diff --git a/rust/src/dns/detect.rs b/rust/src/dns/detect.rs index db373e9036..79a32950ef 100644 --- a/rust/src/dns/detect.rs +++ b/rust/src/dns/detect.rs @@ -15,11 +15,14 @@ * 02110-1301, USA. */ -use super::dns::{DNSRcode, DNSRecordType, DNSTransaction, ALPROTO_DNS}; +use super::dns::{ + DNSAnswerEntry, DNSQueryEntry, DNSRcode, DNSRecordType, DNSTransaction, ALPROTO_DNS, +}; use crate::core::{STREAM_TOCLIENT, STREAM_TOSERVER}; use crate::detect::uint::{ - detect_match_uint, detect_parse_uint_enum, DetectUintData, SCDetectU16Free, SCDetectU8Free, - SCDetectU8Parse, + detect_match_uint, detect_parse_array_uint_enum, detect_parse_uint_enum, + detect_uint_match_at_index, DetectUintArrayData, DetectUintData, SCDetectU16Free, + SCDetectU8Free, SCDetectU8Parse, }; use crate::detect::{helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer}; use crate::direction::Direction; @@ -102,23 +105,21 @@ unsafe extern "C" fn dns_rrtype_match( tx: *mut c_void, _sig: *const Signature, ctx: *const SigMatchCtx, ) -> c_int { let tx = cast_pointer!(tx, DNSTransaction); - let ctx = cast_pointer!(ctx, DetectUintData); + let ctx = cast_pointer!(ctx, DetectUintArrayData); if flags & Direction::ToServer as u8 != 0 { if let Some(request) = &tx.request { - for i in 0..request.queries.len() { - if detect_match_uint(ctx, request.queries[i].rrtype) { - return 1; - } - } + return detect_uint_match_at_index::(&request.queries, ctx, |q| { + Some(q.rrtype) + }); } } else if flags & Direction::ToClient as u8 != 0 { if let Some(response) = &tx.response { - for i in 0..response.answers.len() { - if detect_match_uint(ctx, response.answers[i].rrtype) { - return 1; - } - } + return detect_uint_match_at_index::( + &response.answers, + ctx, + |a| Some(a.rrtype), + ); } } return 0; @@ -209,10 +210,10 @@ unsafe extern "C" fn dns_rcode_free(_de: *mut DetectEngineCtx, ctx: *mut c_void) unsafe extern "C" fn dns_rrtype_parse( ustr: *const std::os::raw::c_char, -) -> *mut DetectUintData { +) -> *mut DetectUintArrayData { let ft_name: &CStr = CStr::from_ptr(ustr); //unsafe if let Ok(s) = ft_name.to_str() { - if let Some(ctx) = detect_parse_uint_enum::(s) { + if let Some(ctx) = detect_parse_array_uint_enum::(s) { let boxed = Box::new(ctx); return Box::into_raw(boxed) as *mut _; } @@ -246,9 +247,8 @@ unsafe extern "C" fn dns_rrtype_setup( } unsafe extern "C" fn dns_rrtype_free(_de: *mut DetectEngineCtx, ctx: *mut c_void) { - // Just unbox... - let ctx = cast_pointer!(ctx, DetectUintData); - SCDetectU16Free(ctx); + let ctx = cast_pointer!(ctx, DetectUintArrayData); + std::mem::drop(Box::from_raw(ctx)); } unsafe extern "C" fn dns_detect_answer_name_setup(