sigmatch_table[DETECT_BASE64_DECODE].RegisterTests =
DetectBase64DecodeRegisterTests;
- sigmatch_table[DETECT_BASE64_DECODE].flags |= SIGMATCH_PAYLOAD;
sigmatch_table[DETECT_BASE64_DECODE].flags |= SIGMATCH_OPTIONAL_OPT;
DetectSetupParseRegexes(decode_pattern, &decode_pcre, &decode_pcre_study);
sigmatch_table[DETECT_BYTE_EXTRACT].Free = DetectByteExtractFree;
sigmatch_table[DETECT_BYTE_EXTRACT].RegisterTests = DetectByteExtractRegisterTests;
- sigmatch_table[DETECT_BYTE_EXTRACT].flags |= SIGMATCH_PAYLOAD;
-
DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study);
}
sigmatch_table[DETECT_BYTEJUMP].Free = DetectBytejumpFree;
sigmatch_table[DETECT_BYTEJUMP].RegisterTests = DetectBytejumpRegisterTests;
- sigmatch_table[DETECT_BYTEJUMP].flags |= SIGMATCH_PAYLOAD;
-
DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study);
}
sigmatch_table[DETECT_BYTETEST].Free = DetectBytetestFree;
sigmatch_table[DETECT_BYTETEST].RegisterTests = DetectBytetestRegisterTests;
- sigmatch_table[DETECT_BYTETEST].flags |= SIGMATCH_PAYLOAD;
-
DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study);
}
sigmatch_table[DETECT_CONTENT].Setup = DetectContentSetup;
sigmatch_table[DETECT_CONTENT].Free = DetectContentFree;
sigmatch_table[DETECT_CONTENT].RegisterTests = DetectContentRegisterTests;
-
- sigmatch_table[DETECT_CONTENT].flags |= SIGMATCH_PAYLOAD;
}
/**
sigmatch_table[DETECT_DCE_IFACE].Free = DetectDceIfaceFree;
sigmatch_table[DETECT_DCE_IFACE].RegisterTests = DetectDceIfaceRegisterTests;
- sigmatch_table[DETECT_DCE_IFACE].flags |= SIGMATCH_PAYLOAD;
-
DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study);
g_dce_generic_list_id = DetectBufferTypeRegister("dce_generic");
sigmatch_table[DETECT_DCE_OPNUM].Free = DetectDceOpnumFree;
sigmatch_table[DETECT_DCE_OPNUM].RegisterTests = DetectDceOpnumRegisterTests;
- sigmatch_table[DETECT_DCE_OPNUM].flags |= SIGMATCH_PAYLOAD;
-
DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study);
g_dce_generic_list_id = DetectBufferTypeRegister("dce_generic");
sigmatch_table[DETECT_DCE_STUB_DATA].RegisterTests = DetectDceStubDataRegisterTests;
sigmatch_table[DETECT_DCE_STUB_DATA].flags |= SIGMATCH_NOOPT;
- sigmatch_table[DETECT_DCE_STUB_DATA].flags |= SIGMATCH_PAYLOAD;
DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOSERVER, 2,
PrefilterTxDceStubDataRequestRegister);
sigmatch_table[DETECT_DEPTH].Setup = DetectDepthSetup;
sigmatch_table[DETECT_DEPTH].Free = NULL;
sigmatch_table[DETECT_DEPTH].RegisterTests = NULL;
-
- sigmatch_table[DETECT_DEPTH].flags |= SIGMATCH_PAYLOAD;
}
static int DetectDepthSetup (DetectEngineCtx *de_ctx, Signature *s, char *depthstr)
sigmatch_table[DETECT_DISTANCE].Setup = DetectDistanceSetup;
sigmatch_table[DETECT_DISTANCE].Free = NULL;
sigmatch_table[DETECT_DISTANCE].RegisterTests = DetectDistanceRegisterTests;
-
- sigmatch_table[DETECT_DISTANCE].flags |= SIGMATCH_PAYLOAD;
}
static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s,
DetectDNP3DataRegisterTests;
sigmatch_table[DETECT_AL_DNP3DATA].flags |= SIGMATCH_NOOPT;
- sigmatch_table[DETECT_AL_DNP3DATA].flags |= SIGMATCH_PAYLOAD;
DetectAppLayerInspectEngineRegister("dnp3_data",
ALPROTO_DNP3, SIG_FLAG_TOSERVER,
sigmatch_table[DETECT_AL_DNS_QUERY].RegisterTests = DetectDnsQueryRegisterTests;
sigmatch_table[DETECT_AL_DNS_QUERY].flags |= SIGMATCH_NOOPT;
- sigmatch_table[DETECT_AL_DNS_QUERY].flags |= SIGMATCH_PAYLOAD;
DetectAppLayerMpmRegister("dns_query", SIG_FLAG_TOSERVER, 2,
PrefilterTxDnsQueryRegister);
sigmatch_table[DETECT_FAST_PATTERN].RegisterTests = DetectFastPatternRegisterTests;
sigmatch_table[DETECT_FAST_PATTERN].flags |= SIGMATCH_NOOPT;
- sigmatch_table[DETECT_FAST_PATTERN].flags |= SIGMATCH_PAYLOAD;
DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study);
}
sigmatch_table[DETECT_FILESIZE].Setup = DetectFilesizeSetup;
sigmatch_table[DETECT_FILESIZE].Free = DetectFilesizeFree;
sigmatch_table[DETECT_FILESIZE].RegisterTests = DetectFilesizeRegisterTests;
- sigmatch_table[DETECT_FILESIZE].flags |= SIGMATCH_PAYLOAD; /** XXX necessary? */
DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study);
sigmatch_table[DETECT_AL_HTTP_CLIENT_BODY].RegisterTests = DetectHttpClientBodyRegisterTests;
sigmatch_table[DETECT_AL_HTTP_CLIENT_BODY].flags |= SIGMATCH_NOOPT ;
- sigmatch_table[DETECT_AL_HTTP_CLIENT_BODY].flags |= SIGMATCH_PAYLOAD ;
DetectAppLayerMpmRegister("http_client_body", SIG_FLAG_TOSERVER, 2,
PrefilterTxHttpRequestBodyRegister);
sigmatch_table[DETECT_AL_HTTP_COOKIE].RegisterTests = DetectHttpCookieRegisterTests;
sigmatch_table[DETECT_AL_HTTP_COOKIE].flags |= SIGMATCH_NOOPT;
- sigmatch_table[DETECT_AL_HTTP_COOKIE].flags |= SIGMATCH_PAYLOAD;
DetectAppLayerMpmRegister("http_cookie", SIG_FLAG_TOSERVER, 2,
PrefilterTxRequestCookieRegister);
sigmatch_table[DETECT_AL_HTTP_HEADER_NAMES].Setup = DetectHttpHeaderNamesSetup;
sigmatch_table[DETECT_AL_HTTP_HEADER_NAMES].flags |= SIGMATCH_NOOPT ;
- sigmatch_table[DETECT_AL_HTTP_HEADER_NAMES].flags |= SIGMATCH_PAYLOAD ;
DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOSERVER, 2,
PrefilterTxHttpRequestHeaderNamesRegister);
sigmatch_table[DETECT_AL_HTTP_HEADER].RegisterTests = DetectHttpHeaderRegisterTests;
sigmatch_table[DETECT_AL_HTTP_HEADER].flags |= SIGMATCH_NOOPT ;
- sigmatch_table[DETECT_AL_HTTP_HEADER].flags |= SIGMATCH_PAYLOAD ;
DetectAppLayerMpmRegister("http_header", SIG_FLAG_TOSERVER, 2,
PrefilterTxHttpRequestHeadersRegister);
sigmatch_table[DETECT_AL_HTTP_HOST].RegisterTests = DetectHttpHHRegisterTests;
sigmatch_table[DETECT_AL_HTTP_HOST].flags |= SIGMATCH_NOOPT ;
- sigmatch_table[DETECT_AL_HTTP_HOST].flags |= SIGMATCH_PAYLOAD ;
DetectAppLayerMpmRegister("http_host", SIG_FLAG_TOSERVER, 2,
PrefilterTxHostnameRegister);
sigmatch_table[DETECT_AL_HTTP_RAW_HOST].RegisterTests = DetectHttpHRHRegisterTests;
sigmatch_table[DETECT_AL_HTTP_RAW_HOST].flags |= SIGMATCH_NOOPT ;
- sigmatch_table[DETECT_AL_HTTP_RAW_HOST].flags |= SIGMATCH_PAYLOAD ;
DetectAppLayerMpmRegister("http_raw_host", SIG_FLAG_TOSERVER, 2,
PrefilterTxHostnameRawRegister);
sigmatch_table[DETECT_AL_HTTP_METHOD].Free = DetectHttpMethodFree;
sigmatch_table[DETECT_AL_HTTP_METHOD].RegisterTests = DetectHttpMethodRegisterTests;
sigmatch_table[DETECT_AL_HTTP_METHOD].flags |= SIGMATCH_NOOPT;
- sigmatch_table[DETECT_AL_HTTP_METHOD].flags |= SIGMATCH_PAYLOAD;
DetectAppLayerMpmRegister("http_method", SIG_FLAG_TOSERVER, 4,
PrefilterTxMethodRegister);
sigmatch_table[DETECT_AL_HTTP_PROTOCOL].Setup = DetectHttpProtocolSetup;
sigmatch_table[DETECT_AL_HTTP_PROTOCOL].flags |= SIGMATCH_NOOPT ;
- sigmatch_table[DETECT_AL_HTTP_PROTOCOL].flags |= SIGMATCH_PAYLOAD ;
DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOSERVER, 2,
PrefilterTxHttpRequestProtocolRegister);
sigmatch_table[DETECT_AL_HTTP_RAW_HEADER].RegisterTests = DetectHttpRawHeaderRegisterTests;
sigmatch_table[DETECT_AL_HTTP_RAW_HEADER].flags |= SIGMATCH_NOOPT;
- sigmatch_table[DETECT_AL_HTTP_RAW_HEADER].flags |= SIGMATCH_PAYLOAD;
DetectAppLayerMpmRegister("http_raw_header", SIG_FLAG_TOSERVER, 2,
PrefilterTxRequestHeadersRawRegister);
sigmatch_table[DETECT_AL_HTTP_RAW_URI].Free = NULL;
sigmatch_table[DETECT_AL_HTTP_RAW_URI].RegisterTests = DetectHttpRawUriRegisterTests;
sigmatch_table[DETECT_AL_HTTP_RAW_URI].flags |= SIGMATCH_NOOPT;
- sigmatch_table[DETECT_AL_HTTP_RAW_URI].flags |= SIGMATCH_PAYLOAD;
DetectAppLayerMpmRegister("http_raw_uri", SIG_FLAG_TOSERVER, 2,
PrefilterTxRawUriRegister);
sigmatch_table[DETECT_AL_HTTP_REQUEST_LINE].RegisterTests = DetectHttpRequestLineRegisterTests;
sigmatch_table[DETECT_AL_HTTP_REQUEST_LINE].flags |= SIGMATCH_NOOPT;
- sigmatch_table[DETECT_AL_HTTP_REQUEST_LINE].flags |= SIGMATCH_PAYLOAD ;
DetectAppLayerMpmRegister("http_request_line", SIG_FLAG_TOSERVER, 2,
PrefilterTxHttpRequestLineRegister);
sigmatch_table[DETECT_AL_HTTP_RESPONSE_LINE].RegisterTests = DetectHttpResponseLineRegisterTests;
sigmatch_table[DETECT_AL_HTTP_RESPONSE_LINE].flags |= SIGMATCH_NOOPT;
- sigmatch_table[DETECT_AL_HTTP_RESPONSE_LINE].flags |= SIGMATCH_PAYLOAD ;
DetectAppLayerMpmRegister("http_response_line", SIG_FLAG_TOCLIENT, 2,
PrefilterTxHttpResponseLineRegister);
sigmatch_table[DETECT_AL_HTTP_SERVER_BODY].RegisterTests = DetectHttpServerBodyRegisterTests;
sigmatch_table[DETECT_AL_HTTP_SERVER_BODY].flags |= SIGMATCH_NOOPT;
- sigmatch_table[DETECT_AL_HTTP_SERVER_BODY].flags |= SIGMATCH_PAYLOAD;
g_file_data_buffer_id = DetectBufferTypeRegister("file_data");
}
sigmatch_table[DETECT_AL_HTTP_START].Setup = DetectHttpStartSetup;
sigmatch_table[DETECT_AL_HTTP_START].flags |= SIGMATCH_NOOPT ;
- sigmatch_table[DETECT_AL_HTTP_START].flags |= SIGMATCH_PAYLOAD ;
DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOSERVER, 2,
PrefilterTxHttpRequestStartRegister);
sigmatch_table[DETECT_AL_HTTP_STAT_CODE].RegisterTests = DetectHttpStatCodeRegisterTests;
sigmatch_table[DETECT_AL_HTTP_STAT_CODE].flags |= SIGMATCH_NOOPT;
- sigmatch_table[DETECT_AL_HTTP_STAT_CODE].flags |= SIGMATCH_PAYLOAD;
DetectAppLayerMpmRegister("http_stat_code", SIG_FLAG_TOCLIENT, 4,
PrefilterTxHttpStatCodeRegister);
sigmatch_table[DETECT_AL_HTTP_STAT_MSG].RegisterTests = DetectHttpStatMsgRegisterTests;
sigmatch_table[DETECT_AL_HTTP_STAT_MSG].flags |= SIGMATCH_NOOPT;
- sigmatch_table[DETECT_AL_HTTP_STAT_MSG].flags |= SIGMATCH_PAYLOAD;
DetectAppLayerMpmRegister("http_stat_msg", SIG_FLAG_TOCLIENT, 3,
PrefilterTxHttpStatMsgRegister);
sigmatch_table[DETECT_AL_HTTP_USER_AGENT].RegisterTests = DetectHttpUARegisterTests;
sigmatch_table[DETECT_AL_HTTP_USER_AGENT].flags |= SIGMATCH_NOOPT;
- sigmatch_table[DETECT_AL_HTTP_USER_AGENT].flags |= SIGMATCH_PAYLOAD ;
DetectAppLayerMpmRegister("http_user_agent", SIG_FLAG_TOSERVER, 2,
PrefilterTxUARegister);
sigmatch_table[DETECT_AL_HTTP_URI].RegisterTests = DetectHttpUriRegisterTests;
sigmatch_table[DETECT_AL_HTTP_URI].flags |= SIGMATCH_NOOPT;
- sigmatch_table[DETECT_AL_HTTP_URI].flags |= SIGMATCH_PAYLOAD;
DetectAppLayerMpmRegister("http_uri", SIG_FLAG_TOSERVER, 2,
PrefilterTxUriRegister);
sigmatch_table[DETECT_ISDATAAT].Free = DetectIsdataatFree;
sigmatch_table[DETECT_ISDATAAT].RegisterTests = DetectIsdataatRegisterTests;
- sigmatch_table[DETECT_ISDATAAT].flags |= SIGMATCH_PAYLOAD;
-
DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study);
}
sigmatch_table[DETECT_NOCASE].RegisterTests = NULL;
sigmatch_table[DETECT_NOCASE].flags |= SIGMATCH_NOOPT;
- sigmatch_table[DETECT_NOCASE].flags |= SIGMATCH_PAYLOAD;
}
/**
sigmatch_table[DETECT_OFFSET].Setup = DetectOffsetSetup;
sigmatch_table[DETECT_OFFSET].Free = NULL;
sigmatch_table[DETECT_OFFSET].RegisterTests = NULL;
-
- sigmatch_table[DETECT_OFFSET].flags |= SIGMATCH_PAYLOAD;
}
int DetectOffsetSetup (DetectEngineCtx *de_ctx, Signature *s, char *offsetstr)
sigmatch_table[DETECT_PCRE].Free = DetectPcreFree;
sigmatch_table[DETECT_PCRE].RegisterTests = DetectPcreRegisterTests;
- sigmatch_table[DETECT_PCRE].flags |= SIGMATCH_PAYLOAD;
-
intmax_t val = 0;
if (!ConfGetInt("pcre.match-limit", &val)) {
sigmatch_table[DETECT_PKTVAR].Free = NULL;
sigmatch_table[DETECT_PKTVAR].RegisterTests = NULL;
- sigmatch_table[DETECT_PKTVAR].flags |= SIGMATCH_PAYLOAD;
-
DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study);
}
sigmatch_table[DETECT_RAWBYTES].RegisterTests = NULL;
sigmatch_table[DETECT_RAWBYTES].flags |= SIGMATCH_NOOPT;
- sigmatch_table[DETECT_RAWBYTES].flags |= SIGMATCH_PAYLOAD;
}
static int DetectRawbytesSetup (DetectEngineCtx *de_ctx, Signature *s, char *nullstr)
sigmatch_table[DETECT_REPLACE].Setup = DetectReplaceSetup;
sigmatch_table[DETECT_REPLACE].Free = NULL;
sigmatch_table[DETECT_REPLACE].RegisterTests = DetectReplaceRegisterTests;
-
- sigmatch_table[DETECT_REPLACE].flags |= SIGMATCH_PAYLOAD;
}
int DetectReplaceSetup(DetectEngineCtx *de_ctx, Signature *s, char *replacestr)
DetectTemplateBufferRegisterTests;
sigmatch_table[DETECT_AL_TEMPLATE_BUFFER].flags |= SIGMATCH_NOOPT;
- sigmatch_table[DETECT_AL_TEMPLATE_BUFFER].flags |= SIGMATCH_PAYLOAD;
/* register inspect engines */
DetectAppLayerInspectEngineRegister("template_buffer",
sigmatch_table[DETECT_AL_TLS_CERT_ISSUER].RegisterTests = DetectTlsIssuerRegisterTests;
sigmatch_table[DETECT_AL_TLS_CERT_ISSUER].flags |= SIGMATCH_NOOPT;
- sigmatch_table[DETECT_AL_TLS_CERT_ISSUER].flags |= SIGMATCH_PAYLOAD;
DetectAppLayerMpmRegister("tls_cert_issuer", SIG_FLAG_TOCLIENT, 2,
PrefilterTxTlsIssuerRegister);
sigmatch_table[DETECT_AL_TLS_CERT_SUBJECT].RegisterTests = DetectTlsSubjectRegisterTests;
sigmatch_table[DETECT_AL_TLS_CERT_SUBJECT].flags |= SIGMATCH_NOOPT;
- sigmatch_table[DETECT_AL_TLS_CERT_SUBJECT].flags |= SIGMATCH_PAYLOAD;
DetectAppLayerMpmRegister("tls_cert_subject", SIG_FLAG_TOCLIENT, 2,
PrefilterTxTlsSubjectRegister);
sigmatch_table[DETECT_AL_TLS_SNI].RegisterTests = DetectTlsSniRegisterTests;
sigmatch_table[DETECT_AL_TLS_SNI].flags |= SIGMATCH_NOOPT;
- sigmatch_table[DETECT_AL_TLS_SNI].flags |= SIGMATCH_PAYLOAD;
DetectAppLayerMpmRegister("tls_sni", SIG_FLAG_TOSERVER, 2,
PrefilterTxTlsSniRegister);
sigmatch_table[DETECT_URICONTENT].Free = DetectUricontentFree;
sigmatch_table[DETECT_URICONTENT].RegisterTests = DetectUricontentRegisterTests;
- sigmatch_table[DETECT_URICONTENT].flags |= SIGMATCH_PAYLOAD;
-
g_http_uri_buffer_id = DetectBufferTypeRegister("http_uri");
}
sigmatch_table[DETECT_AL_URILEN].Setup = DetectUrilenSetup;
sigmatch_table[DETECT_AL_URILEN].Free = DetectUrilenFree;
sigmatch_table[DETECT_AL_URILEN].RegisterTests = DetectUrilenRegisterTests;
- sigmatch_table[DETECT_AL_URILEN].flags |= SIGMATCH_PAYLOAD;
DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study);
sigmatch_table[DETECT_WITHIN].Setup = DetectWithinSetup;
sigmatch_table[DETECT_WITHIN].Free = NULL;
sigmatch_table[DETECT_WITHIN].RegisterTests = DetectWithinRegisterTests;
-
- sigmatch_table[DETECT_WITHIN].flags |= SIGMATCH_PAYLOAD;
}
/** \brief Setup within pattern (content/uricontent) modifier.
if (s->init_data->smlists[DETECT_SM_LIST_PMATCH] != NULL) {
return 1;
}
-#if 0
- SigMatch *sm = s->sm_lists[DETECT_SM_LIST_PMATCH];
- if (sm == NULL)
- return 0;
-
- for (; sm != NULL; sm = sm->next) {
- if (sigmatch_table[sm->type].flags & SIGMATCH_PAYLOAD) {
- if (!(de_ctx->flags & DE_QUIET))
- SCLogDebug("Signature (%" PRIu32 "): is inspecting payload.", s->id);
- return 1;
- }
- }
-#endif
return 0;
}
printf("compatible with decoder event only rule");
prev = 1;
}
- if (flags & SIGMATCH_PAYLOAD) {
- if (prev == 1)
- printf("%c", sep);
- printf("payload inspecting keyword");
- prev = 1;
- }
if (e->SupportsPrefilter) {
if (prev == 1)
printf("%c", sep);
#define SIGMATCH_IPONLY_COMPAT (1 << 1)
/** sigmatch is compatible with a decode event only rule */
#define SIGMATCH_DEONLY_COMPAT (1 << 2)
-/**< Flag to indicate that the signature inspects the packet payload */
-#define SIGMATCH_PAYLOAD (1 << 3)
/**< Flag to indicate that the signature is not built-in */
-#define SIGMATCH_NOT_BUILT (1 << 4)
+#define SIGMATCH_NOT_BUILT (1 << 3)
/** sigmatch may have options, so the parser should be ready to
* deal with both cases */
-#define SIGMATCH_OPTIONAL_OPT (1 << 5)
+#define SIGMATCH_OPTIONAL_OPT (1 << 4)
enum DetectEngineTenantSelectors
{