contrib/tcpdump/print-domain.c

   1 /*
   2  * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
   3  *      The Regents of the University of California.  All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that: (1) source code distributions
   7  * retain the above copyright notice and this paragraph in its entirety, (2)
   8  * distributions including binary code include the above copyright notice and
   9  * this paragraph in its entirety in the documentation or other materials
  10  * provided with the distribution, and (3) all advertising materials mentioning
  11  * features or use of this software display the following acknowledgement:
  12  * ``This product includes software developed by the University of California,
  13  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
  14  * the University nor the names of its contributors may be used to endorse
  15  * or promote products derived from this software without specific prior
  16  * written permission.
  17  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
  18  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  19  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  20  *
  21  * $FreeBSD$
  22  */
  23
  24 #ifndef lint
  25 static const char rcsid[] _U_ =
  26     "@(#) $Header: /tcpdump/master/tcpdump/print-domain.c,v 1.89.2.8 2007/02/13 19:19:27 guy Exp $ (LBL)";
  27 #endif
  28
  29 #ifdef HAVE_CONFIG_H
  30 #include "config.h"
  31 #endif
  32
  33 #include <tcpdump-stdinc.h>
  34
  35 #include "nameser.h"
  36
  37 #include <stdio.h>
  38 #include <string.h>
  39
  40 #include "interface.h"
  41 #include "addrtoname.h"
  42 #include "extract.h"                    /* must come after interface.h */
  43
  44 static const char *ns_ops[] = {
  45         "", " inv_q", " stat", " op3", " notify", " update", " op6", " op7",
  46         " op8", " updataA", " updateD", " updateDA",
  47         " updateM", " updateMA", " zoneInit", " zoneRef",
  48 };
  49
  50 static const char *ns_resp[] = {
  51         "", " FormErr", " ServFail", " NXDomain",
  52         " NotImp", " Refused", " YXDomain", " YXRRSet",
  53         " NXRRSet", " NotAuth", " NotZone", " Resp11",
  54         " Resp12", " Resp13", " Resp14", " NoChange",
  55 };
  56
  57 /* skip over a domain name */
  58 static const u_char *
  59 ns_nskip(register const u_char *cp)
  60 {
  61         register u_char i;
  62
  63         if (!TTEST2(*cp, 1))
  64                 return (NULL);
  65         i = *cp++;
  66         while (i) {
  67                 if ((i & INDIR_MASK) == INDIR_MASK)
  68                         return (cp + 1);
  69                 if ((i & INDIR_MASK) == EDNS0_MASK) {
  70                         int bitlen, bytelen;
  71
  72                         if ((i & ~INDIR_MASK) != EDNS0_ELT_BITLABEL)
  73                                 return(NULL); /* unknown ELT */
  74                         if (!TTEST2(*cp, 1))
  75                                 return (NULL);
  76                         if ((bitlen = *cp++) == 0)
  77                                 bitlen = 256;
  78                         bytelen = (bitlen + 7) / 8;
  79                         cp += bytelen;
  80                 } else
  81                         cp += i;
  82                 if (!TTEST2(*cp, 1))
  83                         return (NULL);
  84                 i = *cp++;
  85         }
  86         return (cp);
  87 }
  88
  89 /* print a <domain-name> */
  90 static const u_char *
  91 blabel_print(const u_char *cp)
  92 {
  93         int bitlen, slen, b;
  94         const u_char *bitp, *lim;
  95         char tc;
  96
  97         if (!TTEST2(*cp, 1))
  98                 return(NULL);
  99         if ((bitlen = *cp) == 0)
 100                 bitlen = 256;
 101         slen = (bitlen + 3) / 4;
 102         lim = cp + 1 + slen;
 103
 104         /* print the bit string as a hex string */
 105         printf("\\[x");
 106         for (bitp = cp + 1, b = bitlen; bitp < lim && b > 7; b -= 8, bitp++) {
 107                 TCHECK(*bitp);
 108                 printf("%02x", *bitp);
 109         }
 110         if (b > 4) {
 111                 TCHECK(*bitp);
 112                 tc = *bitp++;
 113                 printf("%02x", tc & (0xff << (8 - b)));
 114         } else if (b > 0) {
 115                 TCHECK(*bitp);
 116                 tc = *bitp++;
 117                 printf("%1x", ((tc >> 4) & 0x0f) & (0x0f << (4 - b)));
 118         }
 119         printf("/%d]", bitlen);
 120         return lim;
 121 trunc:
 122         printf(".../%d]", bitlen);
 123         return NULL;
 124 }
 125
 126 static int
 127 labellen(const u_char *cp)
 128 {
 129         register u_int i;
 130
 131         if (!TTEST2(*cp, 1))
 132                 return(-1);
 133         i = *cp;
 134         if ((i & INDIR_MASK) == EDNS0_MASK) {
 135                 int bitlen, elt;
 136                 if ((elt = (i & ~INDIR_MASK)) != EDNS0_ELT_BITLABEL) {
 137                         printf("<ELT %d>", elt);
 138                         return(-1);
 139                 }
 140                 if (!TTEST2(*(cp + 1), 1))
 141                         return(-1);
 142                 if ((bitlen = *(cp + 1)) == 0)
 143                         bitlen = 256;
 144                 return(((bitlen + 7) / 8) + 1);
 145         } else
 146                 return(i);
 147 }
 148
 149 static const u_char *
 150 ns_nprint(register const u_char *cp, register const u_char *bp)
 151 {
 152         register u_int i, l;
 153         register const u_char *rp = NULL;
 154         register int compress = 0;
 155         int chars_processed;
 156         int elt;
 157         int data_size = snapend - bp;
 158
 159         if ((l = labellen(cp)) == (u_int)-1)
 160                 return(NULL);
 161         if (!TTEST2(*cp, 1))
 162                 return(NULL);
 163         chars_processed = 1;
 164         if (((i = *cp++) & INDIR_MASK) != INDIR_MASK) {
 165                 compress = 0;
 166                 rp = cp + l;
 167         }
 168
 169         if (i != 0)
 170                 while (i && cp < snapend) {
 171                         if ((i & INDIR_MASK) == INDIR_MASK) {
 172                                 if (!compress) {
 173                                         rp = cp + 1;
 174                                         compress = 1;
 175                                 }
 176                                 if (!TTEST2(*cp, 1))
 177                                         return(NULL);
 178                                 cp = bp + (((i << 8) | *cp) & 0x3fff);
 179                                 if ((l = labellen(cp)) == (u_int)-1)
 180                                         return(NULL);
 181                                 if (!TTEST2(*cp, 1))
 182                                         return(NULL);
 183                                 i = *cp++;
 184                                 chars_processed++;
 185
 186                                 /*
 187                                  * If we've looked at every character in
 188                                  * the message, this pointer will make
 189                                  * us look at some character again,
 190                                  * which means we're looping.
 191                                  */
 192                                 if (chars_processed >= data_size) {
 193                                         printf("<LOOP>");
 194                                         return (NULL);
 195                                 }
 196                                 continue;
 197                         }
 198                         if ((i & INDIR_MASK) == EDNS0_MASK) {
 199                                 elt = (i & ~INDIR_MASK);
 200                                 switch(elt) {
 201                                 case EDNS0_ELT_BITLABEL:
 202                                         if (blabel_print(cp) == NULL)
 203                                                 return (NULL);
 204                                         break;
 205                                 default:
 206                                         /* unknown ELT */
 207                                         printf("<ELT %d>", elt);
 208                                         return(NULL);
 209                                 }
 210                         } else {
 211                                 if (fn_printn(cp, l, snapend))
 212                                         return(NULL);
 213                         }
 214
 215                         cp += l;
 216                         chars_processed += l;
 217                         putchar('.');
 218                         if ((l = labellen(cp)) == (u_int)-1)
 219                                 return(NULL);
 220                         if (!TTEST2(*cp, 1))
 221                                 return(NULL);
 222                         i = *cp++;
 223                         chars_processed++;
 224                         if (!compress)
 225                                 rp += l + 1;
 226                 }
 227         else
 228                 putchar('.');
 229         return (rp);
 230 }
 231
 232 /* print a <character-string> */
 233 static const u_char *
 234 ns_cprint(register const u_char *cp)
 235 {
 236         register u_int i;
 237
 238         if (!TTEST2(*cp, 1))
 239                 return (NULL);
 240         i = *cp++;
 241         if (fn_printn(cp, i, snapend))
 242                 return (NULL);
 243         return (cp + i);
 244 }
 245
 246 /* http://www.iana.org/assignments/dns-parameters */
 247 struct tok ns_type2str[] = {
 248         { T_A,          "A" },                  /* RFC 1035 */
 249         { T_NS,         "NS" },                 /* RFC 1035 */
 250         { T_MD,         "MD" },                 /* RFC 1035 */
 251         { T_MF,         "MF" },                 /* RFC 1035 */
 252         { T_CNAME,      "CNAME" },              /* RFC 1035 */
 253         { T_SOA,        "SOA" },                /* RFC 1035 */
 254         { T_MB,         "MB" },                 /* RFC 1035 */
 255         { T_MG,         "MG" },                 /* RFC 1035 */
 256         { T_MR,         "MR" },                 /* RFC 1035 */
 257         { T_NULL,       "NULL" },               /* RFC 1035 */
 258         { T_WKS,        "WKS" },                /* RFC 1035 */
 259         { T_PTR,        "PTR" },                /* RFC 1035 */
 260         { T_HINFO,      "HINFO" },              /* RFC 1035 */
 261         { T_MINFO,      "MINFO" },              /* RFC 1035 */
 262         { T_MX,         "MX" },                 /* RFC 1035 */
 263         { T_TXT,        "TXT" },                /* RFC 1035 */
 264         { T_RP,         "RP" },                 /* RFC 1183 */
 265         { T_AFSDB,      "AFSDB" },              /* RFC 1183 */
 266         { T_X25,        "X25" },                /* RFC 1183 */
 267         { T_ISDN,       "ISDN" },               /* RFC 1183 */
 268         { T_RT,         "RT" },                 /* RFC 1183 */
 269         { T_NSAP,       "NSAP" },               /* RFC 1706 */
 270         { T_NSAP_PTR,   "NSAP_PTR" },
 271         { T_SIG,        "SIG" },                /* RFC 2535 */
 272         { T_KEY,        "KEY" },                /* RFC 2535 */
 273         { T_PX,         "PX" },                 /* RFC 2163 */
 274         { T_GPOS,       "GPOS" },               /* RFC 1712 */
 275         { T_AAAA,       "AAAA" },               /* RFC 1886 */
 276         { T_LOC,        "LOC" },                /* RFC 1876 */
 277         { T_NXT,        "NXT" },                /* RFC 2535 */
 278         { T_EID,        "EID" },                /* Nimrod */
 279         { T_NIMLOC,     "NIMLOC" },             /* Nimrod */
 280         { T_SRV,        "SRV" },                /* RFC 2782 */
 281         { T_ATMA,       "ATMA" },               /* ATM Forum */
 282         { T_NAPTR,      "NAPTR" },              /* RFC 2168, RFC 2915 */
 283         { T_KX,         "KX" },                 /* RFC 2230 */
 284         { T_CERT,       "CERT" },               /* RFC 2538 */
 285         { T_A6,         "A6" },                 /* RFC 2874 */
 286         { T_DNAME,      "DNAME" },              /* RFC 2672 */
 287         { T_SINK,       "SINK" },
 288         { T_OPT,        "OPT" },                /* RFC 2671 */
 289         { T_APL,        "APL" },                /* RFC 3123 */
 290         { T_DS,         "DS" },                 /* RFC 4034 */
 291         { T_SSHFP,      "SSHFP" },              /* RFC 4255 */
 292         { T_IPSECKEY,   "IPSECKEY" },           /* RFC 4025 */
 293         { T_RRSIG,      "RRSIG" },              /* RFC 4034 */
 294         { T_NSEC,       "NSEC" },               /* RFC 4034 */
 295         { T_DNSKEY,     "DNSKEY" },             /* RFC 4034 */
 296         { T_SPF,        "SPF" },                /* RFC-schlitt-spf-classic-02.txt */
 297         { T_UINFO,      "UINFO" },
 298         { T_UID,        "UID" },
 299         { T_GID,        "GID" },
 300         { T_UNSPEC,     "UNSPEC" },
 301         { T_UNSPECA,    "UNSPECA" },
 302         { T_TKEY,       "TKEY" },               /* RFC 2930 */
 303         { T_TSIG,       "TSIG" },               /* RFC 2845 */
 304         { T_IXFR,       "IXFR" },               /* RFC 1995 */
 305         { T_AXFR,       "AXFR" },               /* RFC 1035 */
 306         { T_MAILB,      "MAILB" },              /* RFC 1035 */
 307         { T_MAILA,      "MAILA" },              /* RFC 1035 */
 308         { T_ANY,        "ANY" },
 309         { 0,            NULL }
 310 };
 311
 312 struct tok ns_class2str[] = {
 313         { C_IN,         "IN" },         /* Not used */
 314         { C_CHAOS,      "CHAOS" },
 315         { C_HS,         "HS" },
 316         { C_ANY,        "ANY" },
 317         { 0,            NULL }
 318 };
 319
 320 /* print a query */
 321 static const u_char *
 322 ns_qprint(register const u_char *cp, register const u_char *bp, int is_mdns)
 323 {
 324         register const u_char *np = cp;
 325         register u_int i, class;
 326
 327         cp = ns_nskip(cp);
 328
 329         if (cp == NULL || !TTEST2(*cp, 4))
 330                 return(NULL);
 331
 332         /* print the qtype */
 333         i = EXTRACT_16BITS(cp);
 334         cp += 2;
 335         printf(" %s", tok2str(ns_type2str, "Type%d", i));
 336         /* print the qclass (if it's not IN) */
 337         i = EXTRACT_16BITS(cp);
 338         cp += 2;
 339         if (is_mdns)
 340                 class = (i & ~C_QU);
 341         else
 342                 class = i;
 343         if (class != C_IN)
 344                 printf(" %s", tok2str(ns_class2str, "(Class %d)", class));
 345         if (is_mdns) {
 346                 if (i & C_QU)
 347                         printf(" (QU)");
 348                 else
 349                         printf(" (QM)");
 350         }
 351
 352         fputs("? ", stdout);
 353         cp = ns_nprint(np, bp);
 354         return(cp ? cp + 4 : NULL);
 355 }
 356
 357 /* print a reply */
 358 static const u_char *
 359 ns_rprint(register const u_char *cp, register const u_char *bp, int is_mdns)
 360 {
 361         register u_int i, class, opt_flags = 0;
 362         register u_short typ, len;
 363         register const u_char *rp;
 364
 365         if (vflag) {
 366                 putchar(' ');
 367                 if ((cp = ns_nprint(cp, bp)) == NULL)
 368                         return NULL;
 369         } else
 370                 cp = ns_nskip(cp);
 371
 372         if (cp == NULL || !TTEST2(*cp, 10))
 373                 return (snapend);
 374
 375         /* print the type/qtype */
 376         typ = EXTRACT_16BITS(cp);
 377         cp += 2;
 378         /* print the class (if it's not IN and the type isn't OPT) */
 379         i = EXTRACT_16BITS(cp);
 380         cp += 2;
 381         if (is_mdns)
 382                 class = (i & ~C_CACHE_FLUSH);
 383         else
 384                 class = i;
 385         if (class != C_IN && typ != T_OPT)
 386                 printf(" %s", tok2str(ns_class2str, "(Class %d)", class));
 387         if (is_mdns) {
 388                 if (i & C_CACHE_FLUSH)
 389                         printf(" (Cache flush)");
 390         }
 391
 392         /* ignore ttl */
 393         cp += 2;
 394         /* if T_OPT, save opt_flags */
 395         if (typ == T_OPT)
 396                 opt_flags = EXTRACT_16BITS(cp);
 397         /* ignore rest of ttl */
 398         cp += 2;
 399
 400         len = EXTRACT_16BITS(cp);
 401         cp += 2;
 402
 403         rp = cp + len;
 404
 405         printf(" %s", tok2str(ns_type2str, "Type%d", typ));
 406         if (rp > snapend)
 407                 return(NULL);
 408
 409         switch (typ) {
 410         case T_A:
 411                 if (!TTEST2(*cp, sizeof(struct in_addr)))
 412                         return(NULL);
 413                 printf(" %s", ipaddr_string(cp));
 414                 break;
 415
 416         case T_NS:
 417         case T_CNAME:
 418         case T_PTR:
 419 #ifdef T_DNAME
 420         case T_DNAME:
 421 #endif
 422                 putchar(' ');
 423                 if (ns_nprint(cp, bp) == NULL)
 424                         return(NULL);
 425                 break;
 426
 427         case T_SOA:
 428                 if (!vflag)
 429                         break;
 430                 putchar(' ');
 431                 if ((cp = ns_nprint(cp, bp)) == NULL)
 432                         return(NULL);
 433                 putchar(' ');
 434                 if ((cp = ns_nprint(cp, bp)) == NULL)
 435                         return(NULL);
 436                 if (!TTEST2(*cp, 5 * 4))
 437                         return(NULL);
 438                 printf(" %u", EXTRACT_32BITS(cp));
 439                 cp += 4;
 440                 printf(" %u", EXTRACT_32BITS(cp));
 441                 cp += 4;
 442                 printf(" %u", EXTRACT_32BITS(cp));
 443                 cp += 4;
 444                 printf(" %u", EXTRACT_32BITS(cp));
 445                 cp += 4;
 446                 printf(" %u", EXTRACT_32BITS(cp));
 447                 cp += 4;
 448                 break;
 449         case T_MX:
 450                 putchar(' ');
 451                 if (!TTEST2(*cp, 2))
 452                         return(NULL);
 453                 if (ns_nprint(cp + 2, bp) == NULL)
 454                         return(NULL);
 455                 printf(" %d", EXTRACT_16BITS(cp));
 456                 break;
 457
 458         case T_TXT:
 459                 while (cp < rp) {
 460                         printf(" \"");
 461                         cp = ns_cprint(cp);
 462                         if (cp == NULL)
 463                                 return(NULL);
 464                         putchar('"');
 465                 }
 466                 break;
 467
 468         case T_SRV:
 469                 putchar(' ');
 470                 if (!TTEST2(*cp, 6))
 471                         return(NULL);
 472                 if (ns_nprint(cp + 6, bp) == NULL)
 473                         return(NULL);
 474                 printf(":%d %d %d", EXTRACT_16BITS(cp + 4),
 475                         EXTRACT_16BITS(cp), EXTRACT_16BITS(cp + 2));
 476                 break;
 477
 478 #ifdef INET6
 479         case T_AAAA:
 480                 if (!TTEST2(*cp, sizeof(struct in6_addr)))
 481                         return(NULL);
 482                 printf(" %s", ip6addr_string(cp));
 483                 break;
 484
 485         case T_A6:
 486             {
 487                 struct in6_addr a;
 488                 int pbit, pbyte;
 489
 490                 if (!TTEST2(*cp, 1))
 491                         return(NULL);
 492                 pbit = *cp;
 493                 pbyte = (pbit & ~7) / 8;
 494                 if (pbit > 128) {
 495                         printf(" %u(bad plen)", pbit);
 496                         break;
 497                 } else if (pbit < 128) {
 498                         if (!TTEST2(*(cp + 1), sizeof(a) - pbyte))
 499                                 return(NULL);
 500                         memset(&a, 0, sizeof(a));
 501                         memcpy(&a.s6_addr[pbyte], cp + 1, sizeof(a) - pbyte);
 502                         printf(" %u %s", pbit, ip6addr_string(&a));
 503                 }
 504                 if (pbit > 0) {
 505                         putchar(' ');
 506                         if (ns_nprint(cp + 1 + sizeof(a) - pbyte, bp) == NULL)
 507                                 return(NULL);
 508                 }
 509                 break;
 510             }
 511 #endif /*INET6*/
 512
 513         case T_OPT:
 514                 printf(" UDPsize=%u", class);
 515                 if (opt_flags & 0x8000)
 516                         printf(" OK");
 517                 break;
 518
 519         case T_UNSPECA:         /* One long string */
 520                 if (!TTEST2(*cp, len))
 521                         return(NULL);
 522                 if (fn_printn(cp, len, snapend))
 523                         return(NULL);
 524                 break;
 525
 526         case T_TSIG:
 527             {
 528                 if (cp + len > snapend)
 529                         return(NULL);
 530                 if (!vflag)
 531                         break;
 532                 putchar(' ');
 533                 if ((cp = ns_nprint(cp, bp)) == NULL)
 534                         return(NULL);
 535                 cp += 6;
 536                 if (!TTEST2(*cp, 2))
 537                         return(NULL);
 538                 printf(" fudge=%u", EXTRACT_16BITS(cp));
 539                 cp += 2;
 540                 if (!TTEST2(*cp, 2))
 541                         return(NULL);
 542                 printf(" maclen=%u", EXTRACT_16BITS(cp));
 543                 cp += 2 + EXTRACT_16BITS(cp);
 544                 if (!TTEST2(*cp, 2))
 545                         return(NULL);
 546                 printf(" origid=%u", EXTRACT_16BITS(cp));
 547                 cp += 2;
 548                 if (!TTEST2(*cp, 2))
 549                         return(NULL);
 550                 printf(" error=%u", EXTRACT_16BITS(cp));
 551                 cp += 2;
 552                 if (!TTEST2(*cp, 2))
 553                         return(NULL);
 554                 printf(" otherlen=%u", EXTRACT_16BITS(cp));
 555                 cp += 2;
 556             }
 557         }
 558         return (rp);            /* XXX This isn't always right */
 559 }
 560
 561 void
 562 ns_print(register const u_char *bp, u_int length, int is_mdns)
 563 {
 564         register const HEADER *np;
 565         register int qdcount, ancount, nscount, arcount;
 566         register const u_char *cp;
 567         u_int16_t b2;
 568
 569         np = (const HEADER *)bp;
 570         TCHECK(*np);
 571         /* get the byte-order right */
 572         qdcount = EXTRACT_16BITS(&np->qdcount);
 573         ancount = EXTRACT_16BITS(&np->ancount);
 574         nscount = EXTRACT_16BITS(&np->nscount);
 575         arcount = EXTRACT_16BITS(&np->arcount);
 576
 577         if (DNS_QR(np)) {
 578                 /* this is a response */
 579                 printf("%d%s%s%s%s%s%s",
 580                         EXTRACT_16BITS(&np->id),
 581                         ns_ops[DNS_OPCODE(np)],
 582                         ns_resp[DNS_RCODE(np)],
 583                         DNS_AA(np)? "*" : "",
 584                         DNS_RA(np)? "" : "-",
 585                         DNS_TC(np)? "|" : "",
 586                         DNS_AD(np)? "$" : "");
 587
 588                 if (qdcount != 1)
 589                         printf(" [%dq]", qdcount);
 590                 /* Print QUESTION section on -vv */
 591                 cp = (const u_char *)(np + 1);
 592                 while (qdcount--) {
 593                         if (qdcount < EXTRACT_16BITS(&np->qdcount) - 1)
 594                                 putchar(',');
 595                         if (vflag > 1) {
 596                                 fputs(" q:", stdout);
 597                                 if ((cp = ns_qprint(cp, bp, is_mdns)) == NULL)
 598                                         goto trunc;
 599                         } else {
 600                                 if ((cp = ns_nskip(cp)) == NULL)
 601                                         goto trunc;
 602                                 cp += 4;        /* skip QTYPE and QCLASS */
 603                         }
 604                 }
 605                 printf(" %d/%d/%d", ancount, nscount, arcount);
 606                 if (ancount--) {
 607                         if ((cp = ns_rprint(cp, bp, is_mdns)) == NULL)
 608                                 goto trunc;
 609                         while (cp < snapend && ancount--) {
 610                                 putchar(',');
 611                                 if ((cp = ns_rprint(cp, bp, is_mdns)) == NULL)
 612                                         goto trunc;
 613                         }
 614                 }
 615                 if (ancount > 0)
 616                         goto trunc;
 617                 /* Print NS and AR sections on -vv */
 618                 if (vflag > 1) {
 619                         if (cp < snapend && nscount--) {
 620                                 fputs(" ns:", stdout);
 621                                 if ((cp = ns_rprint(cp, bp, is_mdns)) == NULL)
 622                                         goto trunc;
 623                                 while (cp < snapend && nscount--) {
 624                                         putchar(',');
 625                                         if ((cp = ns_rprint(cp, bp, is_mdns)) == NULL)
 626                                                 goto trunc;
 627                                 }
 628                         }
 629                         if (nscount > 0)
 630                                 goto trunc;
 631                         if (cp < snapend && arcount--) {
 632                                 fputs(" ar:", stdout);
 633                                 if ((cp = ns_rprint(cp, bp, is_mdns)) == NULL)
 634                                         goto trunc;
 635                                 while (cp < snapend && arcount--) {
 636                                         putchar(',');
 637                                         if ((cp = ns_rprint(cp, bp, is_mdns)) == NULL)
 638                                                 goto trunc;
 639                                 }
 640                         }
 641                         if (arcount > 0)
 642                                 goto trunc;
 643                 }
 644         }
 645         else {
 646                 /* this is a request */
 647                 printf("%d%s%s%s", EXTRACT_16BITS(&np->id), ns_ops[DNS_OPCODE(np)],
 648                     DNS_RD(np) ? "+" : "",
 649                     DNS_CD(np) ? "%" : "");
 650
 651                 /* any weirdness? */
 652                 b2 = EXTRACT_16BITS(((u_short *)np)+1);
 653                 if (b2 & 0x6cf)
 654                         printf(" [b2&3=0x%x]", b2);
 655
 656                 if (DNS_OPCODE(np) == IQUERY) {
 657                         if (qdcount)
 658                                 printf(" [%dq]", qdcount);
 659                         if (ancount != 1)
 660                                 printf(" [%da]", ancount);
 661                 }
 662                 else {
 663                         if (ancount)
 664                                 printf(" [%da]", ancount);
 665                         if (qdcount != 1)
 666                                 printf(" [%dq]", qdcount);
 667                 }
 668                 if (nscount)
 669                         printf(" [%dn]", nscount);
 670                 if (arcount)
 671                         printf(" [%dau]", arcount);
 672
 673                 cp = (const u_char *)(np + 1);
 674                 if (qdcount--) {
 675                         cp = ns_qprint(cp, (const u_char *)np, is_mdns);
 676                         if (!cp)
 677                                 goto trunc;
 678                         while (cp < snapend && qdcount--) {
 679                                 cp = ns_qprint((const u_char *)cp,
 680                                                (const u_char *)np,
 681                                                is_mdns);
 682                                 if (!cp)
 683                                         goto trunc;
 684                         }
 685                 }
 686                 if (qdcount > 0)
 687                         goto trunc;
 688
 689                 /* Print remaining sections on -vv */
 690                 if (vflag > 1) {
 691                         if (ancount--) {
 692                                 if ((cp = ns_rprint(cp, bp, is_mdns)) == NULL)
 693                                         goto trunc;
 694                                 while (cp < snapend && ancount--) {
 695                                         putchar(',');
 696                                         if ((cp = ns_rprint(cp, bp, is_mdns)) == NULL)
 697                                                 goto trunc;
 698                                 }
 699                         }
 700                         if (ancount > 0)
 701                                 goto trunc;
 702                         if (cp < snapend && nscount--) {
 703                                 fputs(" ns:", stdout);
 704                                 if ((cp = ns_rprint(cp, bp, is_mdns)) == NULL)
 705                                         goto trunc;
 706                                 while (nscount-- && cp < snapend) {
 707                                         putchar(',');
 708                                         if ((cp = ns_rprint(cp, bp, is_mdns)) == NULL)
 709                                                 goto trunc;
 710                                 }
 711                         }
 712                         if (nscount > 0)
 713                                 goto trunc;
 714                         if (cp < snapend && arcount--) {
 715                                 fputs(" ar:", stdout);
 716                                 if ((cp = ns_rprint(cp, bp, is_mdns)) == NULL)
 717                                         goto trunc;
 718                                 while (cp < snapend && arcount--) {
 719                                         putchar(',');
 720                                         if ((cp = ns_rprint(cp, bp, is_mdns)) == NULL)
 721                                                 goto trunc;
 722                                 }
 723                         }
 724                         if (arcount > 0)
 725                                 goto trunc;
 726                 }
 727         }
 728         printf(" (%d)", length);
 729         return;
 730
 731   trunc:
 732         printf("[|domain]");
 733         return;
 734 }