Content: set up sticky buffers like file_data and dce_stub_data w/o flags, but with...

diff --git a/src/detect-byte-extract.c b/src/detect-byte-extract.c
index 6a20b188d07de5ec1a247097726e9d0f840909f4..a7225f31f892e8b5968316ac2e5984b3c258f8d0 100644 (file)
--- a/src/detect-byte-extract.c
+++ b/src/detect-byte-extract.c
@@ -545,18 +545,16 @@ int DetectByteExtractSetup(DetectEngineCtx *de_ctx, Signature *s, char *arg)
         goto error;
 
     int sm_list;
-    if (s->init_flags & (SIG_FLAG_INIT_FILE_DATA | SIG_FLAG_INIT_DCE_STUB_DATA)) {
-        if (s->init_flags & SIG_FLAG_INIT_FILE_DATA) {
+    if (s->list != DETECT_SM_LIST_NOTSET) {
+        if (s->list == DETECT_SM_LIST_HSBDMATCH) {
             if (data->endian == DETECT_BYTE_EXTRACT_ENDIAN_DCE) {
                 SCLogError(SC_ERR_INVALID_SIGNATURE, "dce byte_extract specified "
                            "with file_data option set.");
                 goto error;
             }
             AppLayerHtpEnableResponseBodyCallback();
-            sm_list = DETECT_SM_LIST_HSBDMATCH;
-        } else {
-            sm_list = DETECT_SM_LIST_DMATCH;
         }
+        sm_list = s->list;
         s->flags |= SIG_FLAG_APPLAYER;
         if (data->flags & DETECT_BYTE_EXTRACT_FLAG_RELATIVE) {
             prev_pm = SigMatchGetLastSMFromLists(s, 4,

diff --git a/src/detect-bytejump.c b/src/detect-bytejump.c
index ac65197b65b1628bef4cda98dee0c1c7430ed079..9549e8e4ca77c2ffec4f9e7b74a2d1a0917dbba9 100644 (file)
--- a/src/detect-bytejump.c
+++ b/src/detect-bytejump.c
@@ -538,18 +538,16 @@ int DetectBytejumpSetup(DetectEngineCtx *de_ctx, Signature *s, char *optstr)
         goto error;
 
     int sm_list;
-    if (s->init_flags & (SIG_FLAG_INIT_FILE_DATA | SIG_FLAG_INIT_DCE_STUB_DATA)) {
-        if (s->init_flags & SIG_FLAG_INIT_FILE_DATA) {
+    if (s->list != DETECT_SM_LIST_NOTSET) {
+        if (s->list == DETECT_SM_LIST_HSBDMATCH) {
             if (data->flags & DETECT_BYTEJUMP_DCE) {
                 SCLogError(SC_ERR_INVALID_SIGNATURE, "dce bytejump specified "
                            "with file_data option set.");
                 goto error;
             }
             AppLayerHtpEnableResponseBodyCallback();
-            sm_list = DETECT_SM_LIST_HSBDMATCH;
-        } else {
-            sm_list = DETECT_SM_LIST_DMATCH;
         }
+        sm_list = s->list;
         s->flags |= SIG_FLAG_APPLAYER;
         if (data->flags & DETECT_BYTEJUMP_RELATIVE) {
             prev_pm = SigMatchGetLastSMFromLists(s, 4,

diff --git a/src/detect-bytetest.c b/src/detect-bytetest.c
index 7e849f177701aaafe5b332968cbbbc5acf2be095..661bb310c9cfd96b93abd775f411e34ca644712a 100644 (file)
--- a/src/detect-bytetest.c
+++ b/src/detect-bytetest.c
@@ -459,18 +459,16 @@ int DetectBytetestSetup(DetectEngineCtx *de_ctx, Signature *s, char *optstr)
         goto error;
 
     int sm_list;
-    if (s->init_flags & (SIG_FLAG_INIT_FILE_DATA | SIG_FLAG_INIT_DCE_STUB_DATA)) {
-        if (s->init_flags & SIG_FLAG_INIT_FILE_DATA) {
+    if (s->list != DETECT_SM_LIST_NOTSET) {
+        if (s->list == DETECT_SM_LIST_HSBDMATCH) {
             if (data->flags & DETECT_BYTETEST_DCE) {
                 SCLogError(SC_ERR_INVALID_SIGNATURE, "dce bytetest specified "
                            "with file_data option set.");
                 goto error;
             }
             AppLayerHtpEnableResponseBodyCallback();
-            sm_list = DETECT_SM_LIST_HSBDMATCH;
-        } else {
-            sm_list = DETECT_SM_LIST_DMATCH;
         }
+        sm_list = s->list;
         s->flags |= SIG_FLAG_APPLAYER;
         if (data->flags & DETECT_BYTETEST_RELATIVE) {
             prev_pm = SigMatchGetLastSMFromLists(s, 4,

diff --git a/src/detect-content.c b/src/detect-content.c
index 631466e4cdcffc4f2b5c7f121933cb39461cf38a..0a885cdbab5e9db7a5eb2ff200a893f149796703 100644 (file)
--- a/src/detect-content.c
+++ b/src/detect-content.c
@@ -384,16 +384,14 @@ int DetectContentSetup(DetectEngineCtx *de_ctx, Signature *s, char *contentstr)
     DetectContentPrint(cd);
 
     int sm_list;
-    if (s->init_flags & (SIG_FLAG_INIT_FILE_DATA | SIG_FLAG_INIT_DCE_STUB_DATA)) {
-        if (s->init_flags & SIG_FLAG_INIT_FILE_DATA) {
+    if (s->list != DETECT_SM_LIST_NOTSET) {
+        if (s->list == DETECT_SM_LIST_HSBDMATCH) {
             AppLayerHtpEnableResponseBodyCallback();
             s->alproto = ALPROTO_HTTP;
-            sm_list = DETECT_SM_LIST_HSBDMATCH;
-        } else {
-            sm_list = DETECT_SM_LIST_DMATCH;
         }
 
         s->flags |= SIG_FLAG_APPLAYER;
+        sm_list = s->list;
     } else {
         sm_list = DETECT_SM_LIST_PMATCH;
     }

diff --git a/src/detect-dce-stub-data.c b/src/detect-dce-stub-data.c
index 7786fd5acd67ca33ac86c19ee0abd13e5e1df0fe..72bf35af696ffd2d9a908b4b5f5df88b04fc44b1 100644 (file)
--- a/src/detect-dce-stub-data.c
+++ b/src/detect-dce-stub-data.c
@@ -91,7 +91,7 @@ static int DetectDceStubDataSetup(DetectEngineCtx *de_ctx, Signature *s, char *a
         goto error;
     }
 
-    s->init_flags |= SIG_FLAG_INIT_DCE_STUB_DATA;
+    s->list = DETECT_SM_LIST_DMATCH;
     s->alproto = ALPROTO_DCERPC;
     s->flags |= SIG_FLAG_APPLAYER;
     return 0;

diff --git a/src/detect-depth.c b/src/detect-depth.c
index 6473ae85831d3cf3cc46f0901a39df040f6f1b7b..b075f1656f21b716871dd743980f2a256da7562a 100644 (file)
--- a/src/detect-depth.c
+++ b/src/detect-depth.c
@@ -71,11 +71,8 @@ static int DetectDepthSetup (DetectEngineCtx *de_ctx, Signature *s, char *depths
     }
 
     /* retrive the sm to apply the depth against */
-    if (s->init_flags & SIG_FLAG_INIT_FILE_DATA || s->init_flags & SIG_FLAG_INIT_DCE_STUB_DATA) {
-        if (s->init_flags & SIG_FLAG_INIT_FILE_DATA)
-            pm = SigMatchGetLastSMFromLists(s, 2, DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]);
-        else
-            pm = SigMatchGetLastSMFromLists(s, 2, DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_DMATCH]);
+    if (s->list != DETECT_SM_LIST_NOTSET) {
+        pm = SigMatchGetLastSMFromLists(s, 2, DETECT_CONTENT, s->sm_lists_tail[s->list]);
     } else {
         pm =  SigMatchGetLastSMFromLists(s, 28,
                                          DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH],

diff --git a/src/detect-distance.c b/src/detect-distance.c
index b0cf071cd076120d7cceb9187ca89375db3fc84b..d0ab9e96c62061f44087e2ebbe0ca23435a2f9ee 100644 (file)
--- a/src/detect-distance.c
+++ b/src/detect-distance.c
@@ -80,11 +80,8 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s,
     }
 
     /* retrive the sm to apply the depth against */
-    if (s->init_flags & SIG_FLAG_INIT_FILE_DATA || s->init_flags & SIG_FLAG_INIT_DCE_STUB_DATA) {
-        if (s->init_flags & SIG_FLAG_INIT_FILE_DATA)
-            pm = SigMatchGetLastSMFromLists(s, 2, DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]);
-        else
-            pm = SigMatchGetLastSMFromLists(s, 2, DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_DMATCH]);
+    if (s->list != DETECT_SM_LIST_NOTSET) {
+        pm = SigMatchGetLastSMFromLists(s, 2, DETECT_CONTENT, s->sm_lists_tail[s->list]);
     } else {
         pm =  SigMatchGetLastSMFromLists(s, 28,
                                          DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH],

diff --git a/src/detect-engine-mpm.c b/src/detect-engine-mpm.c
index 7aedf0c639ca8c2d3e476d8a47920709cef23ff0..01c8ac80c37ed4a43bc49652f2823dd6f459944d 100644 (file)
--- a/src/detect-engine-mpm.c
+++ b/src/detect-engine-mpm.c
@@ -2895,8 +2895,8 @@ uint32_t DetectPatternGetId(MpmPatternIdStore *ht, void *ctx, Signature *s, uint
 
     r = HashTableLookup(ht->hash, (void *)e, sizeof(MpmPatternIdTableElmt));
     if (r == NULL) {
-        if (s->init_flags & (SIG_FLAG_INIT_FILE_DATA | SIG_FLAG_INIT_DCE_STUB_DATA)) {
-            BUG_ON((sm_list != DETECT_SM_LIST_HSBDMATCH) & (sm_list != DETECT_SM_LIST_DMATCH));
+        if (s->list != DETECT_SM_LIST_NOTSET) {
+            BUG_ON((sm_list != DETECT_SM_LIST_HSBDMATCH) && (sm_list != DETECT_SM_LIST_DMATCH));
             e->id = ht->max_id;
             ht->max_id++;
             id = e->id;
@@ -2960,7 +2960,7 @@ uint32_t DetectPatternGetId(MpmPatternIdStore *ht, void *ctx, Signature *s, uint
     } else {
         /* oh cool!  It is a duplicate for content, uricontent types.  Update the
          * dup_count and get out */
-        if ((s->init_flags & (SIG_FLAG_INIT_FILE_DATA | SIG_FLAG_INIT_DCE_STUB_DATA)) ||
+        if ((s->list != DETECT_SM_LIST_NOTSET) ||
             sm_list == DETECT_SM_LIST_PMATCH) {
             /* we have a duplicate */
             r->dup_count++;

diff --git a/src/detect-file-data.c b/src/detect-file-data.c
index 7b826ca8fb9b32eee788b5a14b6748382097b826..f1b805790671dbf6a30be50d92808f85598f2b9e 100644 (file)
--- a/src/detect-file-data.c
+++ b/src/detect-file-data.c
@@ -78,7 +78,8 @@ static int DetectFiledataSetup (DetectEngineCtx *de_ctx, Signature *s, char *str
         SCLogError(SC_ERR_INVALID_SIGNATURE, "Can't use file_data with flow:to_server or from_client with http.");
         return -1;
     }
-    s->init_flags |= SIG_FLAG_INIT_FILE_DATA;
+
+    s->list = DETECT_SM_LIST_HSBDMATCH;
 
     return 0;
 }

diff --git a/src/detect-isdataat.c b/src/detect-isdataat.c
index 9e2d31cd32eec5d2ff1cce65a6b7c6c2148cc899..45b6fc768ee50052d183d3c8e021e207cb321212 100644 (file)
--- a/src/detect-isdataat.c
+++ b/src/detect-isdataat.c
@@ -260,14 +260,12 @@ int DetectIsdataatSetup (DetectEngineCtx *de_ctx, Signature *s, char *isdataatst
         goto end;
 
     int sm_list;
-    if (s->init_flags & (SIG_FLAG_INIT_FILE_DATA | SIG_FLAG_INIT_DCE_STUB_DATA)) {
-        if (s->init_flags & SIG_FLAG_INIT_FILE_DATA) {
+    if (s->list != DETECT_SM_LIST_NOTSET) {
+        if (s->list == DETECT_SM_LIST_HSBDMATCH) {
             AppLayerHtpEnableResponseBodyCallback();
             s->alproto = ALPROTO_HTTP;
-            sm_list = DETECT_SM_LIST_HSBDMATCH;
-        } else {
-            sm_list = DETECT_SM_LIST_DMATCH;
         }
+        sm_list = s->list;
         s->flags |= SIG_FLAG_APPLAYER;
         if (idad->flags & ISDATAAT_RELATIVE) {
             prev_pm = SigMatchGetLastSMFromLists(s, 4,

diff --git a/src/detect-nocase.c b/src/detect-nocase.c
index 6bab8f271e33e32e0044e7189ea78934c944f9bb..69461351271459ba9241777bd0f34585046290d0 100644 (file)
--- a/src/detect-nocase.c
+++ b/src/detect-nocase.c
@@ -80,11 +80,8 @@ static int DetectNocaseSetup (DetectEngineCtx *de_ctx, Signature *s, char *nulls
     }
 
     /* retrive the sm to apply the depth against */
-    if (s->init_flags & SIG_FLAG_INIT_FILE_DATA || s->init_flags & SIG_FLAG_INIT_DCE_STUB_DATA) {
-        if (s->init_flags & SIG_FLAG_INIT_FILE_DATA)
-            pm = SigMatchGetLastSMFromLists(s, 2, DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]);
-        else
-            pm = SigMatchGetLastSMFromLists(s, 2, DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_DMATCH]);
+    if (s->list != DETECT_SM_LIST_NOTSET) {
+        pm = SigMatchGetLastSMFromLists(s, 2, DETECT_CONTENT, s->sm_lists_tail[s->list]);
     } else {
         pm =  SigMatchGetLastSMFromLists(s, 28,
                                          DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH],

diff --git a/src/detect-offset.c b/src/detect-offset.c
index afbe44cf6b310e54fc0a55d6f0b43431b10240c5..34f45736e926dc409d81a40f6d0ddd15acd45ac6 100644 (file)
--- a/src/detect-offset.c
+++ b/src/detect-offset.c
@@ -70,11 +70,8 @@ int DetectOffsetSetup (DetectEngineCtx *de_ctx, Signature *s, char *offsetstr)
     }
 
     /* retrive the sm to apply the depth against */
-    if (s->init_flags & SIG_FLAG_INIT_FILE_DATA || s->init_flags & SIG_FLAG_INIT_DCE_STUB_DATA) {
-        if (s->init_flags & SIG_FLAG_INIT_FILE_DATA)
-            pm = SigMatchGetLastSMFromLists(s, 2, DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]);
-        else
-            pm = SigMatchGetLastSMFromLists(s, 2, DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_DMATCH]);
+    if (s->list != DETECT_SM_LIST_NOTSET) {
+        pm = SigMatchGetLastSMFromLists(s, 2, DETECT_CONTENT, s->sm_lists_tail[s->list]);
     } else {
         pm =  SigMatchGetLastSMFromLists(s, 28,
                                          DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH],

diff --git a/src/detect-parse.c b/src/detect-parse.c
index 98324d65c1631ffb081d71114ecc25fbdad10b27..c3ba7bf1c4915d3d23a1d8f2d4f084869344845b 100644 (file)
--- a/src/detect-parse.c
+++ b/src/detect-parse.c
@@ -109,7 +109,7 @@ int DetectEngineContentModifierBufferSetup(DetectEngineCtx *de_ctx, Signature *s
         goto end;
     }
 
-    if (s->init_flags & (SIG_FLAG_INIT_FILE_DATA | SIG_FLAG_INIT_DCE_STUB_DATA)) {
+    if (s->list != DETECT_SM_LIST_NOTSET) {
         SCLogError(SC_ERR_INVALID_SIGNATURE, "\"%s\" keyword seen "
                    "with a sticky buffer still set.  Reset sticky buffer "
                    "with pkt_data before using the modifier.",
@@ -902,6 +902,8 @@ Signature *SigAlloc (void) {
      * overwritten after the Signature has been parsed, and if it hasn't been
      * overwritten, we can then assign the default value of 3 */
     sig->prio = -1;
+
+    sig->list = DETECT_SM_LIST_NOTSET;
     return sig;
 }
 

diff --git a/src/detect-pcre.c b/src/detect-pcre.c
index 24163c18c1073cc6b1b19eb0d9314ff70a0f46e4..4d03e0e0d8563347264c14865f74fb75fdfc92d0 100644 (file)
--- a/src/detect-pcre.c
+++ b/src/detect-pcre.c
@@ -689,7 +689,7 @@ static int DetectPcreSetup (DetectEngineCtx *de_ctx, Signature *s, char *regexst
                        "for the rule.");
             goto error;
         }
-        if (s->init_flags & (SIG_FLAG_INIT_FILE_DATA | SIG_FLAG_INIT_DCE_STUB_DATA)) {
+        if (s->list != DETECT_SM_LIST_NOTSET) {
             SCLogError(SC_ERR_INVALID_SIGNATURE, "pcre found with http "
                        "modifier set, with file_data/dce_stub_data sticky "
                        "option set.");
@@ -705,7 +705,7 @@ static int DetectPcreSetup (DetectEngineCtx *de_ctx, Signature *s, char *regexst
                        "for the rule.");
             goto error;
         }
-        if (s->init_flags & (SIG_FLAG_INIT_FILE_DATA | SIG_FLAG_INIT_DCE_STUB_DATA)) {
+        if (s->list != DETECT_SM_LIST_NOTSET) {
             SCLogError(SC_ERR_INVALID_SIGNATURE, "pcre found with dns "
                        "modifier set, with file_data/dce_stub_data sticky "
                        "option set.");
@@ -714,15 +714,15 @@ static int DetectPcreSetup (DetectEngineCtx *de_ctx, Signature *s, char *regexst
     }
 
     int sm_list;
-    if (s->init_flags & SIG_FLAG_INIT_FILE_DATA) {
-        SCLogDebug("adding to http server body list because of file data");
-        s->flags |= SIG_FLAG_APPLAYER;
-        AppLayerHtpEnableResponseBodyCallback();
-        sm_list = DETECT_SM_LIST_HSBDMATCH;
-    } else if (s->init_flags & SIG_FLAG_INIT_DCE_STUB_DATA) {
-        SCLogDebug("adding to dmatch list because of dce_stub_data");
+    if (s->list != DETECT_SM_LIST_NOTSET) {
+        if (s->list == DETECT_SM_LIST_HSBDMATCH) {
+            SCLogDebug("adding to http server body list because of file data");
+            AppLayerHtpEnableResponseBodyCallback();
+        } else if (s->list == DETECT_SM_LIST_DMATCH) {
+            SCLogDebug("adding to dmatch list because of dce_stub_data");
+        }
         s->flags |= SIG_FLAG_APPLAYER;
-        sm_list = DETECT_SM_LIST_DMATCH;
+        sm_list = s->list;
     } else if (pd->flags & DETECT_PCRE_URI) {
         s->flags |= SIG_FLAG_APPLAYER;
         s->alproto = ALPROTO_HTTP;

diff --git a/src/detect-pkt-data.c b/src/detect-pkt-data.c
index 836c9c026b2adc5bcb229415fbe4741e4a1e9cb1..c159a0ff1bac5c91a706fde238ab2efaf51262e2 100644 (file)
--- a/src/detect-pkt-data.c
+++ b/src/detect-pkt-data.c
@@ -73,7 +73,7 @@ void DetectPktDataRegister(void) {
 static int DetectPktDataSetup (DetectEngineCtx *de_ctx, Signature *s, char *str)
 {
     SCEnter();
-    s->init_flags &= (~SIG_FLAG_INIT_FILE_DATA & ~SIG_FLAG_INIT_DCE_STUB_DATA);
+    s->list = DETECT_SM_LIST_NOTSET;
 
     return 0;
 }
@@ -126,8 +126,8 @@ static int DetectPktDataTest01(void)
     }
 
 
-    if (sig->init_flags & SIG_FLAG_INIT_FILE_DATA) {
-        printf("sm init_flags SIG_FLAG_INIT_FILE_DATA set: ");
+    if (sig->list != DETECT_SM_LIST_NOTSET) {
+        printf("sticky buffer set: ");
         goto end;
     }
 

diff --git a/src/detect-rawbytes.c b/src/detect-rawbytes.c
index 2695c147b56dfbbcb8ab5c36b806b43a4a6af721..cf676d005bcc42f92179b1e4ce62bbf28dacc057 100644 (file)
--- a/src/detect-rawbytes.c
+++ b/src/detect-rawbytes.c
@@ -59,7 +59,7 @@ static int DetectRawbytesSetup (DetectEngineCtx *de_ctx, Signature *s, char *nul
         return -1;
     }
 
-    if (s->init_flags & SIG_FLAG_INIT_FILE_DATA) {
+    if (s->list != DETECT_SM_LIST_NOTSET) {
         SCLogError(SC_ERR_RAWBYTES_FILE_DATA, "\"rawbytes\" cannot be combined with \"file_data\"");
         SCReturnInt(-1);
     }

diff --git a/src/detect-within.c b/src/detect-within.c
index 0f6d9265c3762974beae023074bbc7564ca8ab4f..6e02ef037584bd6fdd334174072f4f8409befe38 100644 (file)
--- a/src/detect-within.c
+++ b/src/detect-within.c
@@ -83,11 +83,8 @@ static int DetectWithinSetup(DetectEngineCtx *de_ctx, Signature *s, char *within
     }
 
     /* retrive the sm to apply the depth against */
-    if (s->init_flags & (SIG_FLAG_INIT_FILE_DATA | SIG_FLAG_INIT_DCE_STUB_DATA)) {
-        if (s->init_flags & SIG_FLAG_INIT_FILE_DATA)
-            pm = SigMatchGetLastSMFromLists(s, 2, DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HSBDMATCH]);
-        else
-            pm = SigMatchGetLastSMFromLists(s, 2, DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_DMATCH]);
+    if (s->list != DETECT_SM_LIST_NOTSET) {
+        pm = SigMatchGetLastSMFromLists(s, 2, DETECT_CONTENT, s->sm_lists_tail[s->list]);
     } else {
         pm =  SigMatchGetLastSMFromLists(s, 28,
                                          DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH],

diff --git a/src/detect.h b/src/detect.h
index a2c82a63e459506e45d8a106054dec48827dd781..57acb988d73c14bbd87acd5058167b77f2db1df8 100644 (file)
--- a/src/detect.h
+++ b/src/detect.h
@@ -123,6 +123,11 @@ enum {
     /* list for alert thresholding */
     DETECT_SM_LIST_THRESHOLD,
     DETECT_SM_LIST_MAX,
+
+    /* used for Signature->list, which indicates which list
+     * we're adding keywords to in cases of sticky buffers like
+     * file_data */
+    DETECT_SM_LIST_NOTSET,
 };
 
 /* a is ... than b */
@@ -277,8 +282,6 @@ typedef struct DetectPort_ {
 #define SIG_FLAG_INIT_FLOW           (1<<2)  /**< signature has a flow setting */
 #define SIG_FLAG_INIT_BIDIREC        (1<<3)  /**< signature has bidirectional operator */
 #define SIG_FLAG_INIT_PAYLOAD        (1<<4)  /**< signature is inspecting the packet payload */
-#define SIG_FLAG_INIT_FILE_DATA      (1<<5)  /**< file_data set */
-#define SIG_FLAG_INIT_DCE_STUB_DATA  (1<<6)  /**< dce_stub_data set */
 
 /* signature mask flags */
 #define SIG_MASK_REQUIRE_PAYLOAD            (1<<0)
@@ -460,6 +463,8 @@ typedef struct Signature_ {
      * to warn the user about any possible problem */
     char *sig_str;
 
+    int list;
+
     /** ptr to the next sig in the list */
     struct Signature_ *next;
 } Signature;