From 7e326f291ad535eec2483117129c4dd093fe6643 Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Mon, 20 Apr 2026 14:11:01 +0200 Subject: [PATCH] detect: (m)dns keywords even with "alert udp" Ticket: 8501 (m)dns.*.rrname keywords required the rules to start with alert (m)dns and refused to load if the rule started with generic alert ip or alert udp, with error message Error: detect-parse: invalid alproto 0 --- src/detect-dns-name.c | 32 ++++++++++++++++++++++---------- 1 file changed, 22 insertions(+), 10 deletions(-) diff --git a/src/detect-dns-name.c b/src/detect-dns-name.c index ac70b38649..7873c43fc0 100644 --- a/src/detect-dns-name.c +++ b/src/detect-dns-name.c @@ -51,12 +51,24 @@ static int mdns_answer_buffer_id = 0; static int mdns_authority_buffer_id = 0; static int mdns_additional_buffer_id = 0; -static int DetectSetup(DetectEngineCtx *de_ctx, Signature *s, const char *str, int id) +static int DetectSetupDNS(DetectEngineCtx *de_ctx, Signature *s, const char *str, int id) { if (SCDetectBufferSetActiveList(de_ctx, s, id) < 0) { return -1; } - if (SCDetectSignatureSetAppProto(s, s->alproto) < 0) { + if (SCDetectSignatureSetAppProto(s, ALPROTO_DNS) < 0) { + return -1; + } + + return 0; +} + +static int DetectSetupMDNS(DetectEngineCtx *de_ctx, Signature *s, const char *str, int id) +{ + if (SCDetectBufferSetActiveList(de_ctx, s, id) < 0) { + return -1; + } + if (SCDetectSignatureSetAppProto(s, ALPROTO_MDNS) < 0) { return -1; } @@ -65,42 +77,42 @@ static int DetectSetup(DetectEngineCtx *de_ctx, Signature *s, const char *str, i static int SetupQueryBuffer(DetectEngineCtx *de_ctx, Signature *s, const char *str) { - return DetectSetup(de_ctx, s, str, query_buffer_id); + return DetectSetupDNS(de_ctx, s, str, query_buffer_id); } static int SetupAnswerBuffer(DetectEngineCtx *de_ctx, Signature *s, const char *str) { - return DetectSetup(de_ctx, s, str, answer_buffer_id); + return DetectSetupDNS(de_ctx, s, str, answer_buffer_id); } static int SetupAdditionalsBuffer(DetectEngineCtx *de_ctx, Signature *s, const char *str) { - return DetectSetup(de_ctx, s, str, additional_buffer_id); + return DetectSetupDNS(de_ctx, s, str, additional_buffer_id); } static int SetupAuthoritiesBuffer(DetectEngineCtx *de_ctx, Signature *s, const char *str) { - return DetectSetup(de_ctx, s, str, authority_buffer_id); + return DetectSetupDNS(de_ctx, s, str, authority_buffer_id); } static int SetupQueryBufferMdns(DetectEngineCtx *de_ctx, Signature *s, const char *str) { - return DetectSetup(de_ctx, s, str, mdns_query_buffer_id); + return DetectSetupMDNS(de_ctx, s, str, mdns_query_buffer_id); } static int SetupAnswerBufferMdns(DetectEngineCtx *de_ctx, Signature *s, const char *str) { - return DetectSetup(de_ctx, s, str, mdns_answer_buffer_id); + return DetectSetupMDNS(de_ctx, s, str, mdns_answer_buffer_id); } static int SetupAdditionalsBufferMdns(DetectEngineCtx *de_ctx, Signature *s, const char *str) { - return DetectSetup(de_ctx, s, str, mdns_additional_buffer_id); + return DetectSetupMDNS(de_ctx, s, str, mdns_additional_buffer_id); } static int SetupAuthoritiesBufferMdns(DetectEngineCtx *de_ctx, Signature *s, const char *str) { - return DetectSetup(de_ctx, s, str, mdns_authority_buffer_id); + return DetectSetupMDNS(de_ctx, s, str, mdns_authority_buffer_id); } static int Register(const char *keyword, const char *desc, const char *doc,