dns/detect: rrtype can now use index

Ticket: 7480
pull/13878/head
Philippe Antoine 1 year ago committed by Victor Julien
parent d8c1f8e7be
commit c0988252ba

@ -15,11 +15,14 @@
* 02110-1301, USA. * 02110-1301, USA.
*/ */
use super::dns::{DNSRcode, DNSRecordType, DNSTransaction, ALPROTO_DNS}; use super::dns::{
DNSAnswerEntry, DNSQueryEntry, DNSRcode, DNSRecordType, DNSTransaction, ALPROTO_DNS,
};
use crate::core::{STREAM_TOCLIENT, STREAM_TOSERVER}; use crate::core::{STREAM_TOCLIENT, STREAM_TOSERVER};
use crate::detect::uint::{ use crate::detect::uint::{
detect_match_uint, detect_parse_uint_enum, DetectUintData, SCDetectU16Free, SCDetectU8Free, detect_match_uint, detect_parse_array_uint_enum, detect_parse_uint_enum,
SCDetectU8Parse, detect_uint_match_at_index, DetectUintArrayData, DetectUintData, SCDetectU16Free,
SCDetectU8Free, SCDetectU8Parse,
}; };
use crate::detect::{helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer}; use crate::detect::{helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer};
use crate::direction::Direction; use crate::direction::Direction;
@ -102,23 +105,21 @@ unsafe extern "C" fn dns_rrtype_match(
tx: *mut c_void, _sig: *const Signature, ctx: *const SigMatchCtx, tx: *mut c_void, _sig: *const Signature, ctx: *const SigMatchCtx,
) -> c_int { ) -> c_int {
let tx = cast_pointer!(tx, DNSTransaction); let tx = cast_pointer!(tx, DNSTransaction);
let ctx = cast_pointer!(ctx, DetectUintData<u16>); let ctx = cast_pointer!(ctx, DetectUintArrayData<u16>);
if flags & Direction::ToServer as u8 != 0 { if flags & Direction::ToServer as u8 != 0 {
if let Some(request) = &tx.request { if let Some(request) = &tx.request {
for i in 0..request.queries.len() { return detect_uint_match_at_index::<DNSQueryEntry, u16>(&request.queries, ctx, |q| {
if detect_match_uint(ctx, request.queries[i].rrtype) { Some(q.rrtype)
return 1; });
}
}
} }
} else if flags & Direction::ToClient as u8 != 0 { } else if flags & Direction::ToClient as u8 != 0 {
if let Some(response) = &tx.response { if let Some(response) = &tx.response {
for i in 0..response.answers.len() { return detect_uint_match_at_index::<DNSAnswerEntry, u16>(
if detect_match_uint(ctx, response.answers[i].rrtype) { &response.answers,
return 1; ctx,
} |a| Some(a.rrtype),
} );
} }
} }
return 0; return 0;
@ -209,10 +210,10 @@ unsafe extern "C" fn dns_rcode_free(_de: *mut DetectEngineCtx, ctx: *mut c_void)
unsafe extern "C" fn dns_rrtype_parse( unsafe extern "C" fn dns_rrtype_parse(
ustr: *const std::os::raw::c_char, ustr: *const std::os::raw::c_char,
) -> *mut DetectUintData<u8> { ) -> *mut DetectUintArrayData<u16> {
let ft_name: &CStr = CStr::from_ptr(ustr); //unsafe let ft_name: &CStr = CStr::from_ptr(ustr); //unsafe
if let Ok(s) = ft_name.to_str() { if let Ok(s) = ft_name.to_str() {
if let Some(ctx) = detect_parse_uint_enum::<u16, DNSRecordType>(s) { if let Some(ctx) = detect_parse_array_uint_enum::<u16, DNSRecordType>(s) {
let boxed = Box::new(ctx); let boxed = Box::new(ctx);
return Box::into_raw(boxed) as *mut _; return Box::into_raw(boxed) as *mut _;
} }
@ -246,9 +247,8 @@ unsafe extern "C" fn dns_rrtype_setup(
} }
unsafe extern "C" fn dns_rrtype_free(_de: *mut DetectEngineCtx, ctx: *mut c_void) { unsafe extern "C" fn dns_rrtype_free(_de: *mut DetectEngineCtx, ctx: *mut c_void) {
// Just unbox... let ctx = cast_pointer!(ctx, DetectUintArrayData<u16>);
let ctx = cast_pointer!(ctx, DetectUintData<u16>); std::mem::drop(Box::from_raw(ctx));
SCDetectU16Free(ctx);
} }
unsafe extern "C" fn dns_detect_answer_name_setup( unsafe extern "C" fn dns_detect_answer_name_setup(

Loading…
Cancel
Save