I think you need to use "proto" here, as this func can be called by both ALPROTO_DNS_TCP and _UDP.