|
|
|
@ -249,14 +249,14 @@ typedef struct DetectPort_ {
|
|
|
|
#define SIG_FLAG_HAS_TARGET (SIG_FLAG_DEST_IS_TARGET|SIG_FLAG_SRC_IS_TARGET)
|
|
|
|
#define SIG_FLAG_HAS_TARGET (SIG_FLAG_DEST_IS_TARGET|SIG_FLAG_SRC_IS_TARGET)
|
|
|
|
|
|
|
|
|
|
|
|
/* signature init flags */
|
|
|
|
/* signature init flags */
|
|
|
|
#define SIG_FLAG_INIT_DEONLY (1<<0) /**< decode event only signature */
|
|
|
|
#define SIG_FLAG_INIT_DEONLY BIT_U32(0) /**< decode event only signature */
|
|
|
|
#define SIG_FLAG_INIT_PACKET (1<<1) /**< signature has matches against a packet (as opposed to app layer) */
|
|
|
|
#define SIG_FLAG_INIT_PACKET BIT_U32(1) /**< signature has matches against a packet (as opposed to app layer) */
|
|
|
|
#define SIG_FLAG_INIT_FLOW (1<<2) /**< signature has a flow setting */
|
|
|
|
#define SIG_FLAG_INIT_FLOW BIT_U32(2) /**< signature has a flow setting */
|
|
|
|
#define SIG_FLAG_INIT_BIDIREC (1<<3) /**< signature has bidirectional operator */
|
|
|
|
#define SIG_FLAG_INIT_BIDIREC BIT_U32(3) /**< signature has bidirectional operator */
|
|
|
|
#define SIG_FLAG_INIT_FIRST_IPPROTO_SEEN (1<<4) /** < signature has seen the first ip_proto keyword */
|
|
|
|
#define SIG_FLAG_INIT_FIRST_IPPROTO_SEEN BIT_U32(4) /** < signature has seen the first ip_proto keyword */
|
|
|
|
#define SIG_FLAG_INIT_HAS_TRANSFORM (1<<5)
|
|
|
|
#define SIG_FLAG_INIT_HAS_TRANSFORM BIT_U32(5)
|
|
|
|
#define SIG_FLAG_INIT_STATE_MATCH (1<<6) /**< signature has matches that require stateful inspection */
|
|
|
|
#define SIG_FLAG_INIT_STATE_MATCH BIT_U32(6) /**< signature has matches that require stateful inspection */
|
|
|
|
#define SIG_FLAG_INIT_NEED_FLUSH (1<<7)
|
|
|
|
#define SIG_FLAG_INIT_NEED_FLUSH BIT_U32(7)
|
|
|
|
|
|
|
|
|
|
|
|
/* signature mask flags */
|
|
|
|
/* signature mask flags */
|
|
|
|
/** \note: additions should be added to the rule analyzer as well */
|
|
|
|
/** \note: additions should be added to the rule analyzer as well */
|
|
|
|
|