The topmost bit in the class field isn't a "cache flush" flag in mDNS

queries.  Display that bit correctly (as per Marc Krochmal's request).

In mDNS, the topmost bit of the class field should be handled the same
way regardless of the value of the lower 15 bits, and *vice versa* -
they're independent fields.

2 files changed, 42 insertions, 15 deletions

diff --git a/nameser.h b/nameser.h
index 3aeedb45..f441f3ea 100644
--- a/nameser.h
+++ b/nameser.h
@@ -1,4 +1,4 @@
-/* @(#) $Header: /tcpdump/master/tcpdump/nameser.h,v 1.15 2006-04-07 08:47:34 guy Exp $ (LBL) */
+/* @(#) $Header: /tcpdump/master/tcpdump/nameser.h,v 1.16 2006-11-10 03:18:21 guy Exp $ (LBL) */
 /*
  * Copyright (c) 1983, 1989, 1993
  *	The Regents of the University of California.  All rights reserved.
@@ -75,6 +75,14 @@
  * Internet nameserver port number
  */
 #define NAMESERVER_PORT	53
+
+/*
+ * Port for multicast DNS; see
+ *
+ *	http://files.multicastdns.org/draft-cheshire-dnsext-multicastdns.txt
+ *
+ * for the current mDNS spec.
+ */
 #define MULTICASTDNS_PORT	5353
 
 /*
@@ -201,7 +209,8 @@
 #define C_HS		4		/* for Hesiod name server (MIT) (XXX) */
 	/* Query class values which do not appear in resource records */
 #define C_ANY		255		/* wildcard match */
-#define C_CACHE_FLUSH	0x8000		/* mDNS cache flush flag */
+#define C_QU		0x8000		/* mDNS QU flag in queries */
+#define C_CACHE_FLUSH	0x8000		/* mDNS cache flush flag in replies */
 
 /*
  * Status return codes for T_UNSPEC conversion routines
diff --git a/print-domain.c b/print-domain.c
index 2a21f2b8..730b1f53 100644
--- a/print-domain.c
+++ b/print-domain.c
@@ -21,7 +21,7 @@
 
 #ifndef lint
 static const char rcsid[] _U_ =
-    "@(#) $Header: /tcpdump/master/tcpdump/print-domain.c,v 1.92 2006-04-07 08:58:29 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/tcpdump/print-domain.c,v 1.93 2006-11-10 03:18:21 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -320,23 +320,33 @@ static const u_char *
 ns_qprint(register const u_char *cp, register const u_char *bp, int is_mdns)
 {
 	register const u_char *np = cp;
-	register u_int i;
+	register u_int i, class, qu;
 
 	cp = ns_nskip(cp);
 
 	if (cp == NULL || !TTEST2(*cp, 4))
 		return(NULL);
 
-	/* print the qtype and qclass (if it's not IN) */
+	/* print the qtype */
 	i = EXTRACT_16BITS(cp);
 	cp += 2;
 	printf(" %s", tok2str(ns_type2str, "Type%d", i));
+	/* print the qclass (if it's not IN) */
 	i = EXTRACT_16BITS(cp);
 	cp += 2;
-	if (is_mdns && i == (C_IN|C_CACHE_FLUSH))
-		printf(" (Cache flush)");
-	else if (i != C_IN)
-		printf(" %s", tok2str(ns_class2str, "(Class %d)", i));
+	if (is_mdns) {
+		class = (i & ~C_QU);
+		qu = (i & C_QU);
+	} else {
+		class = i;
+		qu = 0;
+	}
+	if (class != C_IN)
+		printf(" %s", tok2str(ns_class2str, "(Class %d)", class));
+	if (qu)
+		printf(" (QU)");
+	else
+		printf(" (QM)");
 
 	fputs("? ", stdout);
 	cp = ns_nprint(np, bp);
@@ -347,7 +357,7 @@ ns_qprint(register const u_char *cp, register const u_char *bp, int is_mdns)
 static const u_char *
 ns_rprint(register const u_char *cp, register const u_char *bp, int is_mdns)
 {
-	register u_int class, opt_flags = 0;
+	register u_int i, class, cache_flush, opt_flags = 0;
 	register u_short typ, len;
 	register const u_char *rp;
 
@@ -361,15 +371,23 @@ ns_rprint(register const u_char *cp, register const u_char *bp, int is_mdns)
 	if (cp == NULL || !TTEST2(*cp, 10))
 		return (snapend);
 
-	/* print the type/qtype and class (if it's not IN) */
+	/* print the type/qtype */
 	typ = EXTRACT_16BITS(cp);
 	cp += 2;
-	class = EXTRACT_16BITS(cp);
+	/* print the class (if it's not IN and the type isn't OPT) */
+	i = EXTRACT_16BITS(cp);
 	cp += 2;
-	if (is_mdns && class == (C_IN|C_CACHE_FLUSH))
-		printf(" (Cache flush)");
-	else if (class != C_IN && typ != T_OPT)
+	if (is_mdns) {
+		class = (i & ~C_CACHE_FLUSH);
+		cache_flush = i & C_CACHE_FLUSH;
+	} else {
+		class = i;
+		cache_flush = 0;
+	}
+	if (class != C_IN && typ != T_OPT)
 		printf(" %s", tok2str(ns_class2str, "(Class %d)", class));
+	if (cache_flush)
+		printf(" (Cache flush)");
 
 	/* ignore ttl */
 	cp += 2;