, dash_shuffle);
+  x = _mm256_insert_epi16(x, betole16(*(uint16_t*)(mem+16)), 7);
+  x = _mm256_insert_epi32(x, betole32(*(uint32_t*)(mem+32)), 7);
+
+  // Build a mask to apply a different offset to alphas and digits
+  const __m256i sub = _mm256_set1_epi8(0x2F);
+  const __m256i mask = _mm256_set1_epi8(0x20);
+  const __m256i alpha_offset = _mm256_set1_epi8(0x28);
+  const __m256i digits_offset = _mm256_set1_epi8(0x01);
+  const __m256i unweave = _mm256_set_epi32(0x0f0d0b09, 0x0e0c0a08, 0x07050301, 0x06040200, 0x0f0d0b09, 0x0e0c0a08, 0x07050301, 0x06040200);
+  const __m256i shift = _mm256_set_epi32(0x00000000, 0x00000004, 0x00000000, 0x00000004, 0x00000000, 0x00000004, 0x00000000, 0x00000004);
+
+  // Translate ascii bytes to their value
+  // i.e. 0x3132333435363738 -> 0x0102030405060708
+  // Shift hi-digits
+  // i.e. 0x0102030405060708 -> 0x1002300450067008
+  // Horizontal add
+  // i.e. 0x1002300450067008 -> 0x12345678
+  __m256i a = _mm256_sub_epi8(x, sub);
+  __m256i alpha = _mm256_slli_epi64(_mm256_and_si256(a, mask), 2);
+  __m256i sub_mask = _mm256_blendv_epi8(digits_offset, alpha_offset, alpha);
+  a = _mm256_sub_epi8(a, sub_mask);
+  a = _mm256_shuffle_epi8(a, unweave);
+  a = _mm256_sllv_epi32(a, shift);
+  a = _mm256_hadd_epi32(a, _mm256_setzero_si256());
+  a = _mm256_permute4x64_epi64(a, 0b00001000);
+
+  return _mm256_castsi256_si128(a);
+}
+
+/*
+ * UUIDv4 (random 128-bits) RFC-4122
+ */
+class UUID {
+  public:
+    UUID()
+    {}
+
+    UUID(const UUID &other) {
+      __m128i x = _mm_load_si128((__m128i*)other.data);
+      _mm_store_si128((__m128i*)data, x);
+    }
+
+    /* Builds a 128-bits UUID */
+    UUID(__m128i uuid) {
+      _mm_store_si128((__m128i*)data, uuid);
+    }
+
+    UUID(uint64_t x, uint64_t y) {
+      __m128i z = _mm_set_epi64x(x, y);
+      _mm_store_si128((__m128i*)data, z);
+    }
+
+    UUID(const uint8_t* bytes) {
+      __m128i x = _mm_loadu_si128((__m128i*)bytes);
+      _mm_store_si128((__m128i*)data, x);
+    }
+
+    /* Builds an UUID from a byte string (16 bytes long) */
+    explicit UUID(const std::string &bytes) {
+      __m128i x = betole128(_mm_loadu_si128((__m128i*)bytes.data()));
+      _mm_store_si128((__m128i*)data, x);
+    }
+
+    /* Static factory to parse an UUID from its string representation */
+    static UUID fromStrFactory(const std::string &s) {
+      return fromStrFactory(s.c_str());
+    }
+
+    static UUID fromStrFactory(const char* raw) {
+      return UUID(stom128i(raw));
+    }
+
+    void fromStr(const char* raw) {
+      _mm_store_si128((__m128i*)data, stom128i(raw));
+    }
+
+    UUID& operator=(const UUID &other) {
+      if (&other == this) {
+        return *this;
+      }
+      __m128i x = _mm_load_si128((__m128i*)other.data);
+      _mm_store_si128((__m128i*)data, x);
+      return *this;
+    }
+
+    friend bool operator==(const UUID &lhs, const UUID &rhs) {
+      __m128i x = _mm_load_si128((__m128i*)lhs.data);
+      __m128i y = _mm_load_si128((__m128i*)rhs.data);
+
+      __m128i neq = _mm_xor_si128(x, y);
+      return _mm_test_all_zeros(neq, neq);
+    }
+
+    friend bool operator<(const UUID &lhs, const UUID &rhs) {
+      // There are no trivial 128-bits comparisons in SSE/AVX
+      // It's faster to compare two uint64_t
+      uint64_t *x = (uint64_t*)lhs.data;
+      uint64_t *y = (uint64_t*)rhs.data;
+      return *x < *y || (*x == *y && *(x + 1) < *(y + 1));
+    }
+
+    friend bool operator!=(const UUID &lhs, const UUID &rhs) { return !(lhs == rhs); }
+    friend bool operator> (const UUID &lhs, const UUID &rhs) { return rhs < lhs; }
+    friend bool operator<=(const UUID &lhs, const UUID &rhs) { return !(lhs > rhs); }
+    friend bool operator>=(const UUID &lhs, const UUID &rhs) { return !(lhs < rhs); }
+
+    /* Serializes the uuid to a byte string (16 bytes) */
+    std::string bytes() const {
+      std::string mem;
+      bytes(mem);
+      return mem;
+    }
+
+    void bytes(std::string &out) const {
+      out.resize(sizeof(data));
+      bytes((char*)out.data());
+    }
+
+    void bytes(char* bytes) const {
+      __m128i x = betole128(_mm_load_si128((__m128i*)data));
+      _mm_storeu_si128((__m128i*)bytes, x);
+    }
+
+    /* Converts the uuid to its string representation */
+    std::string str() const {
+      std::string mem;
+      str(mem);
+      return mem;
+    }
+
+    void str(std::string &s) const {
+      s.resize(36);
+      str((char*)s.data());
+    }
+
+    void str(char *res) const {
+      __m128i x = _mm_load_si128((__m128i*)data);
+      m128itos(x, res);
+    }
+
+    friend std::ostream& operator<< (std::ostream& stream, const UUID& uuid) {
+      return stream << uuid.str();
+    }
+
+    friend std::istream& operator>> (std::istream& stream, UUID& uuid) {
+      std::string s;
+      stream >> s;
+      uuid = fromStrFactory(s);
+      return stream;
+    }
+
+    size_t hash() const {
+      const uint64_t a = *((uint64_t*)data);
+      const uint64_t b = *((uint64_t*)&data[8]);
+      return a ^ (b + 0x9e3779b9 + (a << 6) + (a >> 2));
+    }
+
+  private:
+    alignas(128) uint8_t data[16];
+};
+
+/*
+  Generates UUIDv4 from a provided random generator (c++11 <random> module)
+  std::mt19937_64 is highly recommended as it has a SIMD implementation that
+  makes it very fast and it produces high quality randomness.
+ */
+template <typename RNG>
+class UUIDGenerator {
+  public:
+    UUIDGenerator() : generator(new RNG(std::random_device()())), distribution(std::numeric_limits<uint64_t>::min(), std::numeric_limits<uint64_t>::max())
+    {}
+
+    UUIDGenerator(uint64_t seed) : generator(new RNG(seed)), distribution(std::numeric_limits<uint64_t>::min(), std::numeric_limits<uint64_t>::max())
+    {}
+
+    UUIDGenerator(RNG &gen) : generator(gen), distribution(std::numeric_limits<uint64_t>::min(), std::numeric_limits<uint64_t>::max())
+    {}
+
+    /* Generates a new UUID */
+    UUID getUUID() {
+      // The two masks set the uuid version (4) and variant (1)
+      const __m128i and_mask = _mm_set_epi64x(0xFFFFFFFFFFFFFF3Full, 0xFF0FFFFFFFFFFFFFull);
+      const __m128i or_mask =  _mm_set_epi64x(0x0000000000000080ull, 0x0040000000000000ull);
+      __m128i n = _mm_set_epi64x(distribution(*generator), distribution(*generator));
+      __m128i uuid = _mm_or_si128(_mm_and_si128(n, and_mask), or_mask);
+
+      return UUID(uuid);
+    }
+
+  private:
+    std::shared_ptr<RNG> generator;
+    std::uniform_int_distribution<uint64_t> distribution;
+};
+
+}
+
+namespace std {
+  template <> struct hash<UUIDv4::UUID>
+  {
+    size_t operator()(const UUIDv4::UUID & uuid) const
+    {
+      return uuid.hash();
+    }
+  };
+}
--- a/include/dns_decoder.h
+++ b/include/dns_decoder.h
@@ -42,11 +42,11 @@ struct dns_resource_record;

 enum dns_message_type dns_message_type_get(struct dns_message *msg);

-int32_t dns_message_transaction_index_get(struct dns_message *msg);
-
 int32_t dns_message_header_id_get(struct dns_message *msg);
 struct dns_flag *dns_message_header_flag_get0(struct dns_message *msg);

+void dns_message_uuid_get0(struct dns_message *msg, char **value, size_t *value_sz);
+
 void dns_message_query_question_get0(struct dns_message *msg, struct dns_query_question **question, uint16_t *n_question);
 const char *dns_query_question_qname_get0(struct dns_query_question *question);
 int32_t dns_query_question_qtype_get0(struct dns_query_question *question);
--- a/src/dns_decoder.cpp
+++ b/src/dns_decoder.cpp
@@ -12,6 +12,11 @@

 #include "fieldstat/fieldstat_easy.h"

+#include "uuid_v4/uuid_v4.h"
+
+std::random_device rd;
+thread_local UUIDv4::UUIDGenerator<std::mt19937_64> dns_decoder_uuidGenerator(rd());
+
 #ifdef __cplusplus
 extern "C"
 {
@@ -27,6 +32,8 @@ extern "C"
 }
 #endif

+#define DNS_UUID_BYTES_SZ 16
+
 #define DNS_HEADER_SIZE 12

 #define	DNS_DECODER_FALSE	0
@@ -67,7 +74,7 @@ struct dns_message
 	int32_t magic;
    enum dns_message_type type;

-	int32_t current_trans_idx;
+	char uuid_bytes[DNS_UUID_BYTES_SZ];
 	uint8_t decode_rr_status;
 	uint16_t trans_identifier_id;
 	struct dns_flag flag;
@@ -134,6 +141,7 @@ struct dns_decoder_plugin_env

 struct dns_transaction
 {
+	char uuid_bytes[DNS_UUID_BYTES_SZ];
 	int32_t message_id;
 	int32_t trans_idx;
 	UT_hash_handle hh;
@@ -352,27 +360,27 @@ int32_t dns_dstring_decode(uint8_t *payload, size_t payload_sz, size_t *payload_
 }


-static size_t integer_tag_fill(struct fieldstat_tag *tag, const char *key, long long value)
+static size_t integer_tag_fill(struct field *tag, const char *key, long long value)
 {
    if(tag==NULL || key==NULL || strlen(key)==0)
    {
        return 0;
    }

-    tag->type=TAG_INTEGER;
+    tag->type=FIELD_VALUE_INTEGER;
    tag->key=key;
    tag->value_longlong=value;
    return 1;
 }

-static size_t string_tag_fill(struct fieldstat_tag *tag, const char *key, const char *value)
+static size_t string_tag_fill(struct field *tag, const char *key, const char *value)
 {
    if(tag==NULL || key==NULL || value==NULL || strlen(key)==0 || strlen(value)==0)
    {
        return 0;
    }

-    tag->type=TAG_CSTRING;
+    tag->type=FIELD_VALUE_CSTRING;
    tag->key=key;
    tag->value_str=value;
    return 1;
@@ -386,7 +394,7 @@ void dns_decoder_local_file_counter_incby(struct dns_decoder_plugin_env *plugin_
    }
    
    size_t tags_offset=0;
-    struct fieldstat_tag tags[n_tags+2]={0};
+    struct field tags[n_tags+2]={0};
 	
 	tags_offset+=string_tag_fill(&(tags[tags_offset]), "decoder", "dns");
 	
@@ -1203,12 +1211,12 @@ void dns_decoder_session_transaction_del(struct dns_decoder_context *per_ss_ctx,
 	FREE(current_trans);
 }

-void dns_message_transaction_publish(struct session *ss, enum dns_message_type type, int32_t topic_id, int32_t current_trans_idx)
+void dns_message_transaction_publish(struct session *ss, enum dns_message_type type, int32_t topic_id, char *uuid_bytes, size_t uuid_bytes_sz)
 {
 	struct dns_message *msg=(struct dns_message *)CALLOC(struct dns_message, 1);
 	msg->magic=DNS_MESSAGE_MAGIC;
 	msg->type=type;
-	msg->current_trans_idx=current_trans_idx;
+	memcpy(msg->uuid_bytes, uuid_bytes, MIN(uuid_bytes_sz, sizeof(msg->uuid_bytes)));

 	session_mq_publish_message(ss, topic_id, msg);
 }
@@ -1234,6 +1242,16 @@ const char *dns_decoder_ipproto_string_get(struct session *ss)
 	return TAG_VALUE_UNKNOWN;
 }

+void dns_response_packet()
+{
+
+}
+
+void dns_query_packet()
+{
+
+}
+
 void dns_decoder_entry(struct session *ss, uint8_t *payload, size_t payload_sz, void *per_session_ctx, void *plugin_env_str)
 {
    struct dns_header dns_hdr={0};
@@ -1283,6 +1301,7 @@ void dns_decoder_entry(struct session *ss, uint8_t *payload, size_t payload_sz,
 	}

 	int32_t current_trans_idx=0;
+	struct dns_transaction response_transaction={0};
 	struct dns_transaction *current_trans=NULL;
 	struct dns_decoder_context *per_ss_ctx=(struct dns_decoder_context *)per_session_ctx;

@@ -1292,7 +1311,7 @@ void dns_decoder_entry(struct session *ss, uint8_t *payload, size_t payload_sz,
 	HASH_FIND_INT(per_ss_ctx->trans_hash, &message_id, current_trans);
 	if(current_trans!=NULL && msg_type==DNS_MESSAGE_QUERY)
 	{
-		dns_message_transaction_publish(ss, DNS_MESSAGE_TRANSACTION_END, plugin_env->dns.topic_id, current_trans->trans_idx);
+		dns_message_transaction_publish(ss, DNS_MESSAGE_TRANSACTION_END, plugin_env->dns.topic_id, current_trans->uuid_bytes, sizeof(current_trans->uuid_bytes));
 		dns_decoder_session_transaction_del(per_ss_ctx, current_trans);
 		current_trans=NULL;
 		
@@ -1310,10 +1329,20 @@ void dns_decoder_entry(struct session *ss, uint8_t *payload, size_t payload_sz,
 			current_trans=(struct dns_transaction *)CALLOC(struct dns_transaction, 1);
 			current_trans->trans_idx=current_trans_idx;
 			current_trans->message_id=message_id;
+			UUIDv4::UUID uid=dns_decoder_uuidGenerator.getUUID();
+			uid.bytes(current_trans->uuid_bytes);
 			dns_decoder_session_transaction_add(per_ss_ctx, current_trans);
 		}
+		else
+		{
+			current_trans=&response_transaction;
+			current_trans->trans_idx=current_trans_idx;
+			current_trans->message_id=message_id;
+			UUIDv4::UUID uid=dns_decoder_uuidGenerator.getUUID();
+			uid.bytes(current_trans->uuid_bytes);
+		}
 		
-		dns_message_transaction_publish(ss, DNS_MESSAGE_TRANSACTION_BEGIN, plugin_env->dns.topic_id, current_trans_idx);
+		dns_message_transaction_publish(ss, DNS_MESSAGE_TRANSACTION_BEGIN, plugin_env->dns.topic_id, current_trans->uuid_bytes, sizeof(current_trans->uuid_bytes));

 		size_t tag_offset=3;
 		const char *tag_key[tag_offset]={TAG_KEY_IPPROTO, TAG_KEY_MESSAGE_TYPE, TAG_KEY_MESSAGE_STATUS};
@@ -1327,7 +1356,7 @@ void dns_decoder_entry(struct session *ss, uint8_t *payload, size_t payload_sz,
 	data_msg->payload_sz=payload_sz;
 	data_msg->payload_offset=payload_offset;
 	data_msg->decode_rr_status=DNS_RR_STATUS_INIT;
-	data_msg->current_trans_idx=current_trans_idx;
+	memcpy(data_msg->uuid_bytes, current_trans->uuid_bytes, MIN(sizeof(data_msg->uuid_bytes), sizeof(current_trans->uuid_bytes)));

    session_mq_publish_message(ss, plugin_env->dns.topic_id, data_msg);

@@ -1339,7 +1368,7 @@ void dns_decoder_entry(struct session *ss, uint8_t *payload, size_t payload_sz,

 	if(msg_type==DNS_MESSAGE_RESPONSE)
 	{
-		dns_message_transaction_publish(ss, DNS_MESSAGE_TRANSACTION_END, plugin_env->dns.topic_id, current_trans_idx);
+		dns_message_transaction_publish(ss, DNS_MESSAGE_TRANSACTION_END, plugin_env->dns.topic_id, current_trans->uuid_bytes, sizeof(current_trans->uuid_bytes));
 		dns_decoder_session_transaction_del(per_ss_ctx, current_trans);

 		size_t tag_offset=3;
@@ -1351,7 +1380,7 @@ void dns_decoder_entry(struct session *ss, uint8_t *payload, size_t payload_sz,
 	if(per_ss_ctx->trans_list_num > plugin_env->max_cache_trans_num)
 	{
 		current_trans=per_ss_ctx->trans_list_head;
-		dns_message_transaction_publish(ss, DNS_MESSAGE_TRANSACTION_END, plugin_env->dns.topic_id, current_trans->trans_idx);
+		dns_message_transaction_publish(ss, DNS_MESSAGE_TRANSACTION_END, plugin_env->dns.topic_id, current_trans->uuid_bytes, sizeof(current_trans->uuid_bytes));
 		dns_decoder_session_transaction_del(per_ss_ctx, current_trans);

 		size_t tag_offset=3;
@@ -1381,7 +1410,7 @@ int dns_decoder_transaction_end_in_closing(struct session *ss, void *per_session
 	struct dns_transaction *current_trans=NULL, *tmp_trans=NULL;
 	HASH_ITER(hh, per_ss_ctx->trans_hash, current_trans, tmp_trans)
 	{
-		dns_message_transaction_publish(ss, DNS_MESSAGE_TRANSACTION_END, plugin_env->dns.topic_id, current_trans->trans_idx);
+		dns_message_transaction_publish(ss, DNS_MESSAGE_TRANSACTION_END, plugin_env->dns.topic_id, current_trans->uuid_bytes, sizeof(current_trans->uuid_bytes));
 		dns_decoder_session_transaction_del(per_ss_ctx, current_trans);
 	}
 	
@@ -1852,14 +1881,15 @@ extern "C" void dns_decoder_exit(void *plugin_env_str)
    FREE(plugin_env_str);
 }

-int32_t dns_message_transaction_index_get(struct dns_message *msg)
+void dns_message_uuid_get0(struct dns_message *msg, char **value, size_t *value_sz)
 {
 	if(NULL==msg || msg->magic!=DNS_MESSAGE_MAGIC)
 	{
-		return -1;
+		return ;
 	}
-
-	return msg->current_trans_idx;
+	
+	(*value)=msg->uuid_bytes;
+	(*value_sz)=sizeof(msg->uuid_bytes);
 }

 enum dns_message_type dns_message_type_get(struct dns_message *msg)
--- a/src/dns_resource_record_exporter.cpp
+++ b/src/dns_resource_record_exporter.cpp
@@ -28,13 +28,7 @@ void dns_resource_record_str2hex_append(yyjson_mut_doc *doc, yyjson_mut_val *rr_
 	if(offset>0)
 	{
 		hex_buff[offset]='\0';
-		char *tmp=(char *)malloc(offset+1);
-		if(tmp!=NULL)
-		{
-			memcpy(tmp, hex_buff, offset+1);
-			yyjson_mut_obj_add_str(doc, rr_object, key, tmp);
-			//free(tmp);
-		}
+		yyjson_mut_obj_add_strcpy(doc, rr_object, key, hex_buff);
 	}
 }

--- a/src/version.map
+++ b/src/version.map
@@ -14,7 +14,7 @@ global:
 		*dns_message_authority_resource_record_get0*;
 		*dns_message_additional_resource_record_get0*;
 		*dns_message_resource_record_json_exporter*;
-		*dns_message_transaction_index_get*;
+		*dns_message_uuid_get0*;
 		*dns_message_resource_record_is_dnssec*;
 		*dns_message_resource_record_cname_json_exporter*;
 		*GIT*;
--- a/test/dns_decoder_perf_main.cpp
+++ b/test/dns_decoder_perf_main.cpp
@@ -48,7 +48,7 @@ enum PERF_TAG
 struct fs_easy_schame
 {
    int id[PERF_TAG_MAX];
-    struct fieldstat_tag tag[PERF_TAG_MAX];
+    struct field tag[PERF_TAG_MAX];
    struct fieldstat_easy *handle;
 };

@@ -145,12 +145,12 @@ static void main_stat_init(struct perf_main_env *main_env)
    fieldstat_easy_enable_auto_output(main_env->fse.handle, "./metrics/dns_decoder_perf_test.json", 1);

    main_env->fse.tag[PERF_TAG_QUESTION].key="question";
-    main_env->fse.tag[PERF_TAG_QUESTION].type=TAG_DOUBLE;
+    main_env->fse.tag[PERF_TAG_QUESTION].type=FIELD_VALUE_DOUBLE;
    main_env->fse.tag[PERF_TAG_QUESTION].value_double=0.00001;
    main_env->fse.id[PERF_TAG_QUESTION]=fieldstat_easy_register_histogram(main_env->fse.handle, "question", 1, 99999999, 5);

    main_env->fse.tag[PERF_TAG_RESOURCE_RECORD].key="resource_record";
-    main_env->fse.tag[PERF_TAG_RESOURCE_RECORD].type=TAG_DOUBLE;
+    main_env->fse.tag[PERF_TAG_RESOURCE_RECORD].type=FIELD_VALUE_DOUBLE;
    main_env->fse.tag[PERF_TAG_RESOURCE_RECORD].value_double=0.00001;
    main_env->fse.id[PERF_TAG_RESOURCE_RECORD]=fieldstat_easy_register_histogram(main_env->fse.handle, "resource-record", 1, 99999999, 5);
 }