[dns] extend filt.peg

This commit is contained in:
Manuel Meitinger 2022-04-24 18:20:52 +02:00
parent ffca36cf9b
commit afdd3db07c
4 changed files with 400 additions and 361 deletions

View file

@ -388,7 +388,7 @@ class FUrl(_Rex):
if isinstance(f, http.HTTPFlow):
return self.re.search(f.request.pretty_url)
elif isinstance(f, dns.DNSFlow):
return self.re.search(f.request.questions[0].name)
return f.request.questions and self.re.search(f.request.questions[0].name)
class FSrc(_Rex):

File diff suppressed because one or more lines are too long

File diff suppressed because it is too large Load diff

View file

@ -122,6 +122,12 @@ function domain(regex){
return domainFilter;
}
// ~dns
function dnsFilter(flow){
return flow.type === "dns";
}
dnsFilter.desc = "is a DNS Flow";
// ~dst
function destination(regex){
regex = new RegExp(regex, "i");
@ -292,6 +298,10 @@ function contentType(regex){
function url(regex){
regex = new RegExp(regex, "i");
function urlFilter(flow){
if (flow.type === "dns") {
const question = flow.request?.questions[0]
return question && regex.test(question.name)
}
return flow.request && regex.test(flowutils.RequestUtils.pretty_url(flow.request));
}
urlFilter.desc = "url matches " + regex;
@ -347,6 +357,7 @@ Expr
/ "~c" ws+ s:IntegerLiteral { return responseCode(s); }
/ "~comment" ws+ s:StringLiteral { return comment(s); }
/ "~d" ws+ s:StringLiteral { return domain(s); }
/ "~dns" { return dnsFilter; }
/ "~dst" ws+ s:StringLiteral { return destination(s); }
/ "~e" { return errorFilter; }
/ "~h" ws+ s:StringLiteral { return header(s); }