bool SigTableHasKeyword(const char *keyword)
{
for (int i = 0; i < DETECT_TBLSIZE; i++) {
- if (sigmatch_table[i].flags & SIGMATCH_NOT_BUILT) {
- continue;
- }
-
const char *name = sigmatch_table[i].name;
if (name == NULL || strlen(name) == 0) {
if (name[0] == '_' || strcmp(name, "template") == 0)
continue;
- if (sigmatch_table[i].flags & SIGMATCH_NOT_BUILT) {
- printf("- %s (not built-in)\n", name);
- } else {
- printf("- %s\n", name);
- }
+ printf("- %s\n", name);
}
}
} else if (strcmp("csv", keyword) == 0) {
for (i = 0; i < size; i++) {
const char *name = sigmatch_table[i].name;
if (name != NULL && strlen(name) > 0) {
- if (sigmatch_table[i].flags & SIGMATCH_NOT_BUILT) {
- continue;
- }
if (name[0] == '_' || strcmp(name, "template") == 0)
continue;
if ((sigmatch_table[i].name != NULL) &&
strcmp(sigmatch_table[i].name, keyword) == 0) {
printf("= %s =\n", sigmatch_table[i].name);
- if (sigmatch_table[i].flags & SIGMATCH_NOT_BUILT) {
- printf("Not built-in\n");
- return TM_ECODE_FAILED;
- }
SigMultilinePrint(i, "");
return TM_ECODE_DONE;
}
#define SIGMATCH_IPONLY_COMPAT BIT_U16(1)
/** sigmatch is compatible with a decode event only rule */
#define SIGMATCH_DEONLY_COMPAT BIT_U16(2)
-/**< Flag to indicate that the signature is not built-in */
-#define SIGMATCH_NOT_BUILT BIT_U16(3)
+
+// vacancy
+
/** sigmatch may have options, so the parser should be ready to
* deal with both cases */
#define SIGMATCH_OPTIONAL_OPT BIT_U16(4)