/*
?*?!!!?XXX?DOES?NOT?USE?BUILT-IN?DETECTION?FUNCTION?XXX?!!!
?*?
?*?alert?udp?$EXTERNAL_NET?any?->?$HOME_NET?53?（msg:“BAD-TRAFFIC?BIND?named?8?dynamic?update?message?remote?dos?attempt“;?flow:to_serverestablished;??content:“|28?00?00?01?00?01|“;?offset:2;?depth:6;?metadata:policy?security-ips?drop?policy?balanced-ips?drop;?reference:cve2009-0696;?reference:url?www.isc.org/node/474;?classtype:attempted-dos;?sid:15734;?rev:1;）
?*
*/
/*
?*?Use?at?your?own?risk.
?*
?*?Copyright?（C）?2005-2008?Sourcefire?Inc.
?*?
?*?This?file?is?autogenerated?via?rules2c?by?Brian?Caswell?
?*/


#include?“sf_snort_plugin_api.h“
#include?“sf_snort_packet.h“

#include?

//#define?DEBUG
#ifdef?DEBUG
#define?DEBUG_WRAP（code）?code
#else
#define?DEBUG_WRAP（code）
#endif


/*?declare?detection?functions?*/
int?rule15734eval（void?*p）;

/*?declare?rule?data?structures?*/
/*?precompile?the?stuff?that?needs?pre-compiled?*/
/*?flow:established?to_server;?*/
static?FlowFlags?rule15734flow0?=?
{
????FLOW_ESTABLISHED|FLOW_TO_SERVER
};

static?RuleOption?rule15734option0?=
{
????OPTION_TYPE_FLOWFLAGS
????{
????????&rule15734flow0
????}
};
#ifndef?CONTENT_FAST_PATTERN
#define?CONTENT_FAST_PATTERN?0
#endif
//?content:“|28?00?00?01?00?01|“?offset?2?depth?6?fast_pattern;?
static?ContentInfo?rule15734content1?=?
{
????（u_int8_t?*）?“|28?00?00?01?00?01|“?/*?pattern?（now?in?snort?content?format）?*/
????6?/*?depth?*/
????2?/*?offset?*/
????CONTENT_FAST_PATTERN|CONTENT_BUF_RAW?/*?flags?*/
????NULL?/*?holder?for?boyer/moore?PTR?*/
????NULL?/*?more?holder?info?-?byteform?*/
????0?/*?byteform?length?*/
????0?/*?increment?length*/
};

static?RuleOption?rule15734option1?=?
{
????OPTION_TYPE_CONTENT
????{
????????&rule15734content1
????}
};

/*?references?for?sid?15734?*/
/*?reference:?cve?“2009-0696“;?*/
static?RuleReference?rule15734ref1?=?
{
????“cve“?/*?type?*/
????“2009-0696“?/*?value?*/
};

/*?reference:?url?“www.isc.org/node/474“;?*/
static?RuleReference?rule15734ref2?=?
{
????“url“?/*?type?*/
????“www.isc.org/node/474“?/*?value?*/
};

static?RuleReference?*rule15734refs[]?=
{
????&rule15734ref1
????&rule15734ref2
????NULL
};
#ifdef?HAS_metaDATA
/*?metadata?for?sid?15734?*/
/*?metadata:policy?balanced-ips?drop?policy?security-ips?drop;?*/

static?RulemetaData?rule15734policy1?=?
{
????“policy?balanced-ips?drop“
};

static?RulemetaData?rule15734policy2?=?
{
????“policy?security-ips?drop“
};

static?RulemetaData?rule15734policy3?=
{
????“service?dns“
};


static?RulemetaData?*rule15734metadata[]?=
{
????&rule15734policy1
????&rule15734policy2
????&rule15734policy3
????NULL
};
#endif

RuleOption?*rule15734options[]?=
{
????&rule15734option0
????&rule15734option1
????NULL
};

Rule?rule15734?=?{
???
???/*?rule?header?akin?to?=>?tcp?any?any?->?any?any???????????????*/{
???????IPPROTO_UDP?/*?proto?*/
???????“$EXTERNAL_NET“?/*?SRCIP?????*/
???????“any“?/*?SRCPORT???*/
???
???????0?/*?DIRECTION?*/
???????“$HOME_NET“?/*?DSTIP?????*/
???
??