1 /*
2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
16 * written permission.
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20 */
21
22 /* \summary: Domain Name System (DNS) printer */
23
24 #ifdef HAVE_CONFIG_H
25 #include "config.h"
26 #endif
27
28 #include <netdissect-stdinc.h>
29
30 #include "nameser.h"
31
32 #include <string.h>
33
34 #include "netdissect.h"
35 #include "addrtoname.h"
36 #include "addrtostr.h"
37 #include "extract.h"
38
39 static const char *ns_ops[] = {
40 "", " inv_q", " stat", " op3", " notify", " update", " op6", " op7",
41 " op8", " updateA", " updateD", " updateDA",
42 " updateM", " updateMA", " zoneInit", " zoneRef",
43 };
44
45 static const char *ns_resp[] = {
46 "", " FormErr", " ServFail", " NXDomain",
47 " NotImp", " Refused", " YXDomain", " YXRRSet",
48 " NXRRSet", " NotAuth", " NotZone", " Resp11",
49 " Resp12", " Resp13", " Resp14", " NoChange",
50 };
51
52 /* skip over a domain name */
53 static const u_char *
ns_nskip(netdissect_options * ndo,register const u_char * cp)54 ns_nskip(netdissect_options *ndo,
55 register const u_char *cp)
56 {
57 register u_char i;
58
59 if (!ND_TTEST2(*cp, 1))
60 return (NULL);
61 i = *cp++;
62 while (i) {
63 if ((i & INDIR_MASK) == INDIR_MASK)
64 return (cp + 1);
65 if ((i & INDIR_MASK) == EDNS0_MASK) {
66 int bitlen, bytelen;
67
68 if ((i & ~INDIR_MASK) != EDNS0_ELT_BITLABEL)
69 return(NULL); /* unknown ELT */
70 if (!ND_TTEST2(*cp, 1))
71 return (NULL);
72 if ((bitlen = *cp++) == 0)
73 bitlen = 256;
74 bytelen = (bitlen + 7) / 8;
75 cp += bytelen;
76 } else
77 cp += i;
78 if (!ND_TTEST2(*cp, 1))
79 return (NULL);
80 i = *cp++;
81 }
82 return (cp);
83 }
84
85 /* print a <domain-name> */
86 static const u_char *
blabel_print(netdissect_options * ndo,const u_char * cp)87 blabel_print(netdissect_options *ndo,
88 const u_char *cp)
89 {
90 int bitlen, slen, b;
91 const u_char *bitp, *lim;
92 char tc;
93
94 if (!ND_TTEST2(*cp, 1))
95 return(NULL);
96 if ((bitlen = *cp) == 0)
97 bitlen = 256;
98 slen = (bitlen + 3) / 4;
99 lim = cp + 1 + slen;
100
101 /* print the bit string as a hex string */
102 ND_PRINT((ndo, "\\[x"));
103 for (bitp = cp + 1, b = bitlen; bitp < lim && b > 7; b -= 8, bitp++) {
104 ND_TCHECK(*bitp);
105 ND_PRINT((ndo, "%02x", *bitp));
106 }
107 if (b > 4) {
108 ND_TCHECK(*bitp);
109 tc = *bitp++;
110 ND_PRINT((ndo, "%02x", tc & (0xff << (8 - b))));
111 } else if (b > 0) {
112 ND_TCHECK(*bitp);
113 tc = *bitp++;
114 ND_PRINT((ndo, "%1x", ((tc >> 4) & 0x0f) & (0x0f << (4 - b))));
115 }
116 ND_PRINT((ndo, "/%d]", bitlen));
117 return lim;
118 trunc:
119 ND_PRINT((ndo, ".../%d]", bitlen));
120 return NULL;
121 }
122
123 static int
labellen(netdissect_options * ndo,const u_char * cp)124 labellen(netdissect_options *ndo,
125 const u_char *cp)
126 {
127 register u_int i;
128
129 if (!ND_TTEST2(*cp, 1))
130 return(-1);
131 i = *cp;
132 if ((i & INDIR_MASK) == EDNS0_MASK) {
133 int bitlen, elt;
134 if ((elt = (i & ~INDIR_MASK)) != EDNS0_ELT_BITLABEL) {
135 ND_PRINT((ndo, "<ELT %d>", elt));
136 return(-1);
137 }
138 if (!ND_TTEST2(*(cp + 1), 1))
139 return(-1);
140 if ((bitlen = *(cp + 1)) == 0)
141 bitlen = 256;
142 return(((bitlen + 7) / 8) + 1);
143 } else
144 return(i);
145 }
146
147 const u_char *
ns_nprint(netdissect_options * ndo,register const u_char * cp,register const u_char * bp)148 ns_nprint(netdissect_options *ndo,
149 register const u_char *cp, register const u_char *bp)
150 {
151 register u_int i, l;
152 register const u_char *rp = NULL;
153 register int compress = 0;
154 int elt;
155 u_int offset, max_offset;
156
157 if ((l = labellen(ndo, cp)) == (u_int)-1)
158 return(NULL);
159 if (!ND_TTEST2(*cp, 1))
160 return(NULL);
161 max_offset = (u_int)(cp - bp);
162 if (((i = *cp++) & INDIR_MASK) != INDIR_MASK) {
163 compress = 0;
164 rp = cp + l;
165 }
166
167 if (i != 0)
168 while (i && cp < ndo->ndo_snapend) {
169 if ((i & INDIR_MASK) == INDIR_MASK) {
170 if (!compress) {
171 rp = cp + 1;
172 compress = 1;
173 }
174 if (!ND_TTEST2(*cp, 1))
175 return(NULL);
176 offset = (((i << 8) | *cp) & 0x3fff);
177 /*
178 * This must move backwards in the packet.
179 * No RFC explicitly says that, but BIND's
180 * name decompression code requires it,
181 * as a way of preventing infinite loops
182 * and other bad behavior, and it's probably
183 * what was intended (compress by pointing
184 * to domain name suffixes already seen in
185 * the packet).
186 */
187 if (offset >= max_offset) {
188 ND_PRINT((ndo, "<BAD PTR>"));
189 return(NULL);
190 }
191 max_offset = offset;
192 cp = bp + offset;
193 if ((l = labellen(ndo, cp)) == (u_int)-1)
194 return(NULL);
195 if (!ND_TTEST2(*cp, 1))
196 return(NULL);
197 i = *cp++;
198 continue;
199 }
200 if ((i & INDIR_MASK) == EDNS0_MASK) {
201 elt = (i & ~INDIR_MASK);
202 switch(elt) {
203 case EDNS0_ELT_BITLABEL:
204 if (blabel_print(ndo, cp) == NULL)
205 return (NULL);
206 break;
207 default:
208 /* unknown ELT */
209 ND_PRINT((ndo, "<ELT %d>", elt));
210 return(NULL);
211 }
212 } else {
213 if (fn_printn(ndo, cp, l, ndo->ndo_snapend))
214 return(NULL);
215 }
216
217 cp += l;
218 ND_PRINT((ndo, "."));
219 if ((l = labellen(ndo, cp)) == (u_int)-1)
220 return(NULL);
221 if (!ND_TTEST2(*cp, 1))
222 return(NULL);
223 i = *cp++;
224 if (!compress)
225 rp += l + 1;
226 }
227 else
228 ND_PRINT((ndo, "."));
229 return (rp);
230 }
231
232 /* print a <character-string> */
233 static const u_char *
ns_cprint(netdissect_options * ndo,register const u_char * cp)234 ns_cprint(netdissect_options *ndo,
235 register const u_char *cp)
236 {
237 register u_int i;
238
239 if (!ND_TTEST2(*cp, 1))
240 return (NULL);
241 i = *cp++;
242 if (fn_printn(ndo, cp, i, ndo->ndo_snapend))
243 return (NULL);
244 return (cp + i);
245 }
246
247 /* http://www.iana.org/assignments/dns-parameters */
248 const struct tok ns_type2str[] = {
249 { T_A, "A" }, /* RFC 1035 */
250 { T_NS, "NS" }, /* RFC 1035 */
251 { T_MD, "MD" }, /* RFC 1035 */
252 { T_MF, "MF" }, /* RFC 1035 */
253 { T_CNAME, "CNAME" }, /* RFC 1035 */
254 { T_SOA, "SOA" }, /* RFC 1035 */
255 { T_MB, "MB" }, /* RFC 1035 */
256 { T_MG, "MG" }, /* RFC 1035 */
257 { T_MR, "MR" }, /* RFC 1035 */
258 { T_NULL, "NULL" }, /* RFC 1035 */
259 { T_WKS, "WKS" }, /* RFC 1035 */
260 { T_PTR, "PTR" }, /* RFC 1035 */
261 { T_HINFO, "HINFO" }, /* RFC 1035 */
262 { T_MINFO, "MINFO" }, /* RFC 1035 */
263 { T_MX, "MX" }, /* RFC 1035 */
264 { T_TXT, "TXT" }, /* RFC 1035 */
265 { T_RP, "RP" }, /* RFC 1183 */
266 { T_AFSDB, "AFSDB" }, /* RFC 1183 */
267 { T_X25, "X25" }, /* RFC 1183 */
268 { T_ISDN, "ISDN" }, /* RFC 1183 */
269 { T_RT, "RT" }, /* RFC 1183 */
270 { T_NSAP, "NSAP" }, /* RFC 1706 */
271 { T_NSAP_PTR, "NSAP_PTR" },
272 { T_SIG, "SIG" }, /* RFC 2535 */
273 { T_KEY, "KEY" }, /* RFC 2535 */
274 { T_PX, "PX" }, /* RFC 2163 */
275 { T_GPOS, "GPOS" }, /* RFC 1712 */
276 { T_AAAA, "AAAA" }, /* RFC 1886 */
277 { T_LOC, "LOC" }, /* RFC 1876 */
278 { T_NXT, "NXT" }, /* RFC 2535 */
279 { T_EID, "EID" }, /* Nimrod */
280 { T_NIMLOC, "NIMLOC" }, /* Nimrod */
281 { T_SRV, "SRV" }, /* RFC 2782 */
282 { T_ATMA, "ATMA" }, /* ATM Forum */
283 { T_NAPTR, "NAPTR" }, /* RFC 2168, RFC 2915 */
284 { T_KX, "KX" }, /* RFC 2230 */
285 { T_CERT, "CERT" }, /* RFC 2538 */
286 { T_A6, "A6" }, /* RFC 2874 */
287 { T_DNAME, "DNAME" }, /* RFC 2672 */
288 { T_SINK, "SINK" },
289 { T_OPT, "OPT" }, /* RFC 2671 */
290 { T_APL, "APL" }, /* RFC 3123 */
291 { T_DS, "DS" }, /* RFC 4034 */
292 { T_SSHFP, "SSHFP" }, /* RFC 4255 */
293 { T_IPSECKEY, "IPSECKEY" }, /* RFC 4025 */
294 { T_RRSIG, "RRSIG" }, /* RFC 4034 */
295 { T_NSEC, "NSEC" }, /* RFC 4034 */
296 { T_DNSKEY, "DNSKEY" }, /* RFC 4034 */
297 { T_SPF, "SPF" }, /* RFC-schlitt-spf-classic-02.txt */
298 { T_UINFO, "UINFO" },
299 { T_UID, "UID" },
300 { T_GID, "GID" },
301 { T_UNSPEC, "UNSPEC" },
302 { T_UNSPECA, "UNSPECA" },
303 { T_TKEY, "TKEY" }, /* RFC 2930 */
304 { T_TSIG, "TSIG" }, /* RFC 2845 */
305 { T_IXFR, "IXFR" }, /* RFC 1995 */
306 { T_AXFR, "AXFR" }, /* RFC 1035 */
307 { T_MAILB, "MAILB" }, /* RFC 1035 */
308 { T_MAILA, "MAILA" }, /* RFC 1035 */
309 { T_ANY, "ANY" },
310 { 0, NULL }
311 };
312
313 const struct tok ns_class2str[] = {
314 { C_IN, "IN" }, /* Not used */
315 { C_CHAOS, "CHAOS" },
316 { C_HS, "HS" },
317 { C_ANY, "ANY" },
318 { 0, NULL }
319 };
320
321 /* print a query */
322 static const u_char *
ns_qprint(netdissect_options * ndo,register const u_char * cp,register const u_char * bp,int is_mdns)323 ns_qprint(netdissect_options *ndo,
324 register const u_char *cp, register const u_char *bp, int is_mdns)
325 {
326 register const u_char *np = cp;
327 register u_int i, class;
328
329 cp = ns_nskip(ndo, cp);
330
331 if (cp == NULL || !ND_TTEST2(*cp, 4))
332 return(NULL);
333
334 /* print the qtype */
335 i = EXTRACT_16BITS(cp);
336 cp += 2;
337 ND_PRINT((ndo, " %s", tok2str(ns_type2str, "Type%d", i)));
338 /* print the qclass (if it's not IN) */
339 i = EXTRACT_16BITS(cp);
340 cp += 2;
341 if (is_mdns)
342 class = (i & ~C_QU);
343 else
344 class = i;
345 if (class != C_IN)
346 ND_PRINT((ndo, " %s", tok2str(ns_class2str, "(Class %d)", class)));
347 if (is_mdns) {
348 ND_PRINT((ndo, i & C_QU ? " (QU)" : " (QM)"));
349 }
350
351 ND_PRINT((ndo, "? "));
352 cp = ns_nprint(ndo, np, bp);
353 return(cp ? cp + 4 : NULL);
354 }
355
356 /* print a reply */
357 static const u_char *
ns_rprint(netdissect_options * ndo,register const u_char * cp,register const u_char * bp,int is_mdns)358 ns_rprint(netdissect_options *ndo,
359 register const u_char *cp, register const u_char *bp, int is_mdns)
360 {
361 register u_int i, class, opt_flags = 0;
362 register u_short typ, len;
363 register const u_char *rp;
364
365 if (ndo->ndo_vflag) {
366 ND_PRINT((ndo, " "));
367 if ((cp = ns_nprint(ndo, cp, bp)) == NULL)
368 return NULL;
369 } else
370 cp = ns_nskip(ndo, cp);
371
372 if (cp == NULL || !ND_TTEST2(*cp, 10))
373 return (ndo->ndo_snapend);
374
375 /* print the type/qtype */
376 typ = EXTRACT_16BITS(cp);
377 cp += 2;
378 /* print the class (if it's not IN and the type isn't OPT) */
379 i = EXTRACT_16BITS(cp);
380 cp += 2;
381 if (is_mdns)
382 class = (i & ~C_CACHE_FLUSH);
383 else
384 class = i;
385 if (class != C_IN && typ != T_OPT)
386 ND_PRINT((ndo, " %s", tok2str(ns_class2str, "(Class %d)", class)));
387 if (is_mdns) {
388 if (i & C_CACHE_FLUSH)
389 ND_PRINT((ndo, " (Cache flush)"));
390 }
391
392 if (typ == T_OPT) {
393 /* get opt flags */
394 cp += 2;
395 opt_flags = EXTRACT_16BITS(cp);
396 /* ignore rest of ttl field */
397 cp += 2;
398 } else if (ndo->ndo_vflag > 2) {
399 /* print ttl */
400 ND_PRINT((ndo, " ["));
401 unsigned_relts_print(ndo, EXTRACT_32BITS(cp));
402 ND_PRINT((ndo, "]"));
403 cp += 4;
404 } else {
405 /* ignore ttl */
406 cp += 4;
407 }
408
409 len = EXTRACT_16BITS(cp);
410 cp += 2;
411
412 rp = cp + len;
413
414 ND_PRINT((ndo, " %s", tok2str(ns_type2str, "Type%d", typ)));
415 if (rp > ndo->ndo_snapend)
416 return(NULL);
417
418 switch (typ) {
419 case T_A:
420 if (!ND_TTEST2(*cp, sizeof(struct in_addr)))
421 return(NULL);
422 ND_PRINT((ndo, " %s", intoa(htonl(EXTRACT_32BITS(cp)))));
423 break;
424
425 case T_NS:
426 case T_CNAME:
427 case T_PTR:
428 #ifdef T_DNAME
429 case T_DNAME:
430 #endif
431 ND_PRINT((ndo, " "));
432 if (ns_nprint(ndo, cp, bp) == NULL)
433 return(NULL);
434 break;
435
436 case T_SOA:
437 if (!ndo->ndo_vflag)
438 break;
439 ND_PRINT((ndo, " "));
440 if ((cp = ns_nprint(ndo, cp, bp)) == NULL)
441 return(NULL);
442 ND_PRINT((ndo, " "));
443 if ((cp = ns_nprint(ndo, cp, bp)) == NULL)
444 return(NULL);
445 if (!ND_TTEST2(*cp, 5 * 4))
446 return(NULL);
447 ND_PRINT((ndo, " %u", EXTRACT_32BITS(cp)));
448 cp += 4;
449 ND_PRINT((ndo, " %u", EXTRACT_32BITS(cp)));
450 cp += 4;
451 ND_PRINT((ndo, " %u", EXTRACT_32BITS(cp)));
452 cp += 4;
453 ND_PRINT((ndo, " %u", EXTRACT_32BITS(cp)));
454 cp += 4;
455 ND_PRINT((ndo, " %u", EXTRACT_32BITS(cp)));
456 cp += 4;
457 break;
458 case T_MX:
459 ND_PRINT((ndo, " "));
460 if (!ND_TTEST2(*cp, 2))
461 return(NULL);
462 if (ns_nprint(ndo, cp + 2, bp) == NULL)
463 return(NULL);
464 ND_PRINT((ndo, " %d", EXTRACT_16BITS(cp)));
465 break;
466
467 case T_TXT:
468 while (cp < rp) {
469 ND_PRINT((ndo, " \""));
470 cp = ns_cprint(ndo, cp);
471 if (cp == NULL)
472 return(NULL);
473 ND_PRINT((ndo, "\""));
474 }
475 break;
476
477 case T_SRV:
478 ND_PRINT((ndo, " "));
479 if (!ND_TTEST2(*cp, 6))
480 return(NULL);
481 if (ns_nprint(ndo, cp + 6, bp) == NULL)
482 return(NULL);
483 ND_PRINT((ndo, ":%d %d %d", EXTRACT_16BITS(cp + 4),
484 EXTRACT_16BITS(cp), EXTRACT_16BITS(cp + 2)));
485 break;
486
487 case T_AAAA:
488 {
489 char ntop_buf[INET6_ADDRSTRLEN];
490
491 if (!ND_TTEST2(*cp, sizeof(struct in6_addr)))
492 return(NULL);
493 ND_PRINT((ndo, " %s",
494 addrtostr6(cp, ntop_buf, sizeof(ntop_buf))));
495
496 break;
497 }
498
499 case T_A6:
500 {
501 struct in6_addr a;
502 int pbit, pbyte;
503 char ntop_buf[INET6_ADDRSTRLEN];
504
505 if (!ND_TTEST2(*cp, 1))
506 return(NULL);
507 pbit = *cp;
508 pbyte = (pbit & ~7) / 8;
509 if (pbit > 128) {
510 ND_PRINT((ndo, " %u(bad plen)", pbit));
511 break;
512 } else if (pbit < 128) {
513 if (!ND_TTEST2(*(cp + 1), sizeof(a) - pbyte))
514 return(NULL);
515 memset(&a, 0, sizeof(a));
516 memcpy(&a.s6_addr[pbyte], cp + 1, sizeof(a) - pbyte);
517 ND_PRINT((ndo, " %u %s", pbit,
518 addrtostr6(&a, ntop_buf, sizeof(ntop_buf))));
519 }
520 if (pbit > 0) {
521 ND_PRINT((ndo, " "));
522 if (ns_nprint(ndo, cp + 1 + sizeof(a) - pbyte, bp) == NULL)
523 return(NULL);
524 }
525 break;
526 }
527
528 case T_OPT:
529 ND_PRINT((ndo, " UDPsize=%u", class));
530 if (opt_flags & 0x8000)
531 ND_PRINT((ndo, " DO"));
532 break;
533
534 case T_UNSPECA: /* One long string */
535 if (!ND_TTEST2(*cp, len))
536 return(NULL);
537 if (fn_printn(ndo, cp, len, ndo->ndo_snapend))
538 return(NULL);
539 break;
540
541 case T_TSIG:
542 {
543 if (cp + len > ndo->ndo_snapend)
544 return(NULL);
545 if (!ndo->ndo_vflag)
546 break;
547 ND_PRINT((ndo, " "));
548 if ((cp = ns_nprint(ndo, cp, bp)) == NULL)
549 return(NULL);
550 cp += 6;
551 if (!ND_TTEST2(*cp, 2))
552 return(NULL);
553 ND_PRINT((ndo, " fudge=%u", EXTRACT_16BITS(cp)));
554 cp += 2;
555 if (!ND_TTEST2(*cp, 2))
556 return(NULL);
557 ND_PRINT((ndo, " maclen=%u", EXTRACT_16BITS(cp)));
558 cp += 2 + EXTRACT_16BITS(cp);
559 if (!ND_TTEST2(*cp, 2))
560 return(NULL);
561 ND_PRINT((ndo, " origid=%u", EXTRACT_16BITS(cp)));
562 cp += 2;
563 if (!ND_TTEST2(*cp, 2))
564 return(NULL);
565 ND_PRINT((ndo, " error=%u", EXTRACT_16BITS(cp)));
566 cp += 2;
567 if (!ND_TTEST2(*cp, 2))
568 return(NULL);
569 ND_PRINT((ndo, " otherlen=%u", EXTRACT_16BITS(cp)));
570 cp += 2;
571 }
572 }
573 return (rp); /* XXX This isn't always right */
574 }
575
576 void
ns_print(netdissect_options * ndo,register const u_char * bp,u_int length,int is_mdns)577 ns_print(netdissect_options *ndo,
578 register const u_char *bp, u_int length, int is_mdns)
579 {
580 register const HEADER *np;
581 register int qdcount, ancount, nscount, arcount;
582 register const u_char *cp;
583 uint16_t b2;
584
585 np = (const HEADER *)bp;
586 ND_TCHECK(*np);
587 /* get the byte-order right */
588 qdcount = EXTRACT_16BITS(&np->qdcount);
589 ancount = EXTRACT_16BITS(&np->ancount);
590 nscount = EXTRACT_16BITS(&np->nscount);
591 arcount = EXTRACT_16BITS(&np->arcount);
592
593 if (DNS_QR(np)) {
594 /* this is a response */
595 ND_PRINT((ndo, "%d%s%s%s%s%s%s",
596 EXTRACT_16BITS(&np->id),
597 ns_ops[DNS_OPCODE(np)],
598 ns_resp[DNS_RCODE(np)],
599 DNS_AA(np)? "*" : "",
600 DNS_RA(np)? "" : "-",
601 DNS_TC(np)? "|" : "",
602 DNS_AD(np)? "$" : ""));
603
604 if (qdcount != 1)
605 ND_PRINT((ndo, " [%dq]", qdcount));
606 /* Print QUESTION section on -vv */
607 cp = (const u_char *)(np + 1);
608 while (qdcount--) {
609 if (qdcount < EXTRACT_16BITS(&np->qdcount) - 1)
610 ND_PRINT((ndo, ","));
611 if (ndo->ndo_vflag > 1) {
612 ND_PRINT((ndo, " q:"));
613 if ((cp = ns_qprint(ndo, cp, bp, is_mdns)) == NULL)
614 goto trunc;
615 } else {
616 if ((cp = ns_nskip(ndo, cp)) == NULL)
617 goto trunc;
618 cp += 4; /* skip QTYPE and QCLASS */
619 }
620 }
621 ND_PRINT((ndo, " %d/%d/%d", ancount, nscount, arcount));
622 if (ancount--) {
623 if ((cp = ns_rprint(ndo, cp, bp, is_mdns)) == NULL)
624 goto trunc;
625 while (cp < ndo->ndo_snapend && ancount--) {
626 ND_PRINT((ndo, ","));
627 if ((cp = ns_rprint(ndo, cp, bp, is_mdns)) == NULL)
628 goto trunc;
629 }
630 }
631 if (ancount > 0)
632 goto trunc;
633 /* Print NS and AR sections on -vv */
634 if (ndo->ndo_vflag > 1) {
635 if (cp < ndo->ndo_snapend && nscount--) {
636 ND_PRINT((ndo, " ns:"));
637 if ((cp = ns_rprint(ndo, cp, bp, is_mdns)) == NULL)
638 goto trunc;
639 while (cp < ndo->ndo_snapend && nscount--) {
640 ND_PRINT((ndo, ","));
641 if ((cp = ns_rprint(ndo, cp, bp, is_mdns)) == NULL)
642 goto trunc;
643 }
644 }
645 if (nscount > 0)
646 goto trunc;
647 if (cp < ndo->ndo_snapend && arcount--) {
648 ND_PRINT((ndo, " ar:"));
649 if ((cp = ns_rprint(ndo, cp, bp, is_mdns)) == NULL)
650 goto trunc;
651 while (cp < ndo->ndo_snapend && arcount--) {
652 ND_PRINT((ndo, ","));
653 if ((cp = ns_rprint(ndo, cp, bp, is_mdns)) == NULL)
654 goto trunc;
655 }
656 }
657 if (arcount > 0)
658 goto trunc;
659 }
660 }
661 else {
662 /* this is a request */
663 ND_PRINT((ndo, "%d%s%s%s", EXTRACT_16BITS(&np->id), ns_ops[DNS_OPCODE(np)],
664 DNS_RD(np) ? "+" : "",
665 DNS_CD(np) ? "%" : ""));
666
667 /* any weirdness? */
668 b2 = EXTRACT_16BITS(((const u_short *)np)+1);
669 if (b2 & 0x6cf)
670 ND_PRINT((ndo, " [b2&3=0x%x]", b2));
671
672 if (DNS_OPCODE(np) == IQUERY) {
673 if (qdcount)
674 ND_PRINT((ndo, " [%dq]", qdcount));
675 if (ancount != 1)
676 ND_PRINT((ndo, " [%da]", ancount));
677 }
678 else {
679 if (ancount)
680 ND_PRINT((ndo, " [%da]", ancount));
681 if (qdcount != 1)
682 ND_PRINT((ndo, " [%dq]", qdcount));
683 }
684 if (nscount)
685 ND_PRINT((ndo, " [%dn]", nscount));
686 if (arcount)
687 ND_PRINT((ndo, " [%dau]", arcount));
688
689 cp = (const u_char *)(np + 1);
690 if (qdcount--) {
691 cp = ns_qprint(ndo, cp, (const u_char *)np, is_mdns);
692 if (!cp)
693 goto trunc;
694 while (cp < ndo->ndo_snapend && qdcount--) {
695 cp = ns_qprint(ndo, (const u_char *)cp,
696 (const u_char *)np,
697 is_mdns);
698 if (!cp)
699 goto trunc;
700 }
701 }
702 if (qdcount > 0)
703 goto trunc;
704
705 /* Print remaining sections on -vv */
706 if (ndo->ndo_vflag > 1) {
707 if (ancount--) {
708 if ((cp = ns_rprint(ndo, cp, bp, is_mdns)) == NULL)
709 goto trunc;
710 while (cp < ndo->ndo_snapend && ancount--) {
711 ND_PRINT((ndo, ","));
712 if ((cp = ns_rprint(ndo, cp, bp, is_mdns)) == NULL)
713 goto trunc;
714 }
715 }
716 if (ancount > 0)
717 goto trunc;
718 if (cp < ndo->ndo_snapend && nscount--) {
719 ND_PRINT((ndo, " ns:"));
720 if ((cp = ns_rprint(ndo, cp, bp, is_mdns)) == NULL)
721 goto trunc;
722 while (nscount-- && cp < ndo->ndo_snapend) {
723 ND_PRINT((ndo, ","));
724 if ((cp = ns_rprint(ndo, cp, bp, is_mdns)) == NULL)
725 goto trunc;
726 }
727 }
728 if (nscount > 0)
729 goto trunc;
730 if (cp < ndo->ndo_snapend && arcount--) {
731 ND_PRINT((ndo, " ar:"));
732 if ((cp = ns_rprint(ndo, cp, bp, is_mdns)) == NULL)
733 goto trunc;
734 while (cp < ndo->ndo_snapend && arcount--) {
735 ND_PRINT((ndo, ","));
736 if ((cp = ns_rprint(ndo, cp, bp, is_mdns)) == NULL)
737 goto trunc;
738 }
739 }
740 if (arcount > 0)
741 goto trunc;
742 }
743 }
744 ND_PRINT((ndo, " (%d)", length));
745 return;
746
747 trunc:
748 ND_PRINT((ndo, "[|domain]"));
749 }
750