dns/detect: rrtype can now use index

Ticket: 7480
pull/13878/head
Philippe Antoine 1 year ago committed by Victor Julien
parent d8c1f8e7be
commit c0988252ba

@ -15,11 +15,14 @@
* 02110-1301, USA.
*/
use super::dns::{DNSRcode, DNSRecordType, DNSTransaction, ALPROTO_DNS};
use super::dns::{
DNSAnswerEntry, DNSQueryEntry, DNSRcode, DNSRecordType, DNSTransaction, ALPROTO_DNS,
};
use crate::core::{STREAM_TOCLIENT, STREAM_TOSERVER};
use crate::detect::uint::{
detect_match_uint, detect_parse_uint_enum, DetectUintData, SCDetectU16Free, SCDetectU8Free,
SCDetectU8Parse,
detect_match_uint, detect_parse_array_uint_enum, detect_parse_uint_enum,
detect_uint_match_at_index, DetectUintArrayData, DetectUintData, SCDetectU16Free,
SCDetectU8Free, SCDetectU8Parse,
};
use crate::detect::{helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer};
use crate::direction::Direction;
@ -102,23 +105,21 @@ unsafe extern "C" fn dns_rrtype_match(
tx: *mut c_void, _sig: *const Signature, ctx: *const SigMatchCtx,
) -> c_int {
let tx = cast_pointer!(tx, DNSTransaction);
let ctx = cast_pointer!(ctx, DetectUintData<u16>);
let ctx = cast_pointer!(ctx, DetectUintArrayData<u16>);
if flags & Direction::ToServer as u8 != 0 {
if let Some(request) = &tx.request {
for i in 0..request.queries.len() {
if detect_match_uint(ctx, request.queries[i].rrtype) {
return 1;
}
}
return detect_uint_match_at_index::<DNSQueryEntry, u16>(&request.queries, ctx, |q| {
Some(q.rrtype)
});
}
} else if flags & Direction::ToClient as u8 != 0 {
if let Some(response) = &tx.response {
for i in 0..response.answers.len() {
if detect_match_uint(ctx, response.answers[i].rrtype) {
return 1;
}
}
return detect_uint_match_at_index::<DNSAnswerEntry, u16>(
&response.answers,
ctx,
|a| Some(a.rrtype),
);
}
}
return 0;
@ -209,10 +210,10 @@ unsafe extern "C" fn dns_rcode_free(_de: *mut DetectEngineCtx, ctx: *mut c_void)
unsafe extern "C" fn dns_rrtype_parse(
ustr: *const std::os::raw::c_char,
) -> *mut DetectUintData<u8> {
) -> *mut DetectUintArrayData<u16> {
let ft_name: &CStr = CStr::from_ptr(ustr); //unsafe
if let Ok(s) = ft_name.to_str() {
if let Some(ctx) = detect_parse_uint_enum::<u16, DNSRecordType>(s) {
if let Some(ctx) = detect_parse_array_uint_enum::<u16, DNSRecordType>(s) {
let boxed = Box::new(ctx);
return Box::into_raw(boxed) as *mut _;
}
@ -246,9 +247,8 @@ unsafe extern "C" fn dns_rrtype_setup(
}
unsafe extern "C" fn dns_rrtype_free(_de: *mut DetectEngineCtx, ctx: *mut c_void) {
// Just unbox...
let ctx = cast_pointer!(ctx, DetectUintData<u16>);
SCDetectU16Free(ctx);
let ctx = cast_pointer!(ctx, DetectUintArrayData<u16>);
std::mem::drop(Box::from_raw(ctx));
}
unsafe extern "C" fn dns_detect_answer_name_setup(

Loading…
Cancel
Save