mirror of https://github.com/OISF/suricata
dns: better error handling when parsing names
The DNS name parser will error out with an error even if the error is incomplete. Instead of manually generating errors, use '?' to let the nom error ripple up the error handling chain. The reason this wasn't done in the first place is this code predates the ? operator, or we were not aware of it at the time. This prevents the case where probing fails when there is enough data to parse the header, but not enough to complete name parser. In such a case a parse error is returned (instead of incomplete) resulting in the payload not being detected as DNS. Ticket #5034pull/7282/head
parent
27679a12aa
commit
0623ada24d
Loading…
Reference in New Issue