2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
22 #include <sys/cdefs.h>
24 __RCSID("$NetBSD: print-domain.c,v 1.5 2014/11/20 03:05:03 christos Exp $");
27 #define NETDISSECT_REWORKED
32 #include <tcpdump-stdinc.h>
38 #include "interface.h"
39 #include "addrtoname.h"
40 #include "extract.h" /* must come after interface.h */
42 static const char *ns_ops
[] = {
43 "", " inv_q", " stat", " op3", " notify", " update", " op6", " op7",
44 " op8", " updateA", " updateD", " updateDA",
45 " updateM", " updateMA", " zoneInit", " zoneRef",
48 static const char *ns_resp
[] = {
49 "", " FormErr", " ServFail", " NXDomain",
50 " NotImp", " Refused", " YXDomain", " YXRRSet",
51 " NXRRSet", " NotAuth", " NotZone", " Resp11",
52 " Resp12", " Resp13", " Resp14", " NoChange",
55 /* skip over a domain name */
57 ns_nskip(netdissect_options
*ndo
,
58 register const u_char
*cp
)
62 if (!ND_TTEST2(*cp
, 1))
66 if ((i
& INDIR_MASK
) == INDIR_MASK
)
68 if ((i
& INDIR_MASK
) == EDNS0_MASK
) {
71 if ((i
& ~INDIR_MASK
) != EDNS0_ELT_BITLABEL
)
72 return(NULL
); /* unknown ELT */
73 if (!ND_TTEST2(*cp
, 1))
75 if ((bitlen
= *cp
++) == 0)
77 bytelen
= (bitlen
+ 7) / 8;
81 if (!ND_TTEST2(*cp
, 1))
88 /* print a <domain-name> */
90 blabel_print(netdissect_options
*ndo
,
94 const u_char
*bitp
, *lim
;
97 if (!ND_TTEST2(*cp
, 1))
99 if ((bitlen
= *cp
) == 0)
101 slen
= (bitlen
+ 3) / 4;
104 /* print the bit string as a hex string */
105 ND_PRINT((ndo
, "\\[x"));
106 for (bitp
= cp
+ 1, b
= bitlen
; bitp
< lim
&& b
> 7; b
-= 8, bitp
++) {
108 ND_PRINT((ndo
, "%02x", *bitp
));
113 ND_PRINT((ndo
, "%02x", tc
& (0xff << (8 - b
))));
117 ND_PRINT((ndo
, "%1x", ((tc
>> 4) & 0x0f) & (0x0f << (4 - b
))));
119 ND_PRINT((ndo
, "/%d]", bitlen
));
122 ND_PRINT((ndo
, ".../%d]", bitlen
));
127 labellen(netdissect_options
*ndo
,
132 if (!ND_TTEST2(*cp
, 1))
135 if ((i
& INDIR_MASK
) == EDNS0_MASK
) {
137 if ((elt
= (i
& ~INDIR_MASK
)) != EDNS0_ELT_BITLABEL
) {
138 ND_PRINT((ndo
, "<ELT %d>", elt
));
141 if (!ND_TTEST2(*(cp
+ 1), 1))
143 if ((bitlen
= *(cp
+ 1)) == 0)
145 return(((bitlen
+ 7) / 8) + 1);
151 ns_nprint(netdissect_options
*ndo
,
152 register const u_char
*cp
, register const u_char
*bp
)
155 register const u_char
*rp
= NULL
;
156 register int compress
= 0;
159 int data_size
= ndo
->ndo_snapend
- bp
;
161 if ((l
= labellen(ndo
, cp
)) == (u_int
)-1)
163 if (!ND_TTEST2(*cp
, 1))
166 if (((i
= *cp
++) & INDIR_MASK
) != INDIR_MASK
) {
172 while (i
&& cp
< ndo
->ndo_snapend
) {
173 if ((i
& INDIR_MASK
) == INDIR_MASK
) {
178 if (!ND_TTEST2(*cp
, 1))
180 cp
= bp
+ (((i
<< 8) | *cp
) & 0x3fff);
181 if ((l
= labellen(ndo
, cp
)) == (u_int
)-1)
183 if (!ND_TTEST2(*cp
, 1))
189 * If we've looked at every character in
190 * the message, this pointer will make
191 * us look at some character again,
192 * which means we're looping.
194 if (chars_processed
>= data_size
) {
195 ND_PRINT((ndo
, "<LOOP>"));
200 if ((i
& INDIR_MASK
) == EDNS0_MASK
) {
201 elt
= (i
& ~INDIR_MASK
);
203 case EDNS0_ELT_BITLABEL
:
204 if (blabel_print(ndo
, cp
) == NULL
)
209 ND_PRINT((ndo
, "<ELT %d>", elt
));
213 if (fn_printn(ndo
, cp
, l
, ndo
->ndo_snapend
))
218 chars_processed
+= l
;
219 ND_PRINT((ndo
, "."));
220 if ((l
= labellen(ndo
, cp
)) == (u_int
)-1)
222 if (!ND_TTEST2(*cp
, 1))
230 ND_PRINT((ndo
, "."));
234 /* print a <character-string> */
235 static const u_char
*
236 ns_cprint(netdissect_options
*ndo
,
237 register const u_char
*cp
)
241 if (!ND_TTEST2(*cp
, 1))
244 if (fn_printn(ndo
, cp
, i
, ndo
->ndo_snapend
))
249 /* http://www.iana.org/assignments/dns-parameters */
250 const struct tok ns_type2str
[] = {
251 { T_A
, "A" }, /* RFC 1035 */
252 { T_NS
, "NS" }, /* RFC 1035 */
253 { T_MD
, "MD" }, /* RFC 1035 */
254 { T_MF
, "MF" }, /* RFC 1035 */
255 { T_CNAME
, "CNAME" }, /* RFC 1035 */
256 { T_SOA
, "SOA" }, /* RFC 1035 */
257 { T_MB
, "MB" }, /* RFC 1035 */
258 { T_MG
, "MG" }, /* RFC 1035 */
259 { T_MR
, "MR" }, /* RFC 1035 */
260 { T_NULL
, "NULL" }, /* RFC 1035 */
261 { T_WKS
, "WKS" }, /* RFC 1035 */
262 { T_PTR
, "PTR" }, /* RFC 1035 */
263 { T_HINFO
, "HINFO" }, /* RFC 1035 */
264 { T_MINFO
, "MINFO" }, /* RFC 1035 */
265 { T_MX
, "MX" }, /* RFC 1035 */
266 { T_TXT
, "TXT" }, /* RFC 1035 */
267 { T_RP
, "RP" }, /* RFC 1183 */
268 { T_AFSDB
, "AFSDB" }, /* RFC 1183 */
269 { T_X25
, "X25" }, /* RFC 1183 */
270 { T_ISDN
, "ISDN" }, /* RFC 1183 */
271 { T_RT
, "RT" }, /* RFC 1183 */
272 { T_NSAP
, "NSAP" }, /* RFC 1706 */
273 { T_NSAP_PTR
, "NSAP_PTR" },
274 { T_SIG
, "SIG" }, /* RFC 2535 */
275 { T_KEY
, "KEY" }, /* RFC 2535 */
276 { T_PX
, "PX" }, /* RFC 2163 */
277 { T_GPOS
, "GPOS" }, /* RFC 1712 */
278 { T_AAAA
, "AAAA" }, /* RFC 1886 */
279 { T_LOC
, "LOC" }, /* RFC 1876 */
280 { T_NXT
, "NXT" }, /* RFC 2535 */
281 { T_EID
, "EID" }, /* Nimrod */
282 { T_NIMLOC
, "NIMLOC" }, /* Nimrod */
283 { T_SRV
, "SRV" }, /* RFC 2782 */
284 { T_ATMA
, "ATMA" }, /* ATM Forum */
285 { T_NAPTR
, "NAPTR" }, /* RFC 2168, RFC 2915 */
286 { T_KX
, "KX" }, /* RFC 2230 */
287 { T_CERT
, "CERT" }, /* RFC 2538 */
288 { T_A6
, "A6" }, /* RFC 2874 */
289 { T_DNAME
, "DNAME" }, /* RFC 2672 */
291 { T_OPT
, "OPT" }, /* RFC 2671 */
292 { T_APL
, "APL" }, /* RFC 3123 */
293 { T_DS
, "DS" }, /* RFC 4034 */
294 { T_SSHFP
, "SSHFP" }, /* RFC 4255 */
295 { T_IPSECKEY
, "IPSECKEY" }, /* RFC 4025 */
296 { T_RRSIG
, "RRSIG" }, /* RFC 4034 */
297 { T_NSEC
, "NSEC" }, /* RFC 4034 */
298 { T_DNSKEY
, "DNSKEY" }, /* RFC 4034 */
299 { T_SPF
, "SPF" }, /* RFC-schlitt-spf-classic-02.txt */
300 { T_UINFO
, "UINFO" },
303 { T_UNSPEC
, "UNSPEC" },
304 { T_UNSPECA
, "UNSPECA" },
305 { T_TKEY
, "TKEY" }, /* RFC 2930 */
306 { T_TSIG
, "TSIG" }, /* RFC 2845 */
307 { T_IXFR
, "IXFR" }, /* RFC 1995 */
308 { T_AXFR
, "AXFR" }, /* RFC 1035 */
309 { T_MAILB
, "MAILB" }, /* RFC 1035 */
310 { T_MAILA
, "MAILA" }, /* RFC 1035 */
315 const struct tok ns_class2str
[] = {
316 { C_IN
, "IN" }, /* Not used */
317 { C_CHAOS
, "CHAOS" },
324 static const u_char
*
325 ns_qprint(netdissect_options
*ndo
,
326 register const u_char
*cp
, register const u_char
*bp
, int is_mdns
)
328 register const u_char
*np
= cp
;
329 register u_int i
, class;
331 cp
= ns_nskip(ndo
, cp
);
333 if (cp
== NULL
|| !ND_TTEST2(*cp
, 4))
336 /* print the qtype */
337 i
= EXTRACT_16BITS(cp
);
339 ND_PRINT((ndo
, " %s", tok2str(ns_type2str
, "Type%d", i
)));
340 /* print the qclass (if it's not IN) */
341 i
= EXTRACT_16BITS(cp
);
348 ND_PRINT((ndo
, " %s", tok2str(ns_class2str
, "(Class %d)", class)));
350 ND_PRINT((ndo
, i
& C_QU
? " (QU)" : " (QM)"));
353 ND_PRINT((ndo
, "? "));
354 cp
= ns_nprint(ndo
, np
, bp
);
355 return(cp
? cp
+ 4 : NULL
);
359 static const u_char
*
360 ns_rprint(netdissect_options
*ndo
,
361 register const u_char
*cp
, register const u_char
*bp
, int is_mdns
)
363 register u_int i
, class, opt_flags
= 0;
364 register u_short typ
, len
;
365 register const u_char
*rp
;
367 if (ndo
->ndo_vflag
) {
368 ND_PRINT((ndo
, " "));
369 if ((cp
= ns_nprint(ndo
, cp
, bp
)) == NULL
)
372 cp
= ns_nskip(ndo
, cp
);
374 if (cp
== NULL
|| !ND_TTEST2(*cp
, 10))
375 return (ndo
->ndo_snapend
);
377 /* print the type/qtype */
378 typ
= EXTRACT_16BITS(cp
);
380 /* print the class (if it's not IN and the type isn't OPT) */
381 i
= EXTRACT_16BITS(cp
);
384 class = (i
& ~C_CACHE_FLUSH
);
387 if (class != C_IN
&& typ
!= T_OPT
)
388 ND_PRINT((ndo
, " %s", tok2str(ns_class2str
, "(Class %d)", class)));
390 if (i
& C_CACHE_FLUSH
)
391 ND_PRINT((ndo
, " (Cache flush)"));
397 opt_flags
= EXTRACT_16BITS(cp
);
398 /* ignore rest of ttl field */
400 } else if (ndo
->ndo_vflag
> 2) {
402 ND_PRINT((ndo
, " ["));
403 relts_print(ndo
, EXTRACT_32BITS(cp
));
404 ND_PRINT((ndo
, "]"));
411 len
= EXTRACT_16BITS(cp
);
416 ND_PRINT((ndo
, " %s", tok2str(ns_type2str
, "Type%d", typ
)));
417 if (rp
> ndo
->ndo_snapend
)
422 if (!ND_TTEST2(*cp
, sizeof(struct in_addr
)))
424 ND_PRINT((ndo
, " %s", intoa(htonl(EXTRACT_32BITS(cp
)))));
433 ND_PRINT((ndo
, " "));
434 if (ns_nprint(ndo
, cp
, bp
) == NULL
)
441 ND_PRINT((ndo
, " "));
442 if ((cp
= ns_nprint(ndo
, cp
, bp
)) == NULL
)
444 ND_PRINT((ndo
, " "));
445 if ((cp
= ns_nprint(ndo
, cp
, bp
)) == NULL
)
447 if (!ND_TTEST2(*cp
, 5 * 4))
449 ND_PRINT((ndo
, " %u", EXTRACT_32BITS(cp
)));
451 ND_PRINT((ndo
, " %u", EXTRACT_32BITS(cp
)));
453 ND_PRINT((ndo
, " %u", EXTRACT_32BITS(cp
)));
455 ND_PRINT((ndo
, " %u", EXTRACT_32BITS(cp
)));
457 ND_PRINT((ndo
, " %u", EXTRACT_32BITS(cp
)));
461 ND_PRINT((ndo
, " "));
462 if (!ND_TTEST2(*cp
, 2))
464 if (ns_nprint(ndo
, cp
+ 2, bp
) == NULL
)
466 ND_PRINT((ndo
, " %d", EXTRACT_16BITS(cp
)));
471 ND_PRINT((ndo
, " \""));
472 cp
= ns_cprint(ndo
, cp
);
475 ND_PRINT((ndo
, "\""));
480 ND_PRINT((ndo
, " "));
481 if (!ND_TTEST2(*cp
, 6))
483 if (ns_nprint(ndo
, cp
+ 6, bp
) == NULL
)
485 ND_PRINT((ndo
, ":%d %d %d", EXTRACT_16BITS(cp
+ 4),
486 EXTRACT_16BITS(cp
), EXTRACT_16BITS(cp
+ 2)));
492 struct in6_addr addr
;
493 char ntop_buf
[INET6_ADDRSTRLEN
];
495 if (!ND_TTEST2(*cp
, sizeof(struct in6_addr
)))
497 memcpy(&addr
, cp
, sizeof(struct in6_addr
));
498 ND_PRINT((ndo
, " %s",
499 inet_ntop(AF_INET6
, &addr
, ntop_buf
, sizeof(ntop_buf
))));
508 char ntop_buf
[INET6_ADDRSTRLEN
];
510 if (!ND_TTEST2(*cp
, 1))
513 pbyte
= (pbit
& ~7) / 8;
515 ND_PRINT((ndo
, " %u(bad plen)", pbit
));
517 } else if (pbit
< 128) {
518 if (!ND_TTEST2(*(cp
+ 1), sizeof(a
) - pbyte
))
520 memset(&a
, 0, sizeof(a
));
521 memcpy(&a
.s6_addr
[pbyte
], cp
+ 1, sizeof(a
) - pbyte
);
522 ND_PRINT((ndo
, " %u %s", pbit
,
523 inet_ntop(AF_INET6
, &a
, ntop_buf
, sizeof(ntop_buf
))));
526 ND_PRINT((ndo
, " "));
527 if (ns_nprint(ndo
, cp
+ 1 + sizeof(a
) - pbyte
, bp
) == NULL
)
535 ND_PRINT((ndo
, " UDPsize=%u", class));
536 if (opt_flags
& 0x8000)
537 ND_PRINT((ndo
, " OK"));
540 case T_UNSPECA
: /* One long string */
541 if (!ND_TTEST2(*cp
, len
))
543 if (fn_printn(ndo
, cp
, len
, ndo
->ndo_snapend
))
549 if (cp
+ len
> ndo
->ndo_snapend
)
553 ND_PRINT((ndo
, " "));
554 if ((cp
= ns_nprint(ndo
, cp
, bp
)) == NULL
)
557 if (!ND_TTEST2(*cp
, 2))
559 ND_PRINT((ndo
, " fudge=%u", EXTRACT_16BITS(cp
)));
561 if (!ND_TTEST2(*cp
, 2))
563 ND_PRINT((ndo
, " maclen=%u", EXTRACT_16BITS(cp
)));
564 cp
+= 2 + EXTRACT_16BITS(cp
);
565 if (!ND_TTEST2(*cp
, 2))
567 ND_PRINT((ndo
, " origid=%u", EXTRACT_16BITS(cp
)));
569 if (!ND_TTEST2(*cp
, 2))
571 ND_PRINT((ndo
, " error=%u", EXTRACT_16BITS(cp
)));
573 if (!ND_TTEST2(*cp
, 2))
575 ND_PRINT((ndo
, " otherlen=%u", EXTRACT_16BITS(cp
)));
579 return (rp
); /* XXX This isn't always right */
583 ns_print(netdissect_options
*ndo
,
584 register const u_char
*bp
, u_int length
, int is_mdns
)
586 register const HEADER
*np
;
587 register int qdcount
, ancount
, nscount
, arcount
;
588 register const u_char
*cp
;
591 np
= (const HEADER
*)bp
;
593 /* get the byte-order right */
594 qdcount
= EXTRACT_16BITS(&np
->qdcount
);
595 ancount
= EXTRACT_16BITS(&np
->ancount
);
596 nscount
= EXTRACT_16BITS(&np
->nscount
);
597 arcount
= EXTRACT_16BITS(&np
->arcount
);
600 /* this is a response */
601 ND_PRINT((ndo
, "%d%s%s%s%s%s%s",
602 EXTRACT_16BITS(&np
->id
),
603 ns_ops
[DNS_OPCODE(np
)],
604 ns_resp
[DNS_RCODE(np
)],
605 DNS_AA(np
)? "*" : "",
606 DNS_RA(np
)? "" : "-",
607 DNS_TC(np
)? "|" : "",
608 DNS_AD(np
)? "$" : ""));
611 ND_PRINT((ndo
, " [%dq]", qdcount
));
612 /* Print QUESTION section on -vv */
613 cp
= (const u_char
*)(np
+ 1);
615 if (qdcount
< EXTRACT_16BITS(&np
->qdcount
) - 1)
616 ND_PRINT((ndo
, ","));
617 if (ndo
->ndo_vflag
> 1) {
618 ND_PRINT((ndo
, " q:"));
619 if ((cp
= ns_qprint(ndo
, cp
, bp
, is_mdns
)) == NULL
)
622 if ((cp
= ns_nskip(ndo
, cp
)) == NULL
)
624 cp
+= 4; /* skip QTYPE and QCLASS */
627 ND_PRINT((ndo
, " %d/%d/%d", ancount
, nscount
, arcount
));
629 if ((cp
= ns_rprint(ndo
, cp
, bp
, is_mdns
)) == NULL
)
631 while (cp
< ndo
->ndo_snapend
&& ancount
--) {
632 ND_PRINT((ndo
, ","));
633 if ((cp
= ns_rprint(ndo
, cp
, bp
, is_mdns
)) == NULL
)
639 /* Print NS and AR sections on -vv */
640 if (ndo
->ndo_vflag
> 1) {
641 if (cp
< ndo
->ndo_snapend
&& nscount
--) {
642 ND_PRINT((ndo
, " ns:"));
643 if ((cp
= ns_rprint(ndo
, cp
, bp
, is_mdns
)) == NULL
)
645 while (cp
< ndo
->ndo_snapend
&& nscount
--) {
646 ND_PRINT((ndo
, ","));
647 if ((cp
= ns_rprint(ndo
, cp
, bp
, is_mdns
)) == NULL
)
653 if (cp
< ndo
->ndo_snapend
&& arcount
--) {
654 ND_PRINT((ndo
, " ar:"));
655 if ((cp
= ns_rprint(ndo
, cp
, bp
, is_mdns
)) == NULL
)
657 while (cp
< ndo
->ndo_snapend
&& arcount
--) {
658 ND_PRINT((ndo
, ","));
659 if ((cp
= ns_rprint(ndo
, cp
, bp
, is_mdns
)) == NULL
)
668 /* this is a request */
669 ND_PRINT((ndo
, "%d%s%s%s", EXTRACT_16BITS(&np
->id
), ns_ops
[DNS_OPCODE(np
)],
670 DNS_RD(np
) ? "+" : "",
671 DNS_CD(np
) ? "%" : ""));
674 b2
= EXTRACT_16BITS(((u_short
*)np
)+1);
676 ND_PRINT((ndo
, " [b2&3=0x%x]", b2
));
678 if (DNS_OPCODE(np
) == IQUERY
) {
680 ND_PRINT((ndo
, " [%dq]", qdcount
));
682 ND_PRINT((ndo
, " [%da]", ancount
));
686 ND_PRINT((ndo
, " [%da]", ancount
));
688 ND_PRINT((ndo
, " [%dq]", qdcount
));
691 ND_PRINT((ndo
, " [%dn]", nscount
));
693 ND_PRINT((ndo
, " [%dau]", arcount
));
695 cp
= (const u_char
*)(np
+ 1);
697 cp
= ns_qprint(ndo
, cp
, (const u_char
*)np
, is_mdns
);
700 while (cp
< ndo
->ndo_snapend
&& qdcount
--) {
701 cp
= ns_qprint(ndo
, (const u_char
*)cp
,
711 /* Print remaining sections on -vv */
712 if (ndo
->ndo_vflag
> 1) {
714 if ((cp
= ns_rprint(ndo
, cp
, bp
, is_mdns
)) == NULL
)
716 while (cp
< ndo
->ndo_snapend
&& ancount
--) {
717 ND_PRINT((ndo
, ","));
718 if ((cp
= ns_rprint(ndo
, cp
, bp
, is_mdns
)) == NULL
)
724 if (cp
< ndo
->ndo_snapend
&& nscount
--) {
725 ND_PRINT((ndo
, " ns:"));
726 if ((cp
= ns_rprint(ndo
, cp
, bp
, is_mdns
)) == NULL
)
728 while (nscount
-- && cp
< ndo
->ndo_snapend
) {
729 ND_PRINT((ndo
, ","));
730 if ((cp
= ns_rprint(ndo
, cp
, bp
, is_mdns
)) == NULL
)
736 if (cp
< ndo
->ndo_snapend
&& arcount
--) {
737 ND_PRINT((ndo
, " ar:"));
738 if ((cp
= ns_rprint(ndo
, cp
, bp
, is_mdns
)) == NULL
)
740 while (cp
< ndo
->ndo_snapend
&& arcount
--) {
741 ND_PRINT((ndo
, ","));
742 if ((cp
= ns_rprint(ndo
, cp
, bp
, is_mdns
)) == NULL
)
750 ND_PRINT((ndo
, " (%d)", length
));
754 ND_PRINT((ndo
, "[|domain]"));