From 0073ea2189d04691dbea1ed779e5d31aee01666a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fran=C3=A7ois=20De=20Keersmaeker?=
 <francois.dekeersmaeker@uclouvain.be>
Date: Fri, 29 Nov 2024 10:57:04 +0100
Subject: [PATCH] Support for DNS subdomains

---
 dns.py | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

diff --git a/dns.py b/dns.py
index dd0d0ae..6ccbcfd 100644
--- a/dns.py
+++ b/dns.py
@@ -24,15 +24,12 @@ class dns(Custom):
         """
         if domain_name.startswith(dns.WILDCARD):
             suffix = domain_name[len(dns.WILDCARD):]
-            return {
-                "template": f"dns_contains_suffix_domain_name(dns_message.questions, dns_message.header.qdcount, \"{{}}\", {len(suffix)})",
-                "match": suffix
-            }
         else:
-            return {
-                "template": "dns_contains_full_domain_name(dns_message.questions, dns_message.header.qdcount, \"{}\")",
-                "match": domain_name
-            }
+            suffix = domain_name.split('.', 1)[1]
+        return {
+            "template": f"dns_contains_suffix_domain_name(dns_message.questions, dns_message.header.qdcount, \"{{}}\", {len(suffix)})",
+            "match": suffix
+        }
 
 
     def parse(self, is_backward: bool = False, initiator: str = "src") -> dict:
-- 
GitLab