detect: (m)dns keywords even with "alert udp"

Ticket: 8501

(m)dns.*.rrname keywords required the rules to start with
alert (m)dns
and refused to load if the rule started with generic alert ip or
alert udp, with error message
Error: detect-parse: invalid alproto 0

(cherry picked from commit 7e326f291a)
pull/15280/head
Philippe Antoine 3 months ago
parent e40775d68a
commit 12d4cc73f9

@ -51,12 +51,24 @@ static int mdns_answer_buffer_id = 0;
static int mdns_authority_buffer_id = 0; static int mdns_authority_buffer_id = 0;
static int mdns_additional_buffer_id = 0; static int mdns_additional_buffer_id = 0;
static int DetectSetup(DetectEngineCtx *de_ctx, Signature *s, const char *str, int id) static int DetectSetupDNS(DetectEngineCtx *de_ctx, Signature *s, const char *str, int id)
{ {
if (SCDetectBufferSetActiveList(de_ctx, s, id) < 0) { if (SCDetectBufferSetActiveList(de_ctx, s, id) < 0) {
return -1; return -1;
} }
if (SCDetectSignatureSetAppProto(s, s->alproto) < 0) { if (SCDetectSignatureSetAppProto(s, ALPROTO_DNS) < 0) {
return -1;
}
return 0;
}
static int DetectSetupMDNS(DetectEngineCtx *de_ctx, Signature *s, const char *str, int id)
{
if (SCDetectBufferSetActiveList(de_ctx, s, id) < 0) {
return -1;
}
if (SCDetectSignatureSetAppProto(s, ALPROTO_MDNS) < 0) {
return -1; return -1;
} }
@ -65,42 +77,42 @@ static int DetectSetup(DetectEngineCtx *de_ctx, Signature *s, const char *str, i
static int SetupQueryBuffer(DetectEngineCtx *de_ctx, Signature *s, const char *str) static int SetupQueryBuffer(DetectEngineCtx *de_ctx, Signature *s, const char *str)
{ {
return DetectSetup(de_ctx, s, str, query_buffer_id); return DetectSetupDNS(de_ctx, s, str, query_buffer_id);
} }
static int SetupAnswerBuffer(DetectEngineCtx *de_ctx, Signature *s, const char *str) static int SetupAnswerBuffer(DetectEngineCtx *de_ctx, Signature *s, const char *str)
{ {
return DetectSetup(de_ctx, s, str, answer_buffer_id); return DetectSetupDNS(de_ctx, s, str, answer_buffer_id);
} }
static int SetupAdditionalsBuffer(DetectEngineCtx *de_ctx, Signature *s, const char *str) static int SetupAdditionalsBuffer(DetectEngineCtx *de_ctx, Signature *s, const char *str)
{ {
return DetectSetup(de_ctx, s, str, additional_buffer_id); return DetectSetupDNS(de_ctx, s, str, additional_buffer_id);
} }
static int SetupAuthoritiesBuffer(DetectEngineCtx *de_ctx, Signature *s, const char *str) static int SetupAuthoritiesBuffer(DetectEngineCtx *de_ctx, Signature *s, const char *str)
{ {
return DetectSetup(de_ctx, s, str, authority_buffer_id); return DetectSetupDNS(de_ctx, s, str, authority_buffer_id);
} }
static int SetupQueryBufferMdns(DetectEngineCtx *de_ctx, Signature *s, const char *str) static int SetupQueryBufferMdns(DetectEngineCtx *de_ctx, Signature *s, const char *str)
{ {
return DetectSetup(de_ctx, s, str, mdns_query_buffer_id); return DetectSetupMDNS(de_ctx, s, str, mdns_query_buffer_id);
} }
static int SetupAnswerBufferMdns(DetectEngineCtx *de_ctx, Signature *s, const char *str) static int SetupAnswerBufferMdns(DetectEngineCtx *de_ctx, Signature *s, const char *str)
{ {
return DetectSetup(de_ctx, s, str, mdns_answer_buffer_id); return DetectSetupMDNS(de_ctx, s, str, mdns_answer_buffer_id);
} }
static int SetupAdditionalsBufferMdns(DetectEngineCtx *de_ctx, Signature *s, const char *str) static int SetupAdditionalsBufferMdns(DetectEngineCtx *de_ctx, Signature *s, const char *str)
{ {
return DetectSetup(de_ctx, s, str, mdns_additional_buffer_id); return DetectSetupMDNS(de_ctx, s, str, mdns_additional_buffer_id);
} }
static int SetupAuthoritiesBufferMdns(DetectEngineCtx *de_ctx, Signature *s, const char *str) static int SetupAuthoritiesBufferMdns(DetectEngineCtx *de_ctx, Signature *s, const char *str)
{ {
return DetectSetup(de_ctx, s, str, mdns_authority_buffer_id); return DetectSetupMDNS(de_ctx, s, str, mdns_authority_buffer_id);
} }
static int Register(const char *keyword, const char *desc, const char *doc, static int Register(const char *keyword, const char *desc, const char *doc,

Loading…
Cancel
Save