+local dns = require("suricata.dns")
+
function init (args)
local needs = {}
- needs["dns.rrname"] = tostring(true)
+ needs["dns.request"] = true
return needs
end
function match(args)
- rrname = tostring(args["dns.rrname"])
+ local tx = dns.get_tx()
+ local rrname = tx:rrname()
if rrname == "www.suricata-ids.org" then
return 1
end
local base64 = require("suricata.base64")
+local dns = require("suricata.dns")
local rrname = "www.suricata-ids.org"
local expected_base64 = "d3d3LnN1cmljYXRhLWlkcy5vcmc="
function init (args)
local needs = {}
- needs["dns.rrname"] = tostring(true)
+ needs["dns.request"] = true
return needs
end
function match(args)
- rrname = tostring(args["dns.rrname"])
+ local tx = dns.get_tx()
+ local rrname = tx:rrname()
encoded = base64.encode(rrname)
if encoded ~= expected_base64 then
local hashlib = require("suricata.hashlib")
+local dns = require("suricata.dns")
local expected_sha256 = "080bdfdfcd8c2c7fce747f9be4603ced6253caac70894ad89d605309588c60f6"
local expected_sha1 = "00f495ffd50c8b5ef3645f61486dae496db0fe2e"
local expected_md5 = "27170ec0609347c6a158bb5b694822a5"
function init (args)
- local needs = {}
- needs["dns.rrname"] = tostring(true)
- return needs
+ return {["dns.request"] = true}
end
local function tohex(str)
end
function match(args)
- rrname = tostring(args["dns.rrname"])
+ local tx = dns.get_tx()
+ local rrname = tx:rrname()
if not test_sha256(rrname) then
SCLogError("test_sha256 failed")