aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

userguide: explain rule types and categorization

Browse Source 
Add documentation about the rule types introduced by commit
2696fda041.

Add doc tags around code definitions that are referenced in the docs.

Task #https://redmine.openinfosecfoundation.org/issues/7031
pull/12492/head
Juliana Fajardini 2 years ago committed by Victor Julien
parent 72c08cb94e
commit a2905ae5d4
14 changed files with 1991 additions and 0 deletions
Show Stats Download Patch File Download Diff File

2
doc/userguide/configuration/suricata-yaml.rst
Unescape Escape View File

@ -2636,6 +2636,8 @@ Engine analysis and profiling
Suricata offers several ways of analyzing performance of rules and the
engine itself.
.. _config:engine-analysis:
Engine-analysis
~~~~~~~~~~~~~~~

2
doc/userguide/devguide/extending/app-layer/transactions.rst
Unescape Escape View File

@ -1,3 +1,5 @@
.. _transactions:
************
Transactions
************

1
doc/userguide/rules/index.rst
Unescape Escape View File

@ -51,3 +51,4 @@ Suricata Rules
tag
vlan-keywords
ldap-keywords
rule-types

1161
doc/userguide/rules/rule-types.rst
View File

File diff suppressed because it is too large Load Diff

BIN
doc/userguide/rules/rule-types/APP_Layer-Packet-TX-Stream.png
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 148 KiB

BIN
doc/userguide/rules/rule-types/IP-Only.png
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 168 KiB

BIN
doc/userguide/rules/rule-types/OverallAlgoHorizontal.png
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 73 KiB

BIN
doc/userguide/rules/rule-types/PD-only.png
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 130 KiB

187
doc/userguide/rules/rule-types/RawFlowcharts/APP_Layer-Packet-TX-Stream.drawio
Unescape Escape View File

@ -0,0 +1,187 @@
<mxfile host="app.diagrams.net" agent="Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0" version="26.0.5">
<diagram id="C5RBs43oDa-KdzZeNtuy" name="Page-1">
<mxGraphModel dx="1434" dy="792" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="827" pageHeight="1169" math="0" shadow="0">
<root>
<mxCell id="WIyWlLk6GJQsqaUBKTNV-0" />
<mxCell id="WIyWlLk6GJQsqaUBKTNV-1" parent="WIyWlLk6GJQsqaUBKTNV-0" />
<mxCell id="WIyWlLk6GJQsqaUBKTNV-2" value="" style="rounded=0;html=1;jettySize=auto;orthogonalLoop=1;fontSize=11;endArrow=blockThin;endFill=1;endSize=8;strokeWidth=1;shadow=0;labelBackgroundColor=none;edgeStyle=orthogonalEdgeStyle;exitX=0;exitY=0.5;exitDx=0;exitDy=0;textShadow=0;" parent="WIyWlLk6GJQsqaUBKTNV-1" source="0s5H1ICuEW0THiAgHV-k-6" target="WIyWlLk6GJQsqaUBKTNV-6" edge="1">
<mxGeometry relative="1" as="geometry">
<mxPoint x="499" y="108" as="sourcePoint" />
</mxGeometry>
</mxCell>
<mxCell id="WIyWlLk6GJQsqaUBKTNV-5" value="Yes" style="edgeStyle=orthogonalEdgeStyle;rounded=0;html=1;jettySize=auto;orthogonalLoop=1;fontSize=15;endArrow=blockThin;endFill=1;endSize=8;strokeWidth=1;shadow=0;labelBackgroundColor=none;textShadow=0;" parent="WIyWlLk6GJQsqaUBKTNV-1" source="WIyWlLk6GJQsqaUBKTNV-6" target="WIyWlLk6GJQsqaUBKTNV-7" edge="1">
<mxGeometry y="10" relative="1" as="geometry">
<mxPoint as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="eGOkAom5l4kSlUUYHeej-0" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;endArrow=blockThin;endFill=1;" edge="1" parent="WIyWlLk6GJQsqaUBKTNV-1" source="WIyWlLk6GJQsqaUBKTNV-6" target="WIyWlLk6GJQsqaUBKTNV-10">
<mxGeometry relative="1" as="geometry" />
</mxCell>
<mxCell id="eGOkAom5l4kSlUUYHeej-1" value="No" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;" vertex="1" connectable="0" parent="eGOkAom5l4kSlUUYHeej-0">
<mxGeometry x="0.0556" y="3" relative="1" as="geometry">
<mxPoint x="9" y="-3" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="WIyWlLk6GJQsqaUBKTNV-6" value="&lt;div&gt;buffer&lt;/div&gt;&lt;div&gt;packet_engine?&lt;/div&gt;" style="rhombus;whiteSpace=wrap;html=1;shadow=1;fontFamily=Helvetica;fontSize=15;align=center;strokeWidth=1;spacing=6;spacingTop=-4;textShadow=0;" parent="WIyWlLk6GJQsqaUBKTNV-1" vertex="1">
<mxGeometry x="89.38" y="187" width="156.25" height="110" as="geometry" />
</mxCell>
<mxCell id="WIyWlLk6GJQsqaUBKTNV-7" value="Packet" style="rounded=1;whiteSpace=wrap;html=1;fontSize=15;glass=0;strokeWidth=1;shadow=1;fillColor=#FFCC99;labelBackgroundColor=none;textShadow=0;" parent="WIyWlLk6GJQsqaUBKTNV-1" vertex="1">
<mxGeometry x="813" y="222" width="120" height="40" as="geometry" />
</mxCell>
<mxCell id="WIyWlLk6GJQsqaUBKTNV-9" value="Yes" style="edgeStyle=orthogonalEdgeStyle;rounded=0;html=1;jettySize=auto;orthogonalLoop=1;fontSize=15;endArrow=blockThin;endFill=1;endSize=8;strokeWidth=1;shadow=0;labelBackgroundColor=none;textShadow=0;" parent="WIyWlLk6GJQsqaUBKTNV-1" source="WIyWlLk6GJQsqaUBKTNV-10" target="WIyWlLk6GJQsqaUBKTNV-12" edge="1">
<mxGeometry y="10" relative="1" as="geometry">
<mxPoint as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="xHfLyH90HpsRTlA_s4lh-2" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;endArrow=blockThin;endFill=1;labelBackgroundColor=none;textShadow=0;" parent="WIyWlLk6GJQsqaUBKTNV-1" source="WIyWlLk6GJQsqaUBKTNV-10" target="xHfLyH90HpsRTlA_s4lh-1" edge="1">
<mxGeometry relative="1" as="geometry" />
</mxCell>
<mxCell id="xHfLyH90HpsRTlA_s4lh-4" value="No" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;labelBackgroundColor=none;textShadow=0;" parent="xHfLyH90HpsRTlA_s4lh-2" vertex="1" connectable="0">
<mxGeometry x="0.2508" y="-1" relative="1" as="geometry">
<mxPoint x="14" y="-4" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="WIyWlLk6GJQsqaUBKTNV-10" value="&lt;div style=&quot;font-size: 15px;&quot;&gt;buffer&lt;br&gt;frame_engine OR buffer app_engine?&lt;/div&gt;" style="rhombus;whiteSpace=wrap;html=1;shadow=1;fontFamily=Helvetica;fontSize=15;align=center;strokeWidth=1;spacing=6;spacingTop=-4;labelBackgroundColor=none;textShadow=0;" parent="WIyWlLk6GJQsqaUBKTNV-1" vertex="1">
<mxGeometry x="50" y="330" width="235" height="110" as="geometry" />
</mxCell>
<mxCell id="WIyWlLk6GJQsqaUBKTNV-11" value="Application Layer Protocol" style="rounded=1;whiteSpace=wrap;html=1;fontSize=15;glass=0;strokeWidth=1;shadow=1;fillColor=#B9E0A5;labelBackgroundColor=none;textShadow=0;" parent="WIyWlLk6GJQsqaUBKTNV-1" vertex="1">
<mxGeometry x="304" y="765" width="170" height="50" as="geometry" />
</mxCell>
<mxCell id="WIyWlLk6GJQsqaUBKTNV-12" value="Application Layer Protocol Transaction" style="rounded=1;whiteSpace=wrap;html=1;fontSize=15;glass=0;strokeWidth=1;shadow=1;fillColor=#67AB9F;labelBackgroundColor=none;textShadow=0;" parent="WIyWlLk6GJQsqaUBKTNV-1" vertex="1">
<mxGeometry x="808" y="350" width="130" height="70" as="geometry" />
</mxCell>
<mxCell id="xHfLyH90HpsRTlA_s4lh-6" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=0.5;entryY=0;entryDx=0;entryDy=0;endArrow=blockThin;endFill=1;labelBackgroundColor=none;textShadow=0;" parent="WIyWlLk6GJQsqaUBKTNV-1" source="xHfLyH90HpsRTlA_s4lh-1" target="xHfLyH90HpsRTlA_s4lh-8" edge="1">
<mxGeometry relative="1" as="geometry">
<mxPoint x="167.4999999999999" y="740" as="targetPoint" />
</mxGeometry>
</mxCell>
<mxCell id="xHfLyH90HpsRTlA_s4lh-7" value="No" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;labelBackgroundColor=none;textShadow=0;" parent="xHfLyH90HpsRTlA_s4lh-6" vertex="1" connectable="0">
<mxGeometry x="-0.2257" y="2" relative="1" as="geometry">
<mxPoint x="11" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="xHfLyH90HpsRTlA_s4lh-9" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;endArrow=blockThin;endFill=1;labelBackgroundColor=none;textShadow=0;" parent="WIyWlLk6GJQsqaUBKTNV-1" source="xHfLyH90HpsRTlA_s4lh-1" target="xHfLyH90HpsRTlA_s4lh-11" edge="1">
<mxGeometry relative="1" as="geometry">
<mxPoint x="352.5" y="600" as="targetPoint" />
</mxGeometry>
</mxCell>
<mxCell id="xHfLyH90HpsRTlA_s4lh-10" value="Yes" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;labelBackgroundColor=none;textShadow=0;" parent="xHfLyH90HpsRTlA_s4lh-9" vertex="1" connectable="0">
<mxGeometry x="-0.0137" y="3" relative="1" as="geometry">
<mxPoint x="-2" y="-9" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="xHfLyH90HpsRTlA_s4lh-1" value="&lt;div&gt;&lt;br&gt;&lt;/div&gt;&lt;div&gt;Payload&amp;nbsp;&lt;/div&gt;&lt;div&gt;and/or&lt;br&gt;Stream match?&lt;/div&gt;&lt;div&gt;&lt;br&gt;&lt;/div&gt;" style="rhombus;whiteSpace=wrap;html=1;shadow=1;fontFamily=Helvetica;fontSize=15;align=center;strokeWidth=1;spacing=6;spacingTop=-4;labelBackgroundColor=none;textShadow=0;" parent="WIyWlLk6GJQsqaUBKTNV-1" vertex="1">
<mxGeometry x="71.25" y="472.5" width="192.5" height="110" as="geometry" />
</mxCell>
<mxCell id="xHfLyH90HpsRTlA_s4lh-26" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=0;entryY=0.5;entryDx=0;entryDy=0;exitX=1;exitY=0.5;exitDx=0;exitDy=0;endArrow=blockThin;endFill=1;labelBackgroundColor=none;textShadow=0;" parent="WIyWlLk6GJQsqaUBKTNV-1" source="xHfLyH90HpsRTlA_s4lh-8" target="ePn_FxX4DdHERsb3t1WL-1" edge="1">
<mxGeometry relative="1" as="geometry">
<mxPoint x="502.5" y="135" as="targetPoint" />
<mxPoint x="312.5" y="795" as="sourcePoint" />
</mxGeometry>
</mxCell>
<mxCell id="xHfLyH90HpsRTlA_s4lh-27" value="Yes" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;labelBackgroundColor=none;textShadow=0;" parent="xHfLyH90HpsRTlA_s4lh-26" vertex="1" connectable="0">
<mxGeometry x="-0.9663" y="-1" relative="1" as="geometry">
<mxPoint x="65" y="-16" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="xHfLyH90HpsRTlA_s4lh-28" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;endArrow=blockThin;endFill=1;labelBackgroundColor=none;textShadow=0;" parent="WIyWlLk6GJQsqaUBKTNV-1" source="xHfLyH90HpsRTlA_s4lh-8" target="xHfLyH90HpsRTlA_s4lh-29" edge="1">
<mxGeometry relative="1" as="geometry">
<mxPoint x="167.4999999999999" y="900" as="targetPoint" />
</mxGeometry>
</mxCell>
<mxCell id="xHfLyH90HpsRTlA_s4lh-30" value="No" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;labelBackgroundColor=none;textShadow=0;" parent="xHfLyH90HpsRTlA_s4lh-28" vertex="1" connectable="0">
<mxGeometry x="-0.0063" y="1" relative="1" as="geometry">
<mxPoint x="15" y="-5" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="xHfLyH90HpsRTlA_s4lh-8" value="&lt;div&gt;&lt;div&gt;&lt;br&gt;&lt;/div&gt;&lt;/div&gt;&lt;div&gt;Non-payload&lt;/div&gt;&lt;div&gt;per-packet match?&lt;/div&gt;&lt;div&gt;&lt;br&gt;&lt;/div&gt;" style="rhombus;whiteSpace=wrap;html=1;shadow=1;fontFamily=Helvetica;fontSize=15;align=center;strokeWidth=1;spacing=6;spacingTop=-4;labelBackgroundColor=none;textShadow=0;" parent="WIyWlLk6GJQsqaUBKTNV-1" vertex="1">
<mxGeometry x="71.25" y="620" width="192.5" height="100" as="geometry" />
</mxCell>
<mxCell id="xHfLyH90HpsRTlA_s4lh-13" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=0;entryY=0.5;entryDx=0;entryDy=0;endArrow=blockThin;endFill=1;labelBackgroundColor=none;textShadow=0;" parent="WIyWlLk6GJQsqaUBKTNV-1" source="xHfLyH90HpsRTlA_s4lh-11" target="ePn_FxX4DdHERsb3t1WL-0" edge="1">
<mxGeometry relative="1" as="geometry">
<mxPoint x="692.5" y="185" as="targetPoint" />
</mxGeometry>
</mxCell>
<mxCell id="IUO5ygfKNNC4OAWbKBHn-0" value="Yes" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;labelBackgroundColor=none;textShadow=0;" parent="xHfLyH90HpsRTlA_s4lh-13" vertex="1" connectable="0">
<mxGeometry x="-0.3438" y="-1" relative="1" as="geometry">
<mxPoint y="-16" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="xHfLyH90HpsRTlA_s4lh-16" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;endArrow=blockThin;endFill=1;entryX=0;entryY=0.5;entryDx=0;entryDy=0;labelBackgroundColor=none;textShadow=0;" parent="WIyWlLk6GJQsqaUBKTNV-1" source="xHfLyH90HpsRTlA_s4lh-11" target="xHfLyH90HpsRTlA_s4lh-17" edge="1">
<mxGeometry relative="1" as="geometry">
<mxPoint x="657.5" y="720" as="targetPoint" />
</mxGeometry>
</mxCell>
<mxCell id="xHfLyH90HpsRTlA_s4lh-21" value="No" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;labelBackgroundColor=none;textShadow=0;" parent="xHfLyH90HpsRTlA_s4lh-16" vertex="1" connectable="0">
<mxGeometry x="-0.3914" y="1" relative="1" as="geometry">
<mxPoint x="13" y="-19" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="xHfLyH90HpsRTlA_s4lh-11" value="&lt;div style=&quot;font-size: 15px;&quot;&gt;flag&lt;br&gt;REQUIRE_PACKET&lt;br&gt;and not flag&lt;br&gt;REQUIRE_STREAM&lt;/div&gt;&lt;div&gt;&lt;br&gt;&lt;/div&gt;" style="rhombus;whiteSpace=wrap;html=1;fontSize=15;labelBackgroundColor=none;textShadow=0;shadow=1;" parent="WIyWlLk6GJQsqaUBKTNV-1" vertex="1">
<mxGeometry x="315" y="456.25" width="247" height="142.5" as="geometry" />
</mxCell>
<mxCell id="xHfLyH90HpsRTlA_s4lh-20" value="" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;endArrow=blockThin;endFill=1;labelBackgroundColor=none;textShadow=0;" parent="WIyWlLk6GJQsqaUBKTNV-1" source="xHfLyH90HpsRTlA_s4lh-17" target="xHfLyH90HpsRTlA_s4lh-19" edge="1">
<mxGeometry relative="1" as="geometry" />
</mxCell>
<mxCell id="xHfLyH90HpsRTlA_s4lh-23" value="Yes" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;labelBackgroundColor=none;textShadow=0;" parent="xHfLyH90HpsRTlA_s4lh-20" vertex="1" connectable="0">
<mxGeometry x="0.2675" y="2" relative="1" as="geometry">
<mxPoint x="-14" y="-12" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="xHfLyH90HpsRTlA_s4lh-24" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;exitX=0.5;exitY=1;exitDx=0;exitDy=0;entryX=0;entryY=0.5;entryDx=0;entryDy=0;endArrow=blockThin;endFill=1;labelBackgroundColor=none;textShadow=0;" parent="WIyWlLk6GJQsqaUBKTNV-1" source="xHfLyH90HpsRTlA_s4lh-17" target="xHfLyH90HpsRTlA_s4lh-25" edge="1">
<mxGeometry relative="1" as="geometry">
<mxPoint x="680.5" y="940" as="targetPoint" />
</mxGeometry>
</mxCell>
<mxCell id="xHfLyH90HpsRTlA_s4lh-35" value="No" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;labelBackgroundColor=none;textShadow=0;" parent="xHfLyH90HpsRTlA_s4lh-24" vertex="1" connectable="0">
<mxGeometry x="-0.2" y="1" relative="1" as="geometry">
<mxPoint x="25" y="-11" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="xHfLyH90HpsRTlA_s4lh-17" value="&lt;div style=&quot;font-size: 15px;&quot;&gt;flag&lt;br&gt;REQUIRE_STREAM&lt;br&gt;and not flag&lt;br&gt;REQUIRE_PACKET&lt;/div&gt;&lt;div style=&quot;font-size: 15px;&quot;&gt;&lt;br&gt;&lt;/div&gt;" style="rhombus;whiteSpace=wrap;html=1;fontSize=15;labelBackgroundColor=none;textShadow=0;shadow=1;" parent="WIyWlLk6GJQsqaUBKTNV-1" vertex="1">
<mxGeometry x="535" y="560" width="220" height="155" as="geometry" />
</mxCell>
<mxCell id="xHfLyH90HpsRTlA_s4lh-19" value="Stream" style="whiteSpace=wrap;html=1;rounded=1;fillColor=#FF9999;fontSize=15;labelBackgroundColor=none;textShadow=0;shadow=1;" parent="WIyWlLk6GJQsqaUBKTNV-1" vertex="1">
<mxGeometry x="813" y="607.5" width="120" height="60" as="geometry" />
</mxCell>
<mxCell id="xHfLyH90HpsRTlA_s4lh-25" value="Packet-Stream" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#E09F63;fontSize=15;labelBackgroundColor=none;textShadow=0;shadow=1;" parent="WIyWlLk6GJQsqaUBKTNV-1" vertex="1">
<mxGeometry x="809.5" y="730" width="127" height="60" as="geometry" />
</mxCell>
<mxCell id="xHfLyH90HpsRTlA_s4lh-31" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;endArrow=blockThin;endFill=1;labelBackgroundColor=none;textShadow=0;" parent="WIyWlLk6GJQsqaUBKTNV-1" source="xHfLyH90HpsRTlA_s4lh-29" target="WIyWlLk6GJQsqaUBKTNV-11" edge="1">
<mxGeometry relative="1" as="geometry" />
</mxCell>
<mxCell id="xHfLyH90HpsRTlA_s4lh-32" value="Yes" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;labelBackgroundColor=none;textShadow=0;" parent="xHfLyH90HpsRTlA_s4lh-31" vertex="1" connectable="0">
<mxGeometry x="0.0571" relative="1" as="geometry">
<mxPoint x="-10" y="-12" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="xHfLyH90HpsRTlA_s4lh-33" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=0;entryY=0.5;entryDx=0;entryDy=0;exitX=0.5;exitY=1;exitDx=0;exitDy=0;endArrow=blockThin;endFill=1;labelBackgroundColor=none;textShadow=0;" parent="WIyWlLk6GJQsqaUBKTNV-1" source="xHfLyH90HpsRTlA_s4lh-29" target="ePn_FxX4DdHERsb3t1WL-2" edge="1">
<mxGeometry relative="1" as="geometry" />
</mxCell>
<mxCell id="xHfLyH90HpsRTlA_s4lh-34" value="No" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;labelBackgroundColor=none;textShadow=0;" parent="xHfLyH90HpsRTlA_s4lh-33" vertex="1" connectable="0">
<mxGeometry x="-0.9653" y="2" relative="1" as="geometry">
<mxPoint x="10" y="16" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="xHfLyH90HpsRTlA_s4lh-29" value="&lt;div style=&quot;font-size: 15px;&quot;&gt;APP LAYER ?&lt;br style=&quot;font-size: 15px;&quot;&gt;&lt;/div&gt;" style="rhombus;whiteSpace=wrap;html=1;fontSize=15;labelBackgroundColor=none;textShadow=0;shadow=1;" parent="WIyWlLk6GJQsqaUBKTNV-1" vertex="1">
<mxGeometry x="98.75" y="755" width="137.5" height="70" as="geometry" />
</mxCell>
<mxCell id="ePn_FxX4DdHERsb3t1WL-0" value="Packet" style="rounded=1;whiteSpace=wrap;html=1;fontSize=15;glass=0;strokeWidth=1;shadow=1;fillColor=#FFCC99;labelBackgroundColor=none;textShadow=0;" parent="WIyWlLk6GJQsqaUBKTNV-1" vertex="1">
<mxGeometry x="813" y="507.5" width="120" height="40" as="geometry" />
</mxCell>
<mxCell id="ePn_FxX4DdHERsb3t1WL-1" value="Packet" style="rounded=1;whiteSpace=wrap;html=1;fontSize=15;glass=0;strokeWidth=1;shadow=1;fillColor=#FFCC99;labelBackgroundColor=none;textShadow=0;" parent="WIyWlLk6GJQsqaUBKTNV-1" vertex="1">
<mxGeometry x="813" y="833" width="120" height="40" as="geometry" />
</mxCell>
<mxCell id="ePn_FxX4DdHERsb3t1WL-2" value="Packet" style="rounded=1;whiteSpace=wrap;html=1;fontSize=15;glass=0;strokeWidth=1;shadow=1;fillColor=#FFCC99;textShadow=0;" parent="WIyWlLk6GJQsqaUBKTNV-1" vertex="1">
<mxGeometry x="329" y="851" width="120" height="40" as="geometry" />
</mxCell>
<mxCell id="ePn_FxX4DdHERsb3t1WL-5" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;exitX=0.5;exitY=1;exitDx=0;exitDy=0;textShadow=0;" parent="WIyWlLk6GJQsqaUBKTNV-1" source="ePn_FxX4DdHERsb3t1WL-2" target="ePn_FxX4DdHERsb3t1WL-2" edge="1">
<mxGeometry relative="1" as="geometry" />
</mxCell>
<mxCell id="0s5H1ICuEW0THiAgHV-k-6" value="Signature" style="shape=parallelogram;html=1;strokeWidth=1;perimeter=parallelogramPerimeter;whiteSpace=wrap;rounded=1;arcSize=12;size=0.23;fontSize=15;textShadow=0;shadow=1;" parent="WIyWlLk6GJQsqaUBKTNV-1" vertex="1">
<mxGeometry x="474" y="126" width="150" height="60" as="geometry" />
</mxCell>
</root>
</mxGraphModel>
</diagram>
</mxfile>

305
doc/userguide/rules/rule-types/RawFlowcharts/IP-Only.drawio
Unescape Escape View File

@ -0,0 +1,305 @@
<mxfile host="app.diagrams.net" agent="Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0" version="26.0.5">
<diagram name="Page-1" id="0w9xQVbQPSFQAx9yTVe1">
<mxGraphModel dx="1936" dy="932" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="850" pageHeight="1100" math="0" shadow="0">
<root>
<mxCell id="0" />
<mxCell id="1" parent="0" />
<mxCell id="LDplG8UmEiPDtL-p8i6A-6" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;fontSize=15;entryX=0.5;entryY=1;entryDx=0;entryDy=0;endArrow=blockThin;endFill=1;" parent="1" source="LDplG8UmEiPDtL-p8i6A-2" target="0AOyOH4djSygT5G8EftG-2" edge="1">
<mxGeometry relative="1" as="geometry">
<mxPoint x="1736" y="433" as="targetPoint" />
</mxGeometry>
</mxCell>
<mxCell id="0AOyOH4djSygT5G8EftG-3" value="No" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;" parent="LDplG8UmEiPDtL-p8i6A-6" vertex="1" connectable="0">
<mxGeometry x="-0.0364" y="-1" relative="1" as="geometry">
<mxPoint x="15" y="-2" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="HzgoOLMbdf1Lhczd7Y_U-3" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=0;entryY=0.5;entryDx=0;entryDy=0;fontSize=15;endArrow=blockThin;endFill=1;" parent="1" source="LDplG8UmEiPDtL-p8i6A-2" target="HzgoOLMbdf1Lhczd7Y_U-1" edge="1">
<mxGeometry relative="1" as="geometry">
<mxPoint x="1327" y="859" as="targetPoint" />
</mxGeometry>
</mxCell>
<mxCell id="D7SFLykBpT77EkUcGLZz-3" value="&lt;div&gt;Yes&lt;/div&gt;" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;" parent="HzgoOLMbdf1Lhczd7Y_U-3" vertex="1" connectable="0">
<mxGeometry x="-0.2" relative="1" as="geometry">
<mxPoint x="-3" y="-16" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="LDplG8UmEiPDtL-p8i6A-2" value="&lt;div&gt;ALPROTO&lt;/div&gt;&lt;div&gt;UNKNOWN?&lt;/div&gt;" style="rhombus;whiteSpace=wrap;html=1;fontSize=15;shadow=1;" parent="1" vertex="1">
<mxGeometry x="636" y="697" width="185" height="90" as="geometry" />
</mxCell>
<mxCell id="LDplG8UmEiPDtL-p8i6A-13" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;fontSize=15;endArrow=blockThin;endFill=1;" parent="1" source="LDplG8UmEiPDtL-p8i6A-9" target="LDplG8UmEiPDtL-p8i6A-12" edge="1">
<mxGeometry relative="1" as="geometry">
<mxPoint x="1230" y="750" as="sourcePoint" />
</mxGeometry>
</mxCell>
<mxCell id="zVmsChvBqX3Bo2thPNO_-7" value="No" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;" parent="LDplG8UmEiPDtL-p8i6A-13" vertex="1" connectable="0">
<mxGeometry x="0.0618" y="-2" relative="1" as="geometry">
<mxPoint x="-3" y="-16" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="0AOyOH4djSygT5G8EftG-6" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;fontSize=15;endArrow=blockThin;endFill=1;" parent="1" source="LDplG8UmEiPDtL-p8i6A-9" target="0AOyOH4djSygT5G8EftG-5" edge="1">
<mxGeometry relative="1" as="geometry" />
</mxCell>
<mxCell id="0AOyOH4djSygT5G8EftG-7" value="Yes" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;" parent="0AOyOH4djSygT5G8EftG-6" vertex="1" connectable="0">
<mxGeometry x="0.1538" y="1" relative="1" as="geometry">
<mxPoint x="19" y="9" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="LDplG8UmEiPDtL-p8i6A-9" value="APP LAYER?" style="rhombus;whiteSpace=wrap;html=1;fontSize=15;shadow=1;" parent="1" vertex="1">
<mxGeometry x="1136" y="702" width="175" height="80" as="geometry" />
</mxCell>
<mxCell id="LDplG8UmEiPDtL-p8i6A-14" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=0.5;entryY=1;entryDx=0;entryDy=0;exitX=0.5;exitY=0;exitDx=0;exitDy=0;fontSize=15;endArrow=blockThin;endFill=1;" parent="1" source="LDplG8UmEiPDtL-p8i6A-12" target="0AOyOH4djSygT5G8EftG-8" edge="1">
<mxGeometry relative="1" as="geometry">
<mxPoint x="1044" y="940" as="targetPoint" />
</mxGeometry>
</mxCell>
<mxCell id="LDplG8UmEiPDtL-p8i6A-15" value="Yes" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;" parent="LDplG8UmEiPDtL-p8i6A-14" vertex="1" connectable="0">
<mxGeometry x="-0.3802" y="2" relative="1" as="geometry">
<mxPoint x="21" y="-9" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="LDplG8UmEiPDtL-p8i6A-18" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;fontSize=15;endArrow=blockThin;endFill=1;exitX=1;exitY=0.5;exitDx=0;exitDy=0;entryX=1;entryY=0.5;entryDx=0;entryDy=0;" parent="1" source="LDplG8UmEiPDtL-p8i6A-12" target="LDplG8UmEiPDtL-p8i6A-16" edge="1">
<mxGeometry relative="1" as="geometry">
<mxPoint x="1549" y="740" as="sourcePoint" />
</mxGeometry>
</mxCell>
<mxCell id="zVmsChvBqX3Bo2thPNO_-8" value="No" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;" parent="LDplG8UmEiPDtL-p8i6A-18" vertex="1" connectable="0">
<mxGeometry x="-0.2857" relative="1" as="geometry">
<mxPoint x="-14" y="24" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="LDplG8UmEiPDtL-p8i6A-12" value="&lt;div&gt;&lt;span&gt;Flow direction&lt;/span&gt;&lt;/div&gt;&lt;div&gt;&lt;span&gt;set?&lt;/span&gt;&lt;/div&gt;" style="rhombus;whiteSpace=wrap;html=1;fontSize=15;shadow=1;" parent="1" vertex="1">
<mxGeometry x="1357.75" y="705.25" width="177.5" height="73.75" as="geometry" />
</mxCell>
<mxCell id="LDplG8UmEiPDtL-p8i6A-17" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;fontSize=15;entryX=0.5;entryY=0;entryDx=0;entryDy=0;endArrow=blockThin;endFill=1;" parent="1" source="LDplG8UmEiPDtL-p8i6A-16" target="0AOyOH4djSygT5G8EftG-21" edge="1">
<mxGeometry relative="1" as="geometry">
<mxPoint x="1719" y="764" as="targetPoint" />
</mxGeometry>
</mxCell>
<mxCell id="HzgoOLMbdf1Lhczd7Y_U-20" value="Yes" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;" parent="LDplG8UmEiPDtL-p8i6A-17" vertex="1" connectable="0">
<mxGeometry x="-0.6767" relative="1" as="geometry">
<mxPoint x="20" y="20" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="HzgoOLMbdf1Lhczd7Y_U-16" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;fontSize=15;endArrow=blockThin;endFill=1;" parent="1" source="LDplG8UmEiPDtL-p8i6A-16" target="n4viz4upnR27VTd0IMI--3" edge="1">
<mxGeometry relative="1" as="geometry">
<mxPoint x="1280" y="1070" as="targetPoint" />
</mxGeometry>
</mxCell>
<mxCell id="zVmsChvBqX3Bo2thPNO_-9" value="No" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;" parent="HzgoOLMbdf1Lhczd7Y_U-16" vertex="1" connectable="0">
<mxGeometry x="-0.7663" y="-1" relative="1" as="geometry">
<mxPoint x="-22" y="-13" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="LDplG8UmEiPDtL-p8i6A-16" value="&lt;div&gt;Buffer&lt;/div&gt;&lt;div&gt;inspection?&lt;/div&gt;" style="rhombus;whiteSpace=wrap;html=1;fontSize=15;shadow=1;" parent="1" vertex="1">
<mxGeometry x="1362.5" y="834" width="168" height="80" as="geometry" />
</mxCell>
<mxCell id="HzgoOLMbdf1Lhczd7Y_U-24" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;fontSize=15;endArrow=blockThin;endFill=1;exitX=0;exitY=0.5;exitDx=0;exitDy=0;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" parent="1" source="LDplG8UmEiPDtL-p8i6A-20" target="HzgoOLMbdf1Lhczd7Y_U-23" edge="1">
<mxGeometry relative="1" as="geometry">
<mxPoint x="477.5" y="1321" as="sourcePoint" />
<mxPoint x="331" y="1321" as="targetPoint" />
</mxGeometry>
</mxCell>
<mxCell id="zVmsChvBqX3Bo2thPNO_-11" value="No" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;" parent="HzgoOLMbdf1Lhczd7Y_U-24" vertex="1" connectable="0">
<mxGeometry x="0.0333" y="-2" relative="1" as="geometry">
<mxPoint x="-13" y="-16" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="0AOyOH4djSygT5G8EftG-13" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;fontSize=15;endArrow=blockThin;endFill=1;" parent="1" source="LDplG8UmEiPDtL-p8i6A-20" target="0AOyOH4djSygT5G8EftG-12" edge="1">
<mxGeometry relative="1" as="geometry" />
</mxCell>
<mxCell id="0AOyOH4djSygT5G8EftG-14" value="Yes" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;" parent="0AOyOH4djSygT5G8EftG-13" vertex="1" connectable="0">
<mxGeometry x="-0.1333" y="-1" relative="1" as="geometry">
<mxPoint x="19" y="-2" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="LDplG8UmEiPDtL-p8i6A-20" value="&lt;div&gt;Flowbits&lt;br&gt;AND NOT&lt;/div&gt;&lt;div&gt;flowbits:set&lt;/div&gt;" style="rhombus;whiteSpace=wrap;html=1;fontSize=15;shadow=1;" parent="1" vertex="1">
<mxGeometry x="660" y="823" width="153" height="102" as="geometry" />
</mxCell>
<mxCell id="LDplG8UmEiPDtL-p8i6A-28" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;exitX=0.5;exitY=1;exitDx=0;exitDy=0;fontSize=15;endArrow=blockThin;endFill=1;" parent="1" source="LDplG8UmEiPDtL-p8i6A-26" target="HzgoOLMbdf1Lhczd7Y_U-11" edge="1">
<mxGeometry relative="1" as="geometry">
<mxPoint x="1577.75" y="900" as="targetPoint" />
</mxGeometry>
</mxCell>
<mxCell id="LDplG8UmEiPDtL-p8i6A-29" value="Yes" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;" parent="LDplG8UmEiPDtL-p8i6A-28" vertex="1" connectable="0">
<mxGeometry x="-0.3683" y="2" relative="1" as="geometry">
<mxPoint x="16" y="2" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="HzgoOLMbdf1Lhczd7Y_U-14" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;fontSize=15;endArrow=blockThin;endFill=1;" parent="1" source="LDplG8UmEiPDtL-p8i6A-26" target="LDplG8UmEiPDtL-p8i6A-31" edge="1">
<mxGeometry relative="1" as="geometry">
<mxPoint x="1309" y="1130" as="targetPoint" />
</mxGeometry>
</mxCell>
<mxCell id="zVmsChvBqX3Bo2thPNO_-13" value="No" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;" parent="HzgoOLMbdf1Lhczd7Y_U-14" vertex="1" connectable="0">
<mxGeometry x="0.0133" y="-1" relative="1" as="geometry">
<mxPoint y="-15" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="LDplG8UmEiPDtL-p8i6A-26" value="Post Match:&lt;br&gt;&lt;div&gt;Flowbits&amp;nbsp;&lt;/div&gt;&lt;div&gt;AND NOT flowbits:set&lt;/div&gt;" style="rhombus;whiteSpace=wrap;html=1;fontSize=15;shadow=1;" parent="1" vertex="1">
<mxGeometry x="853.5" y="1068" width="251" height="124" as="geometry" />
</mxCell>
<mxCell id="LDplG8UmEiPDtL-p8i6A-33" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;fontSize=15;entryX=0;entryY=0.5;entryDx=0;entryDy=0;endArrow=blockThin;endFill=1;" parent="1" target="0AOyOH4djSygT5G8EftG-23" edge="1">
<mxGeometry relative="1" as="geometry">
<mxPoint x="1485.5" y="1150" as="targetPoint" />
<mxPoint x="1324" y="1130" as="sourcePoint" />
</mxGeometry>
</mxCell>
<mxCell id="HzgoOLMbdf1Lhczd7Y_U-12" value="Yes" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;" parent="LDplG8UmEiPDtL-p8i6A-33" vertex="1" connectable="0">
<mxGeometry x="0.3875" y="2" relative="1" as="geometry">
<mxPoint x="-18" y="-12" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="LDplG8UmEiPDtL-p8i6A-36" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;exitX=0.5;exitY=1;exitDx=0;exitDy=0;fontSize=15;endArrow=blockThin;endFill=1;" parent="1" source="LDplG8UmEiPDtL-p8i6A-31" target="0AOyOH4djSygT5G8EftG-25" edge="1">
<mxGeometry relative="1" as="geometry">
<mxPoint x="1266.5" y="1230" as="targetPoint" />
</mxGeometry>
</mxCell>
<mxCell id="HzgoOLMbdf1Lhczd7Y_U-13" value="No" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;" parent="LDplG8UmEiPDtL-p8i6A-36" vertex="1" connectable="0">
<mxGeometry x="-0.0667" y="-1" relative="1" as="geometry">
<mxPoint x="18" y="-2" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="LDplG8UmEiPDtL-p8i6A-31" value="&lt;div&gt;Contains negated&lt;/div&gt;&lt;div&gt;IP address?&lt;/div&gt;" style="rhombus;whiteSpace=wrap;html=1;fontSize=15;shadow=1;" parent="1" vertex="1">
<mxGeometry x="1161.5" y="1065" width="168.5" height="130" as="geometry" />
</mxCell>
<mxCell id="HzgoOLMbdf1Lhczd7Y_U-4" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;exitX=0.5;exitY=0;exitDx=0;exitDy=0;fontSize=15;entryX=0.5;entryY=1;entryDx=0;entryDy=0;endArrow=blockThin;endFill=1;" parent="1" source="HzgoOLMbdf1Lhczd7Y_U-1" target="0AOyOH4djSygT5G8EftG-4" edge="1">
<mxGeometry relative="1" as="geometry">
<mxPoint x="1457" y="389" as="targetPoint" />
<mxPoint x="1327" y="589" as="sourcePoint" />
</mxGeometry>
</mxCell>
<mxCell id="zVmsChvBqX3Bo2thPNO_-5" value="Yes" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;" parent="HzgoOLMbdf1Lhczd7Y_U-4" vertex="1" connectable="0">
<mxGeometry x="-0.8787" y="4" relative="1" as="geometry">
<mxPoint x="22" y="-17" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="HzgoOLMbdf1Lhczd7Y_U-8" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;fontSize=15;endArrow=blockThin;endFill=1;" parent="1" source="HzgoOLMbdf1Lhczd7Y_U-1" target="LDplG8UmEiPDtL-p8i6A-9" edge="1">
<mxGeometry relative="1" as="geometry">
<mxPoint x="878.5" y="1176" as="sourcePoint" />
<mxPoint x="1144" y="740" as="targetPoint" />
</mxGeometry>
</mxCell>
<mxCell id="zVmsChvBqX3Bo2thPNO_-15" value="No" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;" parent="HzgoOLMbdf1Lhczd7Y_U-8" vertex="1" connectable="0">
<mxGeometry x="0.4426" y="-1" relative="1" as="geometry">
<mxPoint x="-18" y="-15" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="HzgoOLMbdf1Lhczd7Y_U-1" value="&lt;div&gt;Payload&lt;/div&gt;&lt;div&gt;and&lt;br&gt;&lt;/div&gt;&lt;div&gt;stream match?&lt;/div&gt;" style="rhombus;whiteSpace=wrap;html=1;fontSize=15;shadow=1;" parent="1" vertex="1">
<mxGeometry x="867" y="687" width="215" height="110" as="geometry" />
</mxCell>
<mxCell id="HzgoOLMbdf1Lhczd7Y_U-7" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;exitX=1;exitY=0.5;exitDx=0;exitDy=0;fontSize=15;endArrow=blockThin;endFill=1;" parent="1" source="0AOyOH4djSygT5G8EftG-1" target="LDplG8UmEiPDtL-p8i6A-2" edge="1">
<mxGeometry relative="1" as="geometry">
<mxPoint x="541" y="743" as="sourcePoint" />
</mxGeometry>
</mxCell>
<mxCell id="HzgoOLMbdf1Lhczd7Y_U-11" value="Not IP Only" style="rounded=1;whiteSpace=wrap;html=1;fontSize=15;shadow=1;" parent="1" vertex="1">
<mxGeometry x="919" y="1240" width="120" height="60" as="geometry" />
</mxCell>
<mxCell id="HzgoOLMbdf1Lhczd7Y_U-17" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;exitX=0;exitY=0.5;exitDx=0;exitDy=0;entryX=1;entryY=0.5;entryDx=0;entryDy=0;fontSize=15;endArrow=blockThin;endFill=1;" parent="1" source="HzgoOLMbdf1Lhczd7Y_U-15" target="LDplG8UmEiPDtL-p8i6A-20" edge="1">
<mxGeometry relative="1" as="geometry">
<mxPoint x="519.5" y="999" as="targetPoint" />
</mxGeometry>
</mxCell>
<mxCell id="zVmsChvBqX3Bo2thPNO_-10" value="Yes" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;" parent="HzgoOLMbdf1Lhczd7Y_U-17" vertex="1" connectable="0">
<mxGeometry x="-0.4493" y="1" relative="1" as="geometry">
<mxPoint x="-16" y="-17" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="0AOyOH4djSygT5G8EftG-16" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;fontSize=15;endArrow=blockThin;endFill=1;" parent="1" source="HzgoOLMbdf1Lhczd7Y_U-15" target="0AOyOH4djSygT5G8EftG-15" edge="1">
<mxGeometry relative="1" as="geometry">
<mxPoint x="880" y="920" as="sourcePoint" />
</mxGeometry>
</mxCell>
<mxCell id="0AOyOH4djSygT5G8EftG-17" value="No" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;" parent="0AOyOH4djSygT5G8EftG-16" vertex="1" connectable="0">
<mxGeometry x="-0.2" y="1" relative="1" as="geometry">
<mxPoint x="14" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="HzgoOLMbdf1Lhczd7Y_U-15" value="&lt;div&gt;IP_Only&lt;/div&gt;&lt;div&gt;compatible?&lt;/div&gt;" style="rhombus;whiteSpace=wrap;html=1;fontSize=15;shadow=1;" parent="1" vertex="1">
<mxGeometry x="890" y="829" width="139" height="89" as="geometry" />
</mxCell>
<mxCell id="HzgoOLMbdf1Lhczd7Y_U-25" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=0;entryY=0.5;entryDx=0;entryDy=0;fontSize=15;endArrow=blockThin;endFill=1;" parent="1" source="HzgoOLMbdf1Lhczd7Y_U-23" target="LDplG8UmEiPDtL-p8i6A-26" edge="1">
<mxGeometry relative="1" as="geometry">
<mxPoint x="825" y="805" as="sourcePoint" />
</mxGeometry>
</mxCell>
<mxCell id="zVmsChvBqX3Bo2thPNO_-12" value="Yes" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;" parent="HzgoOLMbdf1Lhczd7Y_U-25" vertex="1" connectable="0">
<mxGeometry x="-0.38" y="-2" relative="1" as="geometry">
<mxPoint x="6" y="-15" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="0AOyOH4djSygT5G8EftG-10" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;fontSize=15;endArrow=blockThin;endFill=1;" parent="1" source="HzgoOLMbdf1Lhczd7Y_U-23" target="n4viz4upnR27VTd0IMI--8" edge="1">
<mxGeometry relative="1" as="geometry">
<mxPoint x="716.9411764705883" y="1240" as="targetPoint" />
</mxGeometry>
</mxCell>
<mxCell id="0AOyOH4djSygT5G8EftG-11" value="No" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;" parent="0AOyOH4djSygT5G8EftG-10" vertex="1" connectable="0">
<mxGeometry x="-0.1333" y="2" relative="1" as="geometry">
<mxPoint x="10" y="-1" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="HzgoOLMbdf1Lhczd7Y_U-23" value="Post Match:&lt;br&gt;&lt;div&gt;IP_Only&lt;/div&gt;&lt;div&gt;compatible?&lt;/div&gt;" style="rhombus;whiteSpace=wrap;html=1;fontSize=15;shadow=1;" parent="1" vertex="1">
<mxGeometry x="643.5" y="1065" width="146.5" height="130" as="geometry" />
</mxCell>
<mxCell id="0AOyOH4djSygT5G8EftG-1" value="Signature" style="shape=parallelogram;html=1;strokeWidth=1;perimeter=parallelogramPerimeter;whiteSpace=wrap;rounded=1;arcSize=12;size=0.23;fontSize=15;shadow=1;" parent="1" vertex="1">
<mxGeometry x="460" y="701" width="140" height="82" as="geometry" />
</mxCell>
<mxCell id="0AOyOH4djSygT5G8EftG-2" value="Not IP Only" style="rounded=1;whiteSpace=wrap;html=1;fontSize=15;shadow=1;" parent="1" vertex="1">
<mxGeometry x="668.5" y="582" width="120" height="60" as="geometry" />
</mxCell>
<mxCell id="0AOyOH4djSygT5G8EftG-4" value="Not IP Only" style="rounded=1;whiteSpace=wrap;html=1;fontSize=15;shadow=1;" parent="1" vertex="1">
<mxGeometry x="914.5" y="578" width="120" height="60" as="geometry" />
</mxCell>
<mxCell id="0AOyOH4djSygT5G8EftG-5" value="Not IP Only" style="rounded=1;whiteSpace=wrap;html=1;fontSize=15;shadow=1;" parent="1" vertex="1">
<mxGeometry x="1163.5" y="579" width="120" height="60" as="geometry" />
</mxCell>
<mxCell id="0AOyOH4djSygT5G8EftG-8" value="Not IP Only" style="rounded=1;whiteSpace=wrap;html=1;fontSize=15;shadow=1;" parent="1" vertex="1">
<mxGeometry x="1386.5" y="579" width="120" height="60" as="geometry" />
</mxCell>
<mxCell id="0AOyOH4djSygT5G8EftG-12" value="Not IP Only" style="rounded=1;whiteSpace=wrap;html=1;fontSize=15;shadow=1;" parent="1" vertex="1">
<mxGeometry x="676.5" y="975" width="120" height="60" as="geometry" />
</mxCell>
<mxCell id="0AOyOH4djSygT5G8EftG-15" value="Not IP Only" style="rounded=1;whiteSpace=wrap;html=1;fontSize=15;shadow=1;" parent="1" vertex="1">
<mxGeometry x="899.5" y="974" width="120" height="60" as="geometry" />
</mxCell>
<mxCell id="0AOyOH4djSygT5G8EftG-21" value="Not IP Only" style="rounded=1;whiteSpace=wrap;html=1;fontSize=15;shadow=1;" parent="1" vertex="1">
<mxGeometry x="1381.5" y="974" width="130" height="60" as="geometry" />
</mxCell>
<mxCell id="0AOyOH4djSygT5G8EftG-23" value="&lt;font&gt;Like IP Only&lt;/font&gt;" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#cdeb8b;strokeColor=#36393d;fontSize=15;shadow=1;" parent="1" vertex="1">
<mxGeometry x="1384" y="1100" width="127.5" height="60" as="geometry" />
</mxCell>
<mxCell id="0AOyOH4djSygT5G8EftG-25" value="IP Only" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#d5e8d4;strokeColor=#000000;fontSize=15;shadow=1;" parent="1" vertex="1">
<mxGeometry x="1186.5" y="1240" width="120" height="60" as="geometry" />
</mxCell>
<mxCell id="n4viz4upnR27VTd0IMI--1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;fontSize=15;endArrow=blockThin;endFill=1;" edge="1" parent="1" source="n4viz4upnR27VTd0IMI--3" target="n4viz4upnR27VTd0IMI--4">
<mxGeometry relative="1" as="geometry" />
</mxCell>
<mxCell id="n4viz4upnR27VTd0IMI--2" value="No" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;" vertex="1" connectable="0" parent="n4viz4upnR27VTd0IMI--1">
<mxGeometry x="-0.2" y="1" relative="1" as="geometry">
<mxPoint x="14" y="-4" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="n4viz4upnR27VTd0IMI--5" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;endArrow=blockThin;endFill=1;fontSize=15;" edge="1" parent="1" source="n4viz4upnR27VTd0IMI--3" target="HzgoOLMbdf1Lhczd7Y_U-15">
<mxGeometry relative="1" as="geometry">
<mxPoint x="973" y="874" as="sourcePoint" />
</mxGeometry>
</mxCell>
<mxCell id="n4viz4upnR27VTd0IMI--6" value="Yes" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;" vertex="1" connectable="0" parent="n4viz4upnR27VTd0IMI--5">
<mxGeometry x="0.0134" y="-1" relative="1" as="geometry">
<mxPoint y="-14" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="n4viz4upnR27VTd0IMI--3" value="&lt;div&gt;Non-payload&lt;/div&gt;&lt;div&gt;per-packet match?&lt;/div&gt;" style="rhombus;whiteSpace=wrap;html=1;fontSize=15;shadow=1;" vertex="1" parent="1">
<mxGeometry x="1100" y="816" width="197" height="116" as="geometry" />
</mxCell>
<mxCell id="n4viz4upnR27VTd0IMI--4" value="Not IP Only" style="rounded=1;whiteSpace=wrap;html=1;fontSize=15;shadow=1;" vertex="1" parent="1">
<mxGeometry x="1138.5" y="974" width="120" height="60" as="geometry" />
</mxCell>
<mxCell id="n4viz4upnR27VTd0IMI--8" value="Not IP Only" style="rounded=1;whiteSpace=wrap;html=1;fontSize=15;shadow=1;" vertex="1" parent="1">
<mxGeometry x="657" y="1240" width="120" height="60" as="geometry" />
</mxCell>
</root>
</mxGraphModel>
</diagram>
</mxfile>

104
doc/userguide/rules/rule-types/RawFlowcharts/OverallAlgoHorizontal.drawio
Unescape Escape View File

@ -0,0 +1,104 @@
<mxfile host="app.diagrams.net" agent="Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:132.0) Gecko/20100101 Firefox/132.0" version="24.9.1">
<diagram id="C5RBs43oDa-KdzZeNtuy" name="Page-1">
<mxGraphModel dx="2261" dy="792" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="827" pageHeight="1169" math="0" shadow="0">
<root>
<mxCell id="WIyWlLk6GJQsqaUBKTNV-0" />
<mxCell id="WIyWlLk6GJQsqaUBKTNV-1" parent="WIyWlLk6GJQsqaUBKTNV-0" />
<mxCell id="WIyWlLk6GJQsqaUBKTNV-4" value="No" style="rounded=0;html=1;jettySize=auto;orthogonalLoop=1;fontSize=16;endArrow=blockThin;endFill=1;endSize=8;strokeWidth=1;shadow=1;labelBackgroundColor=none;edgeStyle=orthogonalEdgeStyle;labelBorderColor=none;textShadow=0;fontStyle=0" parent="WIyWlLk6GJQsqaUBKTNV-1" source="WIyWlLk6GJQsqaUBKTNV-6" target="WIyWlLk6GJQsqaUBKTNV-10" edge="1">
<mxGeometry y="20" relative="1" as="geometry">
<mxPoint as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="WIyWlLk6GJQsqaUBKTNV-5" value="No" style="edgeStyle=orthogonalEdgeStyle;rounded=0;html=1;jettySize=auto;orthogonalLoop=1;fontSize=16;endArrow=blockThin;endFill=1;endSize=8;strokeWidth=1;shadow=1;labelBackgroundColor=none;labelBorderColor=none;textShadow=0;entryX=0;entryY=0.5;entryDx=0;entryDy=0;fontStyle=0" parent="WIyWlLk6GJQsqaUBKTNV-1" source="2s8PCpyst4B-AYq6nZVi-2" target="WIyWlLk6GJQsqaUBKTNV-7" edge="1">
<mxGeometry x="0.0039" y="15" relative="1" as="geometry">
<mxPoint as="offset" />
<mxPoint x="-120" y="220" as="sourcePoint" />
<Array as="points">
<mxPoint x="-120" y="195" />
</Array>
</mxGeometry>
</mxCell>
<mxCell id="2s8PCpyst4B-AYq6nZVi-1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;exitX=0.5;exitY=0;exitDx=0;exitDy=0;endArrow=blockThin;endFill=1;fontSize=16;labelBackgroundColor=none;labelBorderColor=none;textShadow=0;shadow=1;fontStyle=0" parent="WIyWlLk6GJQsqaUBKTNV-1" source="WIyWlLk6GJQsqaUBKTNV-6" target="2s8PCpyst4B-AYq6nZVi-2" edge="1">
<mxGeometry relative="1" as="geometry">
<mxPoint x="-120" y="200" as="targetPoint" />
<Array as="points">
<mxPoint x="-120" y="360" />
<mxPoint x="-120" y="360" />
</Array>
</mxGeometry>
</mxCell>
<mxCell id="YKtqplUdx_BT4Hee0G-G-2" value="Yes" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=16;fontStyle=0" vertex="1" connectable="0" parent="2s8PCpyst4B-AYq6nZVi-1">
<mxGeometry x="-0.05" y="-3" relative="1" as="geometry">
<mxPoint x="17" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="WIyWlLk6GJQsqaUBKTNV-6" value="Is IpOnly" style="rhombus;html=1;shadow=1;fontFamily=Helvetica;fontSize=16;align=center;strokeWidth=1;spacing=5;spacingTop=2;whiteSpace=wrap;labelBackgroundColor=none;labelBorderColor=none;textShadow=0;spacingRight=5;spacingBottom=2;spacingLeft=5;fontStyle=0" parent="WIyWlLk6GJQsqaUBKTNV-1" vertex="1">
<mxGeometry x="-170" y="390" width="100" height="80" as="geometry" />
</mxCell>
<mxCell id="WIyWlLk6GJQsqaUBKTNV-7" value="&lt;span&gt;IP Only&lt;/span&gt;" style="rounded=1;html=1;fontSize=16;glass=0;strokeWidth=1;shadow=1;whiteSpace=wrap;labelBackgroundColor=none;labelBorderColor=none;textShadow=0;spacingRight=5;spacingBottom=2;spacingLeft=5;spacingTop=2;spacing=5;fontStyle=0" parent="WIyWlLk6GJQsqaUBKTNV-1" vertex="1">
<mxGeometry x="213.5" y="160" width="91" height="70" as="geometry" />
</mxCell>
<mxCell id="WIyWlLk6GJQsqaUBKTNV-8" value="No" style="rounded=0;html=1;jettySize=auto;orthogonalLoop=1;fontSize=16;endArrow=blockThin;endFill=1;endSize=8;strokeWidth=1;shadow=1;labelBackgroundColor=none;edgeStyle=orthogonalEdgeStyle;labelBorderColor=none;textShadow=0;fontStyle=0" parent="WIyWlLk6GJQsqaUBKTNV-1" source="WIyWlLk6GJQsqaUBKTNV-10" target="WIyWlLk6GJQsqaUBKTNV-11" edge="1">
<mxGeometry x="0.3333" y="20" relative="1" as="geometry">
<mxPoint as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="WIyWlLk6GJQsqaUBKTNV-9" value="Yes" style="edgeStyle=orthogonalEdgeStyle;rounded=0;html=1;jettySize=auto;orthogonalLoop=1;fontSize=16;endArrow=blockThin;endFill=1;endSize=8;strokeWidth=1;shadow=1;labelBackgroundColor=none;labelBorderColor=none;textShadow=0;fontStyle=0" parent="WIyWlLk6GJQsqaUBKTNV-1" source="WIyWlLk6GJQsqaUBKTNV-10" target="WIyWlLk6GJQsqaUBKTNV-12" edge="1">
<mxGeometry x="-0.0769" y="20" relative="1" as="geometry">
<mxPoint as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="WIyWlLk6GJQsqaUBKTNV-10" value="Is DEOnly" style="rhombus;html=1;shadow=1;fontFamily=Helvetica;fontSize=16;align=center;strokeWidth=1;spacing=5;spacingTop=2;whiteSpace=wrap;labelBackgroundColor=none;labelBorderColor=none;textShadow=0;spacingRight=5;spacingBottom=2;spacingLeft=5;fontStyle=0" parent="WIyWlLk6GJQsqaUBKTNV-1" vertex="1">
<mxGeometry y="390" width="100" height="80" as="geometry" />
</mxCell>
<mxCell id="WIyWlLk6GJQsqaUBKTNV-11" value="Handle &lt;span&gt;&#39;Packet&#39;&lt;/span&gt;, &lt;span&gt;&#39;Stream&#39;&lt;/span&gt;, &#39;&lt;span&gt;AppLayer&#39;&lt;/span&gt; and &lt;span&gt;&#39;AppLayer Transaction&#39;&lt;/span&gt; rule types" style="rounded=1;html=1;fontSize=16;glass=0;strokeWidth=1;shadow=1;whiteSpace=wrap;labelBackgroundColor=none;labelBorderColor=none;textShadow=0;spacingRight=5;spacingBottom=2;spacingLeft=5;spacingTop=2;spacing=5;fontStyle=0" parent="WIyWlLk6GJQsqaUBKTNV-1" vertex="1">
<mxGeometry x="163.5" y="375" width="191" height="110" as="geometry" />
</mxCell>
<mxCell id="WIyWlLk6GJQsqaUBKTNV-12" value="&lt;span&gt;Decoder Events Only&lt;/span&gt;" style="rounded=1;html=1;fontSize=16;glass=0;strokeWidth=1;shadow=1;whiteSpace=wrap;labelBackgroundColor=none;labelBorderColor=none;textShadow=0;spacingRight=5;spacingBottom=2;spacingLeft=5;spacingTop=2;spacing=5;fontStyle=0" parent="WIyWlLk6GJQsqaUBKTNV-1" vertex="1">
<mxGeometry x="-30" y="535" width="160" height="55" as="geometry" />
</mxCell>
<mxCell id="3Z0NyFf9CSu-jNyiQ6yW-0" value="Yes" style="edgeStyle=orthogonalEdgeStyle;rounded=0;html=1;jettySize=auto;orthogonalLoop=1;fontSize=16;endArrow=blockThin;endFill=1;endSize=8;strokeWidth=1;shadow=1;labelBackgroundColor=none;labelBorderColor=none;textShadow=0;fontStyle=0" parent="WIyWlLk6GJQsqaUBKTNV-1" source="3Z0NyFf9CSu-jNyiQ6yW-1" target="3Z0NyFf9CSu-jNyiQ6yW-2" edge="1">
<mxGeometry x="-0.0769" y="20" relative="1" as="geometry">
<mxPoint as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="3Z0NyFf9CSu-jNyiQ6yW-3" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;endArrow=blockThin;endFill=1;fontSize=16;labelBackgroundColor=none;labelBorderColor=none;textShadow=0;shadow=1;fontStyle=0" parent="WIyWlLk6GJQsqaUBKTNV-1" source="3Z0NyFf9CSu-jNyiQ6yW-1" target="WIyWlLk6GJQsqaUBKTNV-6" edge="1">
<mxGeometry relative="1" as="geometry" />
</mxCell>
<mxCell id="3Z0NyFf9CSu-jNyiQ6yW-4" value="No" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=16;labelBackgroundColor=none;labelBorderColor=none;textShadow=0;shadow=1;spacingRight=5;spacingBottom=2;spacingLeft=5;spacingTop=2;spacing=5;fontStyle=0" parent="3Z0NyFf9CSu-jNyiQ6yW-3" vertex="1" connectable="0">
<mxGeometry x="-0.1667" relative="1" as="geometry">
<mxPoint y="-20" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="3Z0NyFf9CSu-jNyiQ6yW-1" value="Is IPDOnly" style="rhombus;html=1;shadow=1;fontFamily=Helvetica;fontSize=16;align=center;strokeWidth=1;spacing=5;spacingTop=2;whiteSpace=wrap;labelBackgroundColor=none;labelBorderColor=none;textShadow=0;spacingRight=5;spacingBottom=2;spacingLeft=5;fontStyle=0" parent="WIyWlLk6GJQsqaUBKTNV-1" vertex="1">
<mxGeometry x="-340" y="390" width="100" height="80" as="geometry" />
</mxCell>
<mxCell id="3Z0NyFf9CSu-jNyiQ6yW-2" value="&lt;span&gt;Protocol Detection Only&lt;/span&gt;" style="rounded=1;html=1;fontSize=16;glass=0;strokeWidth=1;shadow=1;whiteSpace=wrap;labelBackgroundColor=none;labelBorderColor=none;textShadow=0;spacingRight=5;spacingBottom=2;spacingLeft=5;spacingTop=2;spacing=5;fontStyle=0" parent="WIyWlLk6GJQsqaUBKTNV-1" vertex="1">
<mxGeometry x="-370" y="535" width="160" height="65" as="geometry" />
</mxCell>
<mxCell id="3Z0NyFf9CSu-jNyiQ6yW-10" value="&lt;div&gt;&lt;span&gt;Like IP Only&lt;/span&gt;&lt;br&gt;(has negated address(es))&lt;br&gt;&lt;/div&gt;" style="rounded=1;html=1;fontSize=16;glass=0;strokeWidth=1;shadow=1;whiteSpace=wrap;labelBackgroundColor=none;labelBorderColor=none;textShadow=0;spacingRight=5;spacingBottom=2;spacingLeft=5;spacingTop=2;spacing=5;fontStyle=0" parent="WIyWlLk6GJQsqaUBKTNV-1" vertex="1">
<mxGeometry x="183.5" y="260" width="151" height="70" as="geometry" />
</mxCell>
<mxCell id="2s8PCpyst4B-AYq6nZVi-3" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;endArrow=blockThin;endFill=1;fontSize=16;labelBackgroundColor=none;labelBorderColor=none;textShadow=0;shadow=1;fontStyle=0" parent="WIyWlLk6GJQsqaUBKTNV-1" source="2s8PCpyst4B-AYq6nZVi-2" target="3Z0NyFf9CSu-jNyiQ6yW-10" edge="1">
<mxGeometry relative="1" as="geometry">
<Array as="points" />
</mxGeometry>
</mxCell>
<mxCell id="2s8PCpyst4B-AYq6nZVi-4" value="&lt;div&gt;Yes&lt;br&gt;&lt;/div&gt;" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=16;labelBackgroundColor=none;labelBorderColor=none;textShadow=0;shadow=1;spacingRight=5;spacingBottom=2;spacingLeft=5;spacingTop=2;spacing=5;fontStyle=0" parent="2s8PCpyst4B-AYq6nZVi-3" vertex="1" connectable="0">
<mxGeometry x="-0.4" relative="1" as="geometry">
<mxPoint y="-20" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="2s8PCpyst4B-AYq6nZVi-2" value="&lt;div&gt;Contains&lt;/div&gt;&lt;div&gt;Negated&lt;/div&gt;&lt;div&gt;Address?&lt;/div&gt;" style="rhombus;html=1;fontSize=16;whiteSpace=wrap;labelBackgroundColor=none;labelBorderColor=none;textShadow=0;shadow=1;spacingRight=5;spacingBottom=2;spacingLeft=5;spacingTop=2;spacing=5;fontStyle=0" parent="WIyWlLk6GJQsqaUBKTNV-1" vertex="1">
<mxGeometry x="-190" y="240" width="140" height="110" as="geometry" />
</mxCell>
<mxCell id="YKtqplUdx_BT4Hee0G-G-1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;endArrow=blockThin;endFill=1;fontSize=16;shadow=1;fontStyle=0" edge="1" parent="WIyWlLk6GJQsqaUBKTNV-1" source="YKtqplUdx_BT4Hee0G-G-0" target="3Z0NyFf9CSu-jNyiQ6yW-1">
<mxGeometry relative="1" as="geometry" />
</mxCell>
<mxCell id="YKtqplUdx_BT4Hee0G-G-0" value="Signature" style="shape=parallelogram;html=1;strokeWidth=1;perimeter=parallelogramPerimeter;whiteSpace=wrap;rounded=1;arcSize=12;size=0.23;fontSize=16;shadow=1;fontStyle=0" vertex="1" parent="WIyWlLk6GJQsqaUBKTNV-1">
<mxGeometry x="-345" y="230" width="110" height="60" as="geometry" />
</mxCell>
</root>
</mxGraphModel>
</diagram>
</mxfile>

225
doc/userguide/rules/rule-types/RawFlowcharts/PD-only.drawio
Unescape Escape View File

@ -0,0 +1,225 @@
<mxfile host="app.diagrams.net" agent="Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0" version="26.0.5">
<diagram name="Page-1" id="Huy6zuTNKuhlR82RVxZD">
<mxGraphModel dx="1434" dy="792" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="850" pageHeight="1100" math="0" shadow="0">
<root>
<mxCell id="0" />
<mxCell id="1" parent="0" />
<mxCell id="SssYP0pVQeMwz5sfJHV3-4" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;fontSize=15;endArrow=blockThin;endFill=1;" parent="1" source="SssYP0pVQeMwz5sfJHV3-7" target="SssYP0pVQeMwz5sfJHV3-8" edge="1">
<mxGeometry relative="1" as="geometry" />
</mxCell>
<mxCell id="SssYP0pVQeMwz5sfJHV3-5" value="Yes" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;" parent="SssYP0pVQeMwz5sfJHV3-4" vertex="1" connectable="0">
<mxGeometry x="0.511" y="1" relative="1" as="geometry">
<mxPoint x="-46" y="-11" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="SssYP0pVQeMwz5sfJHV3-6" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;fontSize=15;endArrow=blockThin;endFill=1;" parent="1" source="SssYP0pVQeMwz5sfJHV3-7" target="SssYP0pVQeMwz5sfJHV3-10" edge="1">
<mxGeometry relative="1" as="geometry">
<mxPoint x="345" y="600" as="targetPoint" />
</mxGeometry>
</mxCell>
<mxCell id="a3aPwti0dP9LQcNFLp-g-1" value="No" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;" parent="SssYP0pVQeMwz5sfJHV3-6" vertex="1" connectable="0">
<mxGeometry x="-0.333" relative="1" as="geometry">
<mxPoint x="13" y="1" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="SssYP0pVQeMwz5sfJHV3-7" value="&lt;div&gt;ALPROTO&lt;/div&gt;&lt;div&gt;UNKNOWN?&lt;/div&gt;" style="rhombus;whiteSpace=wrap;html=1;fontSize=15;" parent="1" vertex="1">
<mxGeometry x="201.88" y="440" width="148.75" height="120" as="geometry" />
</mxCell>
<mxCell id="SssYP0pVQeMwz5sfJHV3-8" value="Not PD_ONLY" style="whiteSpace=wrap;html=1;aspect=fixed;rotation=0;rounded=1;shadow=1;fontSize=15;" parent="1" vertex="1">
<mxGeometry x="473.13000000000005" y="467.13" width="121.82" height="67" as="geometry" />
</mxCell>
<mxCell id="SssYP0pVQeMwz5sfJHV3-9" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;fontSize=15;endArrow=blockThin;endFill=1;" parent="1" source="SssYP0pVQeMwz5sfJHV3-10" target="SssYP0pVQeMwz5sfJHV3-19" edge="1">
<mxGeometry relative="1" as="geometry">
<mxPoint x="277.25" y="960" as="targetPoint" />
<mxPoint x="277.29999999999995" y="819.9744360902255" as="sourcePoint" />
</mxGeometry>
</mxCell>
<mxCell id="a3aPwti0dP9LQcNFLp-g-2" value="No" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;" parent="SssYP0pVQeMwz5sfJHV3-9" vertex="1" connectable="0">
<mxGeometry x="-0.5283" y="1" relative="1" as="geometry">
<mxPoint x="12" y="7" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="SssYP0pVQeMwz5sfJHV3-10" value="&lt;div&gt;Payload&lt;br&gt;and/or&lt;br&gt;Stream match list?&lt;/div&gt;&lt;div&gt;&lt;br&gt;&lt;/div&gt;" style="rhombus;whiteSpace=wrap;html=1;fontSize=15;" parent="1" vertex="1">
<mxGeometry x="176.26" y="612" width="200" height="130" as="geometry" />
</mxCell>
<mxCell id="SssYP0pVQeMwz5sfJHV3-11" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;fontSize=15;endArrow=blockThin;endFill=1;" parent="1" source="SssYP0pVQeMwz5sfJHV3-10" target="mP8Eb71_Q6LACfifqw_b-11" edge="1">
<mxGeometry relative="1" as="geometry" />
</mxCell>
<mxCell id="SssYP0pVQeMwz5sfJHV3-12" value="Yes" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;" parent="SssYP0pVQeMwz5sfJHV3-11" vertex="1" connectable="0">
<mxGeometry x="-0.3513" y="1" relative="1" as="geometry">
<mxPoint x="6" y="-11" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="SssYP0pVQeMwz5sfJHV3-17" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;exitX=1;exitY=0.5;exitDx=0;exitDy=0;fontSize=15;endArrow=blockThin;endFill=1;" parent="1" source="SssYP0pVQeMwz5sfJHV3-19" target="mP8Eb71_Q6LACfifqw_b-3" edge="1">
<mxGeometry relative="1" as="geometry">
<mxPoint x="701.8000000000002" y="698.04" as="targetPoint" />
<mxPoint x="310" y="1112" as="sourcePoint" />
</mxGeometry>
</mxCell>
<mxCell id="SssYP0pVQeMwz5sfJHV3-33" value="&lt;div&gt;Yes&lt;/div&gt;" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;" parent="SssYP0pVQeMwz5sfJHV3-17" vertex="1" connectable="0">
<mxGeometry x="-0.6597" y="-3" relative="1" as="geometry">
<mxPoint x="36" y="-17" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="SssYP0pVQeMwz5sfJHV3-19" value="Buffer inspection?" style="rhombus;whiteSpace=wrap;html=1;fontSize=15;" parent="1" vertex="1">
<mxGeometry x="192.25" y="802" width="168" height="80" as="geometry" />
</mxCell>
<mxCell id="SssYP0pVQeMwz5sfJHV3-35" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;fontSize=15;endArrow=blockThin;endFill=1;" parent="1" source="SssYP0pVQeMwz5sfJHV3-22" target="SssYP0pVQeMwz5sfJHV3-34" edge="1">
<mxGeometry relative="1" as="geometry">
<mxPoint x="276.29999999999995" y="1024.9749646239252" as="sourcePoint" />
<mxPoint x="276.29999999999995" y="1136.01" as="targetPoint" />
</mxGeometry>
</mxCell>
<mxCell id="a3aPwti0dP9LQcNFLp-g-12" value="Yes" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;" parent="SssYP0pVQeMwz5sfJHV3-35" vertex="1" connectable="0">
<mxGeometry x="0.0619" y="3" relative="1" as="geometry">
<mxPoint x="14" y="-9" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="mP8Eb71_Q6LACfifqw_b-10" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;fontSize=15;endArrow=blockThin;endFill=1;" parent="1" source="SssYP0pVQeMwz5sfJHV3-22" target="a3aPwti0dP9LQcNFLp-g-5" edge="1">
<mxGeometry relative="1" as="geometry">
<mxPoint x="557" y="991" as="targetPoint" />
</mxGeometry>
</mxCell>
<mxCell id="a3aPwti0dP9LQcNFLp-g-9" value="&lt;font&gt;No&lt;/font&gt;" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;" parent="mP8Eb71_Q6LACfifqw_b-10" vertex="1" connectable="0">
<mxGeometry x="-0.4399" y="3" relative="1" as="geometry">
<mxPoint x="15" y="-9" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="SssYP0pVQeMwz5sfJHV3-22" value="&lt;div&gt;non-payload&lt;/div&gt;&lt;div&gt;per-packet&lt;/div&gt;&lt;div&gt;matches?&lt;/div&gt;" style="rhombus;whiteSpace=wrap;html=1;fontSize=15;" parent="1" vertex="1">
<mxGeometry x="184.39" y="934" width="183.74" height="115" as="geometry" />
</mxCell>
<mxCell id="SssYP0pVQeMwz5sfJHV3-29" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;fontSize=15;endArrow=blockThin;endFill=1;" parent="1" source="SssYP0pVQeMwz5sfJHV3-30" target="SssYP0pVQeMwz5sfJHV3-32" edge="1">
<mxGeometry relative="1" as="geometry">
<mxPoint x="275" y="1786" as="sourcePoint" />
</mxGeometry>
</mxCell>
<mxCell id="WFfWZLXEymwSXmm__kdr-14" value="Yes" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;" parent="SssYP0pVQeMwz5sfJHV3-29" vertex="1" connectable="0">
<mxGeometry x="-0.5874" y="-4" relative="1" as="geometry">
<mxPoint x="20" y="16" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="SssYP0pVQeMwz5sfJHV3-30" value="&lt;div&gt;Has keyword&lt;/div&gt;&lt;div&gt;app-layer-protocol?&lt;/div&gt;" style="rhombus;whiteSpace=wrap;html=1;fontSize=15;" parent="1" vertex="1">
<mxGeometry x="150.25" y="1596" width="249.5" height="112" as="geometry" />
</mxCell>
<mxCell id="SssYP0pVQeMwz5sfJHV3-32" value="&lt;div&gt;Protocol Detection Only&lt;br&gt;&lt;/div&gt;" style="whiteSpace=wrap;html=1;fillColor=#d5e8d4;strokeColor=#000000;rounded=1;shadow=1;fontSize=15;imageAspect=1;" parent="1" vertex="1">
<mxGeometry x="214.5" y="1758" width="121" height="67" as="geometry" />
</mxCell>
<mxCell id="SssYP0pVQeMwz5sfJHV3-36" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=0.5;entryY=0;entryDx=0;entryDy=0;fontSize=15;endArrow=blockThin;endFill=1;" parent="1" source="SssYP0pVQeMwz5sfJHV3-34" target="SssYP0pVQeMwz5sfJHV3-39" edge="1">
<mxGeometry relative="1" as="geometry">
<mxPoint x="170" y="1599" as="targetPoint" />
</mxGeometry>
</mxCell>
<mxCell id="a3aPwti0dP9LQcNFLp-g-16" value="No" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;" parent="SssYP0pVQeMwz5sfJHV3-36" vertex="1" connectable="0">
<mxGeometry x="-0.2574" y="-1" relative="1" as="geometry">
<mxPoint x="15" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="SssYP0pVQeMwz5sfJHV3-37" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;fontSize=15;endArrow=blockThin;endFill=1;" parent="1" source="SssYP0pVQeMwz5sfJHV3-34" target="a3aPwti0dP9LQcNFLp-g-4" edge="1">
<mxGeometry relative="1" as="geometry">
<mxPoint x="726.26" y="1164" as="targetPoint" />
</mxGeometry>
</mxCell>
<mxCell id="SssYP0pVQeMwz5sfJHV3-38" value="Yes" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;" parent="SssYP0pVQeMwz5sfJHV3-37" vertex="1" connectable="0">
<mxGeometry x="-0.3341" y="2" relative="1" as="geometry">
<mxPoint x="9" y="-10" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="SssYP0pVQeMwz5sfJHV3-34" value="Flowbits&lt;br&gt;AND NOT&lt;br&gt;flowbits:set" style="rhombus;whiteSpace=wrap;html=1;fontSize=15;" parent="1" vertex="1">
<mxGeometry x="184.39000000000001" y="1084" width="181.87" height="110" as="geometry" />
</mxCell>
<mxCell id="SssYP0pVQeMwz5sfJHV3-42" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;fontSize=15;endArrow=blockThin;endFill=1;" parent="1" source="SssYP0pVQeMwz5sfJHV3-39" target="SssYP0pVQeMwz5sfJHV3-43" edge="1">
<mxGeometry relative="1" as="geometry">
<mxPoint x="182.5" y="1831" as="targetPoint" />
</mxGeometry>
</mxCell>
<mxCell id="a3aPwti0dP9LQcNFLp-g-15" value="No" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;" parent="SssYP0pVQeMwz5sfJHV3-42" vertex="1" connectable="0">
<mxGeometry x="-0.05" y="4" relative="1" as="geometry">
<mxPoint x="10" y="-6" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="WFfWZLXEymwSXmm__kdr-16" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;fontSize=15;endArrow=blockThin;endFill=1;" parent="1" source="SssYP0pVQeMwz5sfJHV3-39" target="a3aPwti0dP9LQcNFLp-g-3" edge="1">
<mxGeometry relative="1" as="geometry">
<mxPoint x="710" y="1546" as="targetPoint" />
</mxGeometry>
</mxCell>
<mxCell id="WFfWZLXEymwSXmm__kdr-17" value="Yes" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;" parent="WFfWZLXEymwSXmm__kdr-16" vertex="1" connectable="0">
<mxGeometry x="-0.7803" y="-4" relative="1" as="geometry">
<mxPoint x="22" y="-17" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="SssYP0pVQeMwz5sfJHV3-39" value="Flow setting&lt;br&gt;AND NOT&lt;br&gt;&lt;div&gt;TOSERVER&lt;/div&gt;&lt;div&gt;or TOCLIENT&lt;/div&gt;" style="rhombus;whiteSpace=wrap;html=1;fontSize=15;" parent="1" vertex="1">
<mxGeometry x="164.24" y="1246" width="222.17" height="140" as="geometry" />
</mxCell>
<mxCell id="SssYP0pVQeMwz5sfJHV3-47" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;fontSize=15;endArrow=blockThin;endFill=1;" parent="1" source="SssYP0pVQeMwz5sfJHV3-43" target="SssYP0pVQeMwz5sfJHV3-30" edge="1">
<mxGeometry relative="1" as="geometry" />
</mxCell>
<mxCell id="a3aPwti0dP9LQcNFLp-g-17" value="Yes" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;" parent="SssYP0pVQeMwz5sfJHV3-47" vertex="1" connectable="0">
<mxGeometry x="-0.2443" y="2" relative="1" as="geometry">
<mxPoint x="13" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="mP8Eb71_Q6LACfifqw_b-9" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;fontSize=15;endArrow=blockThin;endFill=1;" parent="1" source="SssYP0pVQeMwz5sfJHV3-43" target="a3aPwti0dP9LQcNFLp-g-7" edge="1">
<mxGeometry relative="1" as="geometry">
<mxPoint x="730" y="1710" as="targetPoint" />
</mxGeometry>
</mxCell>
<mxCell id="a3aPwti0dP9LQcNFLp-g-14" value="No" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;" parent="mP8Eb71_Q6LACfifqw_b-9" vertex="1" connectable="0">
<mxGeometry x="-0.1489" y="-1" relative="1" as="geometry">
<mxPoint x="-13" y="-14" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="SssYP0pVQeMwz5sfJHV3-43" value="&lt;div&gt;Match&lt;/div&gt;&lt;div&gt;IP_Only compatible?&lt;/div&gt;" style="rhombus;whiteSpace=wrap;html=1;fontSize=15;" parent="1" vertex="1">
<mxGeometry x="160.17000000000002" y="1436.5" width="229.67" height="103" as="geometry" />
</mxCell>
<mxCell id="WFfWZLXEymwSXmm__kdr-3" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;fontSize=15;endArrow=blockThin;endFill=1;" parent="1" source="SssYP0pVQeMwz5sfJHV3-19" target="SssYP0pVQeMwz5sfJHV3-22" edge="1">
<mxGeometry relative="1" as="geometry">
<mxPoint x="300" y="900" as="sourcePoint" />
</mxGeometry>
</mxCell>
<mxCell id="a3aPwti0dP9LQcNFLp-g-10" value="No" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;" parent="WFfWZLXEymwSXmm__kdr-3" vertex="1" connectable="0">
<mxGeometry x="-0.4227" y="3" relative="1" as="geometry">
<mxPoint x="11" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="WFfWZLXEymwSXmm__kdr-18" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;fontSize=15;endArrow=blockThin;endFill=1;" parent="1" source="SssYP0pVQeMwz5sfJHV3-30" target="a3aPwti0dP9LQcNFLp-g-8" edge="1">
<mxGeometry relative="1" as="geometry">
<mxPoint x="459.5" y="1691" as="sourcePoint" />
<mxPoint x="735" y="1691" as="targetPoint" />
</mxGeometry>
</mxCell>
<mxCell id="WFfWZLXEymwSXmm__kdr-19" value="No" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=15;" parent="WFfWZLXEymwSXmm__kdr-18" vertex="1" connectable="0">
<mxGeometry x="-0.7573" y="-5" relative="1" as="geometry">
<mxPoint x="16" y="-19" as="offset" />
</mxGeometry>
</mxCell>
<mxCell id="mP8Eb71_Q6LACfifqw_b-2" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=0.5;entryY=0;entryDx=0;entryDy=0;endArrow=blockThin;endFill=1;fontSize=15;" parent="1" source="mP8Eb71_Q6LACfifqw_b-1" target="SssYP0pVQeMwz5sfJHV3-7" edge="1">
<mxGeometry relative="1" as="geometry" />
</mxCell>
<mxCell id="mP8Eb71_Q6LACfifqw_b-1" value="Signature" style="shape=parallelogram;perimeter=parallelogramPerimeter;whiteSpace=wrap;html=1;fixedSize=1;rounded=1;fontSize=15;" parent="1" vertex="1">
<mxGeometry x="365" y="350" width="120" height="60" as="geometry" />
</mxCell>
<mxCell id="mP8Eb71_Q6LACfifqw_b-3" value="Not PD_ONLY" style="whiteSpace=wrap;html=1;aspect=fixed;rotation=0;rounded=1;shadow=1;fontSize=15;" parent="1" vertex="1">
<mxGeometry x="472" y="808.5" width="121.82" height="67" as="geometry" />
</mxCell>
<mxCell id="mP8Eb71_Q6LACfifqw_b-11" value="Not PD_ONLY" style="whiteSpace=wrap;html=1;aspect=fixed;rotation=0;rounded=1;shadow=1;fontSize=15;" parent="1" vertex="1">
<mxGeometry x="469.27" y="643.5" width="121.82" height="67" as="geometry" />
</mxCell>
<mxCell id="a3aPwti0dP9LQcNFLp-g-3" value="Not PD_ONLY" style="whiteSpace=wrap;html=1;aspect=fixed;rotation=0;rounded=1;shadow=1;fontSize=15;" parent="1" vertex="1">
<mxGeometry x="472" y="1282.5" width="121.82" height="67" as="geometry" />
</mxCell>
<mxCell id="a3aPwti0dP9LQcNFLp-g-4" value="Not PD_ONLY" style="whiteSpace=wrap;html=1;aspect=fixed;rotation=0;rounded=1;shadow=1;fontSize=15;" parent="1" vertex="1">
<mxGeometry x="472" y="1105.5" width="121.82" height="67" as="geometry" />
</mxCell>
<mxCell id="a3aPwti0dP9LQcNFLp-g-5" value="Not PD_ONLY" style="whiteSpace=wrap;html=1;aspect=fixed;rotation=0;rounded=1;shadow=1;fontSize=15;" parent="1" vertex="1">
<mxGeometry x="472" y="957.5" width="121.82" height="67" as="geometry" />
</mxCell>
<mxCell id="a3aPwti0dP9LQcNFLp-g-7" value="Not PD_ONLY" style="whiteSpace=wrap;html=1;aspect=fixed;rotation=0;rounded=1;shadow=1;fontSize=15;" parent="1" vertex="1">
<mxGeometry x="472" y="1454.5" width="121.82" height="67" as="geometry" />
</mxCell>
<mxCell id="a3aPwti0dP9LQcNFLp-g-8" value="Not PD_ONLY" style="whiteSpace=wrap;html=1;aspect=fixed;rotation=0;rounded=1;shadow=1;fontSize=15;" parent="1" vertex="1">
<mxGeometry x="469.27" y="1618.5" width="121.82" height="67" as="geometry" />
</mxCell>
</root>
</mxGraphModel>
</diagram>
</mxfile>

2
src/detect-engine.c
Unescape Escape View File

@ -110,6 +110,7 @@ static DetectEnginePktInspectionEngine *g_pkt_inspect_engines = NULL;
static DetectEngineFrameInspectionEngine *g_frame_inspect_engines = NULL;
// clang-format off
// rule types documentation tag start: SignatureProperties
const struct SignatureProperties signature_properties[SIG_TYPE_MAX] = {
/* SIG_TYPE_NOT_SET */ { SIG_PROP_FLOW_ACTION_PACKET, },
/* SIG_TYPE_IPONLY */ { SIG_PROP_FLOW_ACTION_FLOW, },
@ -122,6 +123,7 @@ const struct SignatureProperties signature_properties[SIG_TYPE_MAX] = {
/* SIG_TYPE_APPLAYER */ { SIG_PROP_FLOW_ACTION_FLOW, },
/* SIG_TYPE_APP_TX */ { SIG_PROP_FLOW_ACTION_FLOW, },
};
// rule types documentation tag end: SignatureProperties
// clang-format on
/** \brief register inspect engine at start up time

2
src/detect.h
Unescape Escape View File

@ -59,6 +59,7 @@ struct SCSigOrderFunc_;
/* Forward declarations for structures from Rust. */
typedef struct SCDetectRequiresStatus SCDetectRequiresStatus;
// rule types documentation tag start: SignatureType
enum SignatureType {
SIG_TYPE_NOT_SET = 0,
SIG_TYPE_IPONLY, // rule is handled by IPONLY engine
@ -76,6 +77,7 @@ enum SignatureType {
SIG_TYPE_MAX,
};
// rule types documentation tag end: SignatureType
enum SignaturePropertyFlowAction {
SIG_PROP_FLOW_ACTION_PACKET,

Write Preview
Loading…
Cancel
Save