diff --git a/doc/userguide/rules/dns-keywords.rst b/doc/userguide/rules/dns-keywords.rst index 693178946a..b949246901 100644 --- a/doc/userguide/rules/dns-keywords.rst +++ b/doc/userguide/rules/dns-keywords.rst @@ -51,6 +51,8 @@ This keyword matches on the **rcode** field found in the DNS header flags. dns.rcode uses an :ref:`unsigned 8-bit integer `. It can also be specified by text from the enumeration. +See ``suricata --list-keywords=json | jq '."dns.rcode".enum_values'`` + Currently, Suricata only supports rcode values in the range [0-15], while the current DNS version supports rcode values from [0-23] as specified in `RFC 6895 `_. @@ -86,6 +88,8 @@ dns.rrtype uses an :ref:`unsigned 16-bit integer `. dns.rrtype is also a :ref:`multi-integer `. +See ``suricata --list-keywords=json | jq '."dns.rrtype".enum_values'`` + It can also be specified by text from the enumeration. Syntax diff --git a/rust/src/dns/detect.rs b/rust/src/dns/detect.rs index 9206db3036..b6c0c9b285 100644 --- a/rust/src/dns/detect.rs +++ b/rust/src/dns/detect.rs @@ -25,20 +25,21 @@ use crate::detect::uint::{ SCDetectU8Free, SCDetectU8Parse, }; use crate::detect::{ - helper_keyword_register_multi_buffer, SigTableElmtStickyBuffer, SIGMATCH_INFO_ENUM_UINT, - SIGMATCH_INFO_MULTI_UINT, SIGMATCH_INFO_UINT16, SIGMATCH_INFO_UINT8, + helper_keyword_register_multi_buffer, EnumString, SigTableElmtStickyBuffer, + SIGMATCH_INFO_ENUM_UINT, SIGMATCH_INFO_MULTI_UINT, SIGMATCH_INFO_UINT16, SIGMATCH_INFO_UINT8, }; use crate::direction::Direction; use crate::http2::http2::{HTTP2TxProgress, HTTP2TxType}; +use crate::jsonbuilder::JsonBuilder; use std::ffi::CStr; use std::os::raw::{c_int, c_void}; use suricata_sys::sys::{ AppProtoEnum, DetectEngineCtx, DetectEngineThreadCtx, Flow, SCDetectBufferSetActiveList, SCDetectHelperBufferProgressRegister, SCDetectHelperBufferProgressRegisterSubState, - SCDetectHelperKeywordAliasRegister, SCDetectHelperKeywordRegister, - SCDetectHelperMultiBufferProgressMpmRegister, + SCDetectHelperKeywordAliasRegister, SCDetectHelperKeywordJsonInfoRegister, + SCDetectHelperKeywordRegister, SCDetectHelperMultiBufferProgressMpmRegister, SCDetectHelperMultiBufferProgressMpmRegisterSubState, SCDetectSignatureSetAppProto, - SCSigMatchAppendSMToList, SCSigTableAppLiteElmt, SigMatchCtx, Signature, + SCJsonBuilder, SCSigMatchAppendSMToList, SCSigTableAppLiteElmt, SigMatchCtx, Signature, SIGMATCH_SUPPORT_FIREWALL, }; @@ -358,6 +359,16 @@ unsafe extern "C" fn dns_detect_query_setup( return 0; } +unsafe extern "C" fn dns_rcode_list_values(jsb: *mut SCJsonBuilder) { + let jsb = cast_pointer!(jsb, JsonBuilder); + let _ = DNSRcode::list_values(jsb); +} + +unsafe extern "C" fn dns_rrtype_list_values(jsb: *mut SCJsonBuilder) { + let jsb = cast_pointer!(jsb, JsonBuilder); + let _ = DNSRecordType::list_values(jsb); +} + #[no_mangle] pub unsafe extern "C" fn SCDetectDNSRegister() { let kw = SigTableElmtStickyBuffer { @@ -452,6 +463,8 @@ pub unsafe extern "C" fn SCDetectDNSRegister() { flags: SIGMATCH_INFO_UINT16 | SIGMATCH_INFO_ENUM_UINT, }; G_DNS_RCODE_KW_ID = SCDetectHelperKeywordRegister(&kw); + SCDetectHelperKeywordJsonInfoRegister(G_DNS_RCODE_KW_ID, Some(dns_rcode_list_values)); + G_DNS_RCODE_BUFFER_ID = SCDetectHelperBufferProgressRegister( b"dns.rcode\0".as_ptr() as *const libc::c_char, ALPROTO_DNS, @@ -476,6 +489,7 @@ pub unsafe extern "C" fn SCDetectDNSRegister() { flags: SIGMATCH_INFO_UINT16 | SIGMATCH_INFO_MULTI_UINT | SIGMATCH_INFO_ENUM_UINT, }; G_DNS_RRTYPE_KW_ID = SCDetectHelperKeywordRegister(&kw); + SCDetectHelperKeywordJsonInfoRegister(G_DNS_RRTYPE_KW_ID, Some(dns_rrtype_list_values)); G_DNS_RRTYPE_BUFFER_ID = SCDetectHelperBufferProgressRegister( b"dns.rrtype\0".as_ptr() as *const libc::c_char, ALPROTO_DNS,