xref: /netbsd-src/external/bsd/tcpdump/dist/print-domain.c (revision ba65fde2d7fefa7d39838fa5fa855e62bd606b5e)
1 /*
2  * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that: (1) source code distributions
7  * retain the above copyright notice and this paragraph in its entirety, (2)
8  * distributions including binary code include the above copyright notice and
9  * this paragraph in its entirety in the documentation or other materials
10  * provided with the distribution, and (3) all advertising materials mentioning
11  * features or use of this software display the following acknowledgement:
12  * ``This product includes software developed by the University of California,
13  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14  * the University nor the names of its contributors may be used to endorse
15  * or promote products derived from this software without specific prior
16  * written permission.
17  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20  */
21 
22 #include <sys/cdefs.h>
23 #ifndef lint
24 #if 0
25 static const char rcsid[] _U_ =
26     "@(#) Header: /tcpdump/master/tcpdump/print-domain.c,v 1.98 2007-12-09 01:40:32 guy Exp (LBL)";
27 #else
28 __RCSID("$NetBSD: print-domain.c,v 1.2 2010/12/05 05:11:30 christos Exp $");
29 #endif
30 #endif
31 
32 #ifdef HAVE_CONFIG_H
33 #include "config.h"
34 #endif
35 
36 #include <tcpdump-stdinc.h>
37 
38 #include "nameser.h"
39 
40 #include <stdio.h>
41 #include <string.h>
42 
43 #include "interface.h"
44 #include "addrtoname.h"
45 #include "extract.h"                    /* must come after interface.h */
46 
47 static const char *ns_ops[] = {
48 	"", " inv_q", " stat", " op3", " notify", " update", " op6", " op7",
49 	" op8", " updataA", " updateD", " updateDA",
50 	" updateM", " updateMA", " zoneInit", " zoneRef",
51 };
52 
53 static const char *ns_resp[] = {
54 	"", " FormErr", " ServFail", " NXDomain",
55 	" NotImp", " Refused", " YXDomain", " YXRRSet",
56 	" NXRRSet", " NotAuth", " NotZone", " Resp11",
57 	" Resp12", " Resp13", " Resp14", " NoChange",
58 };
59 
60 /* skip over a domain name */
61 static const u_char *
62 ns_nskip(register const u_char *cp)
63 {
64 	register u_char i;
65 
66 	if (!TTEST2(*cp, 1))
67 		return (NULL);
68 	i = *cp++;
69 	while (i) {
70 		if ((i & INDIR_MASK) == INDIR_MASK)
71 			return (cp + 1);
72 		if ((i & INDIR_MASK) == EDNS0_MASK) {
73 			int bitlen, bytelen;
74 
75 			if ((i & ~INDIR_MASK) != EDNS0_ELT_BITLABEL)
76 				return(NULL); /* unknown ELT */
77 			if (!TTEST2(*cp, 1))
78 				return (NULL);
79 			if ((bitlen = *cp++) == 0)
80 				bitlen = 256;
81 			bytelen = (bitlen + 7) / 8;
82 			cp += bytelen;
83 		} else
84 			cp += i;
85 		if (!TTEST2(*cp, 1))
86 			return (NULL);
87 		i = *cp++;
88 	}
89 	return (cp);
90 }
91 
92 /* print a <domain-name> */
93 static const u_char *
94 blabel_print(const u_char *cp)
95 {
96 	int bitlen, slen, b;
97 	const u_char *bitp, *lim;
98 	char tc;
99 
100 	if (!TTEST2(*cp, 1))
101 		return(NULL);
102 	if ((bitlen = *cp) == 0)
103 		bitlen = 256;
104 	slen = (bitlen + 3) / 4;
105 	lim = cp + 1 + slen;
106 
107 	/* print the bit string as a hex string */
108 	printf("\\[x");
109 	for (bitp = cp + 1, b = bitlen; bitp < lim && b > 7; b -= 8, bitp++) {
110 		TCHECK(*bitp);
111 		printf("%02x", *bitp);
112 	}
113 	if (b > 4) {
114 		TCHECK(*bitp);
115 		tc = *bitp++;
116 		printf("%02x", tc & (0xff << (8 - b)));
117 	} else if (b > 0) {
118 		TCHECK(*bitp);
119 		tc = *bitp++;
120 		printf("%1x", ((tc >> 4) & 0x0f) & (0x0f << (4 - b)));
121 	}
122 	printf("/%d]", bitlen);
123 	return lim;
124 trunc:
125 	printf(".../%d]", bitlen);
126 	return NULL;
127 }
128 
129 static int
130 labellen(const u_char *cp)
131 {
132 	register u_int i;
133 
134 	if (!TTEST2(*cp, 1))
135 		return(-1);
136 	i = *cp;
137 	if ((i & INDIR_MASK) == EDNS0_MASK) {
138 		int bitlen, elt;
139 		if ((elt = (i & ~INDIR_MASK)) != EDNS0_ELT_BITLABEL) {
140 			printf("<ELT %d>", elt);
141 			return(-1);
142 		}
143 		if (!TTEST2(*(cp + 1), 1))
144 			return(-1);
145 		if ((bitlen = *(cp + 1)) == 0)
146 			bitlen = 256;
147 		return(((bitlen + 7) / 8) + 1);
148 	} else
149 		return(i);
150 }
151 
152 static const u_char *
153 ns_nprint(register const u_char *cp, register const u_char *bp)
154 {
155 	register u_int i, l;
156 	register const u_char *rp = NULL;
157 	register int compress = 0;
158 	int chars_processed;
159 	int elt;
160 	int data_size = snapend - bp;
161 
162 	if ((l = labellen(cp)) == (u_int)-1)
163 		return(NULL);
164 	if (!TTEST2(*cp, 1))
165 		return(NULL);
166 	chars_processed = 1;
167 	if (((i = *cp++) & INDIR_MASK) != INDIR_MASK) {
168 		compress = 0;
169 		rp = cp + l;
170 	}
171 
172 	if (i != 0)
173 		while (i && cp < snapend) {
174 			if ((i & INDIR_MASK) == INDIR_MASK) {
175 				if (!compress) {
176 					rp = cp + 1;
177 					compress = 1;
178 				}
179 				if (!TTEST2(*cp, 1))
180 					return(NULL);
181 				cp = bp + (((i << 8) | *cp) & 0x3fff);
182 				if ((l = labellen(cp)) == (u_int)-1)
183 					return(NULL);
184 				if (!TTEST2(*cp, 1))
185 					return(NULL);
186 				i = *cp++;
187 				chars_processed++;
188 
189 				/*
190 				 * If we've looked at every character in
191 				 * the message, this pointer will make
192 				 * us look at some character again,
193 				 * which means we're looping.
194 				 */
195 				if (chars_processed >= data_size) {
196 					printf("<LOOP>");
197 					return (NULL);
198 				}
199 				continue;
200 			}
201 			if ((i & INDIR_MASK) == EDNS0_MASK) {
202 				elt = (i & ~INDIR_MASK);
203 				switch(elt) {
204 				case EDNS0_ELT_BITLABEL:
205 					if (blabel_print(cp) == NULL)
206 						return (NULL);
207 					break;
208 				default:
209 					/* unknown ELT */
210 					printf("<ELT %d>", elt);
211 					return(NULL);
212 				}
213 			} else {
214 				if (fn_printn(cp, l, snapend))
215 					return(NULL);
216 			}
217 
218 			cp += l;
219 			chars_processed += l;
220 			putchar('.');
221 			if ((l = labellen(cp)) == (u_int)-1)
222 				return(NULL);
223 			if (!TTEST2(*cp, 1))
224 				return(NULL);
225 			i = *cp++;
226 			chars_processed++;
227 			if (!compress)
228 				rp += l + 1;
229 		}
230 	else
231 		putchar('.');
232 	return (rp);
233 }
234 
235 /* print a <character-string> */
236 static const u_char *
237 ns_cprint(register const u_char *cp)
238 {
239 	register u_int i;
240 
241 	if (!TTEST2(*cp, 1))
242 		return (NULL);
243 	i = *cp++;
244 	if (fn_printn(cp, i, snapend))
245 		return (NULL);
246 	return (cp + i);
247 }
248 
249 /* http://www.iana.org/assignments/dns-parameters */
250 struct tok ns_type2str[] = {
251 	{ T_A,		"A" },			/* RFC 1035 */
252 	{ T_NS,		"NS" },			/* RFC 1035 */
253 	{ T_MD,		"MD" },			/* RFC 1035 */
254 	{ T_MF,		"MF" },			/* RFC 1035 */
255 	{ T_CNAME,	"CNAME" },		/* RFC 1035 */
256 	{ T_SOA,	"SOA" },		/* RFC 1035 */
257 	{ T_MB,		"MB" },			/* RFC 1035 */
258 	{ T_MG,		"MG" },			/* RFC 1035 */
259 	{ T_MR,		"MR" },			/* RFC 1035 */
260 	{ T_NULL,	"NULL" },		/* RFC 1035 */
261 	{ T_WKS,	"WKS" },		/* RFC 1035 */
262 	{ T_PTR,	"PTR" },		/* RFC 1035 */
263 	{ T_HINFO,	"HINFO" },		/* RFC 1035 */
264 	{ T_MINFO,	"MINFO" },		/* RFC 1035 */
265 	{ T_MX,		"MX" },			/* RFC 1035 */
266 	{ T_TXT,	"TXT" },		/* RFC 1035 */
267 	{ T_RP,		"RP" },			/* RFC 1183 */
268 	{ T_AFSDB,	"AFSDB" },		/* RFC 1183 */
269 	{ T_X25,	"X25" },		/* RFC 1183 */
270 	{ T_ISDN,	"ISDN" },		/* RFC 1183 */
271 	{ T_RT,		"RT" },			/* RFC 1183 */
272 	{ T_NSAP,	"NSAP" },		/* RFC 1706 */
273 	{ T_NSAP_PTR,	"NSAP_PTR" },
274 	{ T_SIG,	"SIG" },		/* RFC 2535 */
275 	{ T_KEY,	"KEY" },		/* RFC 2535 */
276 	{ T_PX,		"PX" },			/* RFC 2163 */
277 	{ T_GPOS,	"GPOS" },		/* RFC 1712 */
278 	{ T_AAAA,	"AAAA" },		/* RFC 1886 */
279 	{ T_LOC,	"LOC" },		/* RFC 1876 */
280 	{ T_NXT,	"NXT" },		/* RFC 2535 */
281 	{ T_EID,	"EID" },		/* Nimrod */
282 	{ T_NIMLOC,	"NIMLOC" },		/* Nimrod */
283 	{ T_SRV,	"SRV" },		/* RFC 2782 */
284 	{ T_ATMA,	"ATMA" },		/* ATM Forum */
285 	{ T_NAPTR,	"NAPTR" },		/* RFC 2168, RFC 2915 */
286 	{ T_KX,		"KX" },			/* RFC 2230 */
287 	{ T_CERT,	"CERT" },		/* RFC 2538 */
288 	{ T_A6,		"A6" },			/* RFC 2874 */
289 	{ T_DNAME,	"DNAME" },		/* RFC 2672 */
290 	{ T_SINK, 	"SINK" },
291 	{ T_OPT,	"OPT" },		/* RFC 2671 */
292 	{ T_APL, 	"APL" },		/* RFC 3123 */
293 	{ T_DS,		"DS" },			/* RFC 4034 */
294 	{ T_SSHFP,	"SSHFP" },		/* RFC 4255 */
295 	{ T_IPSECKEY,	"IPSECKEY" },		/* RFC 4025 */
296 	{ T_RRSIG, 	"RRSIG" },		/* RFC 4034 */
297 	{ T_NSEC,	"NSEC" },		/* RFC 4034 */
298 	{ T_DNSKEY,	"DNSKEY" },		/* RFC 4034 */
299 	{ T_SPF,	"SPF" },		/* RFC-schlitt-spf-classic-02.txt */
300 	{ T_UINFO,	"UINFO" },
301 	{ T_UID,	"UID" },
302 	{ T_GID,	"GID" },
303 	{ T_UNSPEC,	"UNSPEC" },
304 	{ T_UNSPECA,	"UNSPECA" },
305 	{ T_TKEY,	"TKEY" },		/* RFC 2930 */
306 	{ T_TSIG,	"TSIG" },		/* RFC 2845 */
307 	{ T_IXFR,	"IXFR" },		/* RFC 1995 */
308 	{ T_AXFR,	"AXFR" },		/* RFC 1035 */
309 	{ T_MAILB,	"MAILB" },		/* RFC 1035 */
310 	{ T_MAILA,	"MAILA" },		/* RFC 1035 */
311 	{ T_ANY,	"ANY" },
312 	{ 0,		NULL }
313 };
314 
315 struct tok ns_class2str[] = {
316 	{ C_IN,		"IN" },		/* Not used */
317 	{ C_CHAOS,	"CHAOS" },
318 	{ C_HS,		"HS" },
319 	{ C_ANY,	"ANY" },
320 	{ 0,		NULL }
321 };
322 
323 /* print a query */
324 static const u_char *
325 ns_qprint(register const u_char *cp, register const u_char *bp, int is_mdns)
326 {
327 	register const u_char *np = cp;
328 	register u_int i, class;
329 
330 	cp = ns_nskip(cp);
331 
332 	if (cp == NULL || !TTEST2(*cp, 4))
333 		return(NULL);
334 
335 	/* print the qtype */
336 	i = EXTRACT_16BITS(cp);
337 	cp += 2;
338 	printf(" %s", tok2str(ns_type2str, "Type%d", i));
339 	/* print the qclass (if it's not IN) */
340 	i = EXTRACT_16BITS(cp);
341 	cp += 2;
342 	if (is_mdns)
343 		class = (i & ~C_QU);
344 	else
345 		class = i;
346 	if (class != C_IN)
347 		printf(" %s", tok2str(ns_class2str, "(Class %d)", class));
348 	if (is_mdns) {
349 		if (i & C_QU)
350 			printf(" (QU)");
351 		else
352 			printf(" (QM)");
353 	}
354 
355 	fputs("? ", stdout);
356 	cp = ns_nprint(np, bp);
357 	return(cp ? cp + 4 : NULL);
358 }
359 
360 /* print a reply */
361 static const u_char *
362 ns_rprint(register const u_char *cp, register const u_char *bp, int is_mdns)
363 {
364 	register u_int i, class, opt_flags = 0;
365 	register u_short typ, len;
366 	register const u_char *rp;
367 
368 	if (vflag) {
369 		putchar(' ');
370 		if ((cp = ns_nprint(cp, bp)) == NULL)
371 			return NULL;
372 	} else
373 		cp = ns_nskip(cp);
374 
375 	if (cp == NULL || !TTEST2(*cp, 10))
376 		return (snapend);
377 
378 	/* print the type/qtype */
379 	typ = EXTRACT_16BITS(cp);
380 	cp += 2;
381 	/* print the class (if it's not IN and the type isn't OPT) */
382 	i = EXTRACT_16BITS(cp);
383 	cp += 2;
384 	if (is_mdns)
385 		class = (i & ~C_CACHE_FLUSH);
386 	else
387 		class = i;
388 	if (class != C_IN && typ != T_OPT)
389 		printf(" %s", tok2str(ns_class2str, "(Class %d)", class));
390 	if (is_mdns) {
391 		if (i & C_CACHE_FLUSH)
392 			printf(" (Cache flush)");
393 	}
394 
395 	if (typ == T_OPT) {
396 		/* get opt flags */
397 		cp += 2;
398 		opt_flags = EXTRACT_16BITS(cp);
399 		/* ignore rest of ttl field */
400 		cp += 2;
401 	} else if (vflag > 2) {
402 		/* print ttl */
403 		printf(" [");
404 		relts_print(EXTRACT_32BITS(cp));
405 		printf("]");
406 		cp += 4;
407 	} else {
408 		/* ignore ttl */
409 		cp += 4;
410 	}
411 
412 	len = EXTRACT_16BITS(cp);
413 	cp += 2;
414 
415 	rp = cp + len;
416 
417 	printf(" %s", tok2str(ns_type2str, "Type%d", typ));
418 	if (rp > snapend)
419 		return(NULL);
420 
421 	switch (typ) {
422 	case T_A:
423 		if (!TTEST2(*cp, sizeof(struct in_addr)))
424 			return(NULL);
425 		printf(" %s", intoa(htonl(EXTRACT_32BITS(cp))));
426 		break;
427 
428 	case T_NS:
429 	case T_CNAME:
430 	case T_PTR:
431 #ifdef T_DNAME
432 	case T_DNAME:
433 #endif
434 		putchar(' ');
435 		if (ns_nprint(cp, bp) == NULL)
436 			return(NULL);
437 		break;
438 
439 	case T_SOA:
440 		if (!vflag)
441 			break;
442 		putchar(' ');
443 		if ((cp = ns_nprint(cp, bp)) == NULL)
444 			return(NULL);
445 		putchar(' ');
446 		if ((cp = ns_nprint(cp, bp)) == NULL)
447 			return(NULL);
448 		if (!TTEST2(*cp, 5 * 4))
449 			return(NULL);
450 		printf(" %u", EXTRACT_32BITS(cp));
451 		cp += 4;
452 		printf(" %u", EXTRACT_32BITS(cp));
453 		cp += 4;
454 		printf(" %u", EXTRACT_32BITS(cp));
455 		cp += 4;
456 		printf(" %u", EXTRACT_32BITS(cp));
457 		cp += 4;
458 		printf(" %u", EXTRACT_32BITS(cp));
459 		cp += 4;
460 		break;
461 	case T_MX:
462 		putchar(' ');
463 		if (!TTEST2(*cp, 2))
464 			return(NULL);
465 		if (ns_nprint(cp + 2, bp) == NULL)
466 			return(NULL);
467 		printf(" %d", EXTRACT_16BITS(cp));
468 		break;
469 
470 	case T_TXT:
471 		while (cp < rp) {
472 			printf(" \"");
473 			cp = ns_cprint(cp);
474 			if (cp == NULL)
475 				return(NULL);
476 			putchar('"');
477 		}
478 		break;
479 
480 	case T_SRV:
481 		putchar(' ');
482 		if (!TTEST2(*cp, 6))
483 			return(NULL);
484 		if (ns_nprint(cp + 6, bp) == NULL)
485 			return(NULL);
486 		printf(":%d %d %d", EXTRACT_16BITS(cp + 4),
487 			EXTRACT_16BITS(cp), EXTRACT_16BITS(cp + 2));
488 		break;
489 
490 #ifdef INET6
491 	case T_AAAA:
492 	    {
493 		struct in6_addr addr;
494 		char ntop_buf[INET6_ADDRSTRLEN];
495 
496 		if (!TTEST2(*cp, sizeof(struct in6_addr)))
497 			return(NULL);
498 		memcpy(&addr, cp, sizeof(struct in6_addr));
499 		printf(" %s",
500 		    inet_ntop(AF_INET6, &addr, ntop_buf, sizeof(ntop_buf)));
501 
502 		break;
503 	    }
504 
505 	case T_A6:
506 	    {
507 		struct in6_addr a;
508 		int pbit, pbyte;
509 		char ntop_buf[INET6_ADDRSTRLEN];
510 
511 		if (!TTEST2(*cp, 1))
512 			return(NULL);
513 		pbit = *cp;
514 		pbyte = (pbit & ~7) / 8;
515 		if (pbit > 128) {
516 			printf(" %u(bad plen)", pbit);
517 			break;
518 		} else if (pbit < 128) {
519 			if (!TTEST2(*(cp + 1), sizeof(a) - pbyte))
520 				return(NULL);
521 			memset(&a, 0, sizeof(a));
522 			memcpy(&a.s6_addr[pbyte], cp + 1, sizeof(a) - pbyte);
523 			printf(" %u %s", pbit,
524 			    inet_ntop(AF_INET6, &a, ntop_buf, sizeof(ntop_buf)));
525 		}
526 		if (pbit > 0) {
527 			putchar(' ');
528 			if (ns_nprint(cp + 1 + sizeof(a) - pbyte, bp) == NULL)
529 				return(NULL);
530 		}
531 		break;
532 	    }
533 #endif /*INET6*/
534 
535 	case T_OPT:
536 		printf(" UDPsize=%u", class);
537 		if (opt_flags & 0x8000)
538 			printf(" OK");
539 		break;
540 
541 	case T_UNSPECA:		/* One long string */
542 		if (!TTEST2(*cp, len))
543 			return(NULL);
544 		if (fn_printn(cp, len, snapend))
545 			return(NULL);
546 		break;
547 
548 	case T_TSIG:
549 	    {
550 		if (cp + len > snapend)
551 			return(NULL);
552 		if (!vflag)
553 			break;
554 		putchar(' ');
555 		if ((cp = ns_nprint(cp, bp)) == NULL)
556 			return(NULL);
557 		cp += 6;
558 		if (!TTEST2(*cp, 2))
559 			return(NULL);
560 		printf(" fudge=%u", EXTRACT_16BITS(cp));
561 		cp += 2;
562 		if (!TTEST2(*cp, 2))
563 			return(NULL);
564 		printf(" maclen=%u", EXTRACT_16BITS(cp));
565 		cp += 2 + EXTRACT_16BITS(cp);
566 		if (!TTEST2(*cp, 2))
567 			return(NULL);
568 		printf(" origid=%u", EXTRACT_16BITS(cp));
569 		cp += 2;
570 		if (!TTEST2(*cp, 2))
571 			return(NULL);
572 		printf(" error=%u", EXTRACT_16BITS(cp));
573 		cp += 2;
574 		if (!TTEST2(*cp, 2))
575 			return(NULL);
576 		printf(" otherlen=%u", EXTRACT_16BITS(cp));
577 		cp += 2;
578 	    }
579 	}
580 	return (rp);		/* XXX This isn't always right */
581 }
582 
583 void
584 ns_print(register const u_char *bp, u_int length, int is_mdns)
585 {
586 	register const HEADER *np;
587 	register int qdcount, ancount, nscount, arcount;
588 	register const u_char *cp;
589 	u_int16_t b2;
590 
591 	np = (const HEADER *)bp;
592 	TCHECK(*np);
593 	/* get the byte-order right */
594 	qdcount = EXTRACT_16BITS(&np->qdcount);
595 	ancount = EXTRACT_16BITS(&np->ancount);
596 	nscount = EXTRACT_16BITS(&np->nscount);
597 	arcount = EXTRACT_16BITS(&np->arcount);
598 
599 	if (DNS_QR(np)) {
600 		/* this is a response */
601 		printf("%d%s%s%s%s%s%s",
602 			EXTRACT_16BITS(&np->id),
603 			ns_ops[DNS_OPCODE(np)],
604 			ns_resp[DNS_RCODE(np)],
605 			DNS_AA(np)? "*" : "",
606 			DNS_RA(np)? "" : "-",
607 			DNS_TC(np)? "|" : "",
608 			DNS_AD(np)? "$" : "");
609 
610 		if (qdcount != 1)
611 			printf(" [%dq]", qdcount);
612 		/* Print QUESTION section on -vv */
613 		cp = (const u_char *)(np + 1);
614 		while (qdcount--) {
615 			if (qdcount < EXTRACT_16BITS(&np->qdcount) - 1)
616 				putchar(',');
617 			if (vflag > 1) {
618 				fputs(" q:", stdout);
619 				if ((cp = ns_qprint(cp, bp, is_mdns)) == NULL)
620 					goto trunc;
621 			} else {
622 				if ((cp = ns_nskip(cp)) == NULL)
623 					goto trunc;
624 				cp += 4;	/* skip QTYPE and QCLASS */
625 			}
626 		}
627 		printf(" %d/%d/%d", ancount, nscount, arcount);
628 		if (ancount--) {
629 			if ((cp = ns_rprint(cp, bp, is_mdns)) == NULL)
630 				goto trunc;
631 			while (cp < snapend && ancount--) {
632 				putchar(',');
633 				if ((cp = ns_rprint(cp, bp, is_mdns)) == NULL)
634 					goto trunc;
635 			}
636 		}
637 		if (ancount > 0)
638 			goto trunc;
639 		/* Print NS and AR sections on -vv */
640 		if (vflag > 1) {
641 			if (cp < snapend && nscount--) {
642 				fputs(" ns:", stdout);
643 				if ((cp = ns_rprint(cp, bp, is_mdns)) == NULL)
644 					goto trunc;
645 				while (cp < snapend && nscount--) {
646 					putchar(',');
647 					if ((cp = ns_rprint(cp, bp, is_mdns)) == NULL)
648 						goto trunc;
649 				}
650 			}
651 			if (nscount > 0)
652 				goto trunc;
653 			if (cp < snapend && arcount--) {
654 				fputs(" ar:", stdout);
655 				if ((cp = ns_rprint(cp, bp, is_mdns)) == NULL)
656 					goto trunc;
657 				while (cp < snapend && arcount--) {
658 					putchar(',');
659 					if ((cp = ns_rprint(cp, bp, is_mdns)) == NULL)
660 						goto trunc;
661 				}
662 			}
663 			if (arcount > 0)
664 				goto trunc;
665 		}
666 	}
667 	else {
668 		/* this is a request */
669 		printf("%d%s%s%s", EXTRACT_16BITS(&np->id), ns_ops[DNS_OPCODE(np)],
670 		    DNS_RD(np) ? "+" : "",
671 		    DNS_CD(np) ? "%" : "");
672 
673 		/* any weirdness? */
674 		b2 = EXTRACT_16BITS(((u_short *)np)+1);
675 		if (b2 & 0x6cf)
676 			printf(" [b2&3=0x%x]", b2);
677 
678 		if (DNS_OPCODE(np) == IQUERY) {
679 			if (qdcount)
680 				printf(" [%dq]", qdcount);
681 			if (ancount != 1)
682 				printf(" [%da]", ancount);
683 		}
684 		else {
685 			if (ancount)
686 				printf(" [%da]", ancount);
687 			if (qdcount != 1)
688 				printf(" [%dq]", qdcount);
689 		}
690 		if (nscount)
691 			printf(" [%dn]", nscount);
692 		if (arcount)
693 			printf(" [%dau]", arcount);
694 
695 		cp = (const u_char *)(np + 1);
696 		if (qdcount--) {
697 			cp = ns_qprint(cp, (const u_char *)np, is_mdns);
698 			if (!cp)
699 				goto trunc;
700 			while (cp < snapend && qdcount--) {
701 				cp = ns_qprint((const u_char *)cp,
702 					       (const u_char *)np,
703 					       is_mdns);
704 				if (!cp)
705 					goto trunc;
706 			}
707 		}
708 		if (qdcount > 0)
709 			goto trunc;
710 
711 		/* Print remaining sections on -vv */
712 		if (vflag > 1) {
713 			if (ancount--) {
714 				if ((cp = ns_rprint(cp, bp, is_mdns)) == NULL)
715 					goto trunc;
716 				while (cp < snapend && ancount--) {
717 					putchar(',');
718 					if ((cp = ns_rprint(cp, bp, is_mdns)) == NULL)
719 						goto trunc;
720 				}
721 			}
722 			if (ancount > 0)
723 				goto trunc;
724 			if (cp < snapend && nscount--) {
725 				fputs(" ns:", stdout);
726 				if ((cp = ns_rprint(cp, bp, is_mdns)) == NULL)
727 					goto trunc;
728 				while (nscount-- && cp < snapend) {
729 					putchar(',');
730 					if ((cp = ns_rprint(cp, bp, is_mdns)) == NULL)
731 						goto trunc;
732 				}
733 			}
734 			if (nscount > 0)
735 				goto trunc;
736 			if (cp < snapend && arcount--) {
737 				fputs(" ar:", stdout);
738 				if ((cp = ns_rprint(cp, bp, is_mdns)) == NULL)
739 					goto trunc;
740 				while (cp < snapend && arcount--) {
741 					putchar(',');
742 					if ((cp = ns_rprint(cp, bp, is_mdns)) == NULL)
743 						goto trunc;
744 				}
745 			}
746 			if (arcount > 0)
747 				goto trunc;
748 		}
749 	}
750 	printf(" (%d)", length);
751 	return;
752 
753   trunc:
754 	printf("[|domain]");
755 	return;
756 }
757