OISF/suricata
1
0
Fork 0
mirror of https://github.com/OISF/suricata.git synced 2026-10-12 02:07:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

dns/doc: list possible values for enum keywords

Browse Source 
Ticket: 8675
This commit is contained in:
Philippe Antoine
2026-10-08 13:08:20 +00:00
committed by Victor Julien
parent 895347aff2
commit b8275da9d0
2 changed files with 23 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/userguide/rules/dns-keywords.rst
+4
View File
@@ -51,6 +51,8 @@ This keyword matches on the **rcode** field found in the DNS header flags.
dns.rcode uses an :ref:`unsigned 8-bit integer <rules-integer-keywords>`.
It can also be specified by text from the enumeration.
See ``suricata --list-keywords=json | jq '."dns.rcode".enum_values'``
Currently, Suricata only supports rcode values in the range [0-15], while
the current DNS version supports rcode values from [0-23] as specified in
`RFC 6895 <https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-6>`_.
@@ -86,6 +88,8 @@ dns.rrtype uses an :ref:`unsigned 16-bit integer <rules-integer-keywords>`.
dns.rrtype is also a :ref:`multi-integer <multi-integers>`.
See ``suricata --list-keywords=json | jq '."dns.rrtype".enum_values'``
It can also be specified by text from the enumeration.
Syntax
rust/src/dns/detect.rs
+19 -5
View File
@@ -25,20 +25,21 @@ use crate::detect::uint::{
SCDetectU8Free, SCDetectU8Parse,
};
use crate::detect::{
helper_keyword_register_multi_buffer, SigTableElmtStickyBuffer, SIGMATCH_INFO_ENUM_UINT,
SIGMATCH_INFO_MULTI_UINT, SIGMATCH_INFO_UINT16, SIGMATCH_INFO_UINT8,
helper_keyword_register_multi_buffer, EnumString, SigTableElmtStickyBuffer,
SIGMATCH_INFO_ENUM_UINT, SIGMATCH_INFO_MULTI_UINT, SIGMATCH_INFO_UINT16, SIGMATCH_INFO_UINT8,
};
use crate::direction::Direction;
use crate::http2::http2::{HTTP2TxProgress, HTTP2TxType};
use crate::jsonbuilder::JsonBuilder;
use std::ffi::CStr;
use std::os::raw::{c_int, c_void};
use suricata_sys::sys::{
AppProtoEnum, DetectEngineCtx, DetectEngineThreadCtx, Flow, SCDetectBufferSetActiveList,
SCDetectHelperBufferProgressRegister, SCDetectHelperBufferProgressRegisterSubState,
SCDetectHelperKeywordAliasRegister, SCDetectHelperKeywordRegister,
SCDetectHelperMultiBufferProgressMpmRegister,
SCDetectHelperKeywordAliasRegister, SCDetectHelperKeywordJsonInfoRegister,
SCDetectHelperKeywordRegister, SCDetectHelperMultiBufferProgressMpmRegister,
SCDetectHelperMultiBufferProgressMpmRegisterSubState, SCDetectSignatureSetAppProto,
SCSigMatchAppendSMToList, SCSigTableAppLiteElmt, SigMatchCtx, Signature,
SCJsonBuilder, SCSigMatchAppendSMToList, SCSigTableAppLiteElmt, SigMatchCtx, Signature,
SIGMATCH_SUPPORT_FIREWALL,
};
@@ -358,6 +359,16 @@ unsafe extern "C" fn dns_detect_query_setup(
return 0;
}
unsafe extern "C" fn dns_rcode_list_values(jsb: *mut SCJsonBuilder) {
let jsb = cast_pointer!(jsb, JsonBuilder);
let _ = DNSRcode::list_values(jsb);
}
unsafe extern "C" fn dns_rrtype_list_values(jsb: *mut SCJsonBuilder) {
let jsb = cast_pointer!(jsb, JsonBuilder);
let _ = DNSRecordType::list_values(jsb);
}
#[no_mangle]
pub unsafe extern "C" fn SCDetectDNSRegister() {
let kw = SigTableElmtStickyBuffer {
@@ -452,6 +463,8 @@ pub unsafe extern "C" fn SCDetectDNSRegister() {
flags: SIGMATCH_INFO_UINT16 | SIGMATCH_INFO_ENUM_UINT,
};
G_DNS_RCODE_KW_ID = SCDetectHelperKeywordRegister(&kw);
SCDetectHelperKeywordJsonInfoRegister(G_DNS_RCODE_KW_ID, Some(dns_rcode_list_values));
G_DNS_RCODE_BUFFER_ID = SCDetectHelperBufferProgressRegister(
b"dns.rcode\0".as_ptr() as *const libc::c_char,
ALPROTO_DNS,
@@ -476,6 +489,7 @@ pub unsafe extern "C" fn SCDetectDNSRegister() {
flags: SIGMATCH_INFO_UINT16 | SIGMATCH_INFO_MULTI_UINT | SIGMATCH_INFO_ENUM_UINT,
};
G_DNS_RRTYPE_KW_ID = SCDetectHelperKeywordRegister(&kw);
SCDetectHelperKeywordJsonInfoRegister(G_DNS_RRTYPE_KW_ID, Some(dns_rrtype_list_values));
G_DNS_RRTYPE_BUFFER_ID = SCDetectHelperBufferProgressRegister(
b"dns.rrtype\0".as_ptr() as *const libc::c_char,
ALPROTO_DNS,