|
|
|
|
@ -15,11 +15,14 @@
|
|
|
|
|
* 02110-1301, USA.
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
use super::dns::{DNSRcode, DNSRecordType, DNSTransaction, ALPROTO_DNS};
|
|
|
|
|
use super::dns::{
|
|
|
|
|
DNSAnswerEntry, DNSQueryEntry, DNSRcode, DNSRecordType, DNSTransaction, ALPROTO_DNS,
|
|
|
|
|
};
|
|
|
|
|
use crate::core::{STREAM_TOCLIENT, STREAM_TOSERVER};
|
|
|
|
|
use crate::detect::uint::{
|
|
|
|
|
detect_match_uint, detect_parse_uint_enum, DetectUintData, SCDetectU16Free, SCDetectU8Free,
|
|
|
|
|
SCDetectU8Parse,
|
|
|
|
|
detect_match_uint, detect_parse_array_uint_enum, detect_parse_uint_enum,
|
|
|
|
|
detect_uint_match_at_index, DetectUintArrayData, DetectUintData, SCDetectU16Free,
|
|
|
|
|
SCDetectU8Free, SCDetectU8Parse,
|
|
|
|
|
};
|
|
|
|
|
use crate::detect::{helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer};
|
|
|
|
|
use crate::direction::Direction;
|
|
|
|
|
@ -102,23 +105,21 @@ unsafe extern "C" fn dns_rrtype_match(
|
|
|
|
|
tx: *mut c_void, _sig: *const Signature, ctx: *const SigMatchCtx,
|
|
|
|
|
) -> c_int {
|
|
|
|
|
let tx = cast_pointer!(tx, DNSTransaction);
|
|
|
|
|
let ctx = cast_pointer!(ctx, DetectUintData<u16>);
|
|
|
|
|
let ctx = cast_pointer!(ctx, DetectUintArrayData<u16>);
|
|
|
|
|
|
|
|
|
|
if flags & Direction::ToServer as u8 != 0 {
|
|
|
|
|
if let Some(request) = &tx.request {
|
|
|
|
|
for i in 0..request.queries.len() {
|
|
|
|
|
if detect_match_uint(ctx, request.queries[i].rrtype) {
|
|
|
|
|
return 1;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
return detect_uint_match_at_index::<DNSQueryEntry, u16>(&request.queries, ctx, |q| {
|
|
|
|
|
Some(q.rrtype)
|
|
|
|
|
});
|
|
|
|
|
}
|
|
|
|
|
} else if flags & Direction::ToClient as u8 != 0 {
|
|
|
|
|
if let Some(response) = &tx.response {
|
|
|
|
|
for i in 0..response.answers.len() {
|
|
|
|
|
if detect_match_uint(ctx, response.answers[i].rrtype) {
|
|
|
|
|
return 1;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
return detect_uint_match_at_index::<DNSAnswerEntry, u16>(
|
|
|
|
|
&response.answers,
|
|
|
|
|
ctx,
|
|
|
|
|
|a| Some(a.rrtype),
|
|
|
|
|
);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
return 0;
|
|
|
|
|
@ -209,10 +210,10 @@ unsafe extern "C" fn dns_rcode_free(_de: *mut DetectEngineCtx, ctx: *mut c_void)
|
|
|
|
|
|
|
|
|
|
unsafe extern "C" fn dns_rrtype_parse(
|
|
|
|
|
ustr: *const std::os::raw::c_char,
|
|
|
|
|
) -> *mut DetectUintData<u8> {
|
|
|
|
|
) -> *mut DetectUintArrayData<u16> {
|
|
|
|
|
let ft_name: &CStr = CStr::from_ptr(ustr); //unsafe
|
|
|
|
|
if let Ok(s) = ft_name.to_str() {
|
|
|
|
|
if let Some(ctx) = detect_parse_uint_enum::<u16, DNSRecordType>(s) {
|
|
|
|
|
if let Some(ctx) = detect_parse_array_uint_enum::<u16, DNSRecordType>(s) {
|
|
|
|
|
let boxed = Box::new(ctx);
|
|
|
|
|
return Box::into_raw(boxed) as *mut _;
|
|
|
|
|
}
|
|
|
|
|
@ -246,9 +247,8 @@ unsafe extern "C" fn dns_rrtype_setup(
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
unsafe extern "C" fn dns_rrtype_free(_de: *mut DetectEngineCtx, ctx: *mut c_void) {
|
|
|
|
|
// Just unbox...
|
|
|
|
|
let ctx = cast_pointer!(ctx, DetectUintData<u16>);
|
|
|
|
|
SCDetectU16Free(ctx);
|
|
|
|
|
let ctx = cast_pointer!(ctx, DetectUintArrayData<u16>);
|
|
|
|
|
std::mem::drop(Box::from_raw(ctx));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
unsafe extern "C" fn dns_detect_answer_name_setup(
|
|
|
|
|
|