Malformed DNS response packet (python + scapy)

Question

I'm working on creating a proxy server using Python and scapy. TCP packets seem to be working fine but I'm running into some issues with UDP, specifically DNS requests. Essentially when a DNS request comes in I capture it in my script, preform the DNS lookup, and am trying to return it back to the person requesting the DNS query. The script successfully preforms the lookup and returns the DNS response, however when looking at wireshark it tells me it's a "Malformed Packet". Could someone tell me what I need to do in order to correctly return the DNS response?

#!/usr/bin/env python

from tornado.websocket import WebSocketHandler
from tornado.httpserver import HTTPServer
from tornado.web import Application
from tornado.ioloop import IOLoop

from collections import defaultdict
from scapy.all import *
import threading    

outbound_udp = defaultdict(int)
connection = None

class PacketSniffer(threading.Thread):
    def __init__(self):
        threading.Thread.__init__(self)

    def run(self):
        global connection
        while (True):
            pkt = sniff(iface="eth0", count=1)

            if pkt[0].haslayer(DNS):
              print "Returning back has UDP"
              print pkt.summary()
              ipPacket = pkt[0][IP]
              dnsPacket = pkt[0][DNS]

              if outbound_udp[(ipPacket.src, dnsPacket.id)] > 0:
                  outbound_udp[(ipPacket.src, dnsPacket.id)] -= 1
                  print "Found in outbound_udp"
                  # Modify the destination address back to the address of the TUN on the host.
                  ipPacket.dst = "10.0.0.1"
                  try:
                    del ipPacket[TCP].chksum
                    del ipPacket[IP].chksum
                    del ipPacket[UDP].chksum
                  except IndexError:
                    print ""

                  ipPacket.show2() # Force recompute the checksum

                  if connection:
                      connection.write_message(str(ipPacket).encode('base64'))


sniffingThread = PacketSniffer()
sniffingThread.daemon = True
sniffingThread.start()

Answer 1

Some bugs have been fixed recently in Scapy around DNS (and other sophisticated protocols, but DNS is the most frequently seen):

• https://bitbucket.org/secdev/scapy/issue/913/
• https://bitbucket.org/secdev/scapy/issue/5104/
• https://bitbucket.org/secdev/scapy/issue/5105/

Trying with the latest Scapy development version from the Mercurial repository (hg clone http://bb.secdev.org/scapy) should fix this.