Skip to content

Commit 12d4cc7

Browse files
committed
detect: (m)dns keywords even with "alert udp"
Ticket: 8501 (m)dns.*.rrname keywords required the rules to start with alert (m)dns and refused to load if the rule started with generic alert ip or alert udp, with error message Error: detect-parse: invalid alproto 0 (cherry picked from commit 7e326f2)
1 parent e40775d commit 12d4cc7

1 file changed

Lines changed: 22 additions & 10 deletions

File tree

src/detect-dns-name.c

Lines changed: 22 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -51,12 +51,24 @@ static int mdns_answer_buffer_id = 0;
5151
static int mdns_authority_buffer_id = 0;
5252
static int mdns_additional_buffer_id = 0;
5353

54-
static int DetectSetup(DetectEngineCtx *de_ctx, Signature *s, const char *str, int id)
54+
static int DetectSetupDNS(DetectEngineCtx *de_ctx, Signature *s, const char *str, int id)
5555
{
5656
if (SCDetectBufferSetActiveList(de_ctx, s, id) < 0) {
5757
return -1;
5858
}
59-
if (SCDetectSignatureSetAppProto(s, s->alproto) < 0) {
59+
if (SCDetectSignatureSetAppProto(s, ALPROTO_DNS) < 0) {
60+
return -1;
61+
}
62+
63+
return 0;
64+
}
65+
66+
static int DetectSetupMDNS(DetectEngineCtx *de_ctx, Signature *s, const char *str, int id)
67+
{
68+
if (SCDetectBufferSetActiveList(de_ctx, s, id) < 0) {
69+
return -1;
70+
}
71+
if (SCDetectSignatureSetAppProto(s, ALPROTO_MDNS) < 0) {
6072
return -1;
6173
}
6274

@@ -65,42 +77,42 @@ static int DetectSetup(DetectEngineCtx *de_ctx, Signature *s, const char *str, i
6577

6678
static int SetupQueryBuffer(DetectEngineCtx *de_ctx, Signature *s, const char *str)
6779
{
68-
return DetectSetup(de_ctx, s, str, query_buffer_id);
80+
return DetectSetupDNS(de_ctx, s, str, query_buffer_id);
6981
}
7082

7183
static int SetupAnswerBuffer(DetectEngineCtx *de_ctx, Signature *s, const char *str)
7284
{
73-
return DetectSetup(de_ctx, s, str, answer_buffer_id);
85+
return DetectSetupDNS(de_ctx, s, str, answer_buffer_id);
7486
}
7587

7688
static int SetupAdditionalsBuffer(DetectEngineCtx *de_ctx, Signature *s, const char *str)
7789
{
78-
return DetectSetup(de_ctx, s, str, additional_buffer_id);
90+
return DetectSetupDNS(de_ctx, s, str, additional_buffer_id);
7991
}
8092

8193
static int SetupAuthoritiesBuffer(DetectEngineCtx *de_ctx, Signature *s, const char *str)
8294
{
83-
return DetectSetup(de_ctx, s, str, authority_buffer_id);
95+
return DetectSetupDNS(de_ctx, s, str, authority_buffer_id);
8496
}
8597

8698
static int SetupQueryBufferMdns(DetectEngineCtx *de_ctx, Signature *s, const char *str)
8799
{
88-
return DetectSetup(de_ctx, s, str, mdns_query_buffer_id);
100+
return DetectSetupMDNS(de_ctx, s, str, mdns_query_buffer_id);
89101
}
90102

91103
static int SetupAnswerBufferMdns(DetectEngineCtx *de_ctx, Signature *s, const char *str)
92104
{
93-
return DetectSetup(de_ctx, s, str, mdns_answer_buffer_id);
105+
return DetectSetupMDNS(de_ctx, s, str, mdns_answer_buffer_id);
94106
}
95107

96108
static int SetupAdditionalsBufferMdns(DetectEngineCtx *de_ctx, Signature *s, const char *str)
97109
{
98-
return DetectSetup(de_ctx, s, str, mdns_additional_buffer_id);
110+
return DetectSetupMDNS(de_ctx, s, str, mdns_additional_buffer_id);
99111
}
100112

101113
static int SetupAuthoritiesBufferMdns(DetectEngineCtx *de_ctx, Signature *s, const char *str)
102114
{
103-
return DetectSetup(de_ctx, s, str, mdns_authority_buffer_id);
115+
return DetectSetupMDNS(de_ctx, s, str, mdns_authority_buffer_id);
104116
}
105117

106118
static int Register(const char *keyword, const char *desc, const char *doc,

0 commit comments

Comments
 (0)