detect/keywords: dynamic version part of doc URL

pull/4895/head
Victor Julien 6 years ago
parent 8f2df0f938
commit 26bcc97515

@ -247,7 +247,7 @@ static void StatsInitCtxPreOutput(void)
if (gstats == NULL) {
SCLogWarning(SC_ERR_STATS_LOG_GENERIC, "global stats config is missing. "
"Stats enabled through legacy stats.log. "
"See %s%s/configuration/suricata-yaml.html#stats", DOC_URL, DOC_VERSION);
"See %s/configuration/suricata-yaml.html#stats", GetDocURL());
}
const char *interval = ConfNodeLookupChildValue(stats, "interval");

@ -67,7 +67,7 @@ void DetectAppLayerEventRegister(void)
{
sigmatch_table[DETECT_AL_APP_LAYER_EVENT].name = "app-layer-event";
sigmatch_table[DETECT_AL_APP_LAYER_EVENT].desc = "match on events generated by the App Layer Parsers and the protocol detection engine";
sigmatch_table[DETECT_AL_APP_LAYER_EVENT].url = DOC_URL DOC_VERSION "/rules/app-layer.html#app-layer-event";
sigmatch_table[DETECT_AL_APP_LAYER_EVENT].url = "/rules/app-layer.html#app-layer-event";
sigmatch_table[DETECT_AL_APP_LAYER_EVENT].Match =
DetectAppLayerEventPktMatch;
sigmatch_table[DETECT_AL_APP_LAYER_EVENT].Setup = DetectAppLayerEventSetupP1;

@ -259,7 +259,7 @@ void DetectAppLayerProtocolRegister(void)
{
sigmatch_table[DETECT_AL_APP_LAYER_PROTOCOL].name = "app-layer-protocol";
sigmatch_table[DETECT_AL_APP_LAYER_PROTOCOL].desc = "match on the detected app-layer protocol";
sigmatch_table[DETECT_AL_APP_LAYER_PROTOCOL].url = DOC_URL DOC_VERSION "/rules/app-layer.html#app-layer-protocol";
sigmatch_table[DETECT_AL_APP_LAYER_PROTOCOL].url = "/rules/app-layer.html#app-layer-protocol";
sigmatch_table[DETECT_AL_APP_LAYER_PROTOCOL].Match =
DetectAppLayerProtocolPacketMatch;
sigmatch_table[DETECT_AL_APP_LAYER_PROTOCOL].Setup =

@ -33,7 +33,7 @@ void DetectBase64DataRegister(void)
sigmatch_table[DETECT_BASE64_DATA].desc =
"Content match base64 decoded data.";
sigmatch_table[DETECT_BASE64_DATA].url =
DOC_URL DOC_VERSION "/rules/base64-keywords.html#base64-data";
"/rules/base64-keywords.html#base64-data";
sigmatch_table[DETECT_BASE64_DATA].Setup = DetectBase64DataSetup;
sigmatch_table[DETECT_BASE64_DATA].RegisterTests =
DetectBase64DataRegisterTests;

@ -42,7 +42,7 @@ void DetectBase64DecodeRegister(void)
sigmatch_table[DETECT_BASE64_DECODE].desc =
"Decodes base64 encoded data.";
sigmatch_table[DETECT_BASE64_DECODE].url =
DOC_URL DOC_VERSION "/rules/base64-keywords.html#base64-decode";
"/rules/base64-keywords.html#base64-decode";
sigmatch_table[DETECT_BASE64_DECODE].Setup = DetectBase64DecodeSetup;
sigmatch_table[DETECT_BASE64_DECODE].Free = DetectBase64DecodeFree;
sigmatch_table[DETECT_BASE64_DECODE].RegisterTests =

@ -51,7 +51,7 @@ void DetectBsizeRegister(void)
{
sigmatch_table[DETECT_BSIZE].name = "bsize";
sigmatch_table[DETECT_BSIZE].desc = "match on the length of a buffer";
sigmatch_table[DETECT_BSIZE].url = DOC_URL DOC_VERSION "/rules/payload-keywords.html#bsize";
sigmatch_table[DETECT_BSIZE].url = "/rules/payload-keywords.html#bsize";
sigmatch_table[DETECT_BSIZE].Match = NULL;
sigmatch_table[DETECT_BSIZE].Setup = DetectBsizeSetup;
sigmatch_table[DETECT_BSIZE].Free = DetectBsizeFree;

@ -62,7 +62,7 @@ void DetectBypassRegister(void)
{
sigmatch_table[DETECT_BYPASS].name = "bypass";
sigmatch_table[DETECT_BYPASS].desc = "call the bypass callback when the match of a sig is complete";
sigmatch_table[DETECT_BYPASS].url = DOC_URL DOC_VERSION "/rules/bypass-keyword.html";
sigmatch_table[DETECT_BYPASS].url = "/rules/bypass-keyword.html";
sigmatch_table[DETECT_BYPASS].Match = DetectBypassMatch;
sigmatch_table[DETECT_BYPASS].Setup = DetectBypassSetup;
sigmatch_table[DETECT_BYPASS].Free = NULL;

@ -99,7 +99,7 @@ void DetectByteExtractRegister(void)
{
sigmatch_table[DETECT_BYTE_EXTRACT].name = "byte_extract";
sigmatch_table[DETECT_BYTE_EXTRACT].desc = "extract <num of bytes> at a particular <offset> and store it in <var_name>";
sigmatch_table[DETECT_BYTE_EXTRACT].url = DOC_URL DOC_VERSION "/rules/payload-keywords.html#byte-extract";
sigmatch_table[DETECT_BYTE_EXTRACT].url = "/rules/payload-keywords.html#byte-extract";
sigmatch_table[DETECT_BYTE_EXTRACT].Match = NULL;
sigmatch_table[DETECT_BYTE_EXTRACT].Setup = DetectByteExtractSetup;
sigmatch_table[DETECT_BYTE_EXTRACT].Free = DetectByteExtractFree;

@ -70,7 +70,7 @@ void DetectBytejumpRegister (void)
{
sigmatch_table[DETECT_BYTEJUMP].name = "byte_jump";
sigmatch_table[DETECT_BYTEJUMP].desc = "allow the ability to select a <num of bytes> from an <offset> and move the detection pointer to that position";
sigmatch_table[DETECT_BYTEJUMP].url = DOC_URL DOC_VERSION "/rules/payload-keywords.html#byte-jump";
sigmatch_table[DETECT_BYTEJUMP].url = "/rules/payload-keywords.html#byte-jump";
sigmatch_table[DETECT_BYTEJUMP].Match = DetectBytejumpMatch;
sigmatch_table[DETECT_BYTEJUMP].Setup = DetectBytejumpSetup;
sigmatch_table[DETECT_BYTEJUMP].Free = DetectBytejumpFree;

@ -77,7 +77,7 @@ void DetectBytetestRegister (void)
{
sigmatch_table[DETECT_BYTETEST].name = "byte_test";
sigmatch_table[DETECT_BYTETEST].desc = "extract <num of bytes> and perform an operation selected with <operator> against the value in <test value> at a particular <offset>";
sigmatch_table[DETECT_BYTETEST].url = DOC_URL DOC_VERSION "/rules/payload-keywords.html#byte-test";
sigmatch_table[DETECT_BYTETEST].url = "/rules/payload-keywords.html#byte-test";
sigmatch_table[DETECT_BYTETEST].Match = DetectBytetestMatch;
sigmatch_table[DETECT_BYTETEST].Setup = DetectBytetestSetup;
sigmatch_table[DETECT_BYTETEST].Free = DetectBytetestFree;

@ -52,7 +52,7 @@ void DetectCipServiceRegister(void)
SCEnter();
sigmatch_table[DETECT_CIPSERVICE].name = "cip_service"; //rule keyword
sigmatch_table[DETECT_CIPSERVICE].desc = "match on CIP Service";
sigmatch_table[DETECT_CIPSERVICE].url = DOC_URL DOC_VERSION "/rules/enip-keyword.html#enip-cip-keywords";
sigmatch_table[DETECT_CIPSERVICE].url = "/rules/enip-keyword.html#enip-cip-keywords";
sigmatch_table[DETECT_CIPSERVICE].Match = NULL;
sigmatch_table[DETECT_CIPSERVICE].Setup = DetectCipServiceSetup;
sigmatch_table[DETECT_CIPSERVICE].Free = DetectCipServiceFree;
@ -307,7 +307,7 @@ void DetectEnipCommandRegister(void)
sigmatch_table[DETECT_ENIPCOMMAND].name = "enip_command"; //rule keyword
sigmatch_table[DETECT_ENIPCOMMAND].desc
= "rules for detecting EtherNet/IP command";
sigmatch_table[DETECT_ENIPCOMMAND].url = DOC_URL DOC_VERSION "/rules/enip-keyword.html#enip-cip-keywords";
sigmatch_table[DETECT_ENIPCOMMAND].url = "/rules/enip-keyword.html#enip-cip-keywords";
sigmatch_table[DETECT_ENIPCOMMAND].Match = NULL;
sigmatch_table[DETECT_ENIPCOMMAND].Setup = DetectEnipCommandSetup;
sigmatch_table[DETECT_ENIPCOMMAND].Free = DetectEnipCommandFree;

@ -50,7 +50,7 @@ void DetectClasstypeRegister(void)
{
sigmatch_table[DETECT_CLASSTYPE].name = "classtype";
sigmatch_table[DETECT_CLASSTYPE].desc = "information about the classification of rules and alerts";
sigmatch_table[DETECT_CLASSTYPE].url = DOC_URL DOC_VERSION "/rules/meta.html#classtype";
sigmatch_table[DETECT_CLASSTYPE].url = "/rules/meta.html#classtype";
sigmatch_table[DETECT_CLASSTYPE].Setup = DetectClasstypeSetup;
sigmatch_table[DETECT_CLASSTYPE].RegisterTests = DetectClasstypeRegisterTests;

@ -56,7 +56,7 @@ void DetectContentRegister (void)
{
sigmatch_table[DETECT_CONTENT].name = "content";
sigmatch_table[DETECT_CONTENT].desc = "match on payload content";
sigmatch_table[DETECT_CONTENT].url = DOC_URL DOC_VERSION "/rules/payload-keywords.html#content";
sigmatch_table[DETECT_CONTENT].url = "/rules/payload-keywords.html#content";
sigmatch_table[DETECT_CONTENT].Match = NULL;
sigmatch_table[DETECT_CONTENT].Setup = DetectContentSetup;
sigmatch_table[DETECT_CONTENT].Free = DetectContentFree;

@ -51,7 +51,7 @@ void DetectDatarepRegister (void)
{
sigmatch_table[DETECT_DATAREP].name = "datarep";
sigmatch_table[DETECT_DATAREP].desc = "operate on datasets (experimental)";
sigmatch_table[DETECT_DATAREP].url = DOC_URL DOC_VERSION "/rules/dataset-keywords.html#datarep";
sigmatch_table[DETECT_DATAREP].url = "/rules/dataset-keywords.html#datarep";
sigmatch_table[DETECT_DATAREP].Setup = DetectDatarepSetup;
sigmatch_table[DETECT_DATAREP].Free = DetectDatarepFree;

@ -50,7 +50,7 @@ void DetectDatasetRegister (void)
{
sigmatch_table[DETECT_DATASET].name = "dataset";
sigmatch_table[DETECT_DATASET].desc = "match sticky buffer against datasets (experimental)";
sigmatch_table[DETECT_DATASET].url = DOC_URL DOC_VERSION "/rules/dataset-keywords.html#dataset";
sigmatch_table[DETECT_DATASET].url = "/rules/dataset-keywords.html#dataset";
sigmatch_table[DETECT_DATASET].Setup = DetectDatasetSetup;
sigmatch_table[DETECT_DATASET].Free = DetectDatasetFree;

@ -48,7 +48,7 @@ void DetectDepthRegister (void)
{
sigmatch_table[DETECT_DEPTH].name = "depth";
sigmatch_table[DETECT_DEPTH].desc = "designate how many bytes from the beginning of the payload will be checked";
sigmatch_table[DETECT_DEPTH].url = DOC_URL DOC_VERSION "/rules/payload-keywords.html#depth";
sigmatch_table[DETECT_DEPTH].url = "/rules/payload-keywords.html#depth";
sigmatch_table[DETECT_DEPTH].Match = NULL;
sigmatch_table[DETECT_DEPTH].Setup = DetectDepthSetup;
sigmatch_table[DETECT_DEPTH].Free = NULL;
@ -56,7 +56,7 @@ void DetectDepthRegister (void)
sigmatch_table[DETECT_STARTS_WITH].name = "startswith";
sigmatch_table[DETECT_STARTS_WITH].desc = "pattern must be at the start of a buffer (same as 'depth:<pattern len>')";
sigmatch_table[DETECT_STARTS_WITH].url = DOC_URL DOC_VERSION "/rules/payload-keywords.html#startswith";
sigmatch_table[DETECT_STARTS_WITH].url = "/rules/payload-keywords.html#startswith";
sigmatch_table[DETECT_STARTS_WITH].Setup = DetectStartsWithSetup;
sigmatch_table[DETECT_STARTS_WITH].flags |= SIGMATCH_NOOPT;
}

@ -63,7 +63,7 @@ void DetectDetectionFilterRegister (void)
{
sigmatch_table[DETECT_DETECTION_FILTER].name = "detection_filter";
sigmatch_table[DETECT_DETECTION_FILTER].desc = "alert on every match after a threshold has been reached";
sigmatch_table[DETECT_DETECTION_FILTER].url = DOC_URL DOC_VERSION "/rules/thresholding.html#detection-filter";
sigmatch_table[DETECT_DETECTION_FILTER].url = "/rules/thresholding.html#detection-filter";
sigmatch_table[DETECT_DETECTION_FILTER].Match = DetectDetectionFilterMatch;
sigmatch_table[DETECT_DETECTION_FILTER].Setup = DetectDetectionFilterSetup;
sigmatch_table[DETECT_DETECTION_FILTER].Free = DetectDetectionFilterFree;

@ -54,7 +54,7 @@ void DetectDistanceRegister(void)
{
sigmatch_table[DETECT_DISTANCE].name = "distance";
sigmatch_table[DETECT_DISTANCE].desc = "indicates a relation between this content keyword and the content preceding it";
sigmatch_table[DETECT_DISTANCE].url = DOC_URL DOC_VERSION "/rules/payload-keywords.html#distance";
sigmatch_table[DETECT_DISTANCE].url = "/rules/payload-keywords.html#distance";
sigmatch_table[DETECT_DISTANCE].Match = NULL;
sigmatch_table[DETECT_DISTANCE].Setup = DetectDistanceSetup;
sigmatch_table[DETECT_DISTANCE].Free = NULL;

@ -493,7 +493,7 @@ static void DetectDNP3FuncRegister(void)
sigmatch_table[DETECT_AL_DNP3FUNC].name = "dnp3_func";
sigmatch_table[DETECT_AL_DNP3FUNC].alias = "dnp3.func";
sigmatch_table[DETECT_AL_DNP3FUNC].desc = "match on the application function code found in DNP3 request and responses";
sigmatch_table[DETECT_AL_DNP3FUNC].url = DOC_URL DOC_VERSION "/rules/dnp3-keywords.html#dnp3-func";
sigmatch_table[DETECT_AL_DNP3FUNC].url = "/rules/dnp3-keywords.html#dnp3-func";
sigmatch_table[DETECT_AL_DNP3FUNC].Match = NULL;
sigmatch_table[DETECT_AL_DNP3FUNC].AppLayerTxMatch = DetectDNP3FuncMatch;
sigmatch_table[DETECT_AL_DNP3FUNC].Setup = DetectDNP3FuncSetup;
@ -511,7 +511,7 @@ static void DetectDNP3IndRegister(void)
sigmatch_table[DETECT_AL_DNP3IND].name = "dnp3_ind";
sigmatch_table[DETECT_AL_DNP3IND].alias = "dnp3.ind";
sigmatch_table[DETECT_AL_DNP3IND].desc = "match on the DNP3 internal indicator flags in the response application header";
sigmatch_table[DETECT_AL_DNP3IND].url = DOC_URL DOC_VERSION "/rules/dnp3-keywords.html#dnp3-ind";
sigmatch_table[DETECT_AL_DNP3IND].url = "/rules/dnp3-keywords.html#dnp3-ind";
sigmatch_table[DETECT_AL_DNP3IND].Match = NULL;
sigmatch_table[DETECT_AL_DNP3IND].AppLayerTxMatch = DetectDNP3IndMatch;
sigmatch_table[DETECT_AL_DNP3IND].Setup = DetectDNP3IndSetup;
@ -529,7 +529,7 @@ static void DetectDNP3ObjRegister(void)
sigmatch_table[DETECT_AL_DNP3OBJ].name = "dnp3_obj";
sigmatch_table[DETECT_AL_DNP3OBJ].alias = "dnp3.obj";
sigmatch_table[DETECT_AL_DNP3OBJ].desc = "match on the DNP3 application data objects";
sigmatch_table[DETECT_AL_DNP3OBJ].url = DOC_URL DOC_VERSION "/rules/dnp3-keywords.html#dnp3-obj";
sigmatch_table[DETECT_AL_DNP3OBJ].url = "/rules/dnp3-keywords.html#dnp3-obj";
sigmatch_table[DETECT_AL_DNP3OBJ].Match = NULL;
sigmatch_table[DETECT_AL_DNP3OBJ].AppLayerTxMatch = DetectDNP3ObjMatch;
sigmatch_table[DETECT_AL_DNP3OBJ].Setup = DetectDNP3ObjSetup;
@ -559,7 +559,7 @@ static void DetectDNP3DataRegister(void)
sigmatch_table[DETECT_AL_DNP3DATA].name = "dnp3.data";
sigmatch_table[DETECT_AL_DNP3DATA].alias = "dnp3_data";
sigmatch_table[DETECT_AL_DNP3DATA].desc = "make the following content options to match on the re-assembled application buffer";
sigmatch_table[DETECT_AL_DNP3DATA].url = DOC_URL DOC_VERSION "/rules/dnp3-keywords.html#dnp3-data";
sigmatch_table[DETECT_AL_DNP3DATA].url = "/rules/dnp3-keywords.html#dnp3-data";
sigmatch_table[DETECT_AL_DNP3DATA].Setup = DetectDNP3DataSetup;
sigmatch_table[DETECT_AL_DNP3DATA].RegisterTests =
DetectDNP3DataRegisterTests;

@ -208,7 +208,7 @@ void DetectDnsQueryRegister (void)
sigmatch_table[DETECT_AL_DNS_QUERY].name = "dns.query";
sigmatch_table[DETECT_AL_DNS_QUERY].alias = "dns_query";
sigmatch_table[DETECT_AL_DNS_QUERY].desc = "sticky buffer to match DNS query-buffer";
sigmatch_table[DETECT_AL_DNS_QUERY].url = DOC_URL DOC_VERSION "/rules/dns-keywords.html#dns-query";
sigmatch_table[DETECT_AL_DNS_QUERY].url = "/rules/dns-keywords.html#dns-query";
sigmatch_table[DETECT_AL_DNS_QUERY].Setup = DetectDnsQuerySetup;
sigmatch_table[DETECT_AL_DNS_QUERY].RegisterTests = DetectDnsQueryRegisterTests;
sigmatch_table[DETECT_AL_DNS_QUERY].flags |= SIGMATCH_NOOPT;

@ -65,7 +65,7 @@ void DetectDsizeRegister (void)
{
sigmatch_table[DETECT_DSIZE].name = "dsize";
sigmatch_table[DETECT_DSIZE].desc = "match on the size of the packet payload";
sigmatch_table[DETECT_DSIZE].url = DOC_URL DOC_VERSION "/rules/payload-keywords.html#dsize";
sigmatch_table[DETECT_DSIZE].url = "/rules/payload-keywords.html#dsize";
sigmatch_table[DETECT_DSIZE].Match = DetectDsizeMatch;
sigmatch_table[DETECT_DSIZE].Setup = DetectDsizeSetup;
sigmatch_table[DETECT_DSIZE].Free = DetectDsizeFree;

@ -315,7 +315,7 @@ static void SigMultilinePrint(int i, const char *prefix)
printf("%sFeatures: ", prefix);
PrintFeatureList(&sigmatch_table[i], ',');
if (sigmatch_table[i].url) {
printf("\n%sDocumentation: %s", prefix, sigmatch_table[i].url);
printf("\n%sDocumentation: %s%s", prefix, GetDocURL(), sigmatch_table[i].url);
}
if (sigmatch_table[i].alternative) {
printf("\n%sReplaced by: %s", prefix, sigmatch_table[sigmatch_table[i].alternative].name);
@ -363,7 +363,7 @@ void SigTableList(const char *keyword)
PrintFeatureList(&sigmatch_table[i], ':');
printf(";");
if (sigmatch_table[i].url) {
printf("%s", sigmatch_table[i].url);
printf("%s%s", GetDocURL(), sigmatch_table[i].url);
}
printf(";");
printf("\n");

@ -165,7 +165,7 @@ void DetectFastPatternRegister(void)
{
sigmatch_table[DETECT_FAST_PATTERN].name = "fast_pattern";
sigmatch_table[DETECT_FAST_PATTERN].desc = "force using preceding content in the multi pattern matcher";
sigmatch_table[DETECT_FAST_PATTERN].url = DOC_URL DOC_VERSION "/rules/prefilter-keywords.html#fast-pattern";
sigmatch_table[DETECT_FAST_PATTERN].url = "/rules/prefilter-keywords.html#fast-pattern";
sigmatch_table[DETECT_FAST_PATTERN].Match = NULL;
sigmatch_table[DETECT_FAST_PATTERN].Setup = DetectFastPatternSetup;
sigmatch_table[DETECT_FAST_PATTERN].Free = NULL;

@ -83,7 +83,7 @@ void DetectFiledataRegister(void)
sigmatch_table[DETECT_FILE_DATA].name = "file.data";
sigmatch_table[DETECT_FILE_DATA].alias = "file_data";
sigmatch_table[DETECT_FILE_DATA].desc = "make content keywords match on file data";
sigmatch_table[DETECT_FILE_DATA].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#file-data";
sigmatch_table[DETECT_FILE_DATA].url = "/rules/http-keywords.html#file-data";
sigmatch_table[DETECT_FILE_DATA].Setup = DetectFiledataSetup;
#ifdef UNITTESTS
sigmatch_table[DETECT_FILE_DATA].RegisterTests = DetectFiledataRegisterTests;

@ -65,7 +65,7 @@ void DetectFileextRegister(void)
{
sigmatch_table[DETECT_FILEEXT].name = "fileext";
sigmatch_table[DETECT_FILEEXT].desc = "match on the extension of a file name";
sigmatch_table[DETECT_FILEEXT].url = DOC_URL DOC_VERSION "/rules/file-keywords.html#fileext";
sigmatch_table[DETECT_FILEEXT].url = "/rules/file-keywords.html#fileext";
sigmatch_table[DETECT_FILEEXT].FileMatch = DetectFileextMatch;
sigmatch_table[DETECT_FILEEXT].Setup = DetectFileextSetup;
sigmatch_table[DETECT_FILEEXT].Free = DetectFileextFree;

@ -71,7 +71,7 @@ void DetectFilemagicRegister(void)
{
sigmatch_table[DETECT_FILEMAGIC].name = "filemagic";
sigmatch_table[DETECT_FILEMAGIC].desc = "match on the information libmagic returns about a file";
sigmatch_table[DETECT_FILEMAGIC].url = DOC_URL DOC_VERSION "/rules/file-keywords.html#filemagic";
sigmatch_table[DETECT_FILEMAGIC].url = "/rules/file-keywords.html#filemagic";
sigmatch_table[DETECT_FILEMAGIC].Setup = DetectFilemagicSetupNoSupport;
sigmatch_table[DETECT_FILEMAGIC].flags = SIGMATCH_QUOTES_MANDATORY|SIGMATCH_HANDLE_NEGATION;
}
@ -106,7 +106,7 @@ void DetectFilemagicRegister(void)
{
sigmatch_table[DETECT_FILEMAGIC].name = "filemagic";
sigmatch_table[DETECT_FILEMAGIC].desc = "match on the information libmagic returns about a file";
sigmatch_table[DETECT_FILEMAGIC].url = DOC_URL DOC_VERSION "/rules/file-keywords.html#filemagic";
sigmatch_table[DETECT_FILEMAGIC].url = "/rules/file-keywords.html#filemagic";
sigmatch_table[DETECT_FILEMAGIC].FileMatch = DetectFilemagicMatch;
sigmatch_table[DETECT_FILEMAGIC].Setup = DetectFilemagicSetup;
sigmatch_table[DETECT_FILEMAGIC].Free = DetectFilemagicFree;
@ -116,7 +116,7 @@ void DetectFilemagicRegister(void)
sigmatch_table[DETECT_FILE_MAGIC].name = "file.magic";
sigmatch_table[DETECT_FILE_MAGIC].desc = "sticky buffer to match on the file magic";
sigmatch_table[DETECT_FILE_MAGIC].url = DOC_URL DOC_VERSION "/rules/file-keywords.html#filemagic";
sigmatch_table[DETECT_FILE_MAGIC].url = "/rules/file-keywords.html#filemagic";
sigmatch_table[DETECT_FILE_MAGIC].Setup = DetectFilemagicSetupSticky;
sigmatch_table[DETECT_FILE_MAGIC].flags = SIGMATCH_NOOPT|SIGMATCH_INFO_STICKY_BUFFER;

@ -69,7 +69,7 @@ void DetectFileMd5Register(void)
{
sigmatch_table[DETECT_FILEMD5].name = "filemd5";
sigmatch_table[DETECT_FILEMD5].desc = "match file MD5 against list of MD5 checksums";
sigmatch_table[DETECT_FILEMD5].url = DOC_URL DOC_VERSION "/rules/file-keywords.html#filemd5";
sigmatch_table[DETECT_FILEMD5].url = "/rules/file-keywords.html#filemd5";
sigmatch_table[DETECT_FILEMD5].FileMatch = DetectFileHashMatch;
sigmatch_table[DETECT_FILEMD5].Setup = DetectFileMd5Setup;
sigmatch_table[DETECT_FILEMD5].Free = DetectFileHashFree;

@ -79,7 +79,7 @@ void DetectFilenameRegister(void)
{
sigmatch_table[DETECT_FILENAME].name = "filename";
sigmatch_table[DETECT_FILENAME].desc = "match on the file name";
sigmatch_table[DETECT_FILENAME].url = DOC_URL DOC_VERSION "/rules/file-keywords.html#filename";
sigmatch_table[DETECT_FILENAME].url = "/rules/file-keywords.html#filename";
sigmatch_table[DETECT_FILENAME].FileMatch = DetectFilenameMatch;
sigmatch_table[DETECT_FILENAME].Setup = DetectFilenameSetup;
sigmatch_table[DETECT_FILENAME].Free = DetectFilenameFree;
@ -89,7 +89,7 @@ void DetectFilenameRegister(void)
sigmatch_table[DETECT_FILE_NAME].name = "file.name";
sigmatch_table[DETECT_FILE_NAME].desc = "sticky buffer to match on the file name";
sigmatch_table[DETECT_FILE_NAME].url = DOC_URL DOC_VERSION "/rules/file-keywords.html#filename";
sigmatch_table[DETECT_FILE_NAME].url = "/rules/file-keywords.html#filename";
sigmatch_table[DETECT_FILE_NAME].Setup = DetectFilenameSetupSticky;
sigmatch_table[DETECT_FILE_NAME].flags = SIGMATCH_NOOPT|SIGMATCH_INFO_STICKY_BUFFER;

@ -69,7 +69,7 @@ void DetectFileSha1Register(void)
{
sigmatch_table[DETECT_FILESHA1].name = "filesha1";
sigmatch_table[DETECT_FILESHA1].desc = "match file SHA-1 against list of SHA-1 checksums";
sigmatch_table[DETECT_FILESHA1].url = DOC_URL DOC_VERSION "/rules/file-keywords.html#filesha1";
sigmatch_table[DETECT_FILESHA1].url = "/rules/file-keywords.html#filesha1";
sigmatch_table[DETECT_FILESHA1].FileMatch = DetectFileHashMatch;
sigmatch_table[DETECT_FILESHA1].Setup = DetectFileSha1Setup;
sigmatch_table[DETECT_FILESHA1].Free = DetectFileHashFree;

@ -69,7 +69,7 @@ void DetectFileSha256Register(void)
{
sigmatch_table[DETECT_FILESHA256].name = "filesha256";
sigmatch_table[DETECT_FILESHA256].desc = "match file SHA-256 against list of SHA-256 checksums";
sigmatch_table[DETECT_FILESHA256].url = DOC_URL DOC_VERSION "/rules/file-keywords.html#filesha256";
sigmatch_table[DETECT_FILESHA256].url = "/rules/file-keywords.html#filesha256";
sigmatch_table[DETECT_FILESHA256].FileMatch = DetectFileHashMatch;
sigmatch_table[DETECT_FILESHA256].Setup = DetectFileSha256Setup;
sigmatch_table[DETECT_FILESHA256].Free = DetectFileHashFree;

@ -64,7 +64,7 @@ void DetectFilesizeRegister(void)
{
sigmatch_table[DETECT_FILESIZE].name = "filesize";
sigmatch_table[DETECT_FILESIZE].desc = "match on the size of the file as it is being transferred";
sigmatch_table[DETECT_FILESIZE].url = DOC_URL DOC_VERSION "/rules/file-keywords.html#filesize";
sigmatch_table[DETECT_FILESIZE].url = "/rules/file-keywords.html#filesize";
sigmatch_table[DETECT_FILESIZE].FileMatch = DetectFilesizeMatch;
sigmatch_table[DETECT_FILESIZE].Setup = DetectFilesizeSetup;
sigmatch_table[DETECT_FILESIZE].Free = DetectFilesizeFree;

@ -77,7 +77,7 @@ void DetectFilestoreRegister(void)
{
sigmatch_table[DETECT_FILESTORE].name = "filestore";
sigmatch_table[DETECT_FILESTORE].desc = "stores files to disk if the rule matched";
sigmatch_table[DETECT_FILESTORE].url = DOC_URL DOC_VERSION "/rules/file-keywords.html#filestore";
sigmatch_table[DETECT_FILESTORE].url = "/rules/file-keywords.html#filestore";
sigmatch_table[DETECT_FILESTORE].FileMatch = DetectFilestoreMatch;
sigmatch_table[DETECT_FILESTORE].Setup = DetectFilestoreSetup;
sigmatch_table[DETECT_FILESTORE].Free = DetectFilestoreFree;

@ -64,7 +64,7 @@ void DetectFlowRegister (void)
{
sigmatch_table[DETECT_FLOW].name = "flow";
sigmatch_table[DETECT_FLOW].desc = "match on direction and state of the flow";
sigmatch_table[DETECT_FLOW].url = DOC_URL DOC_VERSION "/rules/flow-keywords.html#flow";
sigmatch_table[DETECT_FLOW].url = "/rules/flow-keywords.html#flow";
sigmatch_table[DETECT_FLOW].Match = DetectFlowMatch;
sigmatch_table[DETECT_FLOW].Setup = DetectFlowSetup;
sigmatch_table[DETECT_FLOW].Free = DetectFlowFree;

@ -61,7 +61,7 @@ void DetectFlowbitsRegister (void)
{
sigmatch_table[DETECT_FLOWBITS].name = "flowbits";
sigmatch_table[DETECT_FLOWBITS].desc = "operate on flow flag";
sigmatch_table[DETECT_FLOWBITS].url = DOC_URL DOC_VERSION "/rules/flow-keywords.html#flowbits";
sigmatch_table[DETECT_FLOWBITS].url = "/rules/flow-keywords.html#flowbits";
sigmatch_table[DETECT_FLOWBITS].Match = DetectFlowbitMatch;
sigmatch_table[DETECT_FLOWBITS].Setup = DetectFlowbitSetup;
sigmatch_table[DETECT_FLOWBITS].Free = DetectFlowbitFree;

@ -62,7 +62,7 @@ void DetectFlowintRegister(void)
{
sigmatch_table[DETECT_FLOWINT].name = "flowint";
sigmatch_table[DETECT_FLOWINT].desc = "operate on a per-flow integer";
sigmatch_table[DETECT_FLOWINT].url = DOC_URL DOC_VERSION "/rules/flow-keywords.html#flowint";
sigmatch_table[DETECT_FLOWINT].url = "/rules/flow-keywords.html#flowint";
sigmatch_table[DETECT_FLOWINT].Match = DetectFlowintMatch;
sigmatch_table[DETECT_FLOWINT].Setup = DetectFlowintSetup;
sigmatch_table[DETECT_FLOWINT].Free = DetectFlowintFree;

@ -83,7 +83,7 @@ void DetectFragBitsRegister (void)
{
sigmatch_table[DETECT_FRAGBITS].name = "fragbits";
sigmatch_table[DETECT_FRAGBITS].desc = "check if the fragmentation and reserved bits are set in the IP header";
sigmatch_table[DETECT_FRAGBITS].url = DOC_URL DOC_VERSION "/rules/header-keywords.html#fragbits-ip-fragmentation";
sigmatch_table[DETECT_FRAGBITS].url = "/rules/header-keywords.html#fragbits-ip-fragmentation";
sigmatch_table[DETECT_FRAGBITS].Match = DetectFragBitsMatch;
sigmatch_table[DETECT_FRAGBITS].Setup = DetectFragBitsSetup;
sigmatch_table[DETECT_FRAGBITS].Free = DetectFragBitsFree;

@ -59,7 +59,7 @@ void DetectFragOffsetRegister (void)
{
sigmatch_table[DETECT_FRAGOFFSET].name = "fragoffset";
sigmatch_table[DETECT_FRAGOFFSET].desc = "match on specific decimal values of the IP fragment offset field";
sigmatch_table[DETECT_FRAGOFFSET].url = DOC_URL DOC_VERSION "/rules/header-keywords.html#fragoffset";
sigmatch_table[DETECT_FRAGOFFSET].url = "/rules/header-keywords.html#fragoffset";
sigmatch_table[DETECT_FRAGOFFSET].Match = DetectFragOffsetMatch;
sigmatch_table[DETECT_FRAGOFFSET].Setup = DetectFragOffsetSetup;
sigmatch_table[DETECT_FRAGOFFSET].Free = DetectFragOffsetFree;

@ -72,7 +72,7 @@ void DetectFtpbounceRegister(void)
sigmatch_table[DETECT_FTPBOUNCE].Setup = DetectFtpbounceSetup;
sigmatch_table[DETECT_FTPBOUNCE].AppLayerTxMatch = DetectFtpbounceALMatch;
sigmatch_table[DETECT_FTPBOUNCE].RegisterTests = DetectFtpbounceRegisterTests;
sigmatch_table[DETECT_FTPBOUNCE].url = DOC_URL DOC_VERSION "/rules/ftp-keywords.html#ftpbounce";
sigmatch_table[DETECT_FTPBOUNCE].url = "/rules/ftp-keywords.html#ftpbounce";
sigmatch_table[DETECT_FTPBOUNCE].flags = SIGMATCH_NOOPT;
g_ftp_request_list_id = DetectBufferTypeRegister("ftp_request");

@ -64,7 +64,7 @@ void DetectFtpdataRegister(void) {
sigmatch_table[DETECT_FTPDATA].name = "ftpdata_command";
/* description: listed in "suricata --list-keywords=all" */
sigmatch_table[DETECT_FTPDATA].desc = "match FTP command triggering a FTP data channel";
sigmatch_table[DETECT_FTPDATA].url = DOC_URL DOC_VERSION "/rules/ftp-keywords.html#ftpdata-command";
sigmatch_table[DETECT_FTPDATA].url = "/rules/ftp-keywords.html#ftpdata-command";
sigmatch_table[DETECT_FTPDATA].AppLayerTxMatch = DetectFtpdataMatch;
/* setup function is called during signature parsing, when the ftpcommand
* keyword is encountered in the rule */

@ -56,7 +56,7 @@ void DetectGeoipRegister(void)
{
sigmatch_table[DETECT_GEOIP].name = "geoip";
sigmatch_table[DETECT_GEOIP].desc = "match on the source, destination or source and destination IP addresses of network traffic, and to see to which country it belongs";
sigmatch_table[DETECT_GEOIP].url = DOC_URL DOC_VERSION "/rules/header-keywords.html#geoip";
sigmatch_table[DETECT_GEOIP].url = "/rules/header-keywords.html#geoip";
sigmatch_table[DETECT_GEOIP].Setup = DetectGeoipSetupNoSupport;
sigmatch_table[DETECT_GEOIP].Free = NULL;
sigmatch_table[DETECT_GEOIP].RegisterTests = NULL;
@ -79,7 +79,7 @@ static void DetectGeoipDataFree(DetectEngineCtx *, void *);
void DetectGeoipRegister(void)
{
sigmatch_table[DETECT_GEOIP].name = "geoip";
sigmatch_table[DETECT_GEOIP].url = DOC_URL DOC_VERSION "/rules/header-keywords.html#geoip";
sigmatch_table[DETECT_GEOIP].url = "/rules/header-keywords.html#geoip";
sigmatch_table[DETECT_GEOIP].desc = "keyword to match on country of src and or dst IP";
sigmatch_table[DETECT_GEOIP].Match = DetectGeoipMatch;
sigmatch_table[DETECT_GEOIP].Setup = DetectGeoipSetup;

@ -46,7 +46,7 @@ void DetectGidRegister (void)
{
sigmatch_table[DETECT_GID].name = "gid";
sigmatch_table[DETECT_GID].desc = "give different groups of signatures another id value";
sigmatch_table[DETECT_GID].url = DOC_URL DOC_VERSION "/rules/meta.html#gid-group-id";
sigmatch_table[DETECT_GID].url = "/rules/meta.html#gid-group-id";
sigmatch_table[DETECT_GID].Match = NULL;
sigmatch_table[DETECT_GID].Setup = DetectGidSetup;
sigmatch_table[DETECT_GID].Free = NULL;

@ -77,7 +77,7 @@ void DetectHostbitsRegister (void)
{
sigmatch_table[DETECT_HOSTBITS].name = "hostbits";
sigmatch_table[DETECT_HOSTBITS].desc = "operate on host flag";
// sigmatch_table[DETECT_HOSTBITS].url = DOC_URL DOC_VERSION "/rules/flow-keywords.html#flowbits";
// sigmatch_table[DETECT_HOSTBITS].url = "/rules/flow-keywords.html#flowbits";
sigmatch_table[DETECT_HOSTBITS].Match = DetectHostbitMatch;
sigmatch_table[DETECT_HOSTBITS].Setup = DetectHostbitSetup;
sigmatch_table[DETECT_HOSTBITS].Free = DetectHostbitFree;

@ -81,7 +81,7 @@ void DetectHttpClientBodyRegister(void)
/* http_client_body content modifier */
sigmatch_table[DETECT_AL_HTTP_CLIENT_BODY].name = "http_client_body";
sigmatch_table[DETECT_AL_HTTP_CLIENT_BODY].desc = "content modifier to match only on HTTP request-body";
sigmatch_table[DETECT_AL_HTTP_CLIENT_BODY].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-client-body";
sigmatch_table[DETECT_AL_HTTP_CLIENT_BODY].url = "/rules/http-keywords.html#http-client-body";
sigmatch_table[DETECT_AL_HTTP_CLIENT_BODY].Setup = DetectHttpClientBodySetup;
#ifdef UNITTESTS
sigmatch_table[DETECT_AL_HTTP_CLIENT_BODY].RegisterTests = DetectHttpClientBodyRegisterTests;
@ -93,7 +93,7 @@ void DetectHttpClientBodyRegister(void)
/* http.request_body sticky buffer */
sigmatch_table[DETECT_HTTP_REQUEST_BODY].name = "http.request_body";
sigmatch_table[DETECT_HTTP_REQUEST_BODY].desc = "sticky buffer to match the HTTP request body buffer";
sigmatch_table[DETECT_HTTP_REQUEST_BODY].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-client-body";
sigmatch_table[DETECT_HTTP_REQUEST_BODY].url = "/rules/http-keywords.html#http-client-body";
sigmatch_table[DETECT_HTTP_REQUEST_BODY].Setup = DetectHttpClientBodySetupSticky;
sigmatch_table[DETECT_HTTP_REQUEST_BODY].flags |= SIGMATCH_NOOPT;
sigmatch_table[DETECT_HTTP_REQUEST_BODY].flags |= SIGMATCH_INFO_STICKY_BUFFER;

@ -85,7 +85,7 @@ void DetectHttpCookieRegister(void)
/* http_cookie content modifier */
sigmatch_table[DETECT_AL_HTTP_COOKIE].name = "http_cookie";
sigmatch_table[DETECT_AL_HTTP_COOKIE].desc = "content modifier to match only on the HTTP cookie-buffer";
sigmatch_table[DETECT_AL_HTTP_COOKIE].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-cookie";
sigmatch_table[DETECT_AL_HTTP_COOKIE].url = "/rules/http-keywords.html#http-cookie";
sigmatch_table[DETECT_AL_HTTP_COOKIE].Setup = DetectHttpCookieSetup;
#ifdef UNITTESTS
sigmatch_table[DETECT_AL_HTTP_COOKIE].RegisterTests = DetectHttpCookieRegisterTests;
@ -97,7 +97,7 @@ void DetectHttpCookieRegister(void)
/* http.cookie sticky buffer */
sigmatch_table[DETECT_HTTP_COOKIE].name = "http.cookie";
sigmatch_table[DETECT_HTTP_COOKIE].desc = "sticky buffer to match on the HTTP Cookie/Set-Cookie buffers";
sigmatch_table[DETECT_HTTP_COOKIE].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-cookie";
sigmatch_table[DETECT_HTTP_COOKIE].url = "/rules/http-keywords.html#http-cookie";
sigmatch_table[DETECT_HTTP_COOKIE].Setup = DetectHttpCookieSetupSticky;
sigmatch_table[DETECT_HTTP_COOKIE].flags |= SIGMATCH_NOOPT;
sigmatch_table[DETECT_HTTP_COOKIE].flags |= SIGMATCH_INFO_STICKY_BUFFER;

@ -393,7 +393,7 @@ void DetectHttpHeaderNamesRegister(void)
sigmatch_table[DETECT_AL_HTTP_HEADER_NAMES].name = KEYWORD_NAME;
sigmatch_table[DETECT_AL_HTTP_HEADER_NAMES].alias = KEYWORD_NAME_LEGACY;
sigmatch_table[DETECT_AL_HTTP_HEADER_NAMES].desc = BUFFER_NAME " sticky buffer";
sigmatch_table[DETECT_AL_HTTP_HEADER_NAMES].url = DOC_URL DOC_VERSION "/rules/" KEYWORD_DOC;
sigmatch_table[DETECT_AL_HTTP_HEADER_NAMES].url = "/rules/" KEYWORD_DOC;
sigmatch_table[DETECT_AL_HTTP_HEADER_NAMES].Setup = DetectHttpHeaderNamesSetup;
sigmatch_table[DETECT_AL_HTTP_HEADER_NAMES].flags |= SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER;

@ -408,7 +408,7 @@ void DetectHttpHeaderRegister(void)
/* http_header content modifier */
sigmatch_table[DETECT_AL_HTTP_HEADER].name = "http_header";
sigmatch_table[DETECT_AL_HTTP_HEADER].desc = "content modifier to match only on the HTTP header-buffer";
sigmatch_table[DETECT_AL_HTTP_HEADER].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-header-and-http-raw-header";
sigmatch_table[DETECT_AL_HTTP_HEADER].url = "/rules/http-keywords.html#http-header-and-http-raw-header";
sigmatch_table[DETECT_AL_HTTP_HEADER].Setup = DetectHttpHeaderSetup;
#ifdef UNITTESTS
sigmatch_table[DETECT_AL_HTTP_HEADER].RegisterTests = DetectHttpHeaderRegisterTests;
@ -420,7 +420,7 @@ void DetectHttpHeaderRegister(void)
/* http.header sticky buffer */
sigmatch_table[DETECT_HTTP_HEADER].name = "http.header";
sigmatch_table[DETECT_HTTP_HEADER].desc = "sticky buffer to match on the normalized HTTP header-buffer";
sigmatch_table[DETECT_HTTP_HEADER].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-header-and-http-raw-header";
sigmatch_table[DETECT_HTTP_HEADER].url = "/rules/http-keywords.html#http-header-and-http-raw-header";
sigmatch_table[DETECT_HTTP_HEADER].Setup = DetectHttpHeaderSetupSticky;
sigmatch_table[DETECT_HTTP_HEADER].flags |= SIGMATCH_NOOPT;
sigmatch_table[DETECT_HTTP_HEADER].flags |= SIGMATCH_INFO_STICKY_BUFFER;

@ -142,7 +142,7 @@ static void DetectHttpHeadersRegisterStub(void)
sigmatch_table[KEYWORD_ID].alias = KEYWORD_NAME_LEGACY;
#endif
sigmatch_table[KEYWORD_ID].desc = KEYWORD_NAME " sticky buffer for the " BUFFER_DESC;
sigmatch_table[KEYWORD_ID].url = DOC_URL DOC_VERSION "/rules/" KEYWORD_DOC;
sigmatch_table[KEYWORD_ID].url = "/rules/" KEYWORD_DOC;
sigmatch_table[KEYWORD_ID].Setup = DetectHttpHeadersSetupSticky;
sigmatch_table[KEYWORD_ID].flags |= SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER;

@ -84,7 +84,7 @@ void DetectHttpHHRegister(void)
/* http_host content modifier */
sigmatch_table[DETECT_AL_HTTP_HOST].name = "http_host";
sigmatch_table[DETECT_AL_HTTP_HOST].desc = "content modifier to match on the HTTP hostname";
sigmatch_table[DETECT_AL_HTTP_HOST].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-host-and-http-raw-host";
sigmatch_table[DETECT_AL_HTTP_HOST].url = "/rules/http-keywords.html#http-host-and-http-raw-host";
sigmatch_table[DETECT_AL_HTTP_HOST].Setup = DetectHttpHHSetup;
#ifdef UNITTESTS
sigmatch_table[DETECT_AL_HTTP_HOST].RegisterTests = DetectHttpHHRegisterTests;
@ -95,7 +95,7 @@ void DetectHttpHHRegister(void)
/* http.host sticky buffer */
sigmatch_table[DETECT_HTTP_HOST].name = "http.host";
sigmatch_table[DETECT_HTTP_HOST].desc = "sticky buffer to match on the HTTP Host buffer";
sigmatch_table[DETECT_HTTP_HOST].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-host-and-http-raw-host";
sigmatch_table[DETECT_HTTP_HOST].url = "/rules/http-keywords.html#http-host-and-http-raw-host";
sigmatch_table[DETECT_HTTP_HOST].Setup = DetectHttpHostSetup;
sigmatch_table[DETECT_HTTP_HOST].flags |= SIGMATCH_NOOPT|SIGMATCH_INFO_STICKY_BUFFER;
@ -118,7 +118,7 @@ void DetectHttpHHRegister(void)
/* http_raw_host content modifier */
sigmatch_table[DETECT_AL_HTTP_RAW_HOST].name = "http_raw_host";
sigmatch_table[DETECT_AL_HTTP_RAW_HOST].desc = "content modifier to match on the HTTP host header or the raw hostname from the HTTP uri";
sigmatch_table[DETECT_AL_HTTP_RAW_HOST].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-host-and-http-raw-host";
sigmatch_table[DETECT_AL_HTTP_RAW_HOST].url = "/rules/http-keywords.html#http-host-and-http-raw-host";
sigmatch_table[DETECT_AL_HTTP_RAW_HOST].Setup = DetectHttpHRHSetup;
sigmatch_table[DETECT_AL_HTTP_RAW_HOST].flags |= SIGMATCH_NOOPT|SIGMATCH_INFO_CONTENT_MODIFIER;
sigmatch_table[DETECT_AL_HTTP_RAW_HOST].alternative = DETECT_HTTP_HOST_RAW;
@ -126,7 +126,7 @@ void DetectHttpHHRegister(void)
/* http.host sticky buffer */
sigmatch_table[DETECT_HTTP_HOST_RAW].name = "http.host.raw";
sigmatch_table[DETECT_HTTP_HOST_RAW].desc = "sticky buffer to match on the HTTP host header or the raw hostname from the HTTP uri";
sigmatch_table[DETECT_HTTP_HOST_RAW].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-host-and-http-raw-host";
sigmatch_table[DETECT_HTTP_HOST_RAW].url = "/rules/http-keywords.html#http-host-and-http-raw-host";
sigmatch_table[DETECT_HTTP_HOST_RAW].Setup = DetectHttpHostRawSetupSticky;
sigmatch_table[DETECT_HTTP_HOST_RAW].flags |= SIGMATCH_NOOPT|SIGMATCH_INFO_STICKY_BUFFER;

@ -79,7 +79,7 @@ void DetectHttpMethodRegister(void)
/* http_method content modifier */
sigmatch_table[DETECT_AL_HTTP_METHOD].name = "http_method";
sigmatch_table[DETECT_AL_HTTP_METHOD].desc = "content modifier to match only on the HTTP method-buffer";
sigmatch_table[DETECT_AL_HTTP_METHOD].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-method";
sigmatch_table[DETECT_AL_HTTP_METHOD].url = "/rules/http-keywords.html#http-method";
sigmatch_table[DETECT_AL_HTTP_METHOD].Match = NULL;
sigmatch_table[DETECT_AL_HTTP_METHOD].Setup = DetectHttpMethodSetup;
#ifdef UNITTESTS
@ -91,7 +91,7 @@ void DetectHttpMethodRegister(void)
/* http.method sticky buffer */
sigmatch_table[DETECT_HTTP_METHOD].name = "http.method";
sigmatch_table[DETECT_HTTP_METHOD].desc = "sticky buffer to match specifically and only on the HTTP method buffer";
sigmatch_table[DETECT_HTTP_METHOD].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-method";
sigmatch_table[DETECT_HTTP_METHOD].url = "/rules/http-keywords.html#http-method";
sigmatch_table[DETECT_HTTP_METHOD].Setup = DetectHttpMethodSetupSticky;
sigmatch_table[DETECT_HTTP_METHOD].flags |= SIGMATCH_NOOPT|SIGMATCH_INFO_STICKY_BUFFER;

@ -124,7 +124,7 @@ void DetectHttpProtocolRegister(void)
sigmatch_table[DETECT_AL_HTTP_PROTOCOL].name = KEYWORD_NAME;
sigmatch_table[DETECT_AL_HTTP_PROTOCOL].alias = KEYWORD_NAME_LEGACY;
sigmatch_table[DETECT_AL_HTTP_PROTOCOL].desc = BUFFER_NAME " sticky buffer";
sigmatch_table[DETECT_AL_HTTP_PROTOCOL].url = DOC_URL DOC_VERSION "/rules/" KEYWORD_DOC;
sigmatch_table[DETECT_AL_HTTP_PROTOCOL].url = "/rules/" KEYWORD_DOC;
sigmatch_table[DETECT_AL_HTTP_PROTOCOL].Setup = DetectHttpProtocolSetup;
sigmatch_table[DETECT_AL_HTTP_PROTOCOL].flags |= SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_NOOPT;

@ -78,7 +78,7 @@ void DetectHttpRawHeaderRegister(void)
/* http_raw_header content modifier */
sigmatch_table[DETECT_AL_HTTP_RAW_HEADER].name = "http_raw_header";
sigmatch_table[DETECT_AL_HTTP_RAW_HEADER].desc = "content modifier to match the raw HTTP header buffer";
sigmatch_table[DETECT_AL_HTTP_RAW_HEADER].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-header-and-http-raw-header";
sigmatch_table[DETECT_AL_HTTP_RAW_HEADER].url = "/rules/http-keywords.html#http-header-and-http-raw-header";
sigmatch_table[DETECT_AL_HTTP_RAW_HEADER].Setup = DetectHttpRawHeaderSetup;
#ifdef UNITTESTS
sigmatch_table[DETECT_AL_HTTP_RAW_HEADER].RegisterTests = DetectHttpRawHeaderRegisterTests;
@ -89,7 +89,7 @@ void DetectHttpRawHeaderRegister(void)
/* http.header.raw sticky buffer */
sigmatch_table[DETECT_HTTP_RAW_HEADER].name = "http.header.raw";
sigmatch_table[DETECT_HTTP_RAW_HEADER].desc = "sticky buffer to match the raw HTTP header buffer";
sigmatch_table[DETECT_HTTP_RAW_HEADER].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-header-and-http-raw-header";
sigmatch_table[DETECT_HTTP_RAW_HEADER].url = "/rules/http-keywords.html#http-header-and-http-raw-header";
sigmatch_table[DETECT_HTTP_RAW_HEADER].Setup = DetectHttpRawHeaderSetupSticky;
sigmatch_table[DETECT_HTTP_RAW_HEADER].flags |= SIGMATCH_NOOPT|SIGMATCH_INFO_STICKY_BUFFER;

@ -76,7 +76,7 @@ void DetectHttpRequestLineRegister(void)
sigmatch_table[DETECT_AL_HTTP_REQUEST_LINE].name = "http.request_line";
sigmatch_table[DETECT_AL_HTTP_REQUEST_LINE].alias = "http_request_line";
sigmatch_table[DETECT_AL_HTTP_REQUEST_LINE].desc = "sticky buffer to match on the HTTP request line";
sigmatch_table[DETECT_AL_HTTP_REQUEST_LINE].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-request-line";
sigmatch_table[DETECT_AL_HTTP_REQUEST_LINE].url = "/rules/http-keywords.html#http-request-line";
sigmatch_table[DETECT_AL_HTTP_REQUEST_LINE].Match = NULL;
sigmatch_table[DETECT_AL_HTTP_REQUEST_LINE].Setup = DetectHttpRequestLineSetup;
sigmatch_table[DETECT_AL_HTTP_REQUEST_LINE].RegisterTests = DetectHttpRequestLineRegisterTests;

@ -76,7 +76,7 @@ void DetectHttpResponseLineRegister(void)
sigmatch_table[DETECT_AL_HTTP_RESPONSE_LINE].name = "http.response_line";
sigmatch_table[DETECT_AL_HTTP_RESPONSE_LINE].alias = "http_response_line";
sigmatch_table[DETECT_AL_HTTP_RESPONSE_LINE].desc = "content modifier to match only on the HTTP response line";
sigmatch_table[DETECT_AL_HTTP_RESPONSE_LINE].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-response-line";
sigmatch_table[DETECT_AL_HTTP_RESPONSE_LINE].url = "/rules/http-keywords.html#http-response-line";
sigmatch_table[DETECT_AL_HTTP_RESPONSE_LINE].Setup = DetectHttpResponseLineSetup;
sigmatch_table[DETECT_AL_HTTP_RESPONSE_LINE].RegisterTests = DetectHttpResponseLineRegisterTests;

@ -74,7 +74,7 @@ void DetectHttpServerBodyRegister(void)
/* http_server_body content modifier */
sigmatch_table[DETECT_AL_HTTP_SERVER_BODY].name = "http_server_body";
sigmatch_table[DETECT_AL_HTTP_SERVER_BODY].desc = "content modifier to match on the HTTP response-body";
sigmatch_table[DETECT_AL_HTTP_SERVER_BODY].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-server-body";
sigmatch_table[DETECT_AL_HTTP_SERVER_BODY].url = "/rules/http-keywords.html#http-server-body";
sigmatch_table[DETECT_AL_HTTP_SERVER_BODY].Setup = DetectHttpServerBodySetup;
#ifdef UNITTESTS
sigmatch_table[DETECT_AL_HTTP_SERVER_BODY].RegisterTests = DetectHttpServerBodyRegisterTests;
@ -86,7 +86,7 @@ void DetectHttpServerBodyRegister(void)
/* http.request_body sticky buffer */
sigmatch_table[DETECT_HTTP_RESPONSE_BODY].name = "http.response_body";
sigmatch_table[DETECT_HTTP_RESPONSE_BODY].desc = "sticky buffer to match the HTTP response body buffer";
sigmatch_table[DETECT_HTTP_RESPONSE_BODY].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-server-body";
sigmatch_table[DETECT_HTTP_RESPONSE_BODY].url = "/rules/http-keywords.html#http-server-body";
sigmatch_table[DETECT_HTTP_RESPONSE_BODY].Setup = DetectHttpServerBodySetupSticky;
sigmatch_table[DETECT_HTTP_RESPONSE_BODY].flags |= SIGMATCH_NOOPT;
sigmatch_table[DETECT_HTTP_RESPONSE_BODY].flags |= SIGMATCH_INFO_STICKY_BUFFER;

@ -377,7 +377,7 @@ void DetectHttpStartRegister(void)
sigmatch_table[DETECT_AL_HTTP_START].name = KEYWORD_NAME;
sigmatch_table[DETECT_AL_HTTP_START].alias = KEYWORD_NAME_LEGACY;
sigmatch_table[DETECT_AL_HTTP_START].desc = BUFFER_NAME " sticky buffer";
sigmatch_table[DETECT_AL_HTTP_START].url = DOC_URL DOC_VERSION "/rules/" KEYWORD_DOC;
sigmatch_table[DETECT_AL_HTTP_START].url = "/rules/" KEYWORD_DOC;
sigmatch_table[DETECT_AL_HTTP_START].Setup = DetectHttpStartSetup;
sigmatch_table[DETECT_AL_HTTP_START].flags |= SIGMATCH_NOOPT|SIGMATCH_INFO_STICKY_BUFFER;

@ -81,7 +81,7 @@ void DetectHttpStatCodeRegister (void)
/* http_stat_code content modifier */
sigmatch_table[DETECT_AL_HTTP_STAT_CODE].name = "http_stat_code";
sigmatch_table[DETECT_AL_HTTP_STAT_CODE].desc = "content modifier to match only on HTTP stat-code-buffer";
sigmatch_table[DETECT_AL_HTTP_STAT_CODE].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-stat-code";
sigmatch_table[DETECT_AL_HTTP_STAT_CODE].url = "/rules/http-keywords.html#http-stat-code";
sigmatch_table[DETECT_AL_HTTP_STAT_CODE].Setup = DetectHttpStatCodeSetup;
#ifdef UNITTESTS
sigmatch_table[DETECT_AL_HTTP_STAT_CODE].RegisterTests = DetectHttpStatCodeRegisterTests;
@ -92,7 +92,7 @@ void DetectHttpStatCodeRegister (void)
/* http.stat_code content modifier */
sigmatch_table[DETECT_HTTP_STAT_CODE].name = "http.stat_code";
sigmatch_table[DETECT_HTTP_STAT_CODE].desc = "sticky buffer to match only on HTTP stat-code-buffer";
sigmatch_table[DETECT_HTTP_STAT_CODE].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-stat-code";
sigmatch_table[DETECT_HTTP_STAT_CODE].url = "/rules/http-keywords.html#http-stat-code";
sigmatch_table[DETECT_HTTP_STAT_CODE].Setup = DetectHttpStatCodeSetupSticky;
sigmatch_table[DETECT_HTTP_STAT_CODE].flags |= SIGMATCH_NOOPT|SIGMATCH_INFO_STICKY_BUFFER;

@ -81,7 +81,7 @@ void DetectHttpStatMsgRegister (void)
/* http_stat_msg content modifier */
sigmatch_table[DETECT_AL_HTTP_STAT_MSG].name = "http_stat_msg";
sigmatch_table[DETECT_AL_HTTP_STAT_MSG].desc = "content modifier to match on HTTP stat-msg-buffer";
sigmatch_table[DETECT_AL_HTTP_STAT_MSG].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-stat-msg";
sigmatch_table[DETECT_AL_HTTP_STAT_MSG].url = "/rules/http-keywords.html#http-stat-msg";
sigmatch_table[DETECT_AL_HTTP_STAT_MSG].Setup = DetectHttpStatMsgSetup;
#ifdef UNITTESTS
sigmatch_table[DETECT_AL_HTTP_STAT_MSG].RegisterTests = DetectHttpStatMsgRegisterTests;
@ -92,7 +92,7 @@ void DetectHttpStatMsgRegister (void)
/* http.stat_msg sticky buffer */
sigmatch_table[DETECT_HTTP_STAT_MSG].name = "http.stat_msg";
sigmatch_table[DETECT_HTTP_STAT_MSG].desc = "sticky buffer to match on the HTTP response status message";
sigmatch_table[DETECT_HTTP_STAT_MSG].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-stat-msg";
sigmatch_table[DETECT_HTTP_STAT_MSG].url = "/rules/http-keywords.html#http-stat-msg";
sigmatch_table[DETECT_HTTP_STAT_MSG].Setup = DetectHttpStatMsgSetupSticky;
sigmatch_table[DETECT_HTTP_STAT_MSG].flags |= SIGMATCH_NOOPT|SIGMATCH_INFO_STICKY_BUFFER;

@ -78,7 +78,7 @@ void DetectHttpUARegister(void)
/* http_user_agent content modifier */
sigmatch_table[DETECT_AL_HTTP_USER_AGENT].name = "http_user_agent";
sigmatch_table[DETECT_AL_HTTP_USER_AGENT].desc = "content modifier to match only on the HTTP User-Agent header";
sigmatch_table[DETECT_AL_HTTP_USER_AGENT].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-user-agent";
sigmatch_table[DETECT_AL_HTTP_USER_AGENT].url = "/rules/http-keywords.html#http-user-agent";
sigmatch_table[DETECT_AL_HTTP_USER_AGENT].Setup = DetectHttpUASetup;
#ifdef UNITTESTS
sigmatch_table[DETECT_AL_HTTP_USER_AGENT].RegisterTests = DetectHttpUARegisterTests;
@ -90,7 +90,7 @@ void DetectHttpUARegister(void)
/* http.user_agent sticky buffer */
sigmatch_table[DETECT_HTTP_UA].name = "http.user_agent";
sigmatch_table[DETECT_HTTP_UA].desc = "sticky buffer to match specifically and only on the HTTP User Agent buffer";
sigmatch_table[DETECT_HTTP_UA].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-user-agent";
sigmatch_table[DETECT_HTTP_UA].url = "/rules/http-keywords.html#http-user-agent";
sigmatch_table[DETECT_HTTP_UA].Setup = DetectHttpUserAgentSetup;
sigmatch_table[DETECT_HTTP_UA].flags |= SIGMATCH_NOOPT;
sigmatch_table[DETECT_HTTP_UA].flags |= SIGMATCH_INFO_STICKY_BUFFER;

@ -90,7 +90,7 @@ void DetectHttpUriRegister (void)
/* http_uri content modifier */
sigmatch_table[DETECT_AL_HTTP_URI].name = "http_uri";
sigmatch_table[DETECT_AL_HTTP_URI].desc = "content modifier to match specifically and only on the HTTP uri-buffer";
sigmatch_table[DETECT_AL_HTTP_URI].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-uri-and-http-raw-uri";
sigmatch_table[DETECT_AL_HTTP_URI].url = "/rules/http-keywords.html#http-uri-and-http-raw-uri";
sigmatch_table[DETECT_AL_HTTP_URI].Setup = DetectHttpUriSetup;
#ifdef UNITTESTS
sigmatch_table[DETECT_AL_HTTP_URI].RegisterTests = DetectHttpUriRegisterTests;
@ -102,7 +102,7 @@ void DetectHttpUriRegister (void)
sigmatch_table[DETECT_HTTP_URI].name = "http.uri";
sigmatch_table[DETECT_HTTP_URI].alias = "http.uri.normalized";
sigmatch_table[DETECT_HTTP_URI].desc = "sticky buffer to match specifically and only on the normalized HTTP URI buffer";
sigmatch_table[DETECT_HTTP_URI].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-uri-and-http-raw-uri";
sigmatch_table[DETECT_HTTP_URI].url = "/rules/http-keywords.html#http-uri-and-http-raw-uri";
sigmatch_table[DETECT_HTTP_URI].Setup = DetectHttpUriSetupSticky;
sigmatch_table[DETECT_HTTP_URI].flags |= SIGMATCH_NOOPT|SIGMATCH_INFO_STICKY_BUFFER;
@ -128,7 +128,7 @@ void DetectHttpUriRegister (void)
/* http_raw_uri content modifier */
sigmatch_table[DETECT_AL_HTTP_RAW_URI].name = "http_raw_uri";
sigmatch_table[DETECT_AL_HTTP_RAW_URI].desc = "content modifier to match on the raw HTTP uri";
sigmatch_table[DETECT_AL_HTTP_RAW_URI].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http_uri-and-http_raw-uri";
sigmatch_table[DETECT_AL_HTTP_RAW_URI].url = "/rules/http-keywords.html#http_uri-and-http_raw-uri";
sigmatch_table[DETECT_AL_HTTP_RAW_URI].Setup = DetectHttpRawUriSetup;
sigmatch_table[DETECT_AL_HTTP_RAW_URI].flags |= SIGMATCH_NOOPT|SIGMATCH_INFO_CONTENT_MODIFIER;
sigmatch_table[DETECT_AL_HTTP_RAW_URI].alternative = DETECT_HTTP_URI_RAW;
@ -136,7 +136,7 @@ void DetectHttpUriRegister (void)
/* http.uri.raw sticky buffer */
sigmatch_table[DETECT_HTTP_URI_RAW].name = "http.uri.raw";
sigmatch_table[DETECT_HTTP_URI_RAW].desc = "sticky buffer to match specifically and only on the raw HTTP URI buffer";
sigmatch_table[DETECT_HTTP_URI_RAW].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-uri-and-http-raw-uri";
sigmatch_table[DETECT_HTTP_URI_RAW].url = "/rules/http-keywords.html#http-uri-and-http-raw-uri";
sigmatch_table[DETECT_HTTP_URI_RAW].Setup = DetectHttpRawUriSetupSticky;
sigmatch_table[DETECT_HTTP_URI_RAW].flags |= SIGMATCH_NOOPT|SIGMATCH_INFO_STICKY_BUFFER;

@ -57,7 +57,7 @@ void DetectIcmpIdRegister (void)
{
sigmatch_table[DETECT_ICMP_ID].name = "icmp_id";
sigmatch_table[DETECT_ICMP_ID].desc = "check for a ICMP ID";
sigmatch_table[DETECT_ICMP_ID].url = DOC_URL DOC_VERSION "/rules/header-keywords.html#icmp-id";
sigmatch_table[DETECT_ICMP_ID].url = "/rules/header-keywords.html#icmp-id";
sigmatch_table[DETECT_ICMP_ID].Match = DetectIcmpIdMatch;
sigmatch_table[DETECT_ICMP_ID].Setup = DetectIcmpIdSetup;
sigmatch_table[DETECT_ICMP_ID].Free = DetectIcmpIdFree;

@ -57,7 +57,7 @@ void DetectIcmpSeqRegister (void)
{
sigmatch_table[DETECT_ICMP_SEQ].name = "icmp_seq";
sigmatch_table[DETECT_ICMP_SEQ].desc = "check for a ICMP sequence number";
sigmatch_table[DETECT_ICMP_SEQ].url = DOC_URL DOC_VERSION "/rules/header-keywords.html#icmp-seq";
sigmatch_table[DETECT_ICMP_SEQ].url = "/rules/header-keywords.html#icmp-seq";
sigmatch_table[DETECT_ICMP_SEQ].Match = DetectIcmpSeqMatch;
sigmatch_table[DETECT_ICMP_SEQ].Setup = DetectIcmpSeqSetup;
sigmatch_table[DETECT_ICMP_SEQ].Free = DetectIcmpSeqFree;

@ -49,7 +49,7 @@ void DetectICMPv6mtuRegister(void)
{
sigmatch_table[DETECT_ICMPV6MTU].name = "icmpv6.mtu";
sigmatch_table[DETECT_ICMPV6MTU].desc = "match on ICMPv6 MTU field";
sigmatch_table[DETECT_ICMPV6MTU].url = DOC_URL DOC_VERSION "/rules/header-keywords.html#icmpv6mtu";
sigmatch_table[DETECT_ICMPV6MTU].url = "/rules/header-keywords.html#icmpv6mtu";
sigmatch_table[DETECT_ICMPV6MTU].Match = DetectICMPv6mtuMatch;
sigmatch_table[DETECT_ICMPV6MTU].Setup = DetectICMPv6mtuSetup;
sigmatch_table[DETECT_ICMPV6MTU].Free = DetectICMPv6mtuFree;

@ -51,7 +51,7 @@ void DetectICMPv6hdrRegister(void)
{
sigmatch_table[DETECT_ICMPV6HDR].name = "icmpv6.hdr";
sigmatch_table[DETECT_ICMPV6HDR].desc = "sticky buffer to match on the ICMP V6 header";
sigmatch_table[DETECT_ICMPV6HDR].url = DOC_URL DOC_VERSION "/rules/header-keywords.html#icmpv6hdr";
sigmatch_table[DETECT_ICMPV6HDR].url = "/rules/header-keywords.html#icmpv6hdr";
sigmatch_table[DETECT_ICMPV6HDR].Setup = DetectICMPv6hdrSetup;
sigmatch_table[DETECT_ICMPV6HDR].flags |= SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER;
#ifdef UNITTESTS

@ -61,7 +61,7 @@ void DetectICodeRegister (void)
{
sigmatch_table[DETECT_ICODE].name = "icode";
sigmatch_table[DETECT_ICODE].desc = "match on specific ICMP id-value";
sigmatch_table[DETECT_ICODE].url = DOC_URL DOC_VERSION "/rules/header-keywords.html#icode";
sigmatch_table[DETECT_ICODE].url = "/rules/header-keywords.html#icode";
sigmatch_table[DETECT_ICODE].Match = DetectICodeMatch;
sigmatch_table[DETECT_ICODE].Setup = DetectICodeSetup;
sigmatch_table[DETECT_ICODE].Free = DetectICodeFree;

@ -65,7 +65,7 @@ void DetectIdRegister (void)
{
sigmatch_table[DETECT_ID].name = "id";
sigmatch_table[DETECT_ID].desc = "match on a specific IP ID value";
sigmatch_table[DETECT_ID].url = DOC_URL DOC_VERSION "/rules/header-keywords.html#id";
sigmatch_table[DETECT_ID].url = "/rules/header-keywords.html#id";
sigmatch_table[DETECT_ID].Match = DetectIdMatch;
sigmatch_table[DETECT_ID].Setup = DetectIdSetup;
sigmatch_table[DETECT_ID].Free = DetectIdFree;

@ -55,7 +55,7 @@ void DetectIpOptsRegister (void)
{
sigmatch_table[DETECT_IPOPTS].name = "ipopts";
sigmatch_table[DETECT_IPOPTS].desc = "check if a specific IP option is set";
sigmatch_table[DETECT_IPOPTS].url = DOC_URL DOC_VERSION "/rules/header-keywords.html#ipopts";
sigmatch_table[DETECT_IPOPTS].url = "/rules/header-keywords.html#ipopts";
sigmatch_table[DETECT_IPOPTS].Match = DetectIpOptsMatch;
sigmatch_table[DETECT_IPOPTS].Setup = DetectIpOptsSetup;
sigmatch_table[DETECT_IPOPTS].Free = DetectIpOptsFree;

@ -58,7 +58,7 @@ void DetectIPProtoRegister(void)
{
sigmatch_table[DETECT_IPPROTO].name = "ip_proto";
sigmatch_table[DETECT_IPPROTO].desc = "match on the IP protocol in the packet-header";
sigmatch_table[DETECT_IPPROTO].url = DOC_URL DOC_VERSION "/rules/header-keywords.html#ip-proto";
sigmatch_table[DETECT_IPPROTO].url = "/rules/header-keywords.html#ip-proto";
sigmatch_table[DETECT_IPPROTO].Match = NULL;
sigmatch_table[DETECT_IPPROTO].Setup = DetectIPProtoSetup;
sigmatch_table[DETECT_IPPROTO].Free = DetectIPProtoFree;

@ -61,7 +61,7 @@ void DetectIPRepRegister (void)
{
sigmatch_table[DETECT_IPREP].name = "iprep";
sigmatch_table[DETECT_IPREP].desc = "match on the IP reputation information for a host";
sigmatch_table[DETECT_IPREP].url = DOC_URL DOC_VERSION "/rules/ip-reputation-rules.html#iprep";
sigmatch_table[DETECT_IPREP].url = "/rules/ip-reputation-rules.html#iprep";
sigmatch_table[DETECT_IPREP].Match = DetectIPRepMatch;
sigmatch_table[DETECT_IPREP].Setup = DetectIPRepSetup;
sigmatch_table[DETECT_IPREP].Free = DetectIPRepFree;

@ -51,7 +51,7 @@ void DetectIpv4hdrRegister(void)
{
sigmatch_table[DETECT_IPV4HDR].name = "ipv4.hdr";
sigmatch_table[DETECT_IPV4HDR].desc = "sticky buffer to match on the IPV4 header";
sigmatch_table[DETECT_IPV4HDR].url = DOC_URL DOC_VERSION "/rules/header-keywords.html#ipv4hdr";
sigmatch_table[DETECT_IPV4HDR].url = "/rules/header-keywords.html#ipv4hdr";
sigmatch_table[DETECT_IPV4HDR].Setup = DetectIpv4hdrSetup;
sigmatch_table[DETECT_IPV4HDR].flags |= SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER;
#ifdef UNITTESTS

@ -51,7 +51,7 @@ void DetectIpv6hdrRegister(void)
{
sigmatch_table[DETECT_IPV6HDR].name = "ipv6.hdr";
sigmatch_table[DETECT_IPV6HDR].desc = "sticky buffer to match on the IPV6 header";
sigmatch_table[DETECT_IPV6HDR].url = DOC_URL DOC_VERSION "/rules/header-keywords.html#ipv6hdr";
sigmatch_table[DETECT_IPV6HDR].url = "/rules/header-keywords.html#ipv6hdr";
sigmatch_table[DETECT_IPV6HDR].Setup = DetectIpv6hdrSetup;
sigmatch_table[DETECT_IPV6HDR].flags |= SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER;
#ifdef UNITTESTS

@ -67,7 +67,7 @@ void DetectIsdataatRegister(void)
{
sigmatch_table[DETECT_ISDATAAT].name = "isdataat";
sigmatch_table[DETECT_ISDATAAT].desc = "check if there is still data at a specific part of the payload";
sigmatch_table[DETECT_ISDATAAT].url = DOC_URL DOC_VERSION "/rules/payload-keywords.html#isdataat";
sigmatch_table[DETECT_ISDATAAT].url = "/rules/payload-keywords.html#isdataat";
/* match is handled in DetectEngineContentInspection() */
sigmatch_table[DETECT_ISDATAAT].Match = NULL;
sigmatch_table[DETECT_ISDATAAT].Setup = DetectIsdataatSetup;
@ -76,7 +76,7 @@ void DetectIsdataatRegister(void)
sigmatch_table[DETECT_ENDS_WITH].name = "endswith";
sigmatch_table[DETECT_ENDS_WITH].desc = "make sure the previous content matches exactly at the end of the buffer";
sigmatch_table[DETECT_ENDS_WITH].url = DOC_URL DOC_VERSION "/rules/payload-keywords.html#endswith";
sigmatch_table[DETECT_ENDS_WITH].url = "/rules/payload-keywords.html#endswith";
sigmatch_table[DETECT_ENDS_WITH].Setup = DetectEndsWithSetup;
sigmatch_table[DETECT_ENDS_WITH].flags = SIGMATCH_NOOPT;

@ -61,7 +61,7 @@ void DetectITypeRegister (void)
{
sigmatch_table[DETECT_ITYPE].name = "itype";
sigmatch_table[DETECT_ITYPE].desc = "match on a specific ICMP type";
sigmatch_table[DETECT_ITYPE].url = DOC_URL DOC_VERSION "/rules/header-keywords.html#itype";
sigmatch_table[DETECT_ITYPE].url = "/rules/header-keywords.html#itype";
sigmatch_table[DETECT_ITYPE].Match = DetectITypeMatch;
sigmatch_table[DETECT_ITYPE].Setup = DetectITypeSetup;
sigmatch_table[DETECT_ITYPE].Free = DetectITypeFree;

@ -193,7 +193,7 @@ void DetectKrb5CNameRegister(void)
{
sigmatch_table[DETECT_AL_KRB5_CNAME].name = "krb5.cname";
sigmatch_table[DETECT_AL_KRB5_CNAME].alias = "krb5_cname";
sigmatch_table[DETECT_AL_KRB5_CNAME].url = DOC_URL DOC_VERSION "/rules/kerberos-keywords.html#krb5-cname";
sigmatch_table[DETECT_AL_KRB5_CNAME].url = "/rules/kerberos-keywords.html#krb5-cname";
sigmatch_table[DETECT_AL_KRB5_CNAME].Setup = DetectKrb5CNameSetup;
sigmatch_table[DETECT_AL_KRB5_CNAME].flags |= SIGMATCH_NOOPT|SIGMATCH_INFO_STICKY_BUFFER;
sigmatch_table[DETECT_AL_KRB5_CNAME].desc = "sticky buffer to match on Kerberos 5 client name";

@ -62,7 +62,7 @@ static int g_krb5_err_code_list_id = 0;
void DetectKrb5ErrCodeRegister(void) {
sigmatch_table[DETECT_AL_KRB5_ERRCODE].name = "krb5_err_code";
sigmatch_table[DETECT_AL_KRB5_ERRCODE].desc = "match Kerberos 5 error code";
sigmatch_table[DETECT_AL_KRB5_ERRCODE].url = DOC_URL DOC_VERSION "/rules/kerberos-keywords.html#krb5-err-code";
sigmatch_table[DETECT_AL_KRB5_ERRCODE].url = "/rules/kerberos-keywords.html#krb5-err-code";
sigmatch_table[DETECT_AL_KRB5_ERRCODE].Match = NULL;
sigmatch_table[DETECT_AL_KRB5_ERRCODE].AppLayerTxMatch = DetectKrb5ErrCodeMatch;
sigmatch_table[DETECT_AL_KRB5_ERRCODE].Setup = DetectKrb5ErrCodeSetup;

@ -62,7 +62,7 @@ static int g_krb5_msg_type_list_id = 0;
void DetectKrb5MsgTypeRegister(void) {
sigmatch_table[DETECT_AL_KRB5_MSGTYPE].name = "krb5_msg_type";
sigmatch_table[DETECT_AL_KRB5_MSGTYPE].desc = "match Kerberos 5 message type";
sigmatch_table[DETECT_AL_KRB5_MSGTYPE].url = DOC_URL DOC_VERSION "/rules/kerberos-keywords.html#krb5-msg-type";
sigmatch_table[DETECT_AL_KRB5_MSGTYPE].url = "/rules/kerberos-keywords.html#krb5-msg-type";
sigmatch_table[DETECT_AL_KRB5_MSGTYPE].Match = NULL;
sigmatch_table[DETECT_AL_KRB5_MSGTYPE].AppLayerTxMatch = DetectKrb5MsgTypeMatch;
sigmatch_table[DETECT_AL_KRB5_MSGTYPE].Setup = DetectKrb5MsgTypeSetup;

@ -193,7 +193,7 @@ void DetectKrb5SNameRegister(void)
{
sigmatch_table[DETECT_AL_KRB5_SNAME].name = "krb5.sname";
sigmatch_table[DETECT_AL_KRB5_SNAME].alias = "krb5_sname";
sigmatch_table[DETECT_AL_KRB5_SNAME].url = DOC_URL DOC_VERSION "/rules/kerberos-keywords.html#krb5-sname";
sigmatch_table[DETECT_AL_KRB5_SNAME].url = "/rules/kerberos-keywords.html#krb5-sname";
sigmatch_table[DETECT_AL_KRB5_SNAME].Setup = DetectKrb5SNameSetup;
sigmatch_table[DETECT_AL_KRB5_SNAME].flags |= SIGMATCH_NOOPT|SIGMATCH_INFO_STICKY_BUFFER;
sigmatch_table[DETECT_AL_KRB5_SNAME].desc = "sticky buffer to match on Kerberos 5 server name";

@ -76,7 +76,7 @@ void DetectLuaRegister(void)
sigmatch_table[DETECT_LUA].name = "lua";
sigmatch_table[DETECT_LUA].alias = "luajit";
sigmatch_table[DETECT_LUA].desc = "support for lua scripting";
sigmatch_table[DETECT_LUA].url = DOC_URL DOC_VERSION "/rules/rule-lua-scripting.html";
sigmatch_table[DETECT_LUA].url = "/rules/rule-lua-scripting.html";
sigmatch_table[DETECT_LUA].Setup = DetectLuaSetupNoSupport;
sigmatch_table[DETECT_LUA].Free = NULL;
sigmatch_table[DETECT_LUA].RegisterTests = NULL;
@ -115,7 +115,7 @@ void DetectLuaRegister(void)
sigmatch_table[DETECT_LUA].name = "lua";
sigmatch_table[DETECT_LUA].alias = "luajit";
sigmatch_table[DETECT_LUA].desc = "match via a lua script";
sigmatch_table[DETECT_LUA].url = DOC_URL DOC_VERSION "/rules/rule-lua-scripting.html";
sigmatch_table[DETECT_LUA].url = "/rules/rule-lua-scripting.html";
sigmatch_table[DETECT_LUA].Match = DetectLuaMatch;
sigmatch_table[DETECT_LUA].AppLayerTxMatch = DetectLuaAppTxMatch;
sigmatch_table[DETECT_LUA].Setup = DetectLuaSetup;

@ -41,7 +41,7 @@ void DetectMetadataRegister (void)
{
sigmatch_table[DETECT_METADATA].name = "metadata";
sigmatch_table[DETECT_METADATA].desc = "used for logging";
sigmatch_table[DETECT_METADATA].url = DOC_URL DOC_VERSION "/rules/meta.html#metadata";
sigmatch_table[DETECT_METADATA].url = "/rules/meta.html#metadata";
sigmatch_table[DETECT_METADATA].Match = NULL;
sigmatch_table[DETECT_METADATA].Setup = DetectMetadataSetup;
sigmatch_table[DETECT_METADATA].Free = NULL;

@ -512,7 +512,7 @@ void DetectModbusRegister(void)
SCEnter();
sigmatch_table[DETECT_AL_MODBUS].name = "modbus";
sigmatch_table[DETECT_AL_MODBUS].desc = "match on various properties of Modbus requests";
sigmatch_table[DETECT_AL_MODBUS].url = DOC_URL DOC_VERSION "/rules/modbus-keyword.html#modbus-keyword";
sigmatch_table[DETECT_AL_MODBUS].url = "/rules/modbus-keyword.html#modbus-keyword";
sigmatch_table[DETECT_AL_MODBUS].Match = NULL;
sigmatch_table[DETECT_AL_MODBUS].Setup = DetectModbusSetup;
sigmatch_table[DETECT_AL_MODBUS].Free = DetectModbusFree;

@ -41,7 +41,7 @@ void DetectMsgRegister (void)
{
sigmatch_table[DETECT_MSG].name = "msg";
sigmatch_table[DETECT_MSG].desc = "information about the rule and the possible alert";
sigmatch_table[DETECT_MSG].url = DOC_URL DOC_VERSION "/rules/meta.html#msg-message";
sigmatch_table[DETECT_MSG].url = "/rules/meta.html#msg-message";
sigmatch_table[DETECT_MSG].Match = NULL;
sigmatch_table[DETECT_MSG].Setup = DetectMsgSetup;
sigmatch_table[DETECT_MSG].Free = NULL;

@ -90,7 +90,7 @@ void DetectNfsProcedureRegister (void)
{
sigmatch_table[DETECT_AL_NFS_PROCEDURE].name = "nfs_procedure";
sigmatch_table[DETECT_AL_NFS_PROCEDURE].desc = "match NFS procedure";
sigmatch_table[DETECT_AL_NFS_PROCEDURE].url = DOC_URL DOC_VERSION "/rules/nfs-keywords.html#procedure";
sigmatch_table[DETECT_AL_NFS_PROCEDURE].url = "/rules/nfs-keywords.html#procedure";
sigmatch_table[DETECT_AL_NFS_PROCEDURE].Match = NULL;
sigmatch_table[DETECT_AL_NFS_PROCEDURE].AppLayerTxMatch = DetectNfsProcedureMatch;
sigmatch_table[DETECT_AL_NFS_PROCEDURE].Setup = DetectNfsProcedureSetup;

@ -91,7 +91,7 @@ void DetectNfsVersionRegister (void)
sigmatch_table[DETECT_AL_NFS_VERSION].name = "nfs.version";
sigmatch_table[DETECT_AL_NFS_VERSION].alias = "nfs_version";
sigmatch_table[DETECT_AL_NFS_VERSION].desc = "match NFS version";
sigmatch_table[DETECT_AL_NFS_VERSION].url = DOC_URL DOC_VERSION "/rules/nfs-keywords.html#version";
sigmatch_table[DETECT_AL_NFS_VERSION].url = "/rules/nfs-keywords.html#version";
sigmatch_table[DETECT_AL_NFS_VERSION].AppLayerTxMatch = DetectNfsVersionMatch;
sigmatch_table[DETECT_AL_NFS_VERSION].Setup = DetectNfsVersionSetup;
sigmatch_table[DETECT_AL_NFS_VERSION].Free = DetectNfsVersionFree;

@ -34,7 +34,7 @@ void DetectNoalertRegister (void)
{
sigmatch_table[DETECT_NOALERT].name = "noalert";
sigmatch_table[DETECT_NOALERT].desc = "no alert will be generated by the rule";
sigmatch_table[DETECT_NOALERT].url = DOC_URL DOC_VERSION "/rules/flow-keywords.html";
sigmatch_table[DETECT_NOALERT].url = "/rules/flow-keywords.html";
sigmatch_table[DETECT_NOALERT].Match = NULL;
sigmatch_table[DETECT_NOALERT].Setup = DetectNoalertSetup;
sigmatch_table[DETECT_NOALERT].Free = NULL;

@ -39,7 +39,7 @@ void DetectNocaseRegister(void)
{
sigmatch_table[DETECT_NOCASE].name = "nocase";
sigmatch_table[DETECT_NOCASE].desc = "modify content match to be case insensitive";
sigmatch_table[DETECT_NOCASE].url = DOC_URL DOC_VERSION "/rules/payload-keywords.html#nocase";
sigmatch_table[DETECT_NOCASE].url = "/rules/payload-keywords.html#nocase";
sigmatch_table[DETECT_NOCASE].Match = NULL;
sigmatch_table[DETECT_NOCASE].Setup = DetectNocaseSetup;
sigmatch_table[DETECT_NOCASE].Free = NULL;

@ -46,7 +46,7 @@ void DetectOffsetRegister (void)
{
sigmatch_table[DETECT_OFFSET].name = "offset";
sigmatch_table[DETECT_OFFSET].desc = "designate from which byte in the payload will be checked to find a match";
sigmatch_table[DETECT_OFFSET].url = DOC_URL DOC_VERSION "/rules/payload-keywords.html#offset";
sigmatch_table[DETECT_OFFSET].url = "/rules/payload-keywords.html#offset";
sigmatch_table[DETECT_OFFSET].Match = NULL;
sigmatch_table[DETECT_OFFSET].Setup = DetectOffsetSetup;
sigmatch_table[DETECT_OFFSET].Free = NULL;

@ -114,7 +114,7 @@ void DetectPcreRegister (void)
{
sigmatch_table[DETECT_PCRE].name = "pcre";
sigmatch_table[DETECT_PCRE].desc = "match on regular expression";
sigmatch_table[DETECT_PCRE].url = DOC_URL DOC_VERSION "/rules/payload-keywords.html#pcre-perl-compatible-regular-expressions";
sigmatch_table[DETECT_PCRE].url = "/rules/payload-keywords.html#pcre-perl-compatible-regular-expressions";
sigmatch_table[DETECT_PCRE].Match = NULL;
sigmatch_table[DETECT_PCRE].Setup = DetectPcreSetup;
sigmatch_table[DETECT_PCRE].Free = DetectPcreFree;

@ -38,7 +38,7 @@ void DetectPrefilterRegister(void)
{
sigmatch_table[DETECT_PREFILTER].name = "prefilter";
sigmatch_table[DETECT_PREFILTER].desc = "force a condition to be used as prefilter";
sigmatch_table[DETECT_PREFILTER].url = DOC_URL DOC_VERSION "/rules/prefilter-keywords.html#prefilter";
sigmatch_table[DETECT_PREFILTER].url = "/rules/prefilter-keywords.html#prefilter";
sigmatch_table[DETECT_PREFILTER].Match = NULL;
sigmatch_table[DETECT_PREFILTER].Setup = DetectPrefilterSetup;
sigmatch_table[DETECT_PREFILTER].Free = NULL;

@ -48,7 +48,7 @@ void DetectPriorityRegister (void)
{
sigmatch_table[DETECT_PRIORITY].name = "priority";
sigmatch_table[DETECT_PRIORITY].desc = "rules with a higher priority will be examined first";
sigmatch_table[DETECT_PRIORITY].url = DOC_URL DOC_VERSION "/rules/meta.html#priority";
sigmatch_table[DETECT_PRIORITY].url = "/rules/meta.html#priority";
sigmatch_table[DETECT_PRIORITY].Setup = DetectPrioritySetup;
sigmatch_table[DETECT_PRIORITY].RegisterTests = SCPriorityRegisterTests;

@ -59,7 +59,7 @@ void DetectReferenceRegister(void)
{
sigmatch_table[DETECT_REFERENCE].name = "reference";
sigmatch_table[DETECT_REFERENCE].desc = "direct to places where information about the rule can be found";
sigmatch_table[DETECT_REFERENCE].url = DOC_URL DOC_VERSION "/rules/meta.html#reference";
sigmatch_table[DETECT_REFERENCE].url = "/rules/meta.html#reference";
sigmatch_table[DETECT_REFERENCE].Setup = DetectReferenceSetup;
#ifdef UNITTESTS
sigmatch_table[DETECT_REFERENCE].RegisterTests = ReferenceRegisterTests;

@ -69,7 +69,7 @@ void DetectReplaceRegister (void)
{
sigmatch_table[DETECT_REPLACE].name = "replace";
sigmatch_table[DETECT_REPLACE].desc = "only to be used in IPS-mode. Change the following content into another";
sigmatch_table[DETECT_REPLACE].url = DOC_URL DOC_VERSION "/rules/payload-keywords.html#replace";
sigmatch_table[DETECT_REPLACE].url = "/rules/payload-keywords.html#replace";
sigmatch_table[DETECT_REPLACE].Match = DetectReplacePostMatch;
sigmatch_table[DETECT_REPLACE].Setup = DetectReplaceSetup;
sigmatch_table[DETECT_REPLACE].Free = NULL;

@ -35,7 +35,7 @@ void DetectRevRegister (void)
{
sigmatch_table[DETECT_REV].name = "rev";
sigmatch_table[DETECT_REV].desc = "set version of the rule";
sigmatch_table[DETECT_REV].url = DOC_URL DOC_VERSION "/rules/meta.html#rev-revision";
sigmatch_table[DETECT_REV].url = "/rules/meta.html#rev-revision";
sigmatch_table[DETECT_REV].Match = NULL;
sigmatch_table[DETECT_REV].Setup = DetectRevSetup;
sigmatch_table[DETECT_REV].Free = NULL;

@ -92,7 +92,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
void DetectRfbNameRegister(void)
{
sigmatch_table[DETECT_AL_RFB_NAME].name = KEYWORD_NAME;
sigmatch_table[DETECT_AL_RFB_NAME].url = DOC_URL DOC_VERSION "/rules/" KEYWORD_DOC
sigmatch_table[DETECT_AL_RFB_NAME].url = "/rules/" KEYWORD_DOC
sigmatch_table[DETECT_AL_RFB_NAME].desc = "sticky buffer to match on the RFB desktop name";
sigmatch_table[DETECT_AL_RFB_NAME].Setup = DetectRfbNameSetup;
sigmatch_table[DETECT_AL_RFB_NAME].flags |= SIGMATCH_NOOPT|SIGMATCH_INFO_STICKY_BUFFER;

@ -62,7 +62,7 @@ void DetectRfbSecresultRegister (void)
{
sigmatch_table[DETECT_AL_RFB_SECRESULT].name = "rfb.secresult";
sigmatch_table[DETECT_AL_RFB_SECRESULT].desc = "match RFB security result";
sigmatch_table[DETECT_AL_RFB_SECRESULT].url = DOC_URL DOC_VERSION "/rules/rfb-keywords.html#rfb-secresult";
sigmatch_table[DETECT_AL_RFB_SECRESULT].url = "/rules/rfb-keywords.html#rfb-secresult";
sigmatch_table[DETECT_AL_RFB_SECRESULT].AppLayerTxMatch = DetectRfbSecresultMatch;
sigmatch_table[DETECT_AL_RFB_SECRESULT].Setup = DetectRfbSecresultSetup;
sigmatch_table[DETECT_AL_RFB_SECRESULT].Free = DetectRfbSecresultFree;

@ -73,7 +73,7 @@ void DetectRfbSectypeRegister (void)
{
sigmatch_table[DETECT_AL_RFB_SECTYPE].name = "rfb.sectype";
sigmatch_table[DETECT_AL_RFB_SECTYPE].desc = "match RFB security type";
sigmatch_table[DETECT_AL_RFB_SECTYPE].url = DOC_URL DOC_VERSION "/rules/rfb-keywords.html#rfb-sectype";
sigmatch_table[DETECT_AL_RFB_SECTYPE].url = "/rules/rfb-keywords.html#rfb-sectype";
sigmatch_table[DETECT_AL_RFB_SECTYPE].AppLayerTxMatch = DetectRfbSectypeMatch;
sigmatch_table[DETECT_AL_RFB_SECTYPE].Setup = DetectRfbSectypeSetup;
sigmatch_table[DETECT_AL_RFB_SECTYPE].Free = DetectRfbSectypeFree;

@ -60,7 +60,7 @@ void DetectRpcRegister (void)
{
sigmatch_table[DETECT_RPC].name = "rpc";
sigmatch_table[DETECT_RPC].desc = "match RPC procedure numbers and RPC version";
sigmatch_table[DETECT_RPC].url = DOC_URL DOC_VERSION "/rules/payload-keywords.html#rpc";
sigmatch_table[DETECT_RPC].url = "/rules/payload-keywords.html#rpc";
sigmatch_table[DETECT_RPC].Match = DetectRpcMatch;
sigmatch_table[DETECT_RPC].Setup = DetectRpcSetup;
sigmatch_table[DETECT_RPC].Free = DetectRpcFree;

@ -50,7 +50,7 @@ void DetectSameipRegister(void)
{
sigmatch_table[DETECT_SAMEIP].name = "sameip";
sigmatch_table[DETECT_SAMEIP].desc = "check if the IP address of the source is the same as the IP address of the destination";
sigmatch_table[DETECT_SAMEIP].url = DOC_URL DOC_VERSION "/rules/header-keywords.html#sameip";
sigmatch_table[DETECT_SAMEIP].url = "/rules/header-keywords.html#sameip";
sigmatch_table[DETECT_SAMEIP].Match = DetectSameipMatch;
sigmatch_table[DETECT_SAMEIP].Setup = DetectSameipSetup;
sigmatch_table[DETECT_SAMEIP].Free = NULL;

@ -39,7 +39,7 @@ void DetectSidRegister (void)
{
sigmatch_table[DETECT_SID].name = "sid";
sigmatch_table[DETECT_SID].desc = "set rule ID";
sigmatch_table[DETECT_SID].url = DOC_URL DOC_VERSION "/rules/meta.html#sid-signature-id";
sigmatch_table[DETECT_SID].url = "/rules/meta.html#sid-signature-id";
sigmatch_table[DETECT_SID].Match = NULL;
sigmatch_table[DETECT_SID].Setup = DetectSidSetup;
sigmatch_table[DETECT_SID].Free = NULL;

@ -127,7 +127,7 @@ void DetectSipMethodRegister(void)
/* sip.method sticky buffer */
sigmatch_table[DETECT_AL_SIP_METHOD].name = KEYWORD_NAME;
sigmatch_table[DETECT_AL_SIP_METHOD].desc = "sticky buffer to match on the SIP method buffer";
sigmatch_table[DETECT_AL_SIP_METHOD].url = DOC_URL DOC_VERSION "/rules/" KEYWORD_DOC;
sigmatch_table[DETECT_AL_SIP_METHOD].url = "/rules/" KEYWORD_DOC;
sigmatch_table[DETECT_AL_SIP_METHOD].Setup = DetectSipMethodSetup;
sigmatch_table[DETECT_AL_SIP_METHOD].flags |= SIGMATCH_NOOPT;

@ -97,7 +97,7 @@ void DetectSipProtocolRegister(void)
/* sip.protocol sticky buffer */
sigmatch_table[DETECT_AL_SIP_PROTOCOL].name = KEYWORD_NAME;
sigmatch_table[DETECT_AL_SIP_PROTOCOL].desc = "sticky buffer to match on the SIP protocol";
sigmatch_table[DETECT_AL_SIP_PROTOCOL].url = DOC_URL DOC_VERSION "/rules/" KEYWORD_DOC;
sigmatch_table[DETECT_AL_SIP_PROTOCOL].url = "/rules/" KEYWORD_DOC;
sigmatch_table[DETECT_AL_SIP_PROTOCOL].Setup = DetectSipProtocolSetup;
sigmatch_table[DETECT_AL_SIP_PROTOCOL].flags |= SIGMATCH_NOOPT;

@ -97,7 +97,7 @@ void DetectSipRequestLineRegister(void)
/* sip.request_line sticky buffer */
sigmatch_table[DETECT_AL_SIP_REQUEST_LINE].name = KEYWORD_NAME;
sigmatch_table[DETECT_AL_SIP_REQUEST_LINE].desc = "sticky buffer to match on the SIP request line";
sigmatch_table[DETECT_AL_SIP_REQUEST_LINE].url = DOC_URL DOC_VERSION "/rules/" KEYWORD_DOC;
sigmatch_table[DETECT_AL_SIP_REQUEST_LINE].url = "/rules/" KEYWORD_DOC;
sigmatch_table[DETECT_AL_SIP_REQUEST_LINE].Setup = DetectSipRequestLineSetup;
sigmatch_table[DETECT_AL_SIP_REQUEST_LINE].flags |= SIGMATCH_NOOPT;

Some files were not shown because too many files have changed in this diff Show More

Loading…
Cancel
Save