detect: (m)dns keywords even with "alert udp"

Ticket: 8501

(m)dns.*.rrname keywords required the rules to start with
alert (m)dns
and refused to load if the rule started with generic alert ip or
alert udp, with error message
Error: detect-parse: invalid alproto 0

(cherry picked from commit 7e326f291a)
pull/15280/head
Philippe Antoine 3 months ago
parent e40775d68a
commit 12d4cc73f9

@ -51,12 +51,24 @@ static int mdns_answer_buffer_id = 0;
static int mdns_authority_buffer_id = 0;
static int mdns_additional_buffer_id = 0;
static int DetectSetup(DetectEngineCtx *de_ctx, Signature *s, const char *str, int id)
static int DetectSetupDNS(DetectEngineCtx *de_ctx, Signature *s, const char *str, int id)
{
if (SCDetectBufferSetActiveList(de_ctx, s, id) < 0) {
return -1;
}
if (SCDetectSignatureSetAppProto(s, s->alproto) < 0) {
if (SCDetectSignatureSetAppProto(s, ALPROTO_DNS) < 0) {
return -1;
}
return 0;
}
static int DetectSetupMDNS(DetectEngineCtx *de_ctx, Signature *s, const char *str, int id)
{
if (SCDetectBufferSetActiveList(de_ctx, s, id) < 0) {
return -1;
}
if (SCDetectSignatureSetAppProto(s, ALPROTO_MDNS) < 0) {
return -1;
}
@ -65,42 +77,42 @@ static int DetectSetup(DetectEngineCtx *de_ctx, Signature *s, const char *str, i
static int SetupQueryBuffer(DetectEngineCtx *de_ctx, Signature *s, const char *str)
{
return DetectSetup(de_ctx, s, str, query_buffer_id);
return DetectSetupDNS(de_ctx, s, str, query_buffer_id);
}
static int SetupAnswerBuffer(DetectEngineCtx *de_ctx, Signature *s, const char *str)
{
return DetectSetup(de_ctx, s, str, answer_buffer_id);
return DetectSetupDNS(de_ctx, s, str, answer_buffer_id);
}
static int SetupAdditionalsBuffer(DetectEngineCtx *de_ctx, Signature *s, const char *str)
{
return DetectSetup(de_ctx, s, str, additional_buffer_id);
return DetectSetupDNS(de_ctx, s, str, additional_buffer_id);
}
static int SetupAuthoritiesBuffer(DetectEngineCtx *de_ctx, Signature *s, const char *str)
{
return DetectSetup(de_ctx, s, str, authority_buffer_id);
return DetectSetupDNS(de_ctx, s, str, authority_buffer_id);
}
static int SetupQueryBufferMdns(DetectEngineCtx *de_ctx, Signature *s, const char *str)
{
return DetectSetup(de_ctx, s, str, mdns_query_buffer_id);
return DetectSetupMDNS(de_ctx, s, str, mdns_query_buffer_id);
}
static int SetupAnswerBufferMdns(DetectEngineCtx *de_ctx, Signature *s, const char *str)
{
return DetectSetup(de_ctx, s, str, mdns_answer_buffer_id);
return DetectSetupMDNS(de_ctx, s, str, mdns_answer_buffer_id);
}
static int SetupAdditionalsBufferMdns(DetectEngineCtx *de_ctx, Signature *s, const char *str)
{
return DetectSetup(de_ctx, s, str, mdns_additional_buffer_id);
return DetectSetupMDNS(de_ctx, s, str, mdns_additional_buffer_id);
}
static int SetupAuthoritiesBufferMdns(DetectEngineCtx *de_ctx, Signature *s, const char *str)
{
return DetectSetup(de_ctx, s, str, mdns_authority_buffer_id);
return DetectSetupMDNS(de_ctx, s, str, mdns_authority_buffer_id);
}
static int Register(const char *keyword, const char *desc, const char *doc,

Loading…
Cancel
Save