forked from OISF/suricata
-
Notifications
You must be signed in to change notification settings - Fork 2
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
dns: add keywords for additionals and authorities names
Add keywords dns.additionals.name and dns.authorities.name. Along the way, consolidate dns.query.name and dns.answer.name into a single file and register them altogether since there is a lot of common code.
- Loading branch information
Showing
9 changed files
with
198 additions
and
236 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file was deleted.
Oops, something went wrong.
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,142 @@ | ||
| /* Copyright (C) 2025 Open Information Security Foundation | ||
| * | ||
| * You can copy, redistribute or modify this Program under the terms of | ||
| * the GNU General Public License version 2 as published by the Free | ||
| * Software Foundation. | ||
| * | ||
| * This program is distributed in the hope that it will be useful, | ||
| * but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
| * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
| * GNU General Public License for more details. | ||
| * | ||
| * You should have received a copy of the GNU General Public License | ||
| * version 2 along with this program; if not, write to the Free Software | ||
| * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA | ||
| * 02110-1301, USA. | ||
| */ | ||
|
|
||
| /** | ||
| * \file | ||
| * | ||
| * Detect keyword for DNS names: | ||
| * - dns.answer.name | ||
| * - dns.authorities.name | ||
| * - dns.additionals.name | ||
| */ | ||
|
|
||
| #include "detect.h" | ||
| #include "detect-parse.h" | ||
| #include "detect-engine.h" | ||
| #include "detect-engine-content-inspection.h" | ||
| #include "detect-engine-helper.h" | ||
| #include "detect-dns-name.h" | ||
| #include "rust.h" | ||
|
|
||
| static int query_buffer_id = 0; | ||
| static int answer_buffer_id = 0; | ||
| static int authority_buffer_id = 0; | ||
| static int additional_buffer_id = 0; | ||
|
|
||
| static int DetectSetup(DetectEngineCtx *de_ctx, Signature *s, const char *str, int id) | ||
| { | ||
| if (DetectBufferSetActiveList(de_ctx, s, id) < 0) { | ||
| return -1; | ||
| } | ||
| if (DetectSignatureSetAppProto(s, ALPROTO_DNS) < 0) { | ||
| return -1; | ||
| } | ||
|
|
||
| return 0; | ||
| } | ||
|
|
||
| static int SetupQueryBuffer(DetectEngineCtx *de_ctx, Signature *s, const char *str) | ||
| { | ||
| return DetectSetup(de_ctx, s, str, query_buffer_id); | ||
| } | ||
|
|
||
| static int SetupAnswerBuffer(DetectEngineCtx *de_ctx, Signature *s, const char *str) | ||
| { | ||
| return DetectSetup(de_ctx, s, str, answer_buffer_id); | ||
| } | ||
|
|
||
| static int SetupAdditionalsBuffer(DetectEngineCtx *de_ctx, Signature *s, const char *str) | ||
| { | ||
| return DetectSetup(de_ctx, s, str, additional_buffer_id); | ||
| } | ||
|
|
||
| static int SetupAuthoritiesBuffer(DetectEngineCtx *de_ctx, Signature *s, const char *str) | ||
| { | ||
| return DetectSetup(de_ctx, s, str, authority_buffer_id); | ||
| } | ||
|
|
||
| static InspectionBuffer *GetBuffer(DetectEngineThreadCtx *det_ctx, | ||
| const DetectEngineTransforms *transforms, Flow *f, uint8_t flags, void *txv, int list_id, | ||
| uint32_t index) | ||
| { | ||
| InspectionBuffer *buffer = InspectionBufferMultipleForListGet(det_ctx, list_id, index); | ||
| if (buffer == NULL) { | ||
| return NULL; | ||
| } | ||
| if (buffer->initialized) { | ||
| return buffer; | ||
| } | ||
|
|
||
| bool to_client = (flags & STREAM_TOSERVER) == 0; | ||
| const uint8_t *data = NULL; | ||
| uint32_t data_len = 0; | ||
|
|
||
| bool ok = false; | ||
| if (list_id == query_buffer_id) { | ||
| ok = SCDnsTxGetQueryName(txv, to_client, index, &data, &data_len); | ||
| } else if (list_id == answer_buffer_id) { | ||
| ok = SCDnsTxGetAnswerName(txv, to_client, index, &data, &data_len); | ||
| } else if (list_id == authority_buffer_id) { | ||
| ok = SCDnsTxGetAuthorityName(txv, index, &data, &data_len); | ||
| } else if (list_id == additional_buffer_id) { | ||
| ok = SCDnsTxGetAdditionalName(txv, index, &data, &data_len); | ||
| } else { | ||
| BUG_ON("invalid list id"); | ||
| } | ||
|
|
||
| if (ok) { | ||
| InspectionBufferSetupMulti(buffer, transforms, data, data_len); | ||
| buffer->flags = DETECT_CI_FLAGS_SINGLE; | ||
| return buffer; | ||
| } | ||
|
|
||
| InspectionBufferSetupMultiEmpty(buffer); | ||
| return NULL; | ||
| } | ||
|
|
||
| static int Register(const char *keyword, const char *desc, const char *doc, | ||
| int (*Setup)(DetectEngineCtx *, Signature *, const char *)) | ||
| { | ||
| int keyword_id = SCDetectHelperNewKeywordId(); | ||
| sigmatch_table[keyword_id].name = keyword; | ||
| sigmatch_table[keyword_id].desc = desc; | ||
| sigmatch_table[keyword_id].url = doc; | ||
| sigmatch_table[keyword_id].Setup = Setup; | ||
| sigmatch_table[keyword_id].flags |= SIGMATCH_NOOPT; | ||
| sigmatch_table[keyword_id].flags |= SIGMATCH_INFO_STICKY_BUFFER; | ||
|
|
||
| DetectAppLayerMultiRegister(keyword, ALPROTO_DNS, SIG_FLAG_TOSERVER, 0, GetBuffer, 2, 1); | ||
| DetectAppLayerMultiRegister(keyword, ALPROTO_DNS, SIG_FLAG_TOCLIENT, 0, GetBuffer, 2, 1); | ||
|
|
||
| DetectBufferTypeSetDescriptionByName(keyword, keyword); | ||
| DetectBufferTypeSupportsMultiInstance(keyword); | ||
|
|
||
| return DetectBufferTypeGetByName(keyword); | ||
| } | ||
|
|
||
| void DetectDnsNameRegister(void) | ||
| { | ||
| query_buffer_id = Register("dns.query.name", "DNS query name sticky buffer", | ||
| "/rules/dns-keywords.html#dns-query-name", SetupQueryBuffer); | ||
| answer_buffer_id = Register("dns.answer.name", "DNS answer name sticky buffer", | ||
| "/rules/dns-keywords.html#dns-answer-name", SetupAnswerBuffer); | ||
| additional_buffer_id = | ||
| Register("dns.additionals.rrname", "DNS additionals rrname sticky buffer", | ||
| "/rules/dns-keywords.html#dns-additionals-rrname", SetupAdditionalsBuffer); | ||
| authority_buffer_id = Register("dns.authorities.rrname", "DNS authorities rrname sticky buffer", | ||
| "/rules/dns-keywords.html#dns-authorities-rrname", SetupAuthoritiesBuffer); | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.