From 0073ea2189d04691dbea1ed779e5d31aee01666a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fran=C3=A7ois=20De=20Keersmaeker?=
<francois.dekeersmaeker@uclouvain.be>
Date: Fri, 29 Nov 2024 10:57:04 +0100
Subject: [PATCH] Support for DNS subdomains
---
dns.py | 13 +++++--------
1 file changed, 5 insertions(+), 8 deletions(-)
diff --git a/dns.py b/dns.py
index dd0d0ae..6ccbcfd 100644
--- a/dns.py
+++ b/dns.py
@@ -24,15 +24,12 @@ class dns(Custom):
"""
if domain_name.startswith(dns.WILDCARD):
suffix = domain_name[len(dns.WILDCARD):]
- return {
- "template": f"dns_contains_suffix_domain_name(dns_message.questions, dns_message.header.qdcount, \"{{}}\", {len(suffix)})",
- "match": suffix
- }
else:
- return {
- "template": "dns_contains_full_domain_name(dns_message.questions, dns_message.header.qdcount, \"{}\")",
- "match": domain_name
- }
+ suffix = domain_name.split('.', 1)[1]
+ return {
+ "template": f"dns_contains_suffix_domain_name(dns_message.questions, dns_message.header.qdcount, \"{{}}\", {len(suffix)})",
+ "match": suffix
+ }
def parse(self, is_backward: bool = False, initiator: str = "src") -> dict:
--
GitLab