aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

dns: rename type so it's purpose is more clear

Browse Source
pull/1600/head
Victor Julien 11 years ago
parent a1e50b3138
commit 2c8e8c2516
12 changed files with 24 additions and 24 deletions
Show Stats Download Patch File Download Diff File

2
src/detect-dns-query.c
Unescape Escape View File

@ -93,7 +93,7 @@ void DetectDnsQueryRegister (void)
static int DetectDnsQuerySetup(DetectEngineCtx *de_ctx, Signature *s, char *str)
{
s->list = DETECT_SM_LIST_DNSQUERY_MATCH;
s->list = DETECT_SM_LIST_DNSQUERYNAME_MATCH;
s->alproto = ALPROTO_DNS;
return 0;
}

2
src/detect-engine-analyzer.c
Unescape Escape View File

@ -476,7 +476,7 @@ static void EngineAnalysisRulesPrintFP(Signature *s)
fprintf(rule_engine_analysis_FD, "http stat msg content");
else if (list_type == DETECT_SM_LIST_HUADMATCH)
fprintf(rule_engine_analysis_FD, "http user agent content");
else if (list_type == DETECT_SM_LIST_DNSQUERY_MATCH)
else if (list_type == DETECT_SM_LIST_DNSQUERYNAME_MATCH)
fprintf(rule_engine_analysis_FD, "dns query name content");
fprintf(rule_engine_analysis_FD, "\" buffer.\n");

2
src/detect-engine-dns.c
Unescape Escape View File

@ -84,7 +84,7 @@ int DetectEngineInspectDnsQueryName(ThreadVars *tv,
//PrintRawDataFp(stdout, buffer, buffer_len);
r = DetectEngineContentInspection(de_ctx, det_ctx,
s, s->sm_lists[DETECT_SM_LIST_DNSQUERY_MATCH],
s, s->sm_lists[DETECT_SM_LIST_DNSQUERYNAME_MATCH],
f, buffer, buffer_len, 0,
DETECT_ENGINE_CONTENT_INSPECTION_MODE_DNSQUERY, NULL);
if (r == 1)

6
src/detect-engine-mpm.c
Unescape Escape View File

@ -1496,7 +1496,7 @@ static void PopulateMpmAddPatternToMpm(DetectEngineCtx *de_ctx,
case DETECT_SM_LIST_HUADMATCH:
case DETECT_SM_LIST_HHHDMATCH:
case DETECT_SM_LIST_HRHHDMATCH:
case DETECT_SM_LIST_DNSQUERY_MATCH:
case DETECT_SM_LIST_DNSQUERYNAME_MATCH:
{
MpmCtx *mpm_ctx_ts = NULL;
MpmCtx *mpm_ctx_tc = NULL;
@ -1605,7 +1605,7 @@ static void PopulateMpmAddPatternToMpm(DetectEngineCtx *de_ctx,
s->flags |= SIG_FLAG_MPM_APPLAYER;
if (cd->flags & DETECT_CONTENT_NEGATED)
s->flags |= SIG_FLAG_MPM_APPLAYER_NEG;
} else if (sm_list == DETECT_SM_LIST_DNSQUERY_MATCH) {
} else if (sm_list == DETECT_SM_LIST_DNSQUERYNAME_MATCH) {
if (s->flags & SIG_FLAG_TOSERVER)
mpm_ctx_ts = sgh->mpm_dnsquery_ctx_ts;
if (s->flags & SIG_FLAG_TOCLIENT)
@ -2078,7 +2078,7 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh)
has_co_hrhhd = 1;
}
if (s->sm_lists[DETECT_SM_LIST_DNSQUERY_MATCH] != NULL) {
if (s->sm_lists[DETECT_SM_LIST_DNSQUERYNAME_MATCH] != NULL) {
has_co_dnsquery = 1;
}
}

2
src/detect-engine-state.h
Unescape Escape View File

@ -74,7 +74,7 @@
#define DE_STATE_FLAG_FILE_TS_INSPECT (1 << 14)
#define DE_STATE_FLAG_FULL_INSPECT (1 << 15)
#define DE_STATE_FLAG_SIG_CANT_MATCH (1 << 16)
#define DE_STATE_FLAG_DNSQUERY_INSPECT (1 << 17)
#define DE_STATE_FLAG_DNSQUERYNAME_INSPECT (1 << 17)
#define DE_STATE_FLAG_APP_EVENT_INSPECT (1 << 18)
#define DE_STATE_FLAG_MODBUS_INSPECT (1 << 19)
#define DE_STATE_FLAG_HRL_INSPECT (1 << 20)

12
src/detect-engine.c
Unescape Escape View File

@ -232,8 +232,8 @@ void DetectEngineRegisterAppInspectionEngines(void)
/* DNS */
{ IPPROTO_TCP,
ALPROTO_DNS,
DETECT_SM_LIST_DNSQUERY_MATCH,
DE_STATE_FLAG_DNSQUERY_INSPECT,
DETECT_SM_LIST_DNSQUERYNAME_MATCH,
DE_STATE_FLAG_DNSQUERYNAME_INSPECT,
0,
DetectEngineInspectDnsQueryName },
/* specifically for UDP, register again
@ -241,8 +241,8 @@ void DetectEngineRegisterAppInspectionEngines(void)
* in the detection engine */
{ IPPROTO_UDP,
ALPROTO_DNS,
DETECT_SM_LIST_DNSQUERY_MATCH,
DE_STATE_FLAG_DNSQUERY_INSPECT,
DETECT_SM_LIST_DNSQUERYNAME_MATCH,
DE_STATE_FLAG_DNSQUERYNAME_INSPECT,
0,
DetectEngineInspectDnsQueryName },
{ IPPROTO_TCP,
@ -1852,8 +1852,8 @@ const char *DetectSigmatchListEnumToString(enum DetectSigmatchListEnum type)
case DETECT_SM_LIST_FILEMATCH:
return "file";
case DETECT_SM_LIST_DNSQUERY_MATCH:
return "dns query";
case DETECT_SM_LIST_DNSQUERYNAME_MATCH:
return "dns query name";
case DETECT_SM_LIST_MODBUS_MATCH:
return "modbus";

6
src/detect-fast-pattern.c
Unescape Escape View File

@ -134,7 +134,7 @@ void SupportFastPatternForSigMatchTypes(void)
SupportFastPatternForSigMatchList(DETECT_SM_LIST_HSCDMATCH, 3);
SupportFastPatternForSigMatchList(DETECT_SM_LIST_HSMDMATCH, 3);
SupportFastPatternForSigMatchList(DETECT_SM_LIST_DNSQUERY_MATCH, 2);
SupportFastPatternForSigMatchList(DETECT_SM_LIST_DNSQUERYNAME_MATCH, 2);
#if 0
SCFPSupportSMList *tmp = sm_fp_support_smlist_list;
@ -225,7 +225,7 @@ static int DetectFastPatternSetup(DetectEngineCtx *de_ctx, Signature *s, char *a
s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH] == NULL &&
s->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH] == NULL &&
s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH] == NULL &&
s->sm_lists_tail[DETECT_SM_LIST_DNSQUERY_MATCH] == NULL) {
s->sm_lists_tail[DETECT_SM_LIST_DNSQUERYNAME_MATCH] == NULL) {
SCLogWarning(SC_WARN_COMPATIBILITY, "fast_pattern found inside the "
"rule, without a preceding content based keyword. "
"Currently we provide fast_pattern support for content, "
@ -252,7 +252,7 @@ static int DetectFastPatternSetup(DetectEngineCtx *de_ctx, Signature *s, char *a
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH],
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH],
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH],
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_DNSQUERY_MATCH]);
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_DNSQUERYNAME_MATCH]);
if (pm == NULL) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "fast_pattern found inside "
"the rule, without a content context. Please use a "

6
src/detect-isdataat.c
Unescape Escape View File

@ -1087,17 +1087,17 @@ static int DetectIsdataatTestParse16(void)
}
s = de_ctx->sig_list;
if (s->sm_lists_tail[DETECT_SM_LIST_DNSQUERY_MATCH] == NULL) {
if (s->sm_lists_tail[DETECT_SM_LIST_DNSQUERYNAME_MATCH] == NULL) {
printf("dns_query list empty: ");
goto end;
}
if (s->sm_lists_tail[DETECT_SM_LIST_DNSQUERY_MATCH]->type != DETECT_ISDATAAT) {
if (s->sm_lists_tail[DETECT_SM_LIST_DNSQUERYNAME_MATCH]->type != DETECT_ISDATAAT) {
printf("last dns_query body sm not isdataat: ");
goto end;
}
data = (DetectIsdataatData *)s->sm_lists_tail[DETECT_SM_LIST_DNSQUERY_MATCH]->ctx;
data = (DetectIsdataatData *)s->sm_lists_tail[DETECT_SM_LIST_DNSQUERYNAME_MATCH]->ctx;
if ( !(data->flags & ISDATAAT_RELATIVE) ||
(data->flags & ISDATAAT_RAWBYTES) ||
!(data->flags & ISDATAAT_NEGATED) ) {

2
src/detect-lua.c
Unescape Escape View File

@ -1044,7 +1044,7 @@ static int DetectLuaSetup (DetectEngineCtx *de_ctx, Signature *s, char *str)
else
SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_HRLMATCH);
} else if (luajit->alproto == ALPROTO_DNS) {
SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_DNSQUERY_MATCH);
SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_DNSQUERYNAME_MATCH);
} else {
SCLogError(SC_ERR_LUA_ERROR, "luajit can't be used with protocol %s",
AppLayerGetProtoName(luajit->alproto));

2
src/detect-parse.c
Unescape Escape View File

@ -1478,7 +1478,7 @@ static Signature *SigInitHelper(DetectEngineCtx *de_ctx, char *sigstr,
sig->flags |= SIG_FLAG_STATE_MATCH;
if (sig->sm_lists[DETECT_SM_LIST_HRHHDMATCH])
sig->flags |= SIG_FLAG_STATE_MATCH;
if (sig->sm_lists[DETECT_SM_LIST_DNSQUERY_MATCH])
if (sig->sm_lists[DETECT_SM_LIST_DNSQUERYNAME_MATCH])
sig->flags |= SIG_FLAG_STATE_MATCH;
if (sig->sm_lists[DETECT_SM_LIST_MODBUS_MATCH])
sig->flags |= SIG_FLAG_STATE_MATCH;

4
src/detect-pcre.c
Unescape Escape View File

@ -686,8 +686,8 @@ static int DetectPcreSetup (DetectEngineCtx *de_ctx, Signature *s, char *regexst
AppLayerHtpEnableResponseBodyCallback();
} else if (s->list == DETECT_SM_LIST_DMATCH) {
SCLogDebug("adding to dmatch list because of dce_stub_data");
} else if (s->list == DETECT_SM_LIST_DNSQUERY_MATCH) {
SCLogDebug("adding to DETECT_SM_LIST_DNSQUERY_MATCH list because of dns_query");
} else if (s->list == DETECT_SM_LIST_DNSQUERYNAME_MATCH) {
SCLogDebug("adding to DETECT_SM_LIST_DNSQUERYNAME_MATCH list because of dns_query");
}
s->flags |= SIG_FLAG_APPLAYER;
sm_list = s->list;

2
src/detect.h
Unescape Escape View File

@ -120,7 +120,7 @@ enum DetectSigmatchListEnum {
DETECT_SM_LIST_FILEMATCH,
DETECT_SM_LIST_DNSQUERY_MATCH,
DETECT_SM_LIST_DNSQUERYNAME_MATCH,
DETECT_SM_LIST_MODBUS_MATCH,
/* list for post match actions: flowbit set, flowint increment, etc */

Write Preview
Loading…
Cancel
Save