The way this worked prior to the change that permitted multiple loggers per
app layer protocol the update didn't depend on the app layer protocol, so I
chose to run everything through one or the other DNS protocols. I chose
ALPROTO_DNS_UDP.  I was a bit worried if there was some breakage somewhere
if I passed proto.

I'll try the change and do some regression testing to make sure nothing
breaks, although I'm not sure I've got any pcaps that mix DNS over UDP and
DNS over TCP to really check the combinations.


On Mon, Nov 18, 2013 at 2:23 PM, Victor Julien <notifications@github.com>wrote:

> In src/output-dnslog.c:
>
> > +        DNSTransaction *tx = NULL;
> > +        for (; tx_id < total_txs; tx_id++)
> > +        {
> > +            tx = AppLayerGetTx(proto, dns_state, tx_id);
> > +            if (tx == NULL)
> > +                continue;
> > +
> > +            DNSQueryEntry *query = NULL;
> > +            TAILQ_FOREACH(query, &tx->query_list, next) {
> > +                LogQuery(aft, js, /*timebuf, dstip, srcip, dp, sp, proto_s,*/ tx, query);
> > +            }
> > +
> > +            LogAnswers(aft, js, /*timebuf, srcip, dstip, sp, dp, proto_s,*/ tx);
> > +
> > +            SCLogDebug("calling AppLayerTransactionUpdateLoggedId");
> > +            AppLayerTransactionUpdateLogId(ALPROTO_DNS_UDP, p->flow);
>
> I think you need to use "proto" here, as this func can be called by both
> ALPROTO_DNS_TCP and _UDP.
>
> —
> Reply to this email directly or view it on GitHub<https://github.com/inliniac/suricata/pull/629/files#r7724776>
> .
>