From fb8eafa638e5338bd3d27005227b0b22a95618d7 Mon Sep 17 00:00:00 2001
From: sthen <sthen@openbsd.org>
Date: Fri, 23 May 2014 20:36:04 +0000
Subject: [PATCH] Don't print a "weird flag" type warning "[b2&3=0x2400]" for
 DNS NOTIFY messages which should be sent with AA set. Adapted from a patch at
 http://marc.info/?l=tcpdump-patches&m=98115734907026&w=2 pointed out by Peter
 J. Philipp, ok henning@

---
 usr.sbin/tcpdump/nameser.h      | 4 +++-
 usr.sbin/tcpdump/print-domain.c | 7 ++++---
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/usr.sbin/tcpdump/nameser.h b/usr.sbin/tcpdump/nameser.h
index b21b34d9b15..8ae9c8b8e0f 100644
--- a/usr.sbin/tcpdump/nameser.h
+++ b/usr.sbin/tcpdump/nameser.h
@@ -1,4 +1,4 @@
-/* @(#) $Id: nameser.h,v 1.6 2010/11/04 17:37:05 canacar Exp $ (LBL) */
+/* @(#) $Id: nameser.h,v 1.7 2014/05/23 20:36:04 sthen Exp $ (LBL) */
 /*
  * Copyright (c) 1983, 1989, 1993
  *	The Regents of the University of California.  All rights reserved.
@@ -82,6 +82,8 @@
 #if 0
 #define xxx		0x3		/* 0x3 reserved */
 #endif
+#define NS_NOTIFY_OP	0x4		/* notify secondary of SOA change */
+
 	/* non standard - supports ALLOW_UPDATES stuff from Mike Schwartz */
 #define UPDATEA		0x9		/* add resource record */
 #define UPDATED		0xa		/* delete a specific resource record */
diff --git a/usr.sbin/tcpdump/print-domain.c b/usr.sbin/tcpdump/print-domain.c
index bc9d3a7e33c..3ea80379581 100644
--- a/usr.sbin/tcpdump/print-domain.c
+++ b/usr.sbin/tcpdump/print-domain.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: print-domain.c,v 1.18 2010/11/04 17:37:05 canacar Exp $	*/
+/*	$OpenBSD: print-domain.c,v 1.19 2014/05/23 20:36:04 sthen Exp $	*/
 
 /*
  * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
@@ -663,9 +663,10 @@ ns_print(register const u_char *bp, u_int length, int is_mdns)
 		    DNS_RD(np) ? "+" : "",
 		    DNS_CD(np) ? "%" : "");
 
-		/* any weirdness? */
+		/* any weirdness? AA is expected in NOTIFY. */
 		b2 = EXTRACT_16BITS(((u_short *)np)+1);
-		if (b2 & 0x6cf)
+		if ((b2 & 0x6cf) !=
+		    (DNS_OPCODE(np) == NS_NOTIFY_OP ? htons(0x400) : 0))
 			printf(" [b2&3=0x%x]", b2);
 
 		if (DNS_OPCODE(np) == IQUERY) {
-- 
2.20.1