From: jacobgb24 Date: Fri, 18 Oct 2019 19:43:05 +0000 (-0600) Subject: DNS: Update printing the EDNS options and their data with -vv X-Git-Tag: tcpdump-4.99-bp~460 X-Git-Url: https://git.tcpdump.org/tcpdump/commitdiff_plain/6bb25b4b4c84e5015bdcfcbd688dff512a20d971 DNS: Update printing the EDNS options and their data with -vv (pull request #808) Format of EDNS options matches format of TCP options. --- diff --git a/nameser.h b/nameser.h index 1e8692e7..eee52b5d 100644 --- a/nameser.h +++ b/nameser.h @@ -201,18 +201,60 @@ /* * Values for EDNS option types */ +#define E_LLQ 1 /* long lived queries protocol */ +#define E_UL 2 /* dynamic dns update leases */ +#define E_NSID 3 /* name server identifier */ +#define E_DAU 5 /* signal DNSSEC algorithm understood */ +#define E_DHU 6 /* signal DS hash understood */ +#define E_N3U 7 /* signal NSEC3 hash understood */ +#define E_ECS 8 /* EDNS client subnet */ +#define E_EXPIRE 9 /* zone expiration */ +#define E_COOKIE 10 /* DNS cookies */ +#define E_KEEPALIVE 11 /* TCP keepalive */ +#define E_PADDING 12 /* pad DNS messages */ +#define E_CHAIN 13 /* chain DNS queries */ +#define E_KEYTAG 14 /* EDNS key tag */ +#define E_CLIENTTAG 16 /* EDNS client tag */ +#define E_SERVERTAG 17 /* EDNS server tag */ + +/* + * Values for DNSSEC Algorithms + * https://www.iana.org/assignments/dns-sec-alg-numbers/dns-sec-alg-numbers.xhtml + */ + +#define A_DELETE 0 +#define A_RSAMD5 1 +#define A_DH 2 +#define A_DSA 3 +#define A_RSASHA1 5 +#define A_DSA_NSEC3_SHA1 6 +#define A_RSASHA1_NSEC3_SHA1 7 +#define A_RSASHA256 8 +#define A_RSASHA512 10 +#define A_ECC_GOST 12 +#define A_ECDSAP256SHA256 13 +#define A_ECDSAP384SHA384 14 +#define A_ED25519 15 +#define A_ED448 16 +#define A_INDIRECT 252 +#define A_PRIVATEDNS 253 +#define A_PRIVATEOID 254 + +/* + * Values for NSEC3 algorithms + * https://www.iana.org/assignments/dnssec-nsec3-parameters/dnssec-nsec3-parameters.xhtml + */ +#define NSEC_SHA1 1 + +/* + * Values for delegation signer algorithms + * https://www.iana.org/assignments/ds-rr-types/ds-rr-types.xhtml + */ +#define DS_SHA1 1 +#define DS_SHA256 2 +#define DS_GOST 3 +#define DS_SHA384 4 -#define E_NSID 3 /* name server identifier */ -#define E_DAU 5 /* signal DNSSEC algorithm understood */ -#define E_DHU 6 /* signal DS hash understood */ -#define E_N3U 7 /* signal NSEC3 hash understood */ -#define E_ECS 8 /* EDNS client subnet */ -#define E_EXPIRE 9 /* zone expiration */ -#define E_COOKIE 10 /* DNS cookies */ -#define E_KEEPALIVE 11 /* TCP keepalive */ -#define E_PADDING 12 /* pad DNS messages */ -#define E_CHAIN 13 /* chain DNS queries */ -#define E_KEYTAG 14 /* EDNS key tag */ /* * Status return codes for T_UNSPEC conversion routines diff --git a/print-domain.c b/print-domain.c index 01270098..2950c73c 100644 --- a/print-domain.c +++ b/print-domain.c @@ -267,27 +267,174 @@ ns_cprint(netdissect_options *ndo, return (cp + i); } +static void +print_eopt_ecs(netdissect_options *ndo, const u_char *cp, + u_int data_len) +{ + u_int family, addr_bits, src_len, scope_len; + + u_char padded[32]; + char addr[INET6_ADDRSTRLEN]; + + /* ecs option must at least contain family, src len, and scope len */ + if (data_len < 4) { + nd_print_invalid(ndo); + return; + } + + family = GET_BE_U_2(cp); + cp += 2; + src_len = GET_U_1(cp); + cp += 1; + scope_len = GET_U_1(cp); + cp += 1; + + if (family == 1) + addr_bits = 32; + else if (family == 2) + addr_bits = 128; + else { + nd_print_invalid(ndo); + return; + } + + if (data_len - 4 > (addr_bits / 8)) { + nd_print_invalid(ndo); + return; + } + /* checks for invalid ecs scope or source length */ + if (src_len > addr_bits || scope_len > addr_bits || ((src_len + 7) / 8) != (data_len - 4)) { + nd_print_invalid(ndo); + return; + } + + /* pad the truncated address from ecs with zeros */ + memset(padded, 0, sizeof(padded)); + memcpy(padded, cp, data_len - 4); + + + if (family == 1) + ND_PRINT("%s/%d/%d", addrtostr(padded, addr, INET_ADDRSTRLEN), + src_len, scope_len); + else + ND_PRINT("%s/%d/%d", addrtostr6(padded, addr, INET6_ADDRSTRLEN), + src_len, scope_len); + +} + extern const struct tok edns_opt2str[]; +extern const struct tok dau_alg2str[]; +extern const struct tok dhu_alg2str[]; +extern const struct tok n3u_alg2str[]; + /* print an */ static const u_char * eopt_print(netdissect_options *ndo, const u_char *cp) { - u_int i; + u_int opt, data_len, i; + + if (!ND_TTEST_2(cp)) + return (NULL); + opt = GET_BE_U_2(cp); + cp += 2; + ND_PRINT("%s", tok2str(edns_opt2str, "Opt%u", opt)); + if (!ND_TTEST_2(cp)) + return (NULL); + data_len = GET_BE_U_2(cp); + cp += 2; + + ND_TCHECK_LEN(cp, data_len); + + if (data_len > 0) { + ND_PRINT(" "); + switch (opt) { + + case E_ECS: + print_eopt_ecs(ndo, cp, data_len); + break; + case E_COOKIE: + if (data_len < 8 || (data_len > 8 && data_len < 16) || data_len > 40) + nd_print_invalid(ndo); + else { + for (i = 0; i < data_len; ++i) { + /* split client and server cookie */ + if (i == 8) + ND_PRINT(" "); + ND_PRINT("%02x", GET_U_1(cp + i)); + } + } + break; + case E_KEEPALIVE: + if (data_len != 2) + nd_print_invalid(ndo); + else + /* keepalive is in increments of 100ms. Convert to seconds */ + ND_PRINT("%0.1f sec", (GET_BE_U_2(cp) / 10.0)); + break; + case E_EXPIRE: + if (data_len != 4) + nd_print_invalid(ndo); + else + ND_PRINT("%u sec", GET_BE_U_4(cp)); + break; + case E_PADDING: + /* ignore contents and just print length */ + ND_PRINT("(%u)", data_len); + break; + case E_KEYTAG: + if (data_len % 2 != 0) + nd_print_invalid(ndo); + else + for (i = 0; i < data_len; i += 2) { + if (i > 0) + ND_PRINT(" "); + ND_PRINT("%u", GET_BE_U_2(cp + i)); + } + break; + case E_DAU: + for (i = 0; i < data_len; ++i) { + if (i > 0) + ND_PRINT(" "); + ND_PRINT("%s", tok2str(dau_alg2str, "Alg_%u", GET_U_1(cp + i))); + } + break; + case E_DHU: + for (i = 0; i < data_len; ++i) { + if (i > 0) + ND_PRINT(" "); + ND_PRINT("%s", tok2str(dhu_alg2str, "Alg_%u", GET_U_1(cp + i))); + } + break; + case E_N3U: + for (i = 0; i < data_len; ++i) { + if (i > 0) + ND_PRINT(" "); + ND_PRINT("%s", tok2str(n3u_alg2str, "Alg_%u", GET_U_1(cp + i))); + } + break; + case E_CHAIN: + fqdn_print(ndo, cp, cp + data_len); + break; + case E_NSID: + /* intentional fall-through. NSID is an undefined byte string */ + default: + for (i = 0; i < data_len; ++i) + ND_PRINT("%02x", GET_U_1(cp + i)); + break; + } + } + return (cp + data_len); + + trunc: + nd_print_invalid(ndo); + return (NULL); - if (!ND_TTEST_2(cp)) - return (NULL); - i = GET_BE_U_2(cp); - cp += 2; - ND_PRINT(" %s", tok2str(edns_opt2str, "Opt%u", i)); - if (!ND_TTEST_2(cp)) - return (NULL); - i = GET_BE_U_2(cp); - cp += 2; - return (cp + i); } + + extern const struct tok ns_type2str[]; /* https://www.iana.org/assignments/dns-parameters */ @@ -367,21 +514,57 @@ const struct tok ns_class2str[] = { { 0, NULL } }; -extern const struct tok edns_opt2str[]; - const struct tok edns_opt2str[] = { - { E_NSID, "NSID" }, - { E_DAU, "DAU" }, - { E_DHU, "DHU" }, - { E_N3U, "N3U" }, - { E_ECS, "ECS" }, - { E_EXPIRE, "EXPIRE" }, - { E_COOKIE, "COOKIE" }, - { E_KEEPALIVE, "KEEPALIVE" }, - { E_PADDING, "PADDING" }, - { E_CHAIN, "CHAIN" }, - { E_KEYTAG, "KEYTAG" }, - { 0, NULL } + { E_LLQ, "LLQ" }, + { E_UL, "UL" }, + { E_NSID, "NSID" }, + { E_DAU, "DAU" }, + { E_DHU, "DHU" }, + { E_N3U, "N3U" }, + { E_ECS, "ECS" }, + { E_EXPIRE, "EXPIRE" }, + { E_COOKIE, "COOKIE" }, + { E_KEEPALIVE, "KEEPALIVE" }, + { E_PADDING, "PADDING" }, + { E_CHAIN, "CHAIN" }, + { E_KEYTAG, "KEY-TAG" }, + { E_CLIENTTAG, "CLIENT-TAG" }, + { E_SERVERTAG, "SERVER-TAG" }, + { 0, NULL } +}; + +const struct tok dau_alg2str[] = { + { A_DELETE, "DELETE" }, + { A_RSAMD5, "RSAMD5" }, + { A_DH, "DH" }, + { A_DSA, "DS" }, + { A_RSASHA1, "RSASHA1" }, + { A_DSA_NSEC3_SHA1, "DSA-NSEC3-SHA1" }, + { A_RSASHA1_NSEC3_SHA1, "RSASHA1-NSEC3-SHA1" }, + { A_RSASHA256, "RSASHA256" }, + { A_RSASHA512, "RSASHA512" }, + { A_ECC_GOST, "ECC-GOST" }, + { A_ECDSAP256SHA256, "ECDSAP256SHA256" }, + { A_ECDSAP384SHA384, "ECDSAP384SHA384" }, + { A_ED25519, "ED25519" }, + { A_ED448, "ED448" }, + { A_INDIRECT, "INDIRECT" }, + { A_PRIVATEDNS, "PRIVATEDNS" }, + { A_PRIVATEOID, "PRIVATEOID" }, + { 0, NULL } +}; + +const struct tok dhu_alg2str[] = { + { DS_SHA1, "SHA-1" }, + { DS_SHA256,"SHA-256" }, + { DS_GOST, "GOST_R_34.11-94" }, + { DS_SHA384,"SHA-384" }, + { 0, NULL } +}; + +const struct tok n3u_alg2str[] = { + { NSEC_SHA1,"SHA-1" }, + { 0, NULL } }; /* print a query */ @@ -603,11 +786,17 @@ ns_rprint(netdissect_options *ndo, ND_PRINT(" UDPsize=%u", class); if (opt_flags & 0x8000) ND_PRINT(" DO"); - while (cp < rp) { - cp = eopt_print(ndo, cp); - if (cp == NULL) - return(NULL); - } + if (cp < rp) { + ND_PRINT(" ["); + while (cp < rp) { + cp = eopt_print(ndo, cp); + if (cp == NULL) + return(NULL); + if (cp < rp) + ND_PRINT(","); + } + ND_PRINT("]"); + } break; case T_UNSPECA: /* One long string */ diff --git a/tests/TESTLIST b/tests/TESTLIST index 78f4f738..a21b2d95 100644 --- a/tests/TESTLIST +++ b/tests/TESTLIST @@ -780,6 +780,6 @@ someip1 someip1.pcap someip1.out someip2 someip2.pcap someip2.out # EDNS Options -edns-opts edns-opts.pcap edns-opts.out -edns-opts-v edns-opts.pcap edns-opts-v.out -v -edns-opts-vv edns-opts.pcap edns-opts-vv.out -vv +edns-opts edns-opts.pcap edns-opts.out +edns-opts-v edns-opts.pcap edns-opts-v.out -v +edns-opts-vv edns-opts.pcap edns-opts-vv.out -vv diff --git a/tests/edns-opts-v.out b/tests/edns-opts-v.out index 054ae380..6ff06ec6 100644 --- a/tests/edns-opts-v.out +++ b/tests/edns-opts-v.out @@ -1,10 +1,84 @@ - 1 15:51:13.645135 IP6 (flowlabel 0x59ab7, hlim 64, next-header UDP (17) payload length: 48) ::1.39913 > ::1.53: [bad udp cksum 0x0043 -> 0xd3c1!] 45044+ [1au] A? example.com. (40) - 2 15:51:13.645368 IP6 (flowlabel 0x407db, hlim 64, next-header UDP (17) payload length: 200) ::1.53 > ::1.39913: [bad udp cksum 0x00db -> 0x47f8!] 45044 1/2/5 example.com. A 93.184.216.34 (192) - 3 15:51:41.824299 IP6 (flowlabel 0x6cf0a, hlim 64, next-header UDP (17) payload length: 60) ::1.40241 > ::1.53: [bad udp cksum 0x004f -> 0x8d32!] 25196+ [1au] A? example.com. (52) - 4 15:51:41.824510 IP6 (flowlabel 0x35b0b, hlim 64, next-header UDP (17) payload length: 228) ::1.53 > ::1.40241: [bad udp cksum 0x00f7 -> 0x7d0f!] 25196 1/2/5 example.com. A 93.184.216.34 (220) - 5 15:51:58.952626 IP6 (flowlabel 0xf9ade, hlim 64, next-header UDP (17) payload length: 64) ::1.52325 > ::1.53: [bad udp cksum 0x0053 -> 0xfe45!] 1171+ [1au] A? example.com. (56) - 6 15:51:58.952934 IP6 (flowlabel 0x3185a, hlim 64, next-header UDP (17) payload length: 228) ::1.53 > ::1.52325: [bad udp cksum 0x00f7 -> 0x8e9d!] 1171 1/2/5 example.com. A 93.184.216.34 (220) - 7 15:52:09.278001 IP6 (flowlabel 0xb5cae, hlim 64, next-header UDP (17) payload length: 75) ::1.45845 > ::1.53: [bad udp cksum 0x005e -> 0xcc5b!] 24578+ [1au] A? example.com. (67) - 8 15:52:09.278215 IP6 (flowlabel 0x3e25d, hlim 64, next-header UDP (17) payload length: 239) ::1.53 > ::1.45845: [bad udp cksum 0x0102 -> 0xb15e!] 24578 1/2/5 example.com. A 93.184.216.34 (231) - 9 15:52:21.041837 IP6 (flowlabel 0xc2911, hlim 64, next-header UDP (17) payload length: 79) ::1.55361 > ::1.53: [bad udp cksum 0x0062 -> 0x13aa!] 11702+ [1au] A? example.com. (71) - 10 15:52:21.042080 IP6 (flowlabel 0x5d5a9, hlim 64, next-header UDP (17) payload length: 239) ::1.53 > ::1.55361: [bad udp cksum 0x0102 -> 0x966c!] 11702 1/2/5 example.com. A 93.184.216.34 (231) + 1 20:58:40.639715 IP (tos 0x0, ttl 64, id 42311, offset 0, flags [none], proto UDP (17), length 57) + 192.0.0.1.46225 > 192.0.0.2.53: 13784+ A? example.com. (29) + 2 20:58:40.661836 IP (tos 0x0, ttl 48, id 43077, offset 0, flags [none], proto UDP (17), length 73) + 192.0.0.2.53 > 192.0.0.1.46225: 13784*- 1/0/0 example.com. A 93.184.216.34 (45) + 3 20:58:41.671700 IP (tos 0x0, ttl 64, id 42441, offset 0, flags [none], proto UDP (17), length 68) + 192.0.0.1.46225 > 192.0.0.2.53: 47424+ [1au] A? example.com. (40) + 4 20:58:41.693577 IP (tos 0x0, ttl 48, id 64719, offset 0, flags [none], proto UDP (17), length 255) + 192.0.0.2.53 > 192.0.0.1.46225: 47424*- 2/0/1 example.com. A 93.184.216.34, example.com. RRSIG (227) + 5 20:58:42.703534 IP (tos 0x0, ttl 64, id 42575, offset 0, flags [none], proto UDP (17), length 79) + 192.0.0.1.46225 > 192.0.0.2.53: 41739+ [1au] A? example.com. (51) + 6 20:58:42.725559 IP (tos 0x0, ttl 48, id 21779, offset 0, flags [none], proto UDP (17), length 95) + 192.0.0.2.53 > 192.0.0.1.46225: 41739*- 1/0/1 example.com. A 93.184.216.34 (67) + 7 20:58:43.734693 IP (tos 0x0, ttl 64, id 42674, offset 0, flags [none], proto UDP (17), length 80) + 192.0.0.1.46225 > 192.0.0.2.53: 18065+ [1au] A? example.com. (52) + 8 20:58:43.756707 IP (tos 0x0, ttl 48, id 43697, offset 0, flags [none], proto UDP (17), length 96) + 192.0.0.2.53 > 192.0.0.1.46225: 18065*- 1/0/1 example.com. A 93.184.216.34 (68) + 9 20:58:44.766528 IP (tos 0x0, ttl 64, id 42890, offset 0, flags [none], proto UDP (17), length 89) + 192.0.0.1.46225 > 192.0.0.2.53: 34237+ [1au] A? example.com. (61) + 10 20:58:44.788502 IP (tos 0x0, ttl 48, id 65435, offset 0, flags [none], proto UDP (17), length 105) + 192.0.0.2.53 > 192.0.0.1.46225: 34237*- 1/0/1 example.com. A 93.184.216.34 (77) + 11 20:58:45.797638 IP (tos 0x0, ttl 64, id 43148, offset 0, flags [none], proto UDP (17), length 80) + 192.0.0.1.46225 > 192.0.0.2.53: 30225+ [1au] A? example.com. (52) + 12 20:58:45.819504 IP (tos 0x0, ttl 48, id 21512, offset 0, flags [none], proto UDP (17), length 112) + 192.0.0.2.53 > 192.0.0.1.46225: 30225*- 1/0/1 example.com. A 93.184.216.34 (84) + 13 20:58:46.829454 IP (tos 0x0, ttl 64, id 43211, offset 0, flags [none], proto UDP (17), length 74) + 192.0.0.1.46225 > 192.0.0.2.53: 52688+ [1au] A? example.com. (46) + 14 20:58:46.851441 IP (tos 0x0, ttl 48, id 43346, offset 0, flags [none], proto UDP (17), length 255) + 192.0.0.2.53 > 192.0.0.1.46225: 52688*- 2/0/1 example.com. A 93.184.216.34, example.com. RRSIG (227) + 15 20:58:47.860858 IP (tos 0x0, ttl 64, id 43235, offset 0, flags [none], proto UDP (17), length 83) + 192.0.0.1.46225 > 192.0.0.2.53: 57808+ [1au] A? example.com. (55) + 16 20:58:47.882669 IP (tos 0x0, ttl 48, id 64510, offset 0, flags [none], proto UDP (17), length 255) + 192.0.0.2.53 > 192.0.0.1.46225: 57808*- 2/0/1 example.com. A 93.184.216.34, example.com. RRSIG (227) + 17 20:58:48.892587 IP (tos 0x0, ttl 64, id 43380, offset 0, flags [none], proto UDP (17), length 89) + 192.0.0.1.46225 > 192.0.0.2.53: 33054+ [1au] A? example.com. (61) + 18 20:58:48.914406 IP (tos 0x0, ttl 48, id 20611, offset 0, flags [none], proto UDP (17), length 255) + 192.0.0.2.53 > 192.0.0.1.46225: 33054*- 2/0/1 example.com. A 93.184.216.34, example.com. RRSIG (227) + 19 20:58:49.924625 IP (tos 0x0, ttl 64, id 43587, offset 0, flags [none], proto UDP (17), length 74) + 192.0.0.1.46225 > 192.0.0.2.53: 14353+ [1au] A? example.com. (46) + 20 20:58:49.946523 IP (tos 0x0, ttl 48, id 42366, offset 0, flags [none], proto UDP (17), length 84) + 192.0.0.2.53 > 192.0.0.1.46225: 14353*- 1/0/1 example.com. A 93.184.216.34 (56) + 21 20:58:50.956601 IP (tos 0x0, ttl 64, id 43603, offset 0, flags [none], proto UDP (17), length 74) + 192.0.0.1.46225 > 192.0.0.2.53: 17010+ [1au] A? example.com. (46) + 22 20:58:50.978366 IP (tos 0x0, ttl 48, id 64034, offset 0, flags [none], proto UDP (17), length 255) + 192.0.0.2.53 > 192.0.0.1.46225: 17010*- 2/0/1 example.com. A 93.184.216.34, example.com. RRSIG (227) + 23 20:58:51.988387 IP (tos 0x0, ttl 64, id 43789, offset 0, flags [none], proto UDP (17), length 76) + 192.0.0.1.46225 > 192.0.0.2.53: 3894+ [1au] A? example.com. (48) + 24 20:58:52.010258 IP (tos 0x0, ttl 48, id 20169, offset 0, flags [none], proto UDP (17), length 255) + 192.0.0.2.53 > 192.0.0.1.46225: 3894*- 2/0/1 example.com. A 93.184.216.34, example.com. RRSIG (227) + 25 20:58:53.015716 IP (tos 0x0, ttl 64, id 43925, offset 0, flags [none], proto UDP (17), length 72) + 192.0.0.1.46225 > 192.0.0.2.53: 8476+ [1au] A? example.com. (44) + 26 20:58:53.037529 IP (tos 0x0, ttl 48, id 42142, offset 0, flags [none], proto UDP (17), length 84) + 192.0.0.2.53 > 192.0.0.1.46225: 8476*- 1/0/1 example.com. A 93.184.216.34 (56) + 27 20:58:54.047412 IP (tos 0x0, ttl 64, id 44065, offset 0, flags [none], proto UDP (17), length 76) + 192.0.0.1.46225 > 192.0.0.2.53: 3966+ [1au] A? example.com. (48) + 28 20:58:54.069358 IP (tos 0x0, ttl 48, id 64128, offset 0, flags [none], proto UDP (17), length 84) + 192.0.0.2.53 > 192.0.0.1.46225: 3966*- 1/0/1 example.com. A 93.184.216.34 (56) + 29 20:58:55.078435 IP (tos 0x0, ttl 64, id 44256, offset 0, flags [none], proto UDP (17), length 72) + 192.0.0.1.46225 > 192.0.0.2.53: 26580+ [1au] A? example.com. (44) + 30 20:58:55.100224 IP (tos 0x0, ttl 48, id 18983, offset 0, flags [none], proto UDP (17), length 84) + 192.0.0.2.53 > 192.0.0.1.46225: 26580*- 1/0/1 example.com. A 93.184.216.34 (56) + 31 20:58:56.110237 IP (tos 0x0, ttl 64, id 44374, offset 0, flags [none], proto UDP (17), length 82) + 192.0.0.1.46225 > 192.0.0.2.53: 2190+ [1au] A? example.com. (54) + 32 20:58:56.132070 IP (tos 0x0, ttl 48, id 39653, offset 0, flags [none], proto UDP (17), length 84) + 192.0.0.2.53 > 192.0.0.1.46225: 2190*- 1/0/1 example.com. A 93.184.216.34 (56) + 33 20:58:57.142215 IP (tos 0x0, ttl 64, id 44395, offset 0, flags [none], proto UDP (17), length 76) + 192.0.0.1.46225 > 192.0.0.2.53: 16386+ [1au] A? example.com. (48) + 34 20:58:57.164050 IP (tos 0x0, ttl 48, id 60845, offset 0, flags [none], proto UDP (17), length 84) + 192.0.0.2.53 > 192.0.0.1.46225: 16386*- 1/0/1 example.com. A 93.184.216.34 (56) + 35 20:58:58.174193 IP (tos 0x0, ttl 64, id 44643, offset 0, flags [none], proto UDP (17), length 78) + 192.0.0.1.46225 > 192.0.0.2.53: 6373+ [1au] A? example.com. (50) + 36 20:58:58.195911 IP (tos 0x0, ttl 48, id 16078, offset 0, flags [none], proto UDP (17), length 84) + 192.0.0.2.53 > 192.0.0.1.46225: 6373*- 1/0/1 example.com. A 93.184.216.34 (56) + 37 20:58:59.206181 IP (tos 0x0, ttl 64, id 44899, offset 0, flags [none], proto UDP (17), length 108) + 192.0.0.1.46225 > 192.0.0.2.53: 29267+ [1au] A? example.com. (80) + 38 20:58:59.228465 IP (tos 0x0, ttl 48, id 37094, offset 0, flags [none], proto UDP (17), length 112) + 192.0.0.2.53 > 192.0.0.1.46225: 29267*- 1/0/1 example.com. A 93.184.216.34 (84) + 39 20:59:00.238274 IP (tos 0x0, ttl 64, id 45092, offset 0, flags [none], proto UDP (17), length 90) + 192.0.0.1.46225 > 192.0.0.2.53: 59326+ [1au] A? example.com. (62) + 40 20:59:00.260209 IP (tos 0x0, ttl 48, id 58611, offset 0, flags [none], proto UDP (17), length 122) + 192.0.0.2.53 > 192.0.0.1.46225: 59326*- 1/0/1 example.com. A 93.184.216.34 (94) + 41 20:59:01.269390 IP (tos 0x0, ttl 64, id 45316, offset 0, flags [none], proto UDP (17), length 100) + 192.0.0.1.46225 > 192.0.0.2.53: 17122+ [1au] A? example.com. (72) + 42 20:59:01.291167 IP (tos 0x0, ttl 48, id 14192, offset 0, flags [none], proto UDP (17), length 255) + 192.0.0.2.53 > 192.0.0.1.46225: 17122*- 2/0/1 example.com. A 93.184.216.34, example.com. RRSIG (227) diff --git a/tests/edns-opts-vv.out b/tests/edns-opts-vv.out index 889d1e77..eb1db0ae 100644 --- a/tests/edns-opts-vv.out +++ b/tests/edns-opts-vv.out @@ -1,10 +1,84 @@ - 1 15:51:13.645135 IP6 (flowlabel 0x59ab7, hlim 64, next-header UDP (17) payload length: 48) ::1.39913 > ::1.53: [bad udp cksum 0x0043 -> 0xd3c1!] 45044+ [1au] A? example.com. ar: . OPT UDPsize=4096 (40) - 2 15:51:13.645368 IP6 (flowlabel 0x407db, hlim 64, next-header UDP (17) payload length: 200) ::1.53 > ::1.39913: [bad udp cksum 0x00db -> 0x47f8!] 45044 q: A? example.com. 1/2/5 example.com. A 93.184.216.34 ns: example.com. NS a.iana-servers.net., example.com. NS b.iana-servers.net. ar: a.iana-servers.net. AAAA 2001:500:8f::53, b.iana-servers.net. AAAA 2001:500:8d::53, a.iana-servers.net. A 199.43.135.53, b.iana-servers.net. A 199.43.133.53, . OPT UDPsize=4096 (192) - 3 15:51:41.824299 IP6 (flowlabel 0x6cf0a, hlim 64, next-header UDP (17) payload length: 60) ::1.40241 > ::1.53: [bad udp cksum 0x004f -> 0x8d32!] 25196+ [1au] A? example.com. ar: . OPT UDPsize=4096 COOKIE (52) - 4 15:51:41.824510 IP6 (flowlabel 0x35b0b, hlim 64, next-header UDP (17) payload length: 228) ::1.53 > ::1.40241: [bad udp cksum 0x00f7 -> 0x7d0f!] 25196 q: A? example.com. 1/2/5 example.com. A 93.184.216.34 ns: example.com. NS a.iana-servers.net., example.com. NS b.iana-servers.net. ar: a.iana-servers.net. AAAA 2001:500:8f::53, b.iana-servers.net. AAAA 2001:500:8d::53, a.iana-servers.net. A 199.43.135.53, b.iana-servers.net. A 199.43.133.53, . OPT UDPsize=4096 COOKIE (220) - 5 15:51:58.952626 IP6 (flowlabel 0xf9ade, hlim 64, next-header UDP (17) payload length: 64) ::1.52325 > ::1.53: [bad udp cksum 0x0053 -> 0xfe45!] 1171+ [1au] A? example.com. ar: . OPT UDPsize=4096 NSID COOKIE (56) - 6 15:51:58.952934 IP6 (flowlabel 0x3185a, hlim 64, next-header UDP (17) payload length: 228) ::1.53 > ::1.52325: [bad udp cksum 0x00f7 -> 0x8e9d!] 1171 q: A? example.com. 1/2/5 example.com. A 93.184.216.34 ns: example.com. NS b.iana-servers.net., example.com. NS a.iana-servers.net. ar: a.iana-servers.net. AAAA 2001:500:8f::53, b.iana-servers.net. AAAA 2001:500:8d::53, a.iana-servers.net. A 199.43.135.53, b.iana-servers.net. A 199.43.133.53, . OPT UDPsize=4096 COOKIE (220) - 7 15:52:09.278001 IP6 (flowlabel 0xb5cae, hlim 64, next-header UDP (17) payload length: 75) ::1.45845 > ::1.53: [bad udp cksum 0x005e -> 0xcc5b!] 24578+ [1au] A? example.com. ar: . OPT UDPsize=4096 NSID ECS COOKIE (67) - 8 15:52:09.278215 IP6 (flowlabel 0x3e25d, hlim 64, next-header UDP (17) payload length: 239) ::1.53 > ::1.45845: [bad udp cksum 0x0102 -> 0xb15e!] 24578 q: A? example.com. 1/2/5 example.com. A 93.184.216.34 ns: example.com. NS a.iana-servers.net., example.com. NS b.iana-servers.net. ar: a.iana-servers.net. AAAA 2001:500:8f::53, b.iana-servers.net. AAAA 2001:500:8d::53, a.iana-servers.net. A 199.43.135.53, b.iana-servers.net. A 199.43.133.53, . OPT UDPsize=4096 COOKIE ECS (231) - 9 15:52:21.041837 IP6 (flowlabel 0xc2911, hlim 64, next-header UDP (17) payload length: 79) ::1.55361 > ::1.53: [bad udp cksum 0x0062 -> 0x13aa!] 11702+ [1au] A? example.com. ar: . OPT UDPsize=4096 NSID ECS COOKIE Opt16 (71) - 10 15:52:21.042080 IP6 (flowlabel 0x5d5a9, hlim 64, next-header UDP (17) payload length: 239) ::1.53 > ::1.55361: [bad udp cksum 0x0102 -> 0x966c!] 11702 q: A? example.com. 1/2/5 example.com. A 93.184.216.34 ns: example.com. NS a.iana-servers.net., example.com. NS b.iana-servers.net. ar: a.iana-servers.net. AAAA 2001:500:8f::53, b.iana-servers.net. AAAA 2001:500:8d::53, a.iana-servers.net. A 199.43.135.53, b.iana-servers.net. A 199.43.133.53, . OPT UDPsize=4096 COOKIE ECS (231) + 1 20:58:40.639715 IP (tos 0x0, ttl 64, id 42311, offset 0, flags [none], proto UDP (17), length 57) + 192.0.0.1.46225 > 192.0.0.2.53: [bad udp cksum 0xcd13 -> 0xc573!] 13784+ A? example.com. (29) + 2 20:58:40.661836 IP (tos 0x0, ttl 48, id 43077, offset 0, flags [none], proto UDP (17), length 73) + 192.0.0.2.53 > 192.0.0.1.46225: [udp sum ok] 13784*- q: A? example.com. 1/0/0 example.com. A 93.184.216.34 (45) + 3 20:58:41.671700 IP (tos 0x0, ttl 64, id 42441, offset 0, flags [none], proto UDP (17), length 68) + 192.0.0.1.46225 > 192.0.0.2.53: [bad udp cksum 0xcd1e -> 0x9191!] 47424+ [1au] A? example.com. ar: . OPT UDPsize=12345 DO (40) + 4 20:58:41.693577 IP (tos 0x0, ttl 48, id 64719, offset 0, flags [none], proto UDP (17), length 255) + 192.0.0.2.53 > 192.0.0.1.46225: [udp sum ok] 47424*- q: A? example.com. 2/0/1 example.com. A 93.184.216.34, example.com. RRSIG ar: . OPT UDPsize=4096 DO (227) + 5 20:58:42.703534 IP (tos 0x0, ttl 64, id 42575, offset 0, flags [none], proto UDP (17), length 79) + 192.0.0.1.46225 > 192.0.0.2.53: [bad udp cksum 0xcd29 -> 0x6dce!] 41739+ [1au] A? example.com. ar: . OPT UDPsize=4096 [ECS 192.0.2.0/24/0] (51) + 6 20:58:42.725559 IP (tos 0x0, ttl 48, id 21779, offset 0, flags [none], proto UDP (17), length 95) + 192.0.0.2.53 > 192.0.0.1.46225: [udp sum ok] 41739*- q: A? example.com. 1/0/1 example.com. A 93.184.216.34 ar: . OPT UDPsize=4096 [ECS 192.0.2.0/24/0] (67) + 7 20:58:43.734693 IP (tos 0x0, ttl 64, id 42674, offset 0, flags [none], proto UDP (17), length 80) + 192.0.0.1.46225 > 192.0.0.2.53: [bad udp cksum 0xcd2a -> 0xc240!] 18065+ [1au] A? example.com. ar: . OPT UDPsize=4096 [ECS 192.1.2.3/32/0] (52) + 8 20:58:43.756707 IP (tos 0x0, ttl 48, id 43697, offset 0, flags [none], proto UDP (17), length 96) + 192.0.0.2.53 > 192.0.0.1.46225: [udp sum ok] 18065*- q: A? example.com. 1/0/1 example.com. A 93.184.216.34 ar: . OPT UDPsize=4096 [ECS 192.1.2.3/32/0] (68) + 9 20:58:44.766528 IP (tos 0x0, ttl 64, id 42890, offset 0, flags [none], proto UDP (17), length 89) + 192.0.0.1.46225 > 192.0.0.2.53: [bad udp cksum 0xcd33 -> 0xc368!] 34237+ [1au] A? example.com. ar: . OPT UDPsize=4096 [ECS 2001:db8:85a3::8a2e:0:0/100/0] (61) + 10 20:58:44.788502 IP (tos 0x0, ttl 48, id 65435, offset 0, flags [none], proto UDP (17), length 105) + 192.0.0.2.53 > 192.0.0.1.46225: [udp sum ok] 34237*- q: A? example.com. 1/0/1 example.com. A 93.184.216.34 ar: . OPT UDPsize=4096 [ECS 2001:db8:85a3::8a2e:0:0/100/0] (77) + 11 20:58:45.797638 IP (tos 0x0, ttl 64, id 43148, offset 0, flags [none], proto UDP (17), length 80) + 192.0.0.1.46225 > 192.0.0.2.53: [bad udp cksum 0xcd2a -> 0x750a!] 30225+ [1au] A? example.com. ar: . OPT UDPsize=4096 [COOKIE a954d29208767b5c] (52) + 12 20:58:45.819504 IP (tos 0x0, ttl 48, id 21512, offset 0, flags [none], proto UDP (17), length 112) + 192.0.0.2.53 > 192.0.0.1.46225: [udp sum ok] 30225*- q: A? example.com. 1/0/1 example.com. A 93.184.216.34 ar: . OPT UDPsize=4096 [COOKIE a954d29208767b5c cf75f75b5db0bf0575c9f2d76c962883] (84) + 13 20:58:46.829454 IP (tos 0x0, ttl 64, id 43211, offset 0, flags [none], proto UDP (17), length 74) + 192.0.0.1.46225 > 192.0.0.2.53: [bad udp cksum 0xcd24 -> 0x971a!] 52688+ [1au] A? example.com. ar: . OPT UDPsize=4096 DO [DAU DSA-NSEC3-SHA1 RSASHA1-NSEC3-SHA1] (46) + 14 20:58:46.851441 IP (tos 0x0, ttl 48, id 43346, offset 0, flags [none], proto UDP (17), length 255) + 192.0.0.2.53 > 192.0.0.1.46225: [udp sum ok] 52688*- q: A? example.com. 2/0/1 example.com. A 93.184.216.34, example.com. RRSIG ar: . OPT UDPsize=4096 DO (227) + 15 20:58:47.860858 IP (tos 0x0, ttl 64, id 43235, offset 0, flags [none], proto UDP (17), length 83) + 192.0.0.1.46225 > 192.0.0.2.53: [bad udp cksum 0xcd2d -> 0x83fc!] 57808+ [1au] A? example.com. ar: . OPT UDPsize=4096 DO [DAU PRIVATEDNS,DHU SHA-256,N3U SHA-1] (55) + 16 20:58:47.882669 IP (tos 0x0, ttl 48, id 64510, offset 0, flags [none], proto UDP (17), length 255) + 192.0.0.2.53 > 192.0.0.1.46225: [udp sum ok] 57808*- q: A? example.com. 2/0/1 example.com. A 93.184.216.34, example.com. RRSIG ar: . OPT UDPsize=4096 DO (227) + 17 20:58:48.892587 IP (tos 0x0, ttl 64, id 43380, offset 0, flags [none], proto UDP (17), length 89) + 192.0.0.1.46225 > 192.0.0.2.53: [bad udp cksum 0xcd33 -> 0xaa4d!] 33054+ [1au] A? example.com. ar: . OPT UDPsize=4096 DO [CHAIN foo.example.com.] (61) + 18 20:58:48.914406 IP (tos 0x0, ttl 48, id 20611, offset 0, flags [none], proto UDP (17), length 255) + 192.0.0.2.53 > 192.0.0.1.46225: [udp sum ok] 33054*- q: A? example.com. 2/0/1 example.com. A 93.184.216.34, example.com. RRSIG ar: . OPT UDPsize=4096 DO (227) + 19 20:58:49.924625 IP (tos 0x0, ttl 64, id 43587, offset 0, flags [none], proto UDP (17), length 74) + 192.0.0.1.46225 > 192.0.0.2.53: [bad udp cksum 0xcd24 -> 0xae09!] 14353+ [1au] A? example.com. ar: . OPT UDPsize=4096 [KEEPALIVE 123.4 sec] (46) + 20 20:58:49.946523 IP (tos 0x0, ttl 48, id 42366, offset 0, flags [none], proto UDP (17), length 84) + 192.0.0.2.53 > 192.0.0.1.46225: [udp sum ok] 14353*- q: A? example.com. 1/0/1 example.com. A 93.184.216.34 ar: . OPT UDPsize=4096 (56) + 21 20:58:50.956601 IP (tos 0x0, ttl 64, id 43603, offset 0, flags [none], proto UDP (17), length 74) + 192.0.0.1.46225 > 192.0.0.2.53: [bad udp cksum 0xcd24 -> 0x8c36!] 17010+ [1au] A? example.com. ar: . OPT UDPsize=4096 DO [KEY-TAG 40000] (46) + 22 20:58:50.978366 IP (tos 0x0, ttl 48, id 64034, offset 0, flags [none], proto UDP (17), length 255) + 192.0.0.2.53 > 192.0.0.1.46225: [udp sum ok] 17010*- q: A? example.com. 2/0/1 example.com. A 93.184.216.34, example.com. RRSIG ar: . OPT UDPsize=4096 DO (227) + 23 20:58:51.988387 IP (tos 0x0, ttl 64, id 43789, offset 0, flags [none], proto UDP (17), length 76) + 192.0.0.1.46225 > 192.0.0.2.53: [bad udp cksum 0xcd26 -> 0xfc19!] 3894+ [1au] A? example.com. ar: . OPT UDPsize=4096 DO [KEY-TAG 30000 60000] (48) + 24 20:58:52.010258 IP (tos 0x0, ttl 48, id 20169, offset 0, flags [none], proto UDP (17), length 255) + 192.0.0.2.53 > 192.0.0.1.46225: [udp sum ok] 3894*- q: A? example.com. 2/0/1 example.com. A 93.184.216.34, example.com. RRSIG ar: . OPT UDPsize=4096 DO (227) + 25 20:58:53.015716 IP (tos 0x0, ttl 64, id 43925, offset 0, flags [none], proto UDP (17), length 72) + 192.0.0.1.46225 > 192.0.0.2.53: [bad udp cksum 0xcd22 -> 0xc9da!] 8476+ [1au] A? example.com. ar: . OPT UDPsize=4096 [EXPIRE] (44) + 26 20:58:53.037529 IP (tos 0x0, ttl 48, id 42142, offset 0, flags [none], proto UDP (17), length 84) + 192.0.0.2.53 > 192.0.0.1.46225: [udp sum ok] 8476*- q: A? example.com. 1/0/1 example.com. A 93.184.216.34 ar: . OPT UDPsize=4096 (56) + 27 20:58:54.047412 IP (tos 0x0, ttl 64, id 44065, offset 0, flags [none], proto UDP (17), length 76) + 192.0.0.1.46225 > 192.0.0.2.53: [bad udp cksum 0xcd26 -> 0x6656!] 3966+ [1au] A? example.com. ar: . OPT UDPsize=4096 [EXPIRE 1209600 sec] (48) + 28 20:58:54.069358 IP (tos 0x0, ttl 48, id 64128, offset 0, flags [none], proto UDP (17), length 84) + 192.0.0.2.53 > 192.0.0.1.46225: [udp sum ok] 3966*- q: A? example.com. 1/0/1 example.com. A 93.184.216.34 ar: . OPT UDPsize=4096 (56) + 29 20:58:55.078435 IP (tos 0x0, ttl 64, id 44256, offset 0, flags [none], proto UDP (17), length 72) + 192.0.0.1.46225 > 192.0.0.2.53: [bad udp cksum 0xcd22 -> 0x8328!] 26580+ [1au] A? example.com. ar: . OPT UDPsize=4096 [NSID] (44) + 30 20:58:55.100224 IP (tos 0x0, ttl 48, id 18983, offset 0, flags [none], proto UDP (17), length 84) + 192.0.0.2.53 > 192.0.0.1.46225: [udp sum ok] 26580*- q: A? example.com. 1/0/1 example.com. A 93.184.216.34 ar: . OPT UDPsize=4096 (56) + 31 20:58:56.110237 IP (tos 0x0, ttl 64, id 44374, offset 0, flags [none], proto UDP (17), length 82) + 192.0.0.1.46225 > 192.0.0.2.53: [bad udp cksum 0xcd2c -> 0x8c9c!] 2190+ [1au] A? example.com. ar: . OPT UDPsize=4096 [NSID 00112233445566778899] (54) + 32 20:58:56.132070 IP (tos 0x0, ttl 48, id 39653, offset 0, flags [none], proto UDP (17), length 84) + 192.0.0.2.53 > 192.0.0.1.46225: [udp sum ok] 2190*- q: A? example.com. 1/0/1 example.com. A 93.184.216.34 ar: . OPT UDPsize=4096 (56) + 33 20:58:57.142215 IP (tos 0x0, ttl 64, id 44395, offset 0, flags [none], proto UDP (17), length 76) + 192.0.0.1.46225 > 192.0.0.2.53: [bad udp cksum 0xcd26 -> 0x0d03!] 16386+ [1au] A? example.com. ar: . OPT UDPsize=4096 [Opt77 deadbeef] (48) + 34 20:58:57.164050 IP (tos 0x0, ttl 48, id 60845, offset 0, flags [none], proto UDP (17), length 84) + 192.0.0.2.53 > 192.0.0.1.46225: [udp sum ok] 16386*- q: A? example.com. 1/0/1 example.com. A 93.184.216.34 ar: . OPT UDPsize=4096 (56) + 35 20:58:58.174193 IP (tos 0x0, ttl 64, id 44643, offset 0, flags [none], proto UDP (17), length 78) + 192.0.0.1.46225 > 192.0.0.2.53: [bad udp cksum 0xcd28 -> 0xd1f6!] 6373+ [1au] A? example.com. ar: . OPT UDPsize=4096 [PADDING (6)] (50) + 36 20:58:58.195911 IP (tos 0x0, ttl 48, id 16078, offset 0, flags [none], proto UDP (17), length 84) + 192.0.0.2.53 > 192.0.0.1.46225: [udp sum ok] 6373*- q: A? example.com. 1/0/1 example.com. A 93.184.216.34 ar: . OPT UDPsize=4096 (56) + 37 20:58:59.206181 IP (tos 0x0, ttl 64, id 44899, offset 0, flags [none], proto UDP (17), length 108) + 192.0.0.1.46225 > 192.0.0.2.53: [bad udp cksum 0xcd46 -> 0x2f3b!] 29267+ [1au] A? example.com. ar: . OPT UDPsize=4096 [NSID 0123456789abcdef,PADDING (12),COOKIE aaaaaaaaaaaaaaaa] (80) + 38 20:58:59.228465 IP (tos 0x0, ttl 48, id 37094, offset 0, flags [none], proto UDP (17), length 112) + 192.0.0.2.53 > 192.0.0.1.46225: [udp sum ok] 29267*- q: A? example.com. 1/0/1 example.com. A 93.184.216.34 ar: . OPT UDPsize=4096 [COOKIE aaaaaaaaaaaaaaaa b5a8ca325db0bf132274faa81cef9aa4] (84) + 39 20:59:00.238274 IP (tos 0x0, ttl 64, id 45092, offset 0, flags [none], proto UDP (17), length 90) + 192.0.0.1.46225 > 192.0.0.2.53: [bad udp cksum 0xcd34 -> 0x883d!] 59326+ [1au] A? example.com. ar: . OPT UDPsize=4096 [ECS 192.1.0.0/16/0,COOKIE aaaaaaaaaaaaaaaa] (62) + 40 20:59:00.260209 IP (tos 0x0, ttl 48, id 58611, offset 0, flags [none], proto UDP (17), length 122) + 192.0.0.2.53 > 192.0.0.1.46225: [udp sum ok] 59326*- q: A? example.com. 1/0/1 example.com. A 93.184.216.34 ar: . OPT UDPsize=4096 [COOKIE aaaaaaaaaaaaaaaa 70a50ca25db0bf14d523a3f77957f788,ECS 192.1.0.0/16/0] (94) + 41 20:59:01.269390 IP (tos 0x0, ttl 64, id 45316, offset 0, flags [none], proto UDP (17), length 100) + 192.0.0.1.46225 > 192.0.0.2.53: [bad udp cksum 0xcd3e -> 0x4731!] 17122+ [1au] A? example.com. ar: . OPT UDPsize=4096 DO [CHAIN com.,DHU GOST_R_34.11-94,PADDING (4),NSID aabbccddeeff] (72) + 42 20:59:01.291167 IP (tos 0x0, ttl 48, id 14192, offset 0, flags [none], proto UDP (17), length 255) + 192.0.0.2.53 > 192.0.0.1.46225: [udp sum ok] 17122*- q: A? example.com. 2/0/1 example.com. A 93.184.216.34, example.com. RRSIG ar: . OPT UDPsize=4096 DO (227) diff --git a/tests/edns-opts.out b/tests/edns-opts.out index 9c9caa5e..f6ccd452 100644 --- a/tests/edns-opts.out +++ b/tests/edns-opts.out @@ -1,10 +1,42 @@ - 1 15:51:13.645135 IP6 ::1.39913 > ::1.53: 45044+ [1au] A? example.com. (40) - 2 15:51:13.645368 IP6 ::1.53 > ::1.39913: 45044 1/2/5 A 93.184.216.34 (192) - 3 15:51:41.824299 IP6 ::1.40241 > ::1.53: 25196+ [1au] A? example.com. (52) - 4 15:51:41.824510 IP6 ::1.53 > ::1.40241: 25196 1/2/5 A 93.184.216.34 (220) - 5 15:51:58.952626 IP6 ::1.52325 > ::1.53: 1171+ [1au] A? example.com. (56) - 6 15:51:58.952934 IP6 ::1.53 > ::1.52325: 1171 1/2/5 A 93.184.216.34 (220) - 7 15:52:09.278001 IP6 ::1.45845 > ::1.53: 24578+ [1au] A? example.com. (67) - 8 15:52:09.278215 IP6 ::1.53 > ::1.45845: 24578 1/2/5 A 93.184.216.34 (231) - 9 15:52:21.041837 IP6 ::1.55361 > ::1.53: 11702+ [1au] A? example.com. (71) - 10 15:52:21.042080 IP6 ::1.53 > ::1.55361: 11702 1/2/5 A 93.184.216.34 (231) + 1 20:58:40.639715 IP 192.0.0.1.46225 > 192.0.0.2.53: 13784+ A? example.com. (29) + 2 20:58:40.661836 IP 192.0.0.2.53 > 192.0.0.1.46225: 13784*- 1/0/0 A 93.184.216.34 (45) + 3 20:58:41.671700 IP 192.0.0.1.46225 > 192.0.0.2.53: 47424+ [1au] A? example.com. (40) + 4 20:58:41.693577 IP 192.0.0.2.53 > 192.0.0.1.46225: 47424*- 2/0/1 A 93.184.216.34, RRSIG (227) + 5 20:58:42.703534 IP 192.0.0.1.46225 > 192.0.0.2.53: 41739+ [1au] A? example.com. (51) + 6 20:58:42.725559 IP 192.0.0.2.53 > 192.0.0.1.46225: 41739*- 1/0/1 A 93.184.216.34 (67) + 7 20:58:43.734693 IP 192.0.0.1.46225 > 192.0.0.2.53: 18065+ [1au] A? example.com. (52) + 8 20:58:43.756707 IP 192.0.0.2.53 > 192.0.0.1.46225: 18065*- 1/0/1 A 93.184.216.34 (68) + 9 20:58:44.766528 IP 192.0.0.1.46225 > 192.0.0.2.53: 34237+ [1au] A? example.com. (61) + 10 20:58:44.788502 IP 192.0.0.2.53 > 192.0.0.1.46225: 34237*- 1/0/1 A 93.184.216.34 (77) + 11 20:58:45.797638 IP 192.0.0.1.46225 > 192.0.0.2.53: 30225+ [1au] A? example.com. (52) + 12 20:58:45.819504 IP 192.0.0.2.53 > 192.0.0.1.46225: 30225*- 1/0/1 A 93.184.216.34 (84) + 13 20:58:46.829454 IP 192.0.0.1.46225 > 192.0.0.2.53: 52688+ [1au] A? example.com. (46) + 14 20:58:46.851441 IP 192.0.0.2.53 > 192.0.0.1.46225: 52688*- 2/0/1 A 93.184.216.34, RRSIG (227) + 15 20:58:47.860858 IP 192.0.0.1.46225 > 192.0.0.2.53: 57808+ [1au] A? example.com. (55) + 16 20:58:47.882669 IP 192.0.0.2.53 > 192.0.0.1.46225: 57808*- 2/0/1 A 93.184.216.34, RRSIG (227) + 17 20:58:48.892587 IP 192.0.0.1.46225 > 192.0.0.2.53: 33054+ [1au] A? example.com. (61) + 18 20:58:48.914406 IP 192.0.0.2.53 > 192.0.0.1.46225: 33054*- 2/0/1 A 93.184.216.34, RRSIG (227) + 19 20:58:49.924625 IP 192.0.0.1.46225 > 192.0.0.2.53: 14353+ [1au] A? example.com. (46) + 20 20:58:49.946523 IP 192.0.0.2.53 > 192.0.0.1.46225: 14353*- 1/0/1 A 93.184.216.34 (56) + 21 20:58:50.956601 IP 192.0.0.1.46225 > 192.0.0.2.53: 17010+ [1au] A? example.com. (46) + 22 20:58:50.978366 IP 192.0.0.2.53 > 192.0.0.1.46225: 17010*- 2/0/1 A 93.184.216.34, RRSIG (227) + 23 20:58:51.988387 IP 192.0.0.1.46225 > 192.0.0.2.53: 3894+ [1au] A? example.com. (48) + 24 20:58:52.010258 IP 192.0.0.2.53 > 192.0.0.1.46225: 3894*- 2/0/1 A 93.184.216.34, RRSIG (227) + 25 20:58:53.015716 IP 192.0.0.1.46225 > 192.0.0.2.53: 8476+ [1au] A? example.com. (44) + 26 20:58:53.037529 IP 192.0.0.2.53 > 192.0.0.1.46225: 8476*- 1/0/1 A 93.184.216.34 (56) + 27 20:58:54.047412 IP 192.0.0.1.46225 > 192.0.0.2.53: 3966+ [1au] A? example.com. (48) + 28 20:58:54.069358 IP 192.0.0.2.53 > 192.0.0.1.46225: 3966*- 1/0/1 A 93.184.216.34 (56) + 29 20:58:55.078435 IP 192.0.0.1.46225 > 192.0.0.2.53: 26580+ [1au] A? example.com. (44) + 30 20:58:55.100224 IP 192.0.0.2.53 > 192.0.0.1.46225: 26580*- 1/0/1 A 93.184.216.34 (56) + 31 20:58:56.110237 IP 192.0.0.1.46225 > 192.0.0.2.53: 2190+ [1au] A? example.com. (54) + 32 20:58:56.132070 IP 192.0.0.2.53 > 192.0.0.1.46225: 2190*- 1/0/1 A 93.184.216.34 (56) + 33 20:58:57.142215 IP 192.0.0.1.46225 > 192.0.0.2.53: 16386+ [1au] A? example.com. (48) + 34 20:58:57.164050 IP 192.0.0.2.53 > 192.0.0.1.46225: 16386*- 1/0/1 A 93.184.216.34 (56) + 35 20:58:58.174193 IP 192.0.0.1.46225 > 192.0.0.2.53: 6373+ [1au] A? example.com. (50) + 36 20:58:58.195911 IP 192.0.0.2.53 > 192.0.0.1.46225: 6373*- 1/0/1 A 93.184.216.34 (56) + 37 20:58:59.206181 IP 192.0.0.1.46225 > 192.0.0.2.53: 29267+ [1au] A? example.com. (80) + 38 20:58:59.228465 IP 192.0.0.2.53 > 192.0.0.1.46225: 29267*- 1/0/1 A 93.184.216.34 (84) + 39 20:59:00.238274 IP 192.0.0.1.46225 > 192.0.0.2.53: 59326+ [1au] A? example.com. (62) + 40 20:59:00.260209 IP 192.0.0.2.53 > 192.0.0.1.46225: 59326*- 1/0/1 A 93.184.216.34 (94) + 41 20:59:01.269390 IP 192.0.0.1.46225 > 192.0.0.2.53: 17122+ [1au] A? example.com. (72) + 42 20:59:01.291167 IP 192.0.0.2.53 > 192.0.0.1.46225: 17122*- 2/0/1 A 93.184.216.34, RRSIG (227) diff --git a/tests/edns-opts.pcap b/tests/edns-opts.pcap index 862c51c6..05563a2d 100644 Binary files a/tests/edns-opts.pcap and b/tests/edns-opts.pcap differ