From 10919e18351bad38d7b9e759011b841d478d40ae Mon Sep 17 00:00:00 2001
From: tlhsec <talhaouy.web3@gmail.com>
Date: Mon, 6 Jul 2026 18:05:09 +0100
Subject: [PATCH] eve/mdns: add requests and responses config flags

The mDNS EVE logger previously logged every transaction unconditionally,
with a TODO noting that request/response-only flags would be useful
(mirroring the existing eve-log.dns logger). This resolves that TODO by
adding "requests" and "responses" configuration keys to eve-log.mdns.

Both default to enabled, preserving the current behavior of logging all
mDNS traffic. Setting either to "no" skips the corresponding
transactions before allocating the JSON builder, avoiding wasted work.

Also documents the new options in suricata.yaml.in and the EVE JSON
output section of the user guide.
---
 doc/userguide/output/eve/eve-json-output.rst | 19 +++++++++++
 src/output-json-mdns.c                       | 33 +++++++++++++++++---
 suricata.yaml.in                             |  9 ++++++
 3 files changed, 56 insertions(+), 5 deletions(-)

diff --git a/doc/userguide/output/eve/eve-json-output.rst b/doc/userguide/output/eve/eve-json-output.rst
index f25a496f6e..8a5cf8e2ac 100644
--- a/doc/userguide/output/eve/eve-json-output.rst
+++ b/doc/userguide/output/eve/eve-json-output.rst
@@ -324,6 +324,25 @@ YAML::
             # Default: all.
             #types: [a, aaaa, cname, mx, ns, ptr, txt]
 
+mDNS
+~~~~
+
+mDNS records are logged as one entry for the request, and one entry for
+the response.
+
+YAML::
+
+        - mdns:
+            # Enable/disable this logger. Default: enabled.
+            #enabled: yes
+
+            # Control logging of requests and responses:
+            # - requests: enable logging of mDNS queries
+            # - responses: enable logging of mDNS answers
+            # By default both requests and responses are logged.
+            #requests: no
+            #responses: no
+
 TLS
 ~~~
 
diff --git a/src/output-json-mdns.c b/src/output-json-mdns.c
index bb1d45aba9..5045eebc94 100644
--- a/src/output-json-mdns.c
+++ b/src/output-json-mdns.c
@@ -28,6 +28,10 @@
 #include "output-json-mdns.h"
 #include "rust.h"
 
+#define MDNS_LOG_REQUESTS  BIT_U64(0)
+#define MDNS_LOG_RESPONSES BIT_U64(1)
+#define MDNS_LOG_DEFAULT   (MDNS_LOG_REQUESTS | MDNS_LOG_RESPONSES)
+
 typedef struct SCDnsLogFileCtx_ {
     uint64_t flags; /** Store mode */
     OutputJsonCtx *eve_ctx;
@@ -50,6 +54,17 @@ static int JsonMdnsLogger(ThreadVars *tv, void *thread_data, const Packet *p, Fl
     SCDnsLogThread *td = (SCDnsLogThread *)thread_data;
     SCDnsLogFileCtx *dnslog_ctx = td->dnslog_ctx;
 
+    /* Filter based on the configured requests/responses flags. */
+    if (SCDnsTxIsRequest(txptr)) {
+        if (unlikely(dnslog_ctx->flags & MDNS_LOG_REQUESTS) == 0) {
+            return TM_ECODE_OK;
+        }
+    } else if (SCDnsTxIsResponse(txptr)) {
+        if (unlikely(dnslog_ctx->flags & MDNS_LOG_RESPONSES) == 0) {
+            return TM_ECODE_OK;
+        }
+    }
+
     SCJsonBuilder *jb = CreateEveHeader(p, LOG_DIR_FLOW, "mdns", NULL, dnslog_ctx->eve_ctx);
     if (unlikely(jb == NULL)) {
         return TM_ECODE_OK;
@@ -130,11 +145,19 @@ static OutputInitResult DnsLogInitCtxSub(SCConfNode *conf, OutputCtx *parent_ctx
     dnslog_ctx->eve_ctx = ojc;
     dnslog_ctx->version = DNS_LOG_VERSION_3;
 
-    /* For mDNS, log everything.
-     *
-     * TODO: Maybe add flags for request and/or response only.
-     */
-    dnslog_ctx->flags = ~0ULL;
+    /* By default both requests and responses are logged. The "requests"
+     * and "responses" config keys allow disabling either independently. */
+    dnslog_ctx->flags = MDNS_LOG_DEFAULT;
+
+    const char *requests = SCConfNodeLookupChildValue(conf, "requests");
+    if (requests != NULL && !SCConfValIsTrue(requests)) {
+        dnslog_ctx->flags &= ~MDNS_LOG_REQUESTS;
+    }
+
+    const char *responses = SCConfNodeLookupChildValue(conf, "responses");
+    if (responses != NULL && !SCConfValIsTrue(responses)) {
+        dnslog_ctx->flags &= ~MDNS_LOG_RESPONSES;
+    }
 
     OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx));
     if (unlikely(output_ctx == NULL)) {
diff --git a/suricata.yaml.in b/suricata.yaml.in
index bf07ad1c0a..b1762c3f05 100644
--- a/suricata.yaml.in
+++ b/suricata.yaml.in
@@ -289,6 +289,15 @@ outputs:
             # Default: all.
             #types: [a, aaaa, cname, mx, ns, ptr, txt]
         - mdns:
+            # Enable/disable this logger. Default: enabled.
+            #enabled: yes
+
+            # Control logging of requests and responses:
+            # - requests: enable logging of mDNS queries
+            # - responses: enable logging of mDNS answers
+            # By default both requests and responses are logged.
+            #requests: no
+            #responses: no
         - tls:
             extended: yes     # enable this for extended logging information
             # output TLS transaction where the session is resumed using a