aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

detect: list-keywords cli shows integers

Browse Source 
Ticket: 7875
pull/13884/head
Philippe Antoine 12 months ago committed by Victor Julien
parent 68017d3fe1
commit da486af881
34 changed files with 148 additions and 50 deletions
Show Stats Download Patch File Download Diff File

9
doc/userguide/rules/integer-keywords.rst
Unescape Escape View File

@ -22,6 +22,15 @@ case-insensitive suffix:
The most direct example is to match for equality, but there are
different modes.
The list of integer keywords can be found by command
``suricata --list-keywords=csv | grep "uint"``
Some other keywords may use unsigned integers as part of their logic:
* iprep
* stream_size
* flow.pkts
* flow.bytes
Comparison modes
----------------

5
rust/cbindgen.toml
Unescape Escape View File

@ -119,6 +119,11 @@ exclude = [
"SIGMATCH_NOOPT",
"SIGMATCH_INFO_STICKY_BUFFER",
"SIGMATCH_INFO_MULTI_BUFFER",
"SIGMATCH_INFO_UINT8",
"SIGMATCH_INFO_UINT16",
"SIGMATCH_INFO_UINT32",
"SIGMATCH_INFO_UINT64",
"SIGMATCH_INFO_MULTI_UINT",
"FtpCommand",
]

6
rust/src/detect/mod.rs
Unescape Escape View File

@ -130,6 +130,12 @@ pub(crate) const SIGMATCH_OPTIONAL_OPT: u32 = 0x10; // BIT_U16(4) in detect.h
pub(crate) const SIGMATCH_QUOTES_MANDATORY: u32 = 0x40; // BIT_U16(6) in detect.h
pub const SIGMATCH_INFO_STICKY_BUFFER: u32 = 0x200; // BIT_U16(9)
pub const SIGMATCH_INFO_MULTI_BUFFER: u32 = 0x4000; // BIT_U16(14)
pub const SIGMATCH_INFO_UINT8: u32 = 0x8000; // BIT_U32(15)
pub const SIGMATCH_INFO_UINT16: u32 = 0x10000; // BIT_U32(16)
pub const SIGMATCH_INFO_UINT32: u32 = 0x20000; // BIT_U32(17)
pub const SIGMATCH_INFO_UINT64: u32 = 0x40000; // BIT_U32(18)
pub const SIGMATCH_INFO_MULTI_UINT: u32 = 0x80000; // BIT_U32(19)
#[repr(u8)]
#[derive(Copy, Clone, Debug, PartialEq, Eq)]

7
rust/src/dhcp/detect.rs
Unescape Escape View File

@ -22,6 +22,7 @@ use super::dhcp::{
use super::parser::DHCPOptionWrapper;
use crate::core::{STREAM_TOCLIENT, STREAM_TOSERVER};
use crate::detect::uint::{DetectUintData, SCDetectU64Free, SCDetectU64Match, SCDetectU64Parse};
use crate::detect::SIGMATCH_INFO_UINT64;
use std::os::raw::{c_int, c_void};
use suricata_sys::sys::{
DetectEngineCtx, DetectEngineThreadCtx, Flow, SCDetectHelperBufferRegister,
@ -173,7 +174,7 @@ pub unsafe extern "C" fn SCDetectDHCPRegister() {
AppLayerTxMatch: Some(dhcp_detect_leasetime_match),
Setup: Some(dhcp_detect_leasetime_setup),
Free: Some(dhcp_detect_time_free),
flags: 0,
flags: SIGMATCH_INFO_UINT64,
};
G_DHCP_LEASE_TIME_KW_ID = SCDetectHelperKeywordRegister(&kw);
G_DHCP_LEASE_TIME_BUFFER_ID = SCDetectHelperBufferRegister(
@ -188,7 +189,7 @@ pub unsafe extern "C" fn SCDetectDHCPRegister() {
AppLayerTxMatch: Some(dhcp_detect_rebindingtime_match),
Setup: Some(dhcp_detect_rebindingtime_setup),
Free: Some(dhcp_detect_time_free),
flags: 0,
flags: SIGMATCH_INFO_UINT64,
};
G_DHCP_REBINDING_TIME_KW_ID = SCDetectHelperKeywordRegister(&kw);
G_DHCP_REBINDING_TIME_BUFFER_ID = SCDetectHelperBufferRegister(
@ -203,7 +204,7 @@ pub unsafe extern "C" fn SCDetectDHCPRegister() {
AppLayerTxMatch: Some(dhcp_detect_renewaltime_match),
Setup: Some(dhcp_detect_renewaltime_setup),
Free: Some(dhcp_detect_time_free),
flags: 0,
flags: SIGMATCH_INFO_UINT64,
};
G_DHCP_RENEWAL_TIME_KW_ID = SCDetectHelperKeywordRegister(&kw);
G_DHCP_RENEWAL_TIME_BUFFER_ID = SCDetectHelperBufferRegister(

11
rust/src/dns/detect.rs
Unescape Escape View File

@ -24,7 +24,10 @@ use crate::detect::uint::{
detect_uint_match_at_index, DetectUintArrayData, DetectUintData, SCDetectU16Free,
SCDetectU8Free, SCDetectU8Parse,
};
use crate::detect::{helper_keyword_register_multi_buffer, SigTableElmtStickyBuffer};
use crate::detect::{
helper_keyword_register_multi_buffer, SigTableElmtStickyBuffer, SIGMATCH_INFO_MULTI_UINT,
SIGMATCH_INFO_UINT16, SIGMATCH_INFO_UINT8,
};
use crate::direction::Direction;
use std::ffi::CStr;
use std::os::raw::{c_int, c_void};
@ -376,7 +379,7 @@ pub unsafe extern "C" fn SCDetectDNSRegister() {
AppLayerTxMatch: Some(dns_opcode_match),
Setup: Some(dns_opcode_setup),
Free: Some(dns_opcode_free),
flags: 0,
flags: SIGMATCH_INFO_UINT8,
};
G_DNS_OPCODE_KW_ID = SCDetectHelperKeywordRegister(&kw);
G_DNS_OPCODE_BUFFER_ID = SCDetectHelperBufferRegister(
@ -408,7 +411,7 @@ pub unsafe extern "C" fn SCDetectDNSRegister() {
AppLayerTxMatch: Some(dns_rcode_match),
Setup: Some(dns_rcode_setup),
Free: Some(dns_rcode_free),
flags: 0,
flags: SIGMATCH_INFO_UINT16,
};
G_DNS_RCODE_KW_ID = SCDetectHelperKeywordRegister(&kw);
G_DNS_RCODE_BUFFER_ID = SCDetectHelperBufferRegister(
@ -423,7 +426,7 @@ pub unsafe extern "C" fn SCDetectDNSRegister() {
AppLayerTxMatch: Some(dns_rrtype_match),
Setup: Some(dns_rrtype_setup),
Free: Some(dns_rrtype_free),
flags: 0,
flags: SIGMATCH_INFO_UINT16 | SIGMATCH_INFO_MULTI_UINT,
};
G_DNS_RRTYPE_KW_ID = SCDetectHelperKeywordRegister(&kw);
G_DNS_RRTYPE_BUFFER_ID = SCDetectHelperBufferRegister(

37
rust/src/enip/detect.rs
Unescape Escape View File

@ -35,7 +35,10 @@ use crate::detect::uint::{
SCDetectU16Parse, SCDetectU32Free, SCDetectU32Match, SCDetectU32Parse, SCDetectU8Free,
SCDetectU8Match, SCDetectU8Parse,
};
use crate::detect::{helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer};
use crate::detect::{
helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer, SIGMATCH_INFO_MULTI_UINT,
SIGMATCH_INFO_UINT16, SIGMATCH_INFO_UINT32, SIGMATCH_INFO_UINT8,
};
use suricata_sys::sys::{
DetectEngineCtx, DetectEngineThreadCtx, Flow, SCDetectBufferSetActiveList,
SCDetectHelperBufferMpmRegister, SCDetectHelperBufferRegister, SCDetectHelperKeywordRegister,
@ -1365,7 +1368,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() {
AppLayerTxMatch: Some(capabilities_match),
Setup: Some(capabilities_setup),
Free: Some(capabilities_free),
flags: 0,
flags: SIGMATCH_INFO_UINT16,
};
G_ENIP_CAPABILITIES_KW_ID = SCDetectHelperKeywordRegister(&kw);
G_ENIP_CAPABILITIES_BUFFER_ID = SCDetectHelperBufferRegister(
@ -1380,7 +1383,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() {
AppLayerTxMatch: Some(cip_attribute_match),
Setup: Some(cip_attribute_setup),
Free: Some(cip_attribute_free),
flags: 0,
flags: SIGMATCH_INFO_UINT32 | SIGMATCH_INFO_MULTI_UINT,
};
G_ENIP_CIP_ATTRIBUTE_KW_ID = SCDetectHelperKeywordRegister(&kw);
G_ENIP_CIP_ATTRIBUTE_BUFFER_ID = SCDetectHelperBufferRegister(
@ -1395,7 +1398,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() {
AppLayerTxMatch: Some(cip_class_match),
Setup: Some(cip_class_setup),
Free: Some(cip_class_free),
flags: 0,
flags: SIGMATCH_INFO_UINT32 | SIGMATCH_INFO_MULTI_UINT,
};
G_ENIP_CIP_CLASS_KW_ID = SCDetectHelperKeywordRegister(&kw);
G_ENIP_CIP_CLASS_BUFFER_ID = SCDetectHelperBufferRegister(
@ -1410,7 +1413,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() {
AppLayerTxMatch: Some(vendor_id_match),
Setup: Some(vendor_id_setup),
Free: Some(vendor_id_free),
flags: 0,
flags: SIGMATCH_INFO_UINT16,
};
G_ENIP_VENDOR_ID_KW_ID = SCDetectHelperKeywordRegister(&kw);
G_ENIP_VENDOR_ID_BUFFER_ID = SCDetectHelperBufferRegister(
@ -1425,7 +1428,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() {
AppLayerTxMatch: Some(status_match),
Setup: Some(status_setup),
Free: Some(status_free),
flags: 0,
flags: SIGMATCH_INFO_UINT32,
};
G_ENIP_STATUS_KW_ID = SCDetectHelperKeywordRegister(&kw);
G_ENIP_STATUS_BUFFER_ID = SCDetectHelperBufferRegister(
@ -1440,7 +1443,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() {
AppLayerTxMatch: Some(state_match),
Setup: Some(state_setup),
Free: Some(state_free),
flags: 0,
flags: SIGMATCH_INFO_UINT8,
};
G_ENIP_STATE_KW_ID = SCDetectHelperKeywordRegister(&kw);
G_ENIP_STATE_BUFFER_ID = SCDetectHelperBufferRegister(
@ -1455,7 +1458,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() {
AppLayerTxMatch: Some(serial_match),
Setup: Some(serial_setup),
Free: Some(serial_free),
flags: 0,
flags: SIGMATCH_INFO_UINT32,
};
G_ENIP_SERIAL_KW_ID = SCDetectHelperKeywordRegister(&kw);
G_ENIP_SERIAL_BUFFER_ID = SCDetectHelperBufferRegister(
@ -1470,7 +1473,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() {
AppLayerTxMatch: Some(revision_match),
Setup: Some(revision_setup),
Free: Some(revision_free),
flags: 0,
flags: SIGMATCH_INFO_UINT16,
};
G_ENIP_REVISION_KW_ID = SCDetectHelperKeywordRegister(&kw);
G_ENIP_REVISION_BUFFER_ID = SCDetectHelperBufferRegister(
@ -1485,7 +1488,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() {
AppLayerTxMatch: Some(protocol_version_match),
Setup: Some(protocol_version_setup),
Free: Some(protocol_version_free),
flags: 0,
flags: SIGMATCH_INFO_UINT16,
};
G_ENIP_PROTOCOL_VERSION_KW_ID = SCDetectHelperKeywordRegister(&kw);
G_ENIP_PROTOCOL_VERSION_BUFFER_ID = SCDetectHelperBufferRegister(
@ -1500,7 +1503,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() {
AppLayerTxMatch: Some(product_code_match),
Setup: Some(product_code_setup),
Free: Some(product_code_free),
flags: 0,
flags: SIGMATCH_INFO_UINT16,
};
G_ENIP_PRODUCT_CODE_KW_ID = SCDetectHelperKeywordRegister(&kw);
G_ENIP_PRODUCT_CODE_BUFFER_ID = SCDetectHelperBufferRegister(
@ -1515,7 +1518,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() {
AppLayerTxMatch: Some(command_match),
Setup: Some(command_setup),
Free: Some(command_free),
flags: 0,
flags: SIGMATCH_INFO_UINT16,
};
G_ENIP_COMMAND_KW_ID = SCDetectHelperKeywordRegister(&kw);
G_ENIP_COMMAND_BUFFER_ID = SCDetectHelperBufferRegister(
@ -1530,7 +1533,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() {
AppLayerTxMatch: Some(identity_status_match),
Setup: Some(identity_status_setup),
Free: Some(identity_status_free),
flags: 0,
flags: SIGMATCH_INFO_UINT16,
};
G_ENIP_IDENTITY_STATUS_KW_ID = SCDetectHelperKeywordRegister(&kw);
G_ENIP_IDENTITY_STATUS_BUFFER_ID = SCDetectHelperBufferRegister(
@ -1545,7 +1548,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() {
AppLayerTxMatch: Some(device_type_match),
Setup: Some(device_type_setup),
Free: Some(device_type_free),
flags: 0,
flags: SIGMATCH_INFO_UINT16,
};
G_ENIP_DEVICE_TYPE_KW_ID = SCDetectHelperKeywordRegister(&kw);
G_ENIP_DEVICE_TYPE_BUFFER_ID = SCDetectHelperBufferRegister(
@ -1560,7 +1563,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() {
AppLayerTxMatch: Some(cip_status_match),
Setup: Some(cip_status_setup),
Free: Some(cip_status_free),
flags: 0,
flags: SIGMATCH_INFO_UINT8 | SIGMATCH_INFO_MULTI_UINT,
};
G_ENIP_CIP_STATUS_KW_ID = SCDetectHelperKeywordRegister(&kw);
G_ENIP_CIP_STATUS_BUFFER_ID = SCDetectHelperBufferRegister(
@ -1575,7 +1578,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() {
AppLayerTxMatch: Some(cip_instance_match),
Setup: Some(cip_instance_setup),
Free: Some(cip_instance_free),
flags: 0,
flags: SIGMATCH_INFO_UINT32 | SIGMATCH_INFO_MULTI_UINT,
};
G_ENIP_CIP_INSTANCE_KW_ID = SCDetectHelperKeywordRegister(&kw);
G_ENIP_CIP_INSTANCE_BUFFER_ID = SCDetectHelperBufferRegister(
@ -1591,7 +1594,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() {
AppLayerTxMatch: Some(cip_extendedstatus_match),
Setup: Some(cip_extendedstatus_setup),
Free: Some(cip_extendedstatus_free),
flags: 0,
flags: SIGMATCH_INFO_UINT16 | SIGMATCH_INFO_MULTI_UINT,
};
G_ENIP_CIP_EXTENDEDSTATUS_KW_ID = SCDetectHelperKeywordRegister(&kw);
G_ENIP_CIP_EXTENDEDSTATUS_BUFFER_ID = SCDetectHelperBufferRegister(

10
rust/src/ldap/detect.rs
Unescape Escape View File

@ -24,7 +24,7 @@ use crate::detect::uint::{
};
use crate::detect::{
helper_keyword_register_multi_buffer, helper_keyword_register_sticky_buffer,
SigTableElmtStickyBuffer,
SigTableElmtStickyBuffer, SIGMATCH_INFO_MULTI_UINT, SIGMATCH_INFO_UINT32, SIGMATCH_INFO_UINT8,
};
use crate::ldap::types::*;
use ldap_parser::ldap::{LdapMessage, ProtocolOp};
@ -519,7 +519,7 @@ pub unsafe extern "C" fn SCDetectLdapRegister() {
AppLayerTxMatch: Some(ldap_detect_request_operation_match),
Setup: Some(ldap_detect_request_operation_setup),
Free: Some(ldap_detect_request_free),
flags: 0,
flags: SIGMATCH_INFO_UINT8,
};
G_LDAP_REQUEST_OPERATION_KW_ID = SCDetectHelperKeywordRegister(&kw);
G_LDAP_REQUEST_OPERATION_BUFFER_ID = SCDetectHelperBufferRegister(
@ -535,7 +535,7 @@ pub unsafe extern "C" fn SCDetectLdapRegister() {
AppLayerTxMatch: Some(ldap_detect_responses_operation_match),
Setup: Some(ldap_detect_responses_operation_setup),
Free: Some(ldap_detect_responses_free),
flags: 0,
flags: SIGMATCH_INFO_UINT8 | SIGMATCH_INFO_MULTI_UINT,
};
G_LDAP_RESPONSES_OPERATION_KW_ID = SCDetectHelperKeywordRegister(&kw);
G_LDAP_RESPONSES_OPERATION_BUFFER_ID = SCDetectHelperBufferRegister(
@ -550,7 +550,7 @@ pub unsafe extern "C" fn SCDetectLdapRegister() {
AppLayerTxMatch: Some(ldap_detect_responses_count_match),
Setup: Some(ldap_detect_responses_count_setup),
Free: Some(ldap_detect_responses_count_free),
flags: 0,
flags: SIGMATCH_INFO_UINT32,
};
G_LDAP_RESPONSES_COUNT_KW_ID = SCDetectHelperKeywordRegister(&kw);
G_LDAP_RESPONSES_COUNT_BUFFER_ID = SCDetectHelperBufferRegister(
@ -594,7 +594,7 @@ pub unsafe extern "C" fn SCDetectLdapRegister() {
AppLayerTxMatch: Some(ldap_detect_responses_result_code_match),
Setup: Some(ldap_detect_responses_result_code_setup),
Free: Some(ldap_detect_responses_result_code_free),
flags: 0,
flags: SIGMATCH_INFO_UINT32 | SIGMATCH_INFO_MULTI_UINT,
};
G_LDAP_RESPONSES_RESULT_CODE_KW_ID = SCDetectHelperKeywordRegister(&kw);
G_LDAP_RESPONSES_RESULT_CODE_BUFFER_ID = SCDetectHelperBufferRegister(

12
rust/src/mqtt/detect.rs
Unescape Escape View File

@ -24,7 +24,7 @@ use crate::detect::uint::{
};
use crate::detect::{
helper_keyword_register_multi_buffer, helper_keyword_register_sticky_buffer,
SigTableElmtStickyBuffer,
SigTableElmtStickyBuffer, SIGMATCH_INFO_MULTI_UINT, SIGMATCH_INFO_UINT8,
};
use suricata_sys::sys::{
DetectEngineCtx, DetectEngineThreadCtx, Flow, SCDetectBufferSetActiveList,
@ -1011,7 +1011,7 @@ pub unsafe extern "C" fn SCDetectMqttRegister() {
AppLayerTxMatch: Some(mqtt_type_match),
Setup: Some(mqtt_type_setup),
Free: Some(mqtt_type_free),
flags: 0,
flags: SIGMATCH_INFO_UINT8 | SIGMATCH_INFO_MULTI_UINT,
};
G_MQTT_TYPE_KW_ID = SCDetectHelperKeywordRegister(&kw);
G_MQTT_TYPE_BUFFER_ID = SCDetectHelperBufferRegister(
@ -1051,7 +1051,7 @@ pub unsafe extern "C" fn SCDetectMqttRegister() {
AppLayerTxMatch: Some(mqtt_reason_code_match),
Setup: Some(mqtt_reason_code_setup),
Free: Some(mqtt_reason_code_free),
flags: 0,
flags: SIGMATCH_INFO_UINT8 | SIGMATCH_INFO_MULTI_UINT,
};
G_MQTT_REASON_CODE_KW_ID = SCDetectHelperKeywordRegister(&kw);
G_MQTT_REASON_CODE_BUFFER_ID = SCDetectHelperBufferRegister(
@ -1126,7 +1126,7 @@ pub unsafe extern "C" fn SCDetectMqttRegister() {
AppLayerTxMatch: Some(mqtt_protocol_version_match),
Setup: Some(mqtt_protocol_version_setup),
Free: Some(mqtt_protocol_version_free),
flags: 0,
flags: SIGMATCH_INFO_UINT8,
};
G_MQTT_PROTOCOL_VERSION_KW_ID = SCDetectHelperKeywordRegister(&kw);
G_MQTT_PROTOCOL_VERSION_BUFFER_ID = SCDetectHelperBufferRegister(
@ -1141,7 +1141,7 @@ pub unsafe extern "C" fn SCDetectMqttRegister() {
AppLayerTxMatch: Some(mqtt_flags_match),
Setup: Some(mqtt_flags_setup),
Free: Some(mqtt_flags_free),
flags: 0,
flags: SIGMATCH_INFO_UINT8 | SIGMATCH_INFO_MULTI_UINT,
};
G_MQTT_FLAGS_KW_ID = SCDetectHelperKeywordRegister(&kw);
G_MQTT_FLAGS_BUFFER_ID = SCDetectHelperBufferRegister(
@ -1156,7 +1156,7 @@ pub unsafe extern "C" fn SCDetectMqttRegister() {
AppLayerTxMatch: Some(mqtt_conn_flags_match),
Setup: Some(mqtt_conn_flags_setup),
Free: Some(mqtt_conn_flags_free),
flags: 0,
flags: SIGMATCH_INFO_UINT8 | SIGMATCH_INFO_MULTI_UINT,
};
G_MQTT_CONN_FLAGS_KW_ID = SCDetectHelperKeywordRegister(&kw);
G_MQTT_CONN_FLAGS_BUFFER_ID = SCDetectHelperBufferRegister(

8
rust/src/rfb/detect.rs
Unescape Escape View File

@ -23,7 +23,9 @@ use crate::core::{STREAM_TOCLIENT, STREAM_TOSERVER};
use crate::detect::uint::{
detect_match_uint, detect_parse_uint_enum, DetectUintData, SCDetectU32Free, SCDetectU32Parse,
};
use crate::detect::{helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer};
use crate::detect::{
helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer, SIGMATCH_INFO_UINT32,
};
use std::ffi::CStr;
use std::os::raw::{c_int, c_void};
use std::ptr;
@ -203,7 +205,7 @@ pub unsafe extern "C" fn SCDetectRfbRegister() {
AppLayerTxMatch: Some(rfb_sec_type_match),
Setup: Some(rfb_sec_type_setup),
Free: Some(rfb_sec_type_free),
flags: 0,
flags: SIGMATCH_INFO_UINT32,
};
G_RFB_SEC_TYPE_KW_ID = SCDetectHelperKeywordRegister(&kw);
G_RFB_SEC_TYPE_BUFFER_ID = SCDetectHelperBufferRegister(
@ -218,7 +220,7 @@ pub unsafe extern "C" fn SCDetectRfbRegister() {
AppLayerTxMatch: Some(rfb_sec_result_match),
Setup: Some(rfb_sec_result_setup),
Free: Some(rfb_sec_result_free),
flags: 0,
flags: SIGMATCH_INFO_UINT32,
};
G_RFB_SEC_RESULT_KW_ID = SCDetectHelperKeywordRegister(&kw);
G_RFB_SEC_RESULT_BUFFER_ID = SCDetectHelperBufferRegister(

6
rust/src/snmp/detect.rs
Unescape Escape View File

@ -20,7 +20,7 @@
use super::snmp::{SNMPTransaction, ALPROTO_SNMP};
use crate::core::{STREAM_TOCLIENT, STREAM_TOSERVER};
use crate::detect::uint::{DetectUintData, SCDetectU32Free, SCDetectU32Match, SCDetectU32Parse};
use crate::detect::{helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer};
use crate::detect::{helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer, SIGMATCH_INFO_UINT32};
use std::os::raw::{c_int, c_void};
use suricata_sys::sys::{
DetectEngineCtx, DetectEngineThreadCtx, Flow, SCDetectBufferSetActiveList,
@ -176,7 +176,7 @@ pub(super) unsafe extern "C" fn detect_snmp_register() {
AppLayerTxMatch: Some(snmp_detect_version_match),
Setup: Some(snmp_detect_version_setup),
Free: Some(snmp_detect_version_free),
flags: 0,
flags: SIGMATCH_INFO_UINT32,
};
G_SNMP_VERSION_KW_ID = SCDetectHelperKeywordRegister(&kw);
G_SNMP_VERSION_BUFFER_ID = SCDetectHelperBufferRegister(
@ -192,7 +192,7 @@ pub(super) unsafe extern "C" fn detect_snmp_register() {
AppLayerTxMatch: Some(snmp_detect_pdutype_match),
Setup: Some(snmp_detect_pdutype_setup),
Free: Some(snmp_detect_pdutype_free),
flags: 0,
flags: SIGMATCH_INFO_UINT32,
};
G_SNMP_PDUTYPE_KW_ID = SCDetectHelperKeywordRegister(&kw);
G_SNMP_PDUTYPE_BUFFER_ID = SCDetectHelperBufferRegister(

11
rust/src/websocket/detect.rs
Unescape Escape View File

@ -21,7 +21,10 @@ use crate::detect::uint::{
detect_parse_uint, detect_parse_uint_enum, DetectUintData, DetectUintMode, SCDetectU32Free,
SCDetectU32Match, SCDetectU32Parse, SCDetectU8Free, SCDetectU8Match,
};
use crate::detect::{helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer};
use crate::detect::{
helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer, SIGMATCH_INFO_UINT32,
SIGMATCH_INFO_UINT8,
};
use crate::websocket::parser::WebSocketOpcode;
use suricata_sys::sys::{
DetectEngineCtx, DetectEngineThreadCtx, Flow, SCDetectBufferSetActiveList,
@ -273,7 +276,7 @@ pub unsafe extern "C" fn SCDetectWebsocketRegister() {
AppLayerTxMatch: Some(websocket_detect_opcode_match),
Setup: Some(websocket_detect_opcode_setup),
Free: Some(websocket_detect_opcode_free),
flags: 0,
flags: SIGMATCH_INFO_UINT8,
};
G_WEBSOCKET_OPCODE_KW_ID = SCDetectHelperKeywordRegister(&kw);
G_WEBSOCKET_OPCODE_BUFFER_ID = SCDetectHelperBufferRegister(
@ -288,7 +291,7 @@ pub unsafe extern "C" fn SCDetectWebsocketRegister() {
AppLayerTxMatch: Some(websocket_detect_mask_match),
Setup: Some(websocket_detect_mask_setup),
Free: Some(websocket_detect_mask_free),
flags: 0,
flags: SIGMATCH_INFO_UINT32,
};
G_WEBSOCKET_MASK_KW_ID = SCDetectHelperKeywordRegister(&kw);
G_WEBSOCKET_MASK_BUFFER_ID = SCDetectHelperBufferRegister(
@ -303,7 +306,7 @@ pub unsafe extern "C" fn SCDetectWebsocketRegister() {
AppLayerTxMatch: Some(websocket_detect_flags_match),
Setup: Some(websocket_detect_flags_setup),
Free: Some(websocket_detect_flags_free),
flags: 0,
flags: SIGMATCH_INFO_UINT8,
};
G_WEBSOCKET_FLAGS_KW_ID = SCDetectHelperKeywordRegister(&kw);
G_WEBSOCKET_FLAGS_BUFFER_ID = SCDetectHelperBufferRegister(

2
src/detect-bsize.c
Unescape Escape View File

@ -105,7 +105,7 @@ void DetectBsizeRegister(void)
sigmatch_table[DETECT_BSIZE].Match = NULL;
sigmatch_table[DETECT_BSIZE].Setup = DetectBsizeSetup;
sigmatch_table[DETECT_BSIZE].Free = DetectBsizeFree;
sigmatch_table[DETECT_BSIZE].flags = SIGMATCH_SUPPORT_FIREWALL;
sigmatch_table[DETECT_BSIZE].flags = SIGMATCH_SUPPORT_FIREWALL | SIGMATCH_INFO_UINT64;
#ifdef UNITTESTS
sigmatch_table[DETECT_BSIZE].RegisterTests = DetectBsizeRegisterTests;
#endif

2
src/detect-dsize.c
Unescape Escape View File

@ -66,7 +66,7 @@ void DetectDsizeRegister (void)
sigmatch_table[DETECT_DSIZE].Match = DetectDsizeMatch;
sigmatch_table[DETECT_DSIZE].Setup = DetectDsizeSetup;
sigmatch_table[DETECT_DSIZE].Free = DetectDsizeFree;
sigmatch_table[DETECT_DSIZE].flags = SIGMATCH_SUPPORT_FIREWALL;
sigmatch_table[DETECT_DSIZE].flags = SIGMATCH_SUPPORT_FIREWALL | SIGMATCH_INFO_UINT16;
#ifdef UNITTESTS
sigmatch_table[DETECT_DSIZE].RegisterTests = DsizeRegisterTests;
#endif

32
src/detect-engine-register.c
Unescape Escape View File

@ -335,6 +335,38 @@ static void PrintFeatureList(const SigTableElmt *e, char sep)
printf("multi buffer");
prev = 1;
}
if (flags & SIGMATCH_INFO_UINT8) {
if (prev == 1)
printf("%c", sep);
if (flags & SIGMATCH_INFO_MULTI_UINT)
printf("multi ");
printf("uint8");
prev = 1;
}
if (flags & SIGMATCH_INFO_UINT16) {
if (prev == 1)
printf("%c", sep);
if (flags & SIGMATCH_INFO_MULTI_UINT)
printf("multi ");
printf("uint16");
prev = 1;
}
if (flags & SIGMATCH_INFO_UINT32) {
if (prev == 1)
printf("%c", sep);
if (flags & SIGMATCH_INFO_MULTI_UINT)
printf("multi ");
printf("uint32");
prev = 1;
}
if (flags & SIGMATCH_INFO_UINT64) {
if (prev == 1)
printf("%c", sep);
if (flags & SIGMATCH_INFO_MULTI_UINT)
printf("multi ");
printf("uint64");
prev = 1;
}
if (e->Transform) {
if (prev == 1)
printf("%c", sep);

3
src/detect-filesize.c
Unescape Escape View File

@ -66,7 +66,8 @@ void DetectFilesizeRegister(void)
sigmatch_table[DETECT_FILESIZE].FileMatch = DetectFilesizeMatch;
sigmatch_table[DETECT_FILESIZE].Setup = DetectFilesizeSetup;
sigmatch_table[DETECT_FILESIZE].Free = DetectFilesizeFree;
sigmatch_table[DETECT_FILESIZE].flags = SIGMATCH_SUPPORT_DIR;
sigmatch_table[DETECT_FILESIZE].flags =
SIGMATCH_SUPPORT_DIR | SIGMATCH_INFO_UINT64 | SIGMATCH_INFO_MULTI_UINT;
#ifdef UNITTESTS
sigmatch_table[DETECT_FILESIZE].RegisterTests = DetectFilesizeRegisterTests;
#endif

1
src/detect-flow-age.c
Unescape Escape View File

@ -94,6 +94,7 @@ void DetectFlowAgeRegister(void)
sigmatch_table[DETECT_FLOW_AGE].Match = DetectFlowAgeMatch;
sigmatch_table[DETECT_FLOW_AGE].Setup = DetectFlowAgeSetup;
sigmatch_table[DETECT_FLOW_AGE].Free = DetectFlowAgeFree;
sigmatch_table[DETECT_FLOW_AGE].flags = SIGMATCH_INFO_UINT32;
sigmatch_table[DETECT_FLOW_AGE].SupportsPrefilter = PrefilterFlowAgeIsPrefilterable;
sigmatch_table[DETECT_FLOW_AGE].SetupPrefilter = PrefilterSetupFlowAge;
}

4
src/detect-flow-pkts.c
Unescape Escape View File

@ -173,6 +173,7 @@ void DetectFlowPktsToServerRegister(void)
sigmatch_table[DETECT_FLOW_PKTS_TO_SERVER].Match = DetectFlowPktsMatch;
sigmatch_table[DETECT_FLOW_PKTS_TO_SERVER].Setup = DetectFlowPktsToServerSetup;
sigmatch_table[DETECT_FLOW_PKTS_TO_SERVER].Free = DetectFlowPktsFree;
sigmatch_table[DETECT_FLOW_PKTS_TO_SERVER].flags = SIGMATCH_INFO_UINT32;
sigmatch_table[DETECT_FLOW_PKTS_TO_SERVER].SupportsPrefilter = PrefilterFlowPktsIsPrefilterable;
sigmatch_table[DETECT_FLOW_PKTS_TO_SERVER].SetupPrefilter = PrefilterSetupFlowPkts;
}
@ -186,6 +187,7 @@ void DetectFlowPktsToClientRegister(void)
sigmatch_table[DETECT_FLOW_PKTS_TO_CLIENT].Match = DetectFlowPktsMatch;
sigmatch_table[DETECT_FLOW_PKTS_TO_CLIENT].Setup = DetectFlowPktsToClientSetup;
sigmatch_table[DETECT_FLOW_PKTS_TO_CLIENT].Free = DetectFlowPktsFree;
sigmatch_table[DETECT_FLOW_PKTS_TO_CLIENT].flags = SIGMATCH_INFO_UINT32;
sigmatch_table[DETECT_FLOW_PKTS_TO_CLIENT].SupportsPrefilter = PrefilterFlowPktsIsPrefilterable;
sigmatch_table[DETECT_FLOW_PKTS_TO_CLIENT].SetupPrefilter = PrefilterSetupFlowPkts;
}
@ -287,6 +289,7 @@ void DetectFlowBytesToServerRegister(void)
sigmatch_table[DETECT_FLOW_BYTES_TO_SERVER].Match = DetectFlowBytesMatch;
sigmatch_table[DETECT_FLOW_BYTES_TO_SERVER].Setup = DetectFlowBytesToServerSetup;
sigmatch_table[DETECT_FLOW_BYTES_TO_SERVER].Free = DetectFlowBytesFree;
sigmatch_table[DETECT_FLOW_BYTES_TO_SERVER].flags = SIGMATCH_INFO_UINT64;
}
void DetectFlowBytesToClientRegister(void)
@ -298,4 +301,5 @@ void DetectFlowBytesToClientRegister(void)
sigmatch_table[DETECT_FLOW_BYTES_TO_CLIENT].Match = DetectFlowBytesMatch;
sigmatch_table[DETECT_FLOW_BYTES_TO_CLIENT].Setup = DetectFlowBytesToClientSetup;
sigmatch_table[DETECT_FLOW_BYTES_TO_CLIENT].Free = DetectFlowBytesFree;
sigmatch_table[DETECT_FLOW_BYTES_TO_CLIENT].flags = SIGMATCH_INFO_UINT64;
}

1
src/detect-ftp-dynamic-port.c
Unescape Escape View File

@ -103,6 +103,7 @@ void DetectFtpDynamicPortRegister(void)
sigmatch_table[DETECT_FTP_DYNPORT].url = "/rules/" KEYWORD_DOC;
sigmatch_table[DETECT_FTP_DYNPORT].Setup = DetectFtpDynamicPortSetup;
sigmatch_table[DETECT_FTP_DYNPORT].Free = DetectFtpDynamicPortFree;
sigmatch_table[DETECT_FTP_DYNPORT].flags = SIGMATCH_INFO_UINT16;
sigmatch_table[DETECT_FTP_DYNPORT].AppLayerTxMatch = DetectFtpDynamicPortMatch;
DetectAppLayerInspectEngineRegister(

4
src/detect-http2.c
Unescape Escape View File

@ -132,6 +132,8 @@ void DetectHttp2Register(void)
sigmatch_table[DETECT_HTTP2_PRIORITY].AppLayerTxMatch = DetectHTTP2priorityMatch;
sigmatch_table[DETECT_HTTP2_PRIORITY].Setup = DetectHTTP2prioritySetup;
sigmatch_table[DETECT_HTTP2_PRIORITY].Free = DetectHTTP2priorityFree;
sigmatch_table[DETECT_HTTP2_PRIORITY].flags =
SIGMATCH_INFO_UINT8 | SIGMATCH_INFO_MULTI_UINT | SIGMATCH_INFO_MULTI_UINT;
#ifdef UNITTESTS
sigmatch_table[DETECT_HTTP2_PRIORITY].RegisterTests = DetectHTTP2priorityRegisterTests;
#endif
@ -143,6 +145,7 @@ void DetectHttp2Register(void)
sigmatch_table[DETECT_HTTP2_WINDOW].AppLayerTxMatch = DetectHTTP2windowMatch;
sigmatch_table[DETECT_HTTP2_WINDOW].Setup = DetectHTTP2windowSetup;
sigmatch_table[DETECT_HTTP2_WINDOW].Free = DetectHTTP2windowFree;
sigmatch_table[DETECT_HTTP2_WINDOW].flags = SIGMATCH_INFO_UINT32 | SIGMATCH_INFO_MULTI_UINT;
#ifdef UNITTESTS
sigmatch_table[DETECT_HTTP2_WINDOW].RegisterTests = DetectHTTP2windowRegisterTests;
#endif
@ -154,6 +157,7 @@ void DetectHttp2Register(void)
sigmatch_table[DETECT_HTTP2_SIZEUPDATE].AppLayerTxMatch = DetectHTTP2sizeUpdateMatch;
sigmatch_table[DETECT_HTTP2_SIZEUPDATE].Setup = DetectHTTP2sizeUpdateSetup;
sigmatch_table[DETECT_HTTP2_SIZEUPDATE].Free = DetectHTTP2sizeUpdateFree;
sigmatch_table[DETECT_HTTP2_SIZEUPDATE].flags = SIGMATCH_INFO_UINT64;
#ifdef UNITTESTS
sigmatch_table[DETECT_HTTP2_SIZEUPDATE].RegisterTests = DetectHTTP2sizeUpdateRegisterTests;
#endif

1
src/detect-icmpv6-mtu.c
Unescape Escape View File

@ -53,6 +53,7 @@ void DetectICMPv6mtuRegister(void)
sigmatch_table[DETECT_ICMPV6MTU].Match = DetectICMPv6mtuMatch;
sigmatch_table[DETECT_ICMPV6MTU].Setup = DetectICMPv6mtuSetup;
sigmatch_table[DETECT_ICMPV6MTU].Free = DetectICMPv6mtuFree;
sigmatch_table[DETECT_ICMPV6MTU].flags = SIGMATCH_INFO_UINT32;
#ifdef UNITTESTS
sigmatch_table[DETECT_ICMPV6MTU].RegisterTests = DetectICMPv6mtuRegisterTests;
#endif

1
src/detect-icode.c
Unescape Escape View File

@ -70,6 +70,7 @@ void DetectICodeRegister (void)
#endif
sigmatch_table[DETECT_ICODE].SupportsPrefilter = PrefilterICodeIsPrefilterable;
sigmatch_table[DETECT_ICODE].SetupPrefilter = PrefilterSetupICode;
sigmatch_table[DETECT_ICODE].flags = SIGMATCH_SUPPORT_FIREWALL | SIGMATCH_INFO_UINT8;
}
/**

1
src/detect-ike-exch-type.c
Unescape Escape View File

@ -56,6 +56,7 @@ void DetectIkeExchTypeRegister(void)
sigmatch_table[DETECT_IKE_EXCH_TYPE].AppLayerTxMatch = DetectIkeExchTypeMatch;
sigmatch_table[DETECT_IKE_EXCH_TYPE].Setup = DetectIkeExchTypeSetup;
sigmatch_table[DETECT_IKE_EXCH_TYPE].Free = DetectIkeExchTypeFree;
sigmatch_table[DETECT_IKE_EXCH_TYPE].flags = SIGMATCH_INFO_UINT8;
DetectAppLayerInspectEngineRegister("ike.exchtype", ALPROTO_IKE, SIG_FLAG_TOSERVER, 1,
DetectEngineInspectGenericList, NULL);

1
src/detect-ike-key-exchange-payload-length.c
Unescape Escape View File

@ -59,6 +59,7 @@ void DetectIkeKeyExchangePayloadLengthRegister(void)
DetectIkeKeyExchangePayloadLengthSetup;
sigmatch_table[DETECT_IKE_KEY_EXCHANGE_PAYLOAD_LENGTH].Free =
DetectIkeKeyExchangePayloadLengthFree;
sigmatch_table[DETECT_IKE_KEY_EXCHANGE_PAYLOAD_LENGTH].flags = SIGMATCH_INFO_UINT32;
DetectAppLayerInspectEngineRegister("ike.key_exchange_payload_length", ALPROTO_IKE,
SIG_FLAG_TOSERVER, 1, DetectEngineInspectGenericList, NULL);

1
src/detect-ike-nonce-payload-length.c
Unescape Escape View File

@ -56,6 +56,7 @@ void DetectIkeNoncePayloadLengthRegister(void)
DetectIkeNoncePayloadLengthMatch;
sigmatch_table[DETECT_IKE_NONCE_PAYLOAD_LENGTH].Setup = DetectIkeNoncePayloadLengthSetup;
sigmatch_table[DETECT_IKE_NONCE_PAYLOAD_LENGTH].Free = DetectIkeNoncePayloadLengthFree;
sigmatch_table[DETECT_IKE_NONCE_PAYLOAD_LENGTH].flags = SIGMATCH_INFO_UINT32;
DetectAppLayerInspectEngineRegister("ike.nonce_payload_length", ALPROTO_IKE, SIG_FLAG_TOSERVER,
1, DetectEngineInspectGenericList, NULL);

2
src/detect-itype.c
Unescape Escape View File

@ -62,7 +62,7 @@ void DetectITypeRegister (void)
sigmatch_table[DETECT_ITYPE].Match = DetectITypeMatch;
sigmatch_table[DETECT_ITYPE].Setup = DetectITypeSetup;
sigmatch_table[DETECT_ITYPE].Free = DetectITypeFree;
sigmatch_table[DETECT_ITYPE].flags = SIGMATCH_SUPPORT_FIREWALL;
sigmatch_table[DETECT_ITYPE].flags = SIGMATCH_SUPPORT_FIREWALL | SIGMATCH_INFO_UINT8;
#ifdef UNITTESTS
sigmatch_table[DETECT_ITYPE].RegisterTests = DetectITypeRegisterTests;
#endif

1
src/detect-nfs-procedure.c
Unescape Escape View File

@ -70,6 +70,7 @@ void DetectNfsProcedureRegister (void)
sigmatch_table[DETECT_NFS_PROCEDURE].AppLayerTxMatch = DetectNfsProcedureMatch;
sigmatch_table[DETECT_NFS_PROCEDURE].Setup = DetectNfsProcedureSetup;
sigmatch_table[DETECT_NFS_PROCEDURE].Free = DetectNfsProcedureFree;
sigmatch_table[DETECT_NFS_PROCEDURE].flags = SIGMATCH_INFO_UINT32 | SIGMATCH_INFO_MULTI_UINT;
#ifdef UNITTESTS
sigmatch_table[DETECT_NFS_PROCEDURE].RegisterTests = DetectNfsProcedureRegisterTests;
#endif

1
src/detect-nfs-version.c
Unescape Escape View File

@ -68,6 +68,7 @@ void DetectNfsVersionRegister (void)
sigmatch_table[DETECT_NFS_VERSION].AppLayerTxMatch = DetectNfsVersionMatch;
sigmatch_table[DETECT_NFS_VERSION].Setup = DetectNfsVersionSetup;
sigmatch_table[DETECT_NFS_VERSION].Free = DetectNfsVersionFree;
sigmatch_table[DETECT_NFS_VERSION].flags = SIGMATCH_INFO_UINT32;
// unit tests were the same as DetectNfsProcedureRegisterTests
g_nfs_request_buffer_id = DetectBufferTypeGetByName("nfs_request");

2
src/detect-tcp-wscale.c
Unescape Escape View File

@ -54,7 +54,7 @@ void DetectTcpWscaleRegister(void)
sigmatch_table[DETECT_TCP_WSCALE].Free = DetectTcpWscaleFree;
sigmatch_table[DETECT_TCP_WSCALE].SupportsPrefilter = PrefilterTcpWscaleIsPrefilterable;
sigmatch_table[DETECT_TCP_WSCALE].SetupPrefilter = PrefilterSetupTcpWscale;
sigmatch_table[DETECT_TCP_WSCALE].flags = SIGMATCH_SUPPORT_FIREWALL;
sigmatch_table[DETECT_TCP_WSCALE].flags = SIGMATCH_SUPPORT_FIREWALL | SIGMATCH_INFO_UINT8;
sigmatch_table[DETECT_TCP_WSCALE].tables =
(DETECT_TABLE_PACKET_PRE_FLOW_FLAG | DETECT_TABLE_PACKET_PRE_STREAM_FLAG |
DETECT_TABLE_PACKET_FILTER_FLAG | DETECT_TABLE_PACKET_TD_FLAG);

1
src/detect-tcpmss.c
Unescape Escape View File

@ -56,6 +56,7 @@ void DetectTcpmssRegister(void)
sigmatch_table[DETECT_TCPMSS].Match = DetectTcpmssMatch;
sigmatch_table[DETECT_TCPMSS].Setup = DetectTcpmssSetup;
sigmatch_table[DETECT_TCPMSS].Free = DetectTcpmssFree;
sigmatch_table[DETECT_TCPMSS].flags = SIGMATCH_INFO_UINT16;
sigmatch_table[DETECT_TCPMSS].SupportsPrefilter = PrefilterTcpmssIsPrefilterable;
sigmatch_table[DETECT_TCPMSS].SetupPrefilter = PrefilterSetupTcpmss;
}

1
src/detect-template2.c
Unescape Escape View File

@ -58,6 +58,7 @@ void DetectTemplate2Register(void)
sigmatch_table[DETECT_TEMPLATE2].Free = DetectTemplate2Free;
sigmatch_table[DETECT_TEMPLATE2].SupportsPrefilter = PrefilterTemplate2IsPrefilterable;
sigmatch_table[DETECT_TEMPLATE2].SetupPrefilter = PrefilterSetupTemplate2;
sigmatch_table[DETECT_TEMPLATE2].flags = SIGMATCH_INFO_UINT8;
}
/**

1
src/detect-tls-certs.c
Unescape Escape View File

@ -243,6 +243,7 @@ void DetectTlsCertChainLenRegister(void)
sigmatch_table[KEYWORD_ID].AppLayerTxMatch = DetectTLSCertChainLenMatch;
sigmatch_table[KEYWORD_ID].Setup = DetectTLSCertChainLenSetup;
sigmatch_table[KEYWORD_ID].Free = DetectTLSCertChainLenFree;
sigmatch_table[KEYWORD_ID].flags = SIGMATCH_INFO_UINT32;
g_tls_cert_buffer_id = DetectBufferTypeGetByName(BUFFER_NAME);
}

1
src/detect-ttl.c
Unescape Escape View File

@ -64,6 +64,7 @@ void DetectTtlRegister(void)
#endif
sigmatch_table[DETECT_TTL].SupportsPrefilter = PrefilterTtlIsPrefilterable;
sigmatch_table[DETECT_TTL].SetupPrefilter = PrefilterSetupTtl;
sigmatch_table[DETECT_TTL].flags = SIGMATCH_INFO_UINT8;
}
/**

2
src/detect-vlan.c
Unescape Escape View File

@ -137,6 +137,7 @@ void DetectVlanIdRegister(void)
sigmatch_table[DETECT_VLAN_ID].Match = DetectVlanIdMatch;
sigmatch_table[DETECT_VLAN_ID].Setup = DetectVlanIdSetup;
sigmatch_table[DETECT_VLAN_ID].Free = DetectVlanIdFree;
sigmatch_table[DETECT_VLAN_ID].flags = SIGMATCH_INFO_UINT16 | SIGMATCH_INFO_MULTI_UINT;
sigmatch_table[DETECT_VLAN_ID].SupportsPrefilter = PrefilterVlanIdIsPrefilterable;
sigmatch_table[DETECT_VLAN_ID].SetupPrefilter = PrefilterSetupVlanId;
}
@ -216,4 +217,5 @@ void DetectVlanLayersRegister(void)
sigmatch_table[DETECT_VLAN_LAYERS].Free = DetectVlanLayersFree;
sigmatch_table[DETECT_VLAN_LAYERS].SupportsPrefilter = PrefilterVlanLayersIsPrefilterable;
sigmatch_table[DETECT_VLAN_LAYERS].SetupPrefilter = PrefilterSetupVlanLayers;
sigmatch_table[DETECT_VLAN_LAYERS].flags = SIGMATCH_INFO_UINT8;
}

10
src/detect.h
Unescape Escape View File

@ -1682,6 +1682,16 @@ typedef struct SigGroupHead_ {
#define SIGMATCH_SUPPORT_DIR BIT_U32(13)
/** keyword is a multi buffer */
#define SIGMATCH_INFO_MULTI_BUFFER BIT_U32(14)
/** keyword is a unsigned 8-bit integer */
#define SIGMATCH_INFO_UINT8 BIT_U32(15)
/** keyword is a unsigned 16-bit integer */
#define SIGMATCH_INFO_UINT16 BIT_U32(16)
/** keyword is a unsigned 32-bit integer */
#define SIGMATCH_INFO_UINT32 BIT_U32(17)
/** keyword is a unsigned 64-bit integer */
#define SIGMATCH_INFO_UINT64 BIT_U32(18)
/** keyword is a multi uint */
#define SIGMATCH_INFO_MULTI_UINT BIT_U32(19)
enum DetectEngineTenantSelectors
{

Write Preview
Loading…
Cancel
Save