libbind

- Fix DNS-OARC#11 DNS-OARC#133: - Remove dependency on libbind, replaced with LDNS - Fix memory leak in EDNS0 ECS address parsing - Change `-g`'s format of EDNS0 output to be consistent with the rest of the parsable output - No more spaces in the output - Fix incorrect `\` and extra empty new-line - All EDNS0 options are added after `edns0[...]` using comma separation, example: `edns0[],edns0opt[],...` - Client Subnet format: `edns0opt[ECS,family=nn,source=nn,scope=nn,addr=...]` - Unknown/unsupported code: `edns0opt[code=nn,codelen=nn]` - Parsing error messages have changed, they came from libbind, now comes from LDNS - `plugins/eventlog`: Use LDNS instead of libbind - `plugins/royparse`: Use LDNS instead of libbind - `plugins/txtout`: Use LDNS instead of libbind - `-X`/`-x` will now match against FQDNs - `network`: Use inline `memcpy()` and endian functions to get network parameters
jelu · Dec 15, 2020 · 30aa366 · 30aa366
1 parent c4f551a
commit 30aa366
Show file tree

Hide file tree

Showing 30 changed files with 772 additions and 864 deletions.
diff --git a/README.md b/README.md
@@ -32,19 +32,16 @@ General support and discussion:
 `dnscap` requires a couple of libraries beside a normal C compiling
 environment with autoconf, automake, libtool and pkgconfig.
 
-`dnscap` has a non-optional dependency on the PCAP library and optional
-dependencies on LDNS. BIND library `libbind` is considered optional but it
-is needed under OpenBSD for various `arpa/nameser*` include headers, see
-[Linking with libbind](#linking-with-libbind).
+`dnscap` has a non-optional dependency on the PCAP library and LDNS.
 
 To install the dependencies under Debian/Ubuntu:
 ```
-apt-get install -y libpcap-dev libldns-dev libbind-dev zlib1g-dev libyaml-perl libssl-dev
+apt-get install -y libpcap-dev libldns-dev zlib1g-dev libyaml-perl libssl-dev
 ```
 
 To install the dependencies under CentOS (with EPEL enabled):
 ```
-yum install -y libpcap-devel ldns-devel openssl-devel bind-devel zlib-devel perl-YAML
+yum install -y libpcap-devel ldns-devel openssl-devel zlib-devel perl-YAML
 ```
 
 For the following OS you will need to install some of the dependencies
@@ -103,21 +100,6 @@ make
 make install
 ```
 
-## Linking with libbind
-
-If you plan to use dnscap's -x/-X features, then you might need
-to have libbind installed.   These features use functions such
-as ns_parserr().  On some systems these functions will be found
-in libresolv.  If not, then you might need to install libbind.
-I suggest first building dnscap on your system as-is, then run
-
-```
-$ ./dnscap -x foo
-```
-
-If you see an error, install libbind either from your OS package system
-or by downloading the source from http://ftp.isc.org/isc/libbind/6.0/ .
-
 ### 64-bit libraries
 
 If you need to link against 64-bit libraries found in non-standard
@@ -130,41 +112,13 @@ $ env LDFLAGS=-L/usr/lib64 ./configure
 
 ### OpenBSD
 
-For OpenBSD you probably installed libpcap and libbind in `/usr/local`
-so you will need to tell `configure` that and libbind might install it's
-libraries and header files in a subdirectory:
-
-```
-$ env CFLAGS="-I/usr/local/include -I/usr/local/include/bind" \
-  LDFLAGS="-L/usr/local/lib -L/usr/local/lib/bind" \
-  ./configure
-```
-
-*KNOWN ISSUES*:
-- libbind export the symbol `_res` which also exists in OpenBSD's libc, this causes it to throw warnings like `dnscap:/usr/lib/libc.so.96.0: /usr/local/lib/libbind.so.6.1 : WARNING: symbol(_res) size mismatch, relink your program` and may segfault.
-- due to above, known to segfault in libpcap when using IPv6 addresses in BPF, see https://github.com/the-tcpdump-group/libpcap/issues/964
-- this will be addressed in future versions of `dnscap`, see https://github.com/DNS-OARC/dnscap/issues/11
-
-### FreeBSD
-
-If you've installed libbind for -x/-X then it probably went into
-/usr/local and you'll need to tell configure how to find it:
+For OpenBSD you probably installed libpcap in `/usr/local` so you will need
+to tell `configure` where to find the libraries and header files:
 
 ```
-$ env CFLAGS="-I/usr/local/include -I/usr/local/include/bind" \
-  LDFLAGS="-L/usr/local/lib -L/usr/local/lib/bind" \
-  ./configure
+$ env CFLAGS="-I/usr/local/include" LDFLAGS="-L/usr/local/lib" ./configure
 ```
 
-Also note that we have observed significant memory leaks on FreeBSD
-(7.2) when using -x/-X.  To rectify:
-
-1. cd /usr/ports/dns/libbind
-1. make config
-1. de-select "Compile with thread support"
-1. reinstall the libbind port
-1. recompile and install dnscap
-
 ## Plugins
 
 `dnscap` comes bundled with a set of plugins, see `-P` option.

diff --git a/configure.ac b/configure.ac
@@ -78,23 +78,18 @@ AM_CONDITIONAL([ENABLE_GCOV], [test "x$enable_gcov" != "xno"])
 AM_EXTRA_RECURSIVE_TARGETS([gcov])
 
 # Checks for libraries.
-AC_CHECK_LIB([bind], [ns_initparse], [], [AC_CHECK_LIB([bind], [__ns_initparse])])
-AC_CHECK_LIB([resolv], [res_mkquery], [], [
-	AC_CHECK_LIB([resolv], [__res_mkquery], [], [
-		AC_CHECK_LIB([resolv], [res_9_mkquery])
-	])
-])
 AC_CHECK_LIB([dl], [dlopen])
 AC_CHECK_LIB([tinycbor], [cbor_parser_init])
 AM_CONDITIONAL([HAVE_CBOR], [test "x$ac_cv_lib_tinycbor_cbor_parser_init" = "xyes"])
-AC_CHECK_LIB([ldns], [ldns_wire2pkt])
-AM_CONDITIONAL([HAVE_LDNS], [test "x$ac_cv_lib_ldns_ldns_wire2pkt" = "xyes"])
 AC_CHECK_LIB([z], [gzopen])
 PKG_CHECK_MODULES([libcrypto], [libcrypto],
     [AC_DEFINE([HAVE_LIBCRYPTO], [1], [Define to 1 if you have libcrypto.])])
 AC_CHECK_LIB([cryptopant], [scramble_init], [], [
     AC_CHECK_LIB([cryptopANT], [scramble_init])
 ])
+PKG_CHECK_MODULES([libldns], [libldns], , [
+  PKG_CHECK_MODULES([libldns], [ldns])
+])
 
 # Check for OS specific libraries
 case "$host_os" in
@@ -122,41 +117,12 @@ AC_CHECK_HEADERS([sys/time.h])
 AC_CHECK_HEADERS([zlib.h])
 AC_CHECK_HEADERS([openssl/conf.h openssl/evp.h openssl/err.h])
 AC_CHECK_HEADERS([cryptopANT.h])
+AC_CHECK_HEADERS([endian.h sys/endian.h machine/endian.h])
 
 # Checks for library functions.
 AC_CHECK_FUNCS([snprintf])
 AC_CHECK_FUNCS([setreuid setresuid setregid setresgid setegid seteuid initgroups setgroups])
 AC_CHECK_FUNCS([funopen fopencookie gzopen])
-AC_CHECK_FUNC([ns_initparse],
-    [AC_DEFINE([HAVE_NS_INITPARSE], [1], [Define to 1 if you have the `ns_initparse' function.])],
-    [AC_CHECK_FUNC(__ns_initparse,
-        [AC_DEFINE([HAVE_NS_INITPARSE], [1], [Define to 1 if you have the `ns_initparse' function.])]
-    )]
-)
-AC_CHECK_FUNC([ns_parserr],
-    [AC_DEFINE([HAVE_NS_PARSERR], [1], [Define to 1 if you have the `ns_parserr' function.])],
-    [AC_CHECK_FUNC(__ns_parserr,
-        [AC_DEFINE([HAVE_NS_PARSERR], [1], [Define to 1 if you have the `ns_parserr' function.])]
-    )]
-)
-AC_CHECK_FUNC([ns_sprintrr],
-    [AC_DEFINE([HAVE_NS_SPRINTRR], [1], [Define to 1 if you have the `ns_sprintrr' function.])],
-    [AC_CHECK_FUNC(__ns_sprintrr,
-        [AC_DEFINE([HAVE_NS_SPRINTRR], [1], [Define to 1 if you have the `ns_sprintrr' function.])]
-    )]
-)
-AC_CHECK_FUNC([ns_name_uncompress],
-    [AC_DEFINE([HAVE_NS_NAME_UNCOMPRESS], [1], [Define to 1 if you have the `ns_name_uncompress' function.])],
-    [AC_CHECK_FUNC(__ns_name_uncompress,
-        [AC_DEFINE([HAVE_NS_NAME_UNCOMPRESS], [1], [Define to 1 if you have the `ns_name_uncompress' function.])]
-    )]
-)
-AC_CHECK_FUNC([p_rcode],
-    [AC_DEFINE([HAVE_P_RCODE], [1], [Define to 1 if you have the `p_rcode' function.])],
-    [AC_CHECK_FUNC(__p_rcode,
-        [AC_DEFINE([HAVE_P_RCODE], [1], [Define to 1 if you have the `p_rcode' function.])]
-    )]
-)
 AC_CHECK_FUNCS([__assertion_failed])
 
 # Check for SECCOMP

diff --git a/plugins/anonaes128/test2.gold b/plugins/anonaes128/test2.gold
@@ -2,38 +2,32 @@
 	[4a92:a508:d567:5c16:d07:5236:4b51:417e].51972 [6733:3377:d5f:662b:299f:6a97:c7fe:d424].53  \
 	dns QUERY,NOERROR,51420,rd|ad \
 	1 google.com,IN,A 0 0 \
-	1 .,4096,4096,0,edns0[len=0,UDP=4096,ver=0,rcode=0,DO=0,z=0] \
-
+	1 .,4096,4096,0,edns0[len=0,UDP=4096,ver=0,rcode=0,DO=0,z=0]
 [103] 2018-11-27 15:52:00.428453 [#1 dns6.pcap-dist 4095] \
 	[6733:3377:d5f:662b:299f:6a97:c7fe:d424].53 [4a92:a508:d567:5c16:d07:5236:4b51:417e].51972  \
 	dns QUERY,NOERROR,51420,qr|rd|ra \
 	1 google.com,IN,A \
 	1 google.com,IN,A,299,172.217.20.46 0 \
-	1 .,512,512,0,edns0[len=0,UDP=512,ver=0,rcode=0,DO=0,z=0] \
-
+	1 .,512,512,0,edns0[len=0,UDP=512,ver=0,rcode=0,DO=0,z=0]
 [87] 2018-11-27 15:52:00.414188 [#0 dns6.pcap-dist 4095] \
 	[4a92:a508:d567:5c16:d07:5236:4b51:417e].51972 [2001:4860:4860::8888].53  \
 	dns QUERY,NOERROR,51420,rd|ad \
 	1 google.com,IN,A 0 0 \
-	1 .,4096,4096,0,edns0[len=0,UDP=4096,ver=0,rcode=0,DO=0,z=0] \
-
+	1 .,4096,4096,0,edns0[len=0,UDP=4096,ver=0,rcode=0,DO=0,z=0]
 [103] 2018-11-27 15:52:00.428453 [#1 dns6.pcap-dist 4095] \
 	[2001:4860:4860::8888].53 [4a92:a508:d567:5c16:d07:5236:4b51:417e].51972  \
 	dns QUERY,NOERROR,51420,qr|rd|ra \
 	1 google.com,IN,A \
 	1 google.com,IN,A,299,172.217.20.46 0 \
-	1 .,512,512,0,edns0[len=0,UDP=512,ver=0,rcode=0,DO=0,z=0] \
-
+	1 .,512,512,0,edns0[len=0,UDP=512,ver=0,rcode=0,DO=0,z=0]
 [87] 2018-11-27 15:52:00.414188 [#0 dns6.pcap-dist 4095] \
 	[2a01:3f0:0:57::245].51972 [6733:3377:d5f:662b:299f:6a97:c7fe:d424].53  \
 	dns QUERY,NOERROR,51420,rd|ad \
 	1 google.com,IN,A 0 0 \
-	1 .,4096,4096,0,edns0[len=0,UDP=4096,ver=0,rcode=0,DO=0,z=0] \
-
+	1 .,4096,4096,0,edns0[len=0,UDP=4096,ver=0,rcode=0,DO=0,z=0]
 [103] 2018-11-27 15:52:00.428453 [#1 dns6.pcap-dist 4095] \
 	[6733:3377:d5f:662b:299f:6a97:c7fe:d424].53 [2a01:3f0:0:57::245].51972  \
 	dns QUERY,NOERROR,51420,qr|rd|ra \
 	1 google.com,IN,A \
 	1 google.com,IN,A,299,172.217.20.46 0 \
-	1 .,512,512,0,edns0[len=0,UDP=512,ver=0,rcode=0,DO=0,z=0] \
-
+	1 .,512,512,0,edns0[len=0,UDP=512,ver=0,rcode=0,DO=0,z=0]
diff --git a/plugins/anonaes128/test3.gold b/plugins/anonaes128/test3.gold
@@ -2,12 +2,10 @@
 	[2a01:3f0:0:57::245].51972 [2001:4860:4860::8888].53  \
 	dns QUERY,NOERROR,51420,rd|ad \
 	1 google.com,IN,A 0 0 \
-	1 .,4096,4096,0,edns0[len=0,UDP=4096,ver=0,rcode=0,DO=0,z=0] \
-
+	1 .,4096,4096,0,edns0[len=0,UDP=4096,ver=0,rcode=0,DO=0,z=0]
 [103] 2018-11-27 15:52:00.428453 [#1 test3.pcap.20181127.155200.414188 4095] \
 	[2001:4860:4860::8888].53 [2a01:3f0:0:57::245].51972  \
 	dns QUERY,NOERROR,51420,qr|rd|ra \
 	1 google.com,IN,A \
 	1 google.com,IN,A,299,172.217.20.46 0 \
-	1 .,512,512,0,edns0[len=0,UDP=512,ver=0,rcode=0,DO=0,z=0] \
-
+	1 .,512,512,0,edns0[len=0,UDP=512,ver=0,rcode=0,DO=0,z=0]
diff --git a/plugins/anonmask/test2.gold b/plugins/anonmask/test2.gold
@@ -2,90 +2,76 @@
 	[2a01:3f0::].51972 [2001:4860:4860::].53  \
 	dns QUERY,NOERROR,51420,rd|ad \
 	1 google.com,IN,A 0 0 \
-	1 .,4096,4096,0,edns0[len=0,UDP=4096,ver=0,rcode=0,DO=0,z=0] \
-
+	1 .,4096,4096,0,edns0[len=0,UDP=4096,ver=0,rcode=0,DO=0,z=0]
 [103] 2018-11-27 15:52:00.428453 [#1 dns6.pcap-dist 4095] \
 	[2001:4860:4860::].53 [2a01:3f0::].51972  \
 	dns QUERY,NOERROR,51420,qr|rd|ra \
 	1 google.com,IN,A \
 	1 google.com,IN,A,299,172.217.20.46 0 \
-	1 .,512,512,0,edns0[len=0,UDP=512,ver=0,rcode=0,DO=0,z=0] \
-
+	1 .,512,512,0,edns0[len=0,UDP=512,ver=0,rcode=0,DO=0,z=0]
 [87] 2018-11-27 15:52:00.414188 [#0 dns6.pcap-dist 4095] \
 	[2a01:300::].51972 [2001:4800::].53  \
 	dns QUERY,NOERROR,51420,rd|ad \
 	1 google.com,IN,A 0 0 \
-	1 .,4096,4096,0,edns0[len=0,UDP=4096,ver=0,rcode=0,DO=0,z=0] \
-
+	1 .,4096,4096,0,edns0[len=0,UDP=4096,ver=0,rcode=0,DO=0,z=0]
 [103] 2018-11-27 15:52:00.428453 [#1 dns6.pcap-dist 4095] \
 	[2001:4800::].53 [2a01:300::].51972  \
 	dns QUERY,NOERROR,51420,qr|rd|ra \
 	1 google.com,IN,A \
 	1 google.com,IN,A,299,172.217.20.46 0 \
-	1 .,512,512,0,edns0[len=0,UDP=512,ver=0,rcode=0,DO=0,z=0] \
-
+	1 .,512,512,0,edns0[len=0,UDP=512,ver=0,rcode=0,DO=0,z=0]
 [87] 2018-11-27 15:52:00.414188 [#0 dns6.pcap-dist 4095] \
 	[2a01:3f0::].51972 [2001:4860::].53  \
 	dns QUERY,NOERROR,51420,rd|ad \
 	1 google.com,IN,A 0 0 \
-	1 .,4096,4096,0,edns0[len=0,UDP=4096,ver=0,rcode=0,DO=0,z=0] \
-
+	1 .,4096,4096,0,edns0[len=0,UDP=4096,ver=0,rcode=0,DO=0,z=0]
 [103] 2018-11-27 15:52:00.428453 [#1 dns6.pcap-dist 4095] \
 	[2001:4860::].53 [2a01:3f0::].51972  \
 	dns QUERY,NOERROR,51420,qr|rd|ra \
 	1 google.com,IN,A \
 	1 google.com,IN,A,299,172.217.20.46 0 \
-	1 .,512,512,0,edns0[len=0,UDP=512,ver=0,rcode=0,DO=0,z=0] \
-
+	1 .,512,512,0,edns0[len=0,UDP=512,ver=0,rcode=0,DO=0,z=0]
 [87] 2018-11-27 15:52:00.414188 [#0 dns6.pcap-dist 4095] \
 	[2a01:3f0:0:57::].51972 [2001:4860:4860::].53  \
 	dns QUERY,NOERROR,51420,rd|ad \
 	1 google.com,IN,A 0 0 \
-	1 .,4096,4096,0,edns0[len=0,UDP=4096,ver=0,rcode=0,DO=0,z=0] \
-
+	1 .,4096,4096,0,edns0[len=0,UDP=4096,ver=0,rcode=0,DO=0,z=0]
 [103] 2018-11-27 15:52:00.428453 [#1 dns6.pcap-dist 4095] \
 	[2001:4860:4860::].53 [2a01:3f0:0:57::].51972  \
 	dns QUERY,NOERROR,51420,qr|rd|ra \
 	1 google.com,IN,A \
 	1 google.com,IN,A,299,172.217.20.46 0 \
-	1 .,512,512,0,edns0[len=0,UDP=512,ver=0,rcode=0,DO=0,z=0] \
-
+	1 .,512,512,0,edns0[len=0,UDP=512,ver=0,rcode=0,DO=0,z=0]
 [87] 2018-11-27 15:52:00.414188 [#0 dns6.pcap-dist 4095] \
 	[2a01:3f0:0:57::].51972 [2001:4860:4860::].53  \
 	dns QUERY,NOERROR,51420,rd|ad \
 	1 google.com,IN,A 0 0 \
-	1 .,4096,4096,0,edns0[len=0,UDP=4096,ver=0,rcode=0,DO=0,z=0] \
-
+	1 .,4096,4096,0,edns0[len=0,UDP=4096,ver=0,rcode=0,DO=0,z=0]
 [103] 2018-11-27 15:52:00.428453 [#1 dns6.pcap-dist 4095] \
 	[2001:4860:4860::].53 [2a01:3f0:0:57::].51972  \
 	dns QUERY,NOERROR,51420,qr|rd|ra \
 	1 google.com,IN,A \
 	1 google.com,IN,A,299,172.217.20.46 0 \
-	1 .,512,512,0,edns0[len=0,UDP=512,ver=0,rcode=0,DO=0,z=0] \
-
+	1 .,512,512,0,edns0[len=0,UDP=512,ver=0,rcode=0,DO=0,z=0]
 [87] 2018-11-27 15:52:00.414188 [#0 dns6.pcap-dist 4095] \
 	[2a01:3f0::].51972 [2001:4860:4860::8888].53  \
 	dns QUERY,NOERROR,51420,rd|ad \
 	1 google.com,IN,A 0 0 \
-	1 .,4096,4096,0,edns0[len=0,UDP=4096,ver=0,rcode=0,DO=0,z=0] \
-
+	1 .,4096,4096,0,edns0[len=0,UDP=4096,ver=0,rcode=0,DO=0,z=0]
 [103] 2018-11-27 15:52:00.428453 [#1 dns6.pcap-dist 4095] \
 	[2001:4860:4860::8888].53 [2a01:3f0::].51972  \
 	dns QUERY,NOERROR,51420,qr|rd|ra \
 	1 google.com,IN,A \
 	1 google.com,IN,A,299,172.217.20.46 0 \
-	1 .,512,512,0,edns0[len=0,UDP=512,ver=0,rcode=0,DO=0,z=0] \
-
+	1 .,512,512,0,edns0[len=0,UDP=512,ver=0,rcode=0,DO=0,z=0]
 [87] 2018-11-27 15:52:00.414188 [#0 dns6.pcap-dist 4095] \
 	[2a01:3f0:0:57::245].51972 [2001:4860:4860::].53  \
 	dns QUERY,NOERROR,51420,rd|ad \
 	1 google.com,IN,A 0 0 \
-	1 .,4096,4096,0,edns0[len=0,UDP=4096,ver=0,rcode=0,DO=0,z=0] \
-
+	1 .,4096,4096,0,edns0[len=0,UDP=4096,ver=0,rcode=0,DO=0,z=0]
 [103] 2018-11-27 15:52:00.428453 [#1 dns6.pcap-dist 4095] \
 	[2001:4860:4860::].53 [2a01:3f0:0:57::245].51972  \
 	dns QUERY,NOERROR,51420,qr|rd|ra \
 	1 google.com,IN,A \
 	1 google.com,IN,A,299,172.217.20.46 0 \
-	1 .,512,512,0,edns0[len=0,UDP=512,ver=0,rcode=0,DO=0,z=0] \
-
+	1 .,512,512,0,edns0[len=0,UDP=512,ver=0,rcode=0,DO=0,z=0]
diff --git a/plugins/cryptopan/test2.gold b/plugins/cryptopan/test2.gold
@@ -2,38 +2,32 @@
 	[11eb:460f:2668:8b63:2668:8b2a:2668:8948].51972 [1845:9ab2:426f:b370:2668:8b2a:2668:33ab].53  \
 	dns QUERY,NOERROR,51420,rd|ad \
 	1 google.com,IN,A 0 0 \
-	1 .,4096,4096,0,edns0[len=0,UDP=4096,ver=0,rcode=0,DO=0,z=0] \
-
+	1 .,4096,4096,0,edns0[len=0,UDP=4096,ver=0,rcode=0,DO=0,z=0]
 [103] 2018-11-27 15:52:00.428453 [#1 dns6.pcap-dist 4095] \
 	[1845:9ab2:426f:b370:2668:8b2a:2668:33ab].53 [11eb:460f:2668:8b63:2668:8b2a:2668:8948].51972  \
 	dns QUERY,NOERROR,51420,qr|rd|ra \
 	1 google.com,IN,A \
 	1 google.com,IN,A,299,172.217.20.46 0 \
-	1 .,512,512,0,edns0[len=0,UDP=512,ver=0,rcode=0,DO=0,z=0] \
-
+	1 .,512,512,0,edns0[len=0,UDP=512,ver=0,rcode=0,DO=0,z=0]
 [87] 2018-11-27 15:52:00.414188 [#0 dns6.pcap-dist 4095] \
 	[11eb:460f:2668:8b63:2668:8b2a:2668:8948].51972 [2001:4860:4860::8888].53  \
 	dns QUERY,NOERROR,51420,rd|ad \
 	1 google.com,IN,A 0 0 \
-	1 .,4096,4096,0,edns0[len=0,UDP=4096,ver=0,rcode=0,DO=0,z=0] \
-
+	1 .,4096,4096,0,edns0[len=0,UDP=4096,ver=0,rcode=0,DO=0,z=0]
 [103] 2018-11-27 15:52:00.428453 [#1 dns6.pcap-dist 4095] \
 	[2001:4860:4860::8888].53 [11eb:460f:2668:8b63:2668:8b2a:2668:8948].51972  \
 	dns QUERY,NOERROR,51420,qr|rd|ra \
 	1 google.com,IN,A \
 	1 google.com,IN,A,299,172.217.20.46 0 \
-	1 .,512,512,0,edns0[len=0,UDP=512,ver=0,rcode=0,DO=0,z=0] \
-
+	1 .,512,512,0,edns0[len=0,UDP=512,ver=0,rcode=0,DO=0,z=0]
 [87] 2018-11-27 15:52:00.414188 [#0 dns6.pcap-dist 4095] \
 	[2a01:3f0:0:57::245].51972 [1845:9ab2:426f:b370:2668:8b2a:2668:33ab].53  \
 	dns QUERY,NOERROR,51420,rd|ad \
 	1 google.com,IN,A 0 0 \
-	1 .,4096,4096,0,edns0[len=0,UDP=4096,ver=0,rcode=0,DO=0,z=0] \
-
+	1 .,4096,4096,0,edns0[len=0,UDP=4096,ver=0,rcode=0,DO=0,z=0]
 [103] 2018-11-27 15:52:00.428453 [#1 dns6.pcap-dist 4095] \
 	[1845:9ab2:426f:b370:2668:8b2a:2668:33ab].53 [2a01:3f0:0:57::245].51972  \
 	dns QUERY,NOERROR,51420,qr|rd|ra \
 	1 google.com,IN,A \
 	1 google.com,IN,A,299,172.217.20.46 0 \
-	1 .,512,512,0,edns0[len=0,UDP=512,ver=0,rcode=0,DO=0,z=0] \
-
+	1 .,512,512,0,edns0[len=0,UDP=512,ver=0,rcode=0,DO=0,z=0]
diff --git a/plugins/cryptopan/test3.gold b/plugins/cryptopan/test3.gold
@@ -716,12 +716,10 @@
 	[2a01:3f0:0:57::245].51972 [2001:4860:4860::8888].53  \
 	dns QUERY,NOERROR,51420,rd|ad \
 	1 google.com,IN,A 0 0 \
-	1 .,4096,4096,0,edns0[len=0,UDP=4096,ver=0,rcode=0,DO=0,z=0] \
-
+	1 .,4096,4096,0,edns0[len=0,UDP=4096,ver=0,rcode=0,DO=0,z=0]
 [103] 2018-11-27 15:52:00.428453 [#1 test3.pcap.20181127.155200.414188 4095] \
 	[2001:4860:4860::8888].53 [2a01:3f0:0:57::245].51972  \
 	dns QUERY,NOERROR,51420,qr|rd|ra \
 	1 google.com,IN,A \
 	1 google.com,IN,A,299,172.217.20.46 0 \
-	1 .,512,512,0,edns0[len=0,UDP=512,ver=0,rcode=0,DO=0,z=0] \
-
+	1 .,512,512,0,edns0[len=0,UDP=512,ver=0,rcode=0,DO=0,z=0]