-
Notifications
You must be signed in to change notification settings - Fork 43
/
dns.go
47 lines (41 loc) · 988 Bytes
/
dns.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
package match
import (
"github.com/google/gopacket/layers"
"github.com/yaklang/yaklang/common/suricata/data/modifier"
"github.com/yaklang/yaklang/common/yak/yaklib/codec"
)
// match dns
func dnsParser(c *matchContext) error {
dns := c.PK.Layer(layers.LayerTypeDNS)
if !c.Must(dns != nil) {
return nil
}
c.SetBufferProvider(func(mdf modifier.Modifier) []byte {
switch mdf {
case modifier.DNSQuery:
return dns.(*layers.DNS).Questions[0].Name
case modifier.Default:
return dns.LayerContents()
}
return nil
})
return nil
}
func dnsMatcher(c *matchContext) error {
if !c.Must(c.Rule.ContentRuleConfig != nil) {
return nil
}
// dns match
dns := c.PK.Layer(layers.LayerTypeDNS)
if !c.Must(dns != nil) {
return nil
}
if c.Rule.ContentRuleConfig.DNS != nil {
if !c.Must(negIf(c.Rule.ContentRuleConfig.DNS.OpcodeNegative,
codec.Atoi(string(dns.(*layers.DNS).OpCode)) == c.Rule.ContentRuleConfig.DNS.Opcode,
)) {
return nil
}
}
return nil
}