aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

documentation: fix list keywords URLs

Browse Source 
Update URLs in keyword definition to point to sphinx documentation.
pull/2414/head
Eric Leblond 9 years ago committed by Victor Julien
parent fffdc6e3fd
commit a2e2f50fb9
69 changed files with 82 additions and 74 deletions
Show Stats Download Patch File Download Diff File

2
src/detect-ack.c
Unescape Escape View File

@ -55,7 +55,7 @@ void DetectAckRegister(void)
{
sigmatch_table[DETECT_ACK].name = "ack";
sigmatch_table[DETECT_ACK].desc = "check for a specific TCP acknowledgement number";
sigmatch_table[DETECT_ACK].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Header_keywords#ack";
sigmatch_table[DETECT_ACK].url = DOC_URL DOC_VERSION "/rules/header-keywords.html#ack";
sigmatch_table[DETECT_ACK].Match = DetectAckMatch;
sigmatch_table[DETECT_ACK].Setup = DetectAckSetup;
sigmatch_table[DETECT_ACK].Free = DetectAckFree;

2
src/detect-base64-data.c
Unescape Escape View File

@ -31,7 +31,7 @@ void DetectBase64DataRegister(void)
sigmatch_table[DETECT_BASE64_DATA].desc =
"Content match base64 decoded data.";
sigmatch_table[DETECT_BASE64_DATA].url =
"https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Payload_keywords#base64_data";
DOC_URL DOC_VERSION "/rules/payload-keywords.html#base64-data";
sigmatch_table[DETECT_BASE64_DATA].Setup = DetectBase64DataSetup;
sigmatch_table[DETECT_BASE64_DATA].RegisterTests =
DetectBase64DataRegisterTests;

2
src/detect-base64-decode.c
Unescape Escape View File

@ -42,7 +42,7 @@ void DetectBase64DecodeRegister(void)
sigmatch_table[DETECT_BASE64_DECODE].desc =
"Decodes base64 encoded data.";
sigmatch_table[DETECT_BASE64_DECODE].url =
"https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Payload_keywords#base64_decode";
DOC_URL DOC_VERSION "/rules/payload-keywords.html#base64-decode";
sigmatch_table[DETECT_BASE64_DECODE].Setup = DetectBase64DecodeSetup;
sigmatch_table[DETECT_BASE64_DECODE].Free = DetectBase64DecodeFree;
sigmatch_table[DETECT_BASE64_DECODE].RegisterTests =

2
src/detect-classtype.c
Unescape Escape View File

@ -52,7 +52,7 @@ void DetectClasstypeRegister(void)
{
sigmatch_table[DETECT_CLASSTYPE].name = "classtype";
sigmatch_table[DETECT_CLASSTYPE].desc = "information about the classification of rules and alerts";
sigmatch_table[DETECT_CLASSTYPE].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Meta-settings#Classtype";
sigmatch_table[DETECT_CLASSTYPE].url = DOC_URL DOC_VERSION "/rules/meta.html#classtype";
sigmatch_table[DETECT_CLASSTYPE].Match = NULL;
sigmatch_table[DETECT_CLASSTYPE].Setup = DetectClasstypeSetup;
sigmatch_table[DETECT_CLASSTYPE].Free = NULL;

2
src/detect-content.c
Unescape Escape View File

@ -56,7 +56,7 @@ void DetectContentRegister (void)
{
sigmatch_table[DETECT_CONTENT].name = "content";
sigmatch_table[DETECT_CONTENT].desc = "match on payload content";
sigmatch_table[DETECT_CONTENT].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Payload_keywords#Content";
sigmatch_table[DETECT_CONTENT].url = DOC_URL DOC_VERSION "/rules/payload-keywords.html#content";
sigmatch_table[DETECT_CONTENT].Match = NULL;
sigmatch_table[DETECT_CONTENT].Setup = DetectContentSetup;
sigmatch_table[DETECT_CONTENT].Free = DetectContentFree;

2
src/detect-depth.c
Unescape Escape View File

@ -45,7 +45,7 @@ void DetectDepthRegister (void)
{
sigmatch_table[DETECT_DEPTH].name = "depth";
sigmatch_table[DETECT_DEPTH].desc = "designate how many bytes from the beginning of the payload will be checked";
sigmatch_table[DETECT_DEPTH].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Payload_keywords#Depth";
sigmatch_table[DETECT_DEPTH].url = DOC_URL DOC_VERSION "/rules/payload-keywords.html#depth";
sigmatch_table[DETECT_DEPTH].Match = NULL;
sigmatch_table[DETECT_DEPTH].Setup = DetectDepthSetup;
sigmatch_table[DETECT_DEPTH].Free = NULL;

2
src/detect-detection-filter.c
Unescape Escape View File

@ -63,7 +63,7 @@ void DetectDetectionFilterRegister (void)
{
sigmatch_table[DETECT_DETECTION_FILTER].name = "detection_filter";
sigmatch_table[DETECT_DETECTION_FILTER].desc = "alert on every match after a threshold has been reached";
sigmatch_table[DETECT_DETECTION_FILTER].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Rule-Thresholding#detection_filter";
sigmatch_table[DETECT_DETECTION_FILTER].url = DOC_URL DOC_VERSION "/rules/thresholding.html#detection-filter";
sigmatch_table[DETECT_DETECTION_FILTER].Match = DetectDetectionFilterMatch;
sigmatch_table[DETECT_DETECTION_FILTER].Setup = DetectDetectionFilterSetup;
sigmatch_table[DETECT_DETECTION_FILTER].Free = DetectDetectionFilterFree;

2
src/detect-distance.c
Unescape Escape View File

@ -52,7 +52,7 @@ void DetectDistanceRegister(void)
{
sigmatch_table[DETECT_DISTANCE].name = "distance";
sigmatch_table[DETECT_DISTANCE].desc = "indicates a relation between this content keyword and the content preceding it";
sigmatch_table[DETECT_DISTANCE].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Payload_keywords#Distance";
sigmatch_table[DETECT_DISTANCE].url = DOC_URL DOC_VERSION "/rules/payload-keywords.html#distance";
sigmatch_table[DETECT_DISTANCE].Match = NULL;
sigmatch_table[DETECT_DISTANCE].Setup = DetectDistanceSetup;
sigmatch_table[DETECT_DISTANCE].Free = NULL;

2
src/detect-dsize.c
Unescape Escape View File

@ -64,7 +64,7 @@ void DetectDsizeRegister (void)
{
sigmatch_table[DETECT_DSIZE].name = "dsize";
sigmatch_table[DETECT_DSIZE].desc = "match on the size of the packet payload";
sigmatch_table[DETECT_DSIZE].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Payload_keywords#Dsize";
sigmatch_table[DETECT_DSIZE].url = DOC_URL DOC_VERSION "/rules/payload-keywords.html#dsize";
sigmatch_table[DETECT_DSIZE].Match = DetectDsizeMatch;
sigmatch_table[DETECT_DSIZE].Setup = DetectDsizeSetup;
sigmatch_table[DETECT_DSIZE].Free = DetectDsizeFree;

2
src/detect-fast-pattern.c
Unescape Escape View File

@ -130,7 +130,7 @@ void DetectFastPatternRegister(void)
{
sigmatch_table[DETECT_FAST_PATTERN].name = "fast_pattern";
sigmatch_table[DETECT_FAST_PATTERN].desc = "force using preceding content in the multi pattern matcher";
sigmatch_table[DETECT_FAST_PATTERN].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/HTTP-keywords#fast_pattern";
sigmatch_table[DETECT_FAST_PATTERN].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#fast-pattern";
sigmatch_table[DETECT_FAST_PATTERN].Match = NULL;
sigmatch_table[DETECT_FAST_PATTERN].Setup = DetectFastPatternSetup;
sigmatch_table[DETECT_FAST_PATTERN].Free = NULL;

2
src/detect-file-data.c
Unescape Escape View File

@ -55,7 +55,7 @@ void DetectFiledataRegister(void)
{
sigmatch_table[DETECT_FILE_DATA].name = "file_data";
sigmatch_table[DETECT_FILE_DATA].desc = "make content keywords match on HTTP response body";
sigmatch_table[DETECT_FILE_DATA].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/HTTP-keywords#file_data";
sigmatch_table[DETECT_FILE_DATA].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#file-data";
sigmatch_table[DETECT_FILE_DATA].Match = NULL;
sigmatch_table[DETECT_FILE_DATA].AppLayerMatch = NULL;
sigmatch_table[DETECT_FILE_DATA].Setup = DetectFiledataSetup;

2
src/detect-fileext.c
Unescape Escape View File

@ -64,7 +64,7 @@ void DetectFileextRegister(void)
{
sigmatch_table[DETECT_FILEEXT].name = "fileext";
sigmatch_table[DETECT_FILEEXT].desc = "match on the extension of a file name";
sigmatch_table[DETECT_FILEEXT].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/File-keywords#fileext";
sigmatch_table[DETECT_FILEEXT].url = DOC_URL DOC_VERSION "/rules/file-keywords.html#fileext";
sigmatch_table[DETECT_FILEEXT].FileMatch = DetectFileextMatch;
sigmatch_table[DETECT_FILEEXT].Setup = DetectFileextSetup;
sigmatch_table[DETECT_FILEEXT].Free = DetectFileextFree;

2
src/detect-filemagic.c
Unescape Escape View File

@ -67,7 +67,7 @@ void DetectFilemagicRegister(void)
{
sigmatch_table[DETECT_FILEMAGIC].name = "filemagic";
sigmatch_table[DETECT_FILEMAGIC].desc = "match on the information libmagic returns about a file";
sigmatch_table[DETECT_FILEMAGIC].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/File-keywords#filemagic";
sigmatch_table[DETECT_FILEMAGIC].url = DOC_URL DOC_VERSION "/rules/file-keywords.html#filemagic";
sigmatch_table[DETECT_FILEMAGIC].FileMatch = DetectFilemagicMatch;
sigmatch_table[DETECT_FILEMAGIC].Setup = DetectFilemagicSetup;
sigmatch_table[DETECT_FILEMAGIC].Free = DetectFilemagicFree;

2
src/detect-filemd5.c
Unescape Escape View File

@ -66,7 +66,7 @@ void DetectFileMd5Register(void)
{
sigmatch_table[DETECT_FILEMD5].name = "filemd5";
sigmatch_table[DETECT_FILEMD5].desc = "match file MD5 against list of MD5 checksums";
sigmatch_table[DETECT_FILEMD5].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/File-keywords#filemd5";
sigmatch_table[DETECT_FILEMD5].url = DOC_URL DOC_VERSION "/rules/file-keywords.html#filemd5";
sigmatch_table[DETECT_FILEMD5].FileMatch = DetectFileHashMatch;
sigmatch_table[DETECT_FILEMD5].Setup = DetectFileMd5Setup;
sigmatch_table[DETECT_FILEMD5].Free = DetectFileHashFree;

2
src/detect-filename.c
Unescape Escape View File

@ -65,7 +65,7 @@ void DetectFilenameRegister(void)
{
sigmatch_table[DETECT_FILENAME].name = "filename";
sigmatch_table[DETECT_FILENAME].desc = "match on the file name";
sigmatch_table[DETECT_FILENAME].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/File-keywords#filename";
sigmatch_table[DETECT_FILENAME].url = DOC_URL DOC_VERSION "/rules/file-keywords.html#filename";
sigmatch_table[DETECT_FILENAME].FileMatch = DetectFilenameMatch;
sigmatch_table[DETECT_FILENAME].Setup = DetectFilenameSetup;
sigmatch_table[DETECT_FILENAME].Free = DetectFilenameFree;

2
src/detect-filesha1.c
Unescape Escape View File

@ -67,7 +67,7 @@ void DetectFileSha1Register(void)
{
sigmatch_table[DETECT_FILESHA1].name = "filesha1";
sigmatch_table[DETECT_FILESHA1].desc = "match file SHA-1 against list of SHA-1 checksums";
sigmatch_table[DETECT_FILESHA1].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/File-keywords#filesha1";
sigmatch_table[DETECT_FILESHA1].url = DOC_URL DOC_VERSION "/rules/file-keywords.html#filesha1";
sigmatch_table[DETECT_FILESHA1].FileMatch = DetectFileHashMatch;
sigmatch_table[DETECT_FILESHA1].Setup = DetectFileSha1Setup;
sigmatch_table[DETECT_FILESHA1].Free = DetectFileHashFree;

2
src/detect-filesha256.c
Unescape Escape View File

@ -67,7 +67,7 @@ void DetectFileSha256Register(void)
{
sigmatch_table[DETECT_FILESHA256].name = "filesha256";
sigmatch_table[DETECT_FILESHA256].desc = "match file SHA-256 against list of SHA-256 checksums";
sigmatch_table[DETECT_FILESHA256].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/File-keywords#filesha256";
sigmatch_table[DETECT_FILESHA256].url = DOC_URL DOC_VERSION "/rules/file-keywords.html#filesha256";
sigmatch_table[DETECT_FILESHA256].FileMatch = DetectFileHashMatch;
sigmatch_table[DETECT_FILESHA256].Setup = DetectFileSha256Setup;
sigmatch_table[DETECT_FILESHA256].Free = DetectFileHashFree;

2
src/detect-filesize.c
Unescape Escape View File

@ -62,7 +62,7 @@ void DetectFilesizeRegister(void)
{
sigmatch_table[DETECT_FILESIZE].name = "filesize";
sigmatch_table[DETECT_FILESIZE].desc = "match on the size of the file as it is being transferred";
sigmatch_table[DETECT_FILESIZE].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/File-keywords#filesize";
sigmatch_table[DETECT_FILESIZE].url = DOC_URL DOC_VERSION "/rules/file-keywords.html#filesize";
sigmatch_table[DETECT_FILESIZE].FileMatch = DetectFilesizeMatch;
sigmatch_table[DETECT_FILESIZE].Setup = DetectFilesizeSetup;
sigmatch_table[DETECT_FILESIZE].Free = DetectFilesizeFree;

2
src/detect-filestore.c
Unescape Escape View File

@ -72,7 +72,7 @@ void DetectFilestoreRegister(void)
{
sigmatch_table[DETECT_FILESTORE].name = "filestore";
sigmatch_table[DETECT_FILESTORE].desc = "stores files to disk if the rule matched";
sigmatch_table[DETECT_FILESTORE].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/File-keywords#filestore";
sigmatch_table[DETECT_FILESTORE].url = DOC_URL DOC_VERSION "/rules/file-keywords.html#filestore";
sigmatch_table[DETECT_FILESTORE].FileMatch = DetectFilestoreMatch;
sigmatch_table[DETECT_FILESTORE].Setup = DetectFilestoreSetup;
sigmatch_table[DETECT_FILESTORE].Free = DetectFilestoreFree;

2
src/detect-flow.c
Unescape Escape View File

@ -64,7 +64,7 @@ void DetectFlowRegister (void)
{
sigmatch_table[DETECT_FLOW].name = "flow";
sigmatch_table[DETECT_FLOW].desc = "match on direction and state of the flow";
sigmatch_table[DETECT_FLOW].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Flow-keywords#Flow";
sigmatch_table[DETECT_FLOW].url = DOC_URL DOC_VERSION "/rules/flow-keywords.html#flow";
sigmatch_table[DETECT_FLOW].Match = DetectFlowMatch;
sigmatch_table[DETECT_FLOW].Setup = DetectFlowSetup;
sigmatch_table[DETECT_FLOW].Free = DetectFlowFree;

2
src/detect-flowbits.c
Unescape Escape View File

@ -58,7 +58,7 @@ void DetectFlowbitsRegister (void)
{
sigmatch_table[DETECT_FLOWBITS].name = "flowbits";
sigmatch_table[DETECT_FLOWBITS].desc = "operate on flow flag";
sigmatch_table[DETECT_FLOWBITS].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Flow-keywords#Flowbits";
sigmatch_table[DETECT_FLOWBITS].url = DOC_URL DOC_VERSION "/rules/flow-keywords.html#flowbits";
sigmatch_table[DETECT_FLOWBITS].Match = DetectFlowbitMatch;
sigmatch_table[DETECT_FLOWBITS].Setup = DetectFlowbitSetup;
sigmatch_table[DETECT_FLOWBITS].Free = DetectFlowbitFree;

2
src/detect-flowint.c
Unescape Escape View File

@ -63,7 +63,7 @@ void DetectFlowintRegister(void)
{
sigmatch_table[DETECT_FLOWINT].name = "flowint";
sigmatch_table[DETECT_FLOWINT].desc = "operate on a per-flow integer";
sigmatch_table[DETECT_FLOWINT].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Flowint";
sigmatch_table[DETECT_FLOWINT].url = DOC_URL DOC_VERSION "/rules/flowint.html";
sigmatch_table[DETECT_FLOWINT].Match = DetectFlowintMatch;
sigmatch_table[DETECT_FLOWINT].Setup = DetectFlowintSetup;
sigmatch_table[DETECT_FLOWINT].Free = DetectFlowintFree;

2
src/detect-fragbits.c
Unescape Escape View File

@ -83,7 +83,7 @@ void DetectFragBitsRegister (void)
{
sigmatch_table[DETECT_FRAGBITS].name = "fragbits";
sigmatch_table[DETECT_FRAGBITS].desc = "check if the fragmentation and reserved bits are set in the IP header";
sigmatch_table[DETECT_FRAGBITS].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Header_keywords#Fragbits";
sigmatch_table[DETECT_FRAGBITS].url = DOC_URL DOC_VERSION "/rules/header-keywords.html#fragbits";
sigmatch_table[DETECT_FRAGBITS].Match = DetectFragBitsMatch;
sigmatch_table[DETECT_FRAGBITS].Setup = DetectFragBitsSetup;
sigmatch_table[DETECT_FRAGBITS].Free = DetectFragBitsFree;

2
src/detect-fragoffset.c
Unescape Escape View File

@ -59,7 +59,7 @@ void DetectFragOffsetRegister (void)
{
sigmatch_table[DETECT_FRAGOFFSET].name = "fragoffset";
sigmatch_table[DETECT_FRAGOFFSET].desc = "match on specific decimal values of the IP fragment offset field";
sigmatch_table[DETECT_FRAGOFFSET].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Header_keywords#Fragoffset";
sigmatch_table[DETECT_FRAGOFFSET].url = DOC_URL DOC_VERSION "/rules/header-keywords.html#fragoffset";
sigmatch_table[DETECT_FRAGOFFSET].Match = DetectFragOffsetMatch;
sigmatch_table[DETECT_FRAGOFFSET].Setup = DetectFragOffsetSetup;
sigmatch_table[DETECT_FRAGOFFSET].Free = DetectFragOffsetFree;

2
src/detect-gid.c
Unescape Escape View File

@ -46,7 +46,7 @@ void DetectGidRegister (void)
{
sigmatch_table[DETECT_GID].name = "gid";
sigmatch_table[DETECT_GID].desc = "give different groups of signatures another id value";
sigmatch_table[DETECT_GID].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Meta-settings#Gid-group-id";
sigmatch_table[DETECT_GID].url = DOC_URL DOC_VERSION "/rules/meta.html#gid-group-id";
sigmatch_table[DETECT_GID].Match = NULL;
sigmatch_table[DETECT_GID].Setup = DetectGidSetup;
sigmatch_table[DETECT_GID].Free = NULL;

2
src/detect-hostbits.c
Unescape Escape View File

@ -77,7 +77,7 @@ void DetectHostbitsRegister (void)
{
sigmatch_table[DETECT_HOSTBITS].name = "hostbits";
sigmatch_table[DETECT_HOSTBITS].desc = "operate on host flag";
// sigmatch_table[DETECT_HOSTBITS].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Flow-keywords#Flowbits";
// sigmatch_table[DETECT_HOSTBITS].url = DOC_URL DOC_VERSION "/rules/flow-keywords.html#flowbits";
sigmatch_table[DETECT_HOSTBITS].Match = DetectHostbitMatch;
sigmatch_table[DETECT_HOSTBITS].Setup = DetectHostbitSetup;
sigmatch_table[DETECT_HOSTBITS].Free = DetectHostbitFree;

2
src/detect-http-client-body.c
Unescape Escape View File

@ -69,7 +69,7 @@ void DetectHttpClientBodyRegister(void)
{
sigmatch_table[DETECT_AL_HTTP_CLIENT_BODY].name = "http_client_body";
sigmatch_table[DETECT_AL_HTTP_CLIENT_BODY].desc = "content modifier to match only on HTTP request-body";
sigmatch_table[DETECT_AL_HTTP_CLIENT_BODY].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/HTTP-keywords#http_client_body";
sigmatch_table[DETECT_AL_HTTP_CLIENT_BODY].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http_client-body";
sigmatch_table[DETECT_AL_HTTP_CLIENT_BODY].Match = NULL;
sigmatch_table[DETECT_AL_HTTP_CLIENT_BODY].AppLayerMatch = NULL;
sigmatch_table[DETECT_AL_HTTP_CLIENT_BODY].Setup = DetectHttpClientBodySetup;

2
src/detect-http-cookie.c
Unescape Escape View File

@ -72,7 +72,7 @@ void DetectHttpCookieRegister(void)
{
sigmatch_table[DETECT_AL_HTTP_COOKIE].name = "http_cookie";
sigmatch_table[DETECT_AL_HTTP_COOKIE].desc = "content modifier to match only on the HTTP cookie-buffer";
sigmatch_table[DETECT_AL_HTTP_COOKIE].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/HTTP-keywords#http_cookie";
sigmatch_table[DETECT_AL_HTTP_COOKIE].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-cookie";
sigmatch_table[DETECT_AL_HTTP_COOKIE].Match = NULL;
sigmatch_table[DETECT_AL_HTTP_COOKIE].AppLayerMatch = NULL;
sigmatch_table[DETECT_AL_HTTP_COOKIE].Setup = DetectHttpCookieSetup;

2
src/detect-http-header.c
Unescape Escape View File

@ -71,7 +71,7 @@ void DetectHttpHeaderRegister(void)
{
sigmatch_table[DETECT_AL_HTTP_HEADER].name = "http_header";
sigmatch_table[DETECT_AL_HTTP_HEADER].desc = "content modifier to match only on the HTTP header-buffer";
sigmatch_table[DETECT_AL_HTTP_HEADER].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/HTTP-keywords#http_header";
sigmatch_table[DETECT_AL_HTTP_HEADER].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-header";
sigmatch_table[DETECT_AL_HTTP_HEADER].Match = NULL;
sigmatch_table[DETECT_AL_HTTP_HEADER].AppLayerMatch = NULL;
sigmatch_table[DETECT_AL_HTTP_HEADER].Setup = DetectHttpHeaderSetup;

2
src/detect-http-method.c
Unescape Escape View File

@ -72,7 +72,7 @@ void DetectHttpMethodRegister(void)
{
sigmatch_table[DETECT_AL_HTTP_METHOD].name = "http_method";
sigmatch_table[DETECT_AL_HTTP_METHOD].desc = "content modifier to match only on the HTTP method-buffer";
sigmatch_table[DETECT_AL_HTTP_METHOD].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/HTTP-keywords#http_method";
sigmatch_table[DETECT_AL_HTTP_METHOD].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-method";
sigmatch_table[DETECT_AL_HTTP_METHOD].Match = NULL;
sigmatch_table[DETECT_AL_HTTP_METHOD].AppLayerMatch = NULL;
sigmatch_table[DETECT_AL_HTTP_METHOD].Setup = DetectHttpMethodSetup;

2
src/detect-http-raw-uri.c
Unescape Escape View File

@ -65,7 +65,7 @@ void DetectHttpRawUriRegister(void)
{
sigmatch_table[DETECT_AL_HTTP_RAW_URI].name = "http_raw_uri";
sigmatch_table[DETECT_AL_HTTP_RAW_URI].desc = "content modifier to match on HTTP uri";
sigmatch_table[DETECT_AL_HTTP_RAW_URI].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/HTTP-keywords#http_uri-and-http_raw_uri";
sigmatch_table[DETECT_AL_HTTP_RAW_URI].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http_uri-and-http_raw-uri";
sigmatch_table[DETECT_AL_HTTP_RAW_URI].Match = NULL;
sigmatch_table[DETECT_AL_HTTP_RAW_URI].AppLayerMatch = NULL;
sigmatch_table[DETECT_AL_HTTP_RAW_URI].Setup = DetectHttpRawUriSetup;

2
src/detect-http-request-line.c
Unescape Escape View File

@ -77,7 +77,7 @@ void DetectHttpRequestLineRegister(void)
{
sigmatch_table[DETECT_AL_HTTP_REQUEST_LINE].name = "http_request_line";
sigmatch_table[DETECT_AL_HTTP_REQUEST_LINE].desc = "content modifier to match only on the HTTP request line";
sigmatch_table[DETECT_AL_HTTP_REQUEST_LINE].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/HTTP-keywords#http_request_line";
sigmatch_table[DETECT_AL_HTTP_REQUEST_LINE].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http_request-line";
sigmatch_table[DETECT_AL_HTTP_REQUEST_LINE].Match = NULL;
sigmatch_table[DETECT_AL_HTTP_REQUEST_LINE].AppLayerMatch = NULL;
sigmatch_table[DETECT_AL_HTTP_REQUEST_LINE].Setup = DetectHttpRequestLineSetup;

2
src/detect-http-response-line.c
Unescape Escape View File

@ -78,7 +78,7 @@ void DetectHttpResponseLineRegister(void)
{
sigmatch_table[DETECT_AL_HTTP_RESPONSE_LINE].name = "http_response_line";
sigmatch_table[DETECT_AL_HTTP_RESPONSE_LINE].desc = "content modifier to match only on the HTTP response line";
sigmatch_table[DETECT_AL_HTTP_RESPONSE_LINE].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/HTTP-keywords#http_response_line";
sigmatch_table[DETECT_AL_HTTP_RESPONSE_LINE].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http_response-line";
sigmatch_table[DETECT_AL_HTTP_RESPONSE_LINE].Match = NULL;
sigmatch_table[DETECT_AL_HTTP_RESPONSE_LINE].AppLayerMatch = NULL;
sigmatch_table[DETECT_AL_HTTP_RESPONSE_LINE].Setup = DetectHttpResponseLineSetup;

2
src/detect-http-server-body.c
Unescape Escape View File

@ -70,7 +70,7 @@ void DetectHttpServerBodyRegister(void)
{
sigmatch_table[DETECT_AL_HTTP_SERVER_BODY].name = "http_server_body";
sigmatch_table[DETECT_AL_HTTP_SERVER_BODY].desc = "content modifier to match only on the HTTP response-body";
sigmatch_table[DETECT_AL_HTTP_SERVER_BODY].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/HTTP-keywords#http_server_body";
sigmatch_table[DETECT_AL_HTTP_SERVER_BODY].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http_server-body";
sigmatch_table[DETECT_AL_HTTP_SERVER_BODY].Match = NULL;
sigmatch_table[DETECT_AL_HTTP_SERVER_BODY].AppLayerMatch = NULL;
sigmatch_table[DETECT_AL_HTTP_SERVER_BODY].Setup = DetectHttpServerBodySetup;

2
src/detect-http-stat-code.c
Unescape Escape View File

@ -77,7 +77,7 @@ void DetectHttpStatCodeRegister (void)
{
sigmatch_table[DETECT_AL_HTTP_STAT_CODE].name = "http_stat_code";
sigmatch_table[DETECT_AL_HTTP_STAT_CODE].desc = "content modifier to match only on HTTP stat-code-buffer";
sigmatch_table[DETECT_AL_HTTP_STAT_CODE].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/HTTP-keywords#http_stat_code";
sigmatch_table[DETECT_AL_HTTP_STAT_CODE].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http_stat-code";
sigmatch_table[DETECT_AL_HTTP_STAT_CODE].Match = NULL;
sigmatch_table[DETECT_AL_HTTP_STAT_CODE].AppLayerMatch = NULL;
sigmatch_table[DETECT_AL_HTTP_STAT_CODE].Setup = DetectHttpStatCodeSetup;

2
src/detect-http-stat-msg.c
Unescape Escape View File

@ -77,7 +77,7 @@ void DetectHttpStatMsgRegister (void)
{
sigmatch_table[DETECT_AL_HTTP_STAT_MSG].name = "http_stat_msg";
sigmatch_table[DETECT_AL_HTTP_STAT_MSG].desc = "content modifier to match on HTTP stat-msg-buffer";
sigmatch_table[DETECT_AL_HTTP_STAT_MSG].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/HTTP-keywords#http_stat_msg";
sigmatch_table[DETECT_AL_HTTP_STAT_MSG].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http_stat-msg";
sigmatch_table[DETECT_AL_HTTP_STAT_MSG].Match = NULL;
sigmatch_table[DETECT_AL_HTTP_STAT_MSG].AppLayerMatch = NULL;
sigmatch_table[DETECT_AL_HTTP_STAT_MSG].Setup = DetectHttpStatMsgSetup;

2
src/detect-http-ua.c
Unescape Escape View File

@ -70,7 +70,7 @@ void DetectHttpUARegister(void)
{
sigmatch_table[DETECT_AL_HTTP_USER_AGENT].name = "http_user_agent";
sigmatch_table[DETECT_AL_HTTP_USER_AGENT].desc = "content modifier to match only on the HTTP User-Agent header";
sigmatch_table[DETECT_AL_HTTP_USER_AGENT].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/HTTP-keywords#http_user_agent";
sigmatch_table[DETECT_AL_HTTP_USER_AGENT].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http_user-agent";
sigmatch_table[DETECT_AL_HTTP_USER_AGENT].Match = NULL;
sigmatch_table[DETECT_AL_HTTP_USER_AGENT].AppLayerMatch = NULL;
sigmatch_table[DETECT_AL_HTTP_USER_AGENT].Setup = DetectHttpUASetup;

2
src/detect-http-uri.c
Unescape Escape View File

@ -66,7 +66,7 @@ void DetectHttpUriRegister (void)
{
sigmatch_table[DETECT_AL_HTTP_URI].name = "http_uri";
sigmatch_table[DETECT_AL_HTTP_URI].desc = "content modifier to match specifically and only on the HTTP uri-buffer";
sigmatch_table[DETECT_AL_HTTP_URI].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/HTTP-keywords#http_uri-and-http_raw_uri";
sigmatch_table[DETECT_AL_HTTP_URI].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http_uri-and-http_raw-uri";
sigmatch_table[DETECT_AL_HTTP_URI].Match = NULL;
sigmatch_table[DETECT_AL_HTTP_URI].AppLayerMatch = NULL;
sigmatch_table[DETECT_AL_HTTP_URI].Setup = DetectHttpUriSetup;

2
src/detect-icmp-id.c
Unescape Escape View File

@ -57,7 +57,7 @@ void DetectIcmpIdRegister (void)
{
sigmatch_table[DETECT_ICMP_ID].name = "icmp_id";
sigmatch_table[DETECT_ICMP_ID].desc = "check for a ICMP id";
sigmatch_table[DETECT_ICMP_ID].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Header_keywords#icmp_id";
sigmatch_table[DETECT_ICMP_ID].url = DOC_URL DOC_VERSION "/rules/header-keywords.html#icmp-id";
sigmatch_table[DETECT_ICMP_ID].Match = DetectIcmpIdMatch;
sigmatch_table[DETECT_ICMP_ID].Setup = DetectIcmpIdSetup;
sigmatch_table[DETECT_ICMP_ID].Free = DetectIcmpIdFree;

2
src/detect-icmp-seq.c
Unescape Escape View File

@ -57,7 +57,7 @@ void DetectIcmpSeqRegister (void)
{
sigmatch_table[DETECT_ICMP_SEQ].name = "icmp_seq";
sigmatch_table[DETECT_ICMP_SEQ].desc = "check for a ICMP sequence number";
sigmatch_table[DETECT_ICMP_SEQ].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Header_keywords#icmp_seq";
sigmatch_table[DETECT_ICMP_SEQ].url = DOC_URL DOC_VERSION "/rules/header-keywords.html#icmp-seq";
sigmatch_table[DETECT_ICMP_SEQ].Match = DetectIcmpSeqMatch;
sigmatch_table[DETECT_ICMP_SEQ].Setup = DetectIcmpSeqSetup;
sigmatch_table[DETECT_ICMP_SEQ].Free = DetectIcmpSeqFree;

2
src/detect-icode.c
Unescape Escape View File

@ -61,7 +61,7 @@ void DetectICodeRegister (void)
{
sigmatch_table[DETECT_ICODE].name = "icode";
sigmatch_table[DETECT_ICODE].desc = "match on specific ICMP id-value";
sigmatch_table[DETECT_ICODE].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Header_keywords#icode";
sigmatch_table[DETECT_ICODE].url = DOC_URL DOC_VERSION "/rules/header-keywords.html#icode";
sigmatch_table[DETECT_ICODE].Match = DetectICodeMatch;
sigmatch_table[DETECT_ICODE].Setup = DetectICodeSetup;
sigmatch_table[DETECT_ICODE].Free = DetectICodeFree;

2
src/detect-id.c
Unescape Escape View File

@ -65,7 +65,7 @@ void DetectIdRegister (void)
{
sigmatch_table[DETECT_ID].name = "id";
sigmatch_table[DETECT_ID].desc = "match on a specific IP ID value";
sigmatch_table[DETECT_ID].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Header_keywords#Id";
sigmatch_table[DETECT_ID].url = DOC_URL DOC_VERSION "/rules/header-keywords.html#id";
sigmatch_table[DETECT_ID].Match = DetectIdMatch;
sigmatch_table[DETECT_ID].Setup = DetectIdSetup;
sigmatch_table[DETECT_ID].Free = DetectIdFree;

2
src/detect-ipopts.c
Unescape Escape View File

@ -55,7 +55,7 @@ void DetectIpOptsRegister (void)
{
sigmatch_table[DETECT_IPOPTS].name = "ipopts";
sigmatch_table[DETECT_IPOPTS].desc = "check if a specific IP option is set";
sigmatch_table[DETECT_IPOPTS].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Header_keywords#Ipopts";
sigmatch_table[DETECT_IPOPTS].url = DOC_URL DOC_VERSION "/rules/header-keywords.html#ipopts";
sigmatch_table[DETECT_IPOPTS].Match = DetectIpOptsMatch;
sigmatch_table[DETECT_IPOPTS].Setup = DetectIpOptsSetup;
sigmatch_table[DETECT_IPOPTS].Free = DetectIpOptsFree;

2
src/detect-ipproto.c
Unescape Escape View File

@ -63,7 +63,7 @@ void DetectIPProtoRegister(void)
{
sigmatch_table[DETECT_IPPROTO].name = "ip_proto";
sigmatch_table[DETECT_IPPROTO].desc = "match on the IP protocol in the packet-header";
sigmatch_table[DETECT_IPPROTO].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Header_keywords#ip_proto";
sigmatch_table[DETECT_IPPROTO].url = DOC_URL DOC_VERSION "/rules/header-keywords.html#ip-proto";
sigmatch_table[DETECT_IPPROTO].Match = NULL;
sigmatch_table[DETECT_IPPROTO].Setup = DetectIPProtoSetup;
sigmatch_table[DETECT_IPPROTO].Free = DetectIPProtoFree;

2
src/detect-isdataat.c
Unescape Escape View File

@ -66,7 +66,7 @@ void DetectIsdataatRegister(void)
{
sigmatch_table[DETECT_ISDATAAT].name = "isdataat";
sigmatch_table[DETECT_ISDATAAT].desc = "check if there is still data at a specific part of the payload";
sigmatch_table[DETECT_ISDATAAT].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Payload_keywords#Isadataat";
sigmatch_table[DETECT_ISDATAAT].url = DOC_URL DOC_VERSION "/rules/payload-keywords.html#isadataat";
/* match is handled in DetectEngineContentInspection() */
sigmatch_table[DETECT_ISDATAAT].Match = NULL;
sigmatch_table[DETECT_ISDATAAT].Setup = DetectIsdataatSetup;

2
src/detect-itype.c
Unescape Escape View File

@ -61,7 +61,7 @@ void DetectITypeRegister (void)
{
sigmatch_table[DETECT_ITYPE].name = "itype";
sigmatch_table[DETECT_ITYPE].desc = "matching on a specific ICMP type";
sigmatch_table[DETECT_ITYPE].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Header_keywords#itype";
sigmatch_table[DETECT_ITYPE].url = DOC_URL DOC_VERSION "/rules/header-keywords.html#itype";
sigmatch_table[DETECT_ITYPE].Match = DetectITypeMatch;
sigmatch_table[DETECT_ITYPE].Setup = DetectITypeSetup;
sigmatch_table[DETECT_ITYPE].Free = DetectITypeFree;

2
src/detect-metadata.c
Unescape Escape View File

@ -35,7 +35,7 @@ void DetectMetadataRegister (void)
{
sigmatch_table[DETECT_METADATA].name = "metadata";
sigmatch_table[DETECT_METADATA].desc = "ignored by suricata";
sigmatch_table[DETECT_METADATA].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Meta-settings#Metadata";
sigmatch_table[DETECT_METADATA].url = DOC_URL DOC_VERSION "/rules/meta.html#metadata";
sigmatch_table[DETECT_METADATA].Match = NULL;
sigmatch_table[DETECT_METADATA].Setup = DetectMetadataSetup;
sigmatch_table[DETECT_METADATA].Free = NULL;

2
src/detect-msg.c
Unescape Escape View File

@ -40,7 +40,7 @@ void DetectMsgRegister (void)
{
sigmatch_table[DETECT_MSG].name = "msg";
sigmatch_table[DETECT_MSG].desc = "information about the rule and the possible alert";
sigmatch_table[DETECT_MSG].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Meta-settings#msg-message";
sigmatch_table[DETECT_MSG].url = DOC_URL DOC_VERSION "/rules/meta.html#msg-message";
sigmatch_table[DETECT_MSG].Match = NULL;
sigmatch_table[DETECT_MSG].Setup = DetectMsgSetup;
sigmatch_table[DETECT_MSG].Free = NULL;

2
src/detect-nocase.c
Unescape Escape View File

@ -48,7 +48,7 @@ void DetectNocaseRegister(void)
{
sigmatch_table[DETECT_NOCASE].name = "nocase";
sigmatch_table[DETECT_NOCASE].desc = "modify content match to be case insensitive";
sigmatch_table[DETECT_NOCASE].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Payload_keywords#Nocase";
sigmatch_table[DETECT_NOCASE].url = DOC_URL DOC_VERSION "/rules/payload-keywords.html#nocase";
sigmatch_table[DETECT_NOCASE].Match = NULL;
sigmatch_table[DETECT_NOCASE].Setup = DetectNocaseSetup;
sigmatch_table[DETECT_NOCASE].Free = NULL;

2
src/detect-offset.c
Unescape Escape View File

@ -45,7 +45,7 @@ void DetectOffsetRegister (void)
{
sigmatch_table[DETECT_OFFSET].name = "offset";
sigmatch_table[DETECT_OFFSET].desc = "designate from which byte in the payload will be checked to find a match";
sigmatch_table[DETECT_OFFSET].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Payload_keywords#Offset";
sigmatch_table[DETECT_OFFSET].url = DOC_URL DOC_VERSION "/rules/payload-keywords.html#offset";
sigmatch_table[DETECT_OFFSET].Match = NULL;
sigmatch_table[DETECT_OFFSET].Setup = DetectOffsetSetup;
sigmatch_table[DETECT_OFFSET].Free = NULL;

2
src/detect-pcre.c
Unescape Escape View File

@ -88,7 +88,7 @@ void DetectPcreRegister (void)
{
sigmatch_table[DETECT_PCRE].name = "pcre";
sigmatch_table[DETECT_PCRE].desc = "match on regular expression";
sigmatch_table[DETECT_PCRE].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/HTTP-keywords#Pcre-Perl-Compatible-Regular-Expressions";
sigmatch_table[DETECT_PCRE].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#pcre-perl-compatible-regular-expressions";
sigmatch_table[DETECT_PCRE].Match = NULL;
sigmatch_table[DETECT_PCRE].AppLayerMatch = NULL;
sigmatch_table[DETECT_PCRE].Setup = DetectPcreSetup;

2
src/detect-priority.c
Unescape Escape View File

@ -48,7 +48,7 @@ void DetectPriorityRegister (void)
{
sigmatch_table[DETECT_PRIORITY].name = "priority";
sigmatch_table[DETECT_PRIORITY].desc = "rules with a higher priority will be examined first";
sigmatch_table[DETECT_PRIORITY].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Meta-settings#Priority";
sigmatch_table[DETECT_PRIORITY].url = DOC_URL DOC_VERSION "/rules/meta.html#priority";
sigmatch_table[DETECT_PRIORITY].Match = NULL;
sigmatch_table[DETECT_PRIORITY].Setup = DetectPrioritySetup;
sigmatch_table[DETECT_PRIORITY].Free = NULL;

2
src/detect-reference.c
Unescape Escape View File

@ -57,7 +57,7 @@ void DetectReferenceRegister(void)
{
sigmatch_table[DETECT_REFERENCE].name = "reference";
sigmatch_table[DETECT_REFERENCE].desc = "direct to places where information about the rule can be found";
sigmatch_table[DETECT_REFERENCE].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Meta-settings#Reference";
sigmatch_table[DETECT_REFERENCE].url = DOC_URL DOC_VERSION "/rules/meta.html#reference";
sigmatch_table[DETECT_REFERENCE].Match = NULL;
sigmatch_table[DETECT_REFERENCE].Setup = DetectReferenceSetup;
sigmatch_table[DETECT_REFERENCE].Free = NULL;

2
src/detect-rev.c
Unescape Escape View File

@ -34,7 +34,7 @@ void DetectRevRegister (void)
{
sigmatch_table[DETECT_REV].name = "rev";
sigmatch_table[DETECT_REV].desc = "set version of the rule";
sigmatch_table[DETECT_REV].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Meta-settings#Rev-Revision";
sigmatch_table[DETECT_REV].url = DOC_URL DOC_VERSION "/rules/meta.html#rev-revision";
sigmatch_table[DETECT_REV].Match = NULL;
sigmatch_table[DETECT_REV].Setup = DetectRevSetup;
sigmatch_table[DETECT_REV].Free = NULL;

2
src/detect-rpc.c
Unescape Escape View File

@ -60,7 +60,7 @@ void DetectRpcRegister (void)
{
sigmatch_table[DETECT_RPC].name = "rpc";
sigmatch_table[DETECT_RPC].desc = "match RPC procedure numbers and RPC version";
sigmatch_table[DETECT_RPC].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Payload_keywords#rpc";
sigmatch_table[DETECT_RPC].url = DOC_URL DOC_VERSION "/rules/payload-keywords.html#rpc";
sigmatch_table[DETECT_RPC].Match = DetectRpcMatch;
sigmatch_table[DETECT_RPC].Setup = DetectRpcSetup;
sigmatch_table[DETECT_RPC].Free = DetectRpcFree;

2
src/detect-sameip.c
Unescape Escape View File

@ -50,7 +50,7 @@ void DetectSameipRegister(void)
{
sigmatch_table[DETECT_SAMEIP].name = "sameip";
sigmatch_table[DETECT_SAMEIP].desc = "check if the IP address of the source is the same as the IP address of the destination";
sigmatch_table[DETECT_SAMEIP].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Header_keywords#sameip";
sigmatch_table[DETECT_SAMEIP].url = DOC_URL DOC_VERSION "/rules/header-keywords.html#sameip";
sigmatch_table[DETECT_SAMEIP].Match = DetectSameipMatch;
sigmatch_table[DETECT_SAMEIP].Setup = DetectSameipSetup;
sigmatch_table[DETECT_SAMEIP].Free = NULL;

2
src/detect-seq.c
Unescape Escape View File

@ -52,7 +52,7 @@ void DetectSeqRegister(void)
{
sigmatch_table[DETECT_SEQ].name = "seq";
sigmatch_table[DETECT_SEQ].desc = "check for a specific TCP sequence number";
sigmatch_table[DETECT_SEQ].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Header_keywords#seq";
sigmatch_table[DETECT_SEQ].url = DOC_URL DOC_VERSION "/rules/header-keywords.html#seq";
sigmatch_table[DETECT_SEQ].Match = DetectSeqMatch;
sigmatch_table[DETECT_SEQ].Setup = DetectSeqSetup;
sigmatch_table[DETECT_SEQ].Free = DetectSeqFree;

2
src/detect-sid.c
Unescape Escape View File

@ -38,7 +38,7 @@ void DetectSidRegister (void)
{
sigmatch_table[DETECT_SID].name = "sid";
sigmatch_table[DETECT_SID].desc = "set rule id";
sigmatch_table[DETECT_SID].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Meta-settings#Sid-signature-id";
sigmatch_table[DETECT_SID].url = DOC_URL DOC_VERSION "/rules/meta.html#sid-signature-id";
sigmatch_table[DETECT_SID].Match = NULL;
sigmatch_table[DETECT_SID].Setup = DetectSidSetup;
sigmatch_table[DETECT_SID].Free = NULL;

2
src/detect-stream_size.c
Unescape Escape View File

@ -57,7 +57,7 @@ void DetectStreamSizeRegister(void)
{
sigmatch_table[DETECT_STREAM_SIZE].name = "stream_size";
sigmatch_table[DETECT_STREAM_SIZE].desc = "match on amount of bytes of a stream";
sigmatch_table[DETECT_STREAM_SIZE].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Flow-keywords#stream_size";
sigmatch_table[DETECT_STREAM_SIZE].url = DOC_URL DOC_VERSION "/rules/flow-keywords.html#stream-size";
sigmatch_table[DETECT_STREAM_SIZE].Match = DetectStreamSizeMatch;
sigmatch_table[DETECT_STREAM_SIZE].Setup = DetectStreamSizeSetup;
sigmatch_table[DETECT_STREAM_SIZE].Free = DetectStreamSizeFree;

2
src/detect-threshold.c
Unescape Escape View File

@ -76,7 +76,7 @@ void DetectThresholdRegister(void)
{
sigmatch_table[DETECT_THRESHOLD].name = "threshold";
sigmatch_table[DETECT_THRESHOLD].desc = "control the rule's alert frequency";
sigmatch_table[DETECT_THRESHOLD].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Rule-Thresholding#threshold";
sigmatch_table[DETECT_THRESHOLD].url = DOC_URL DOC_VERSION "/rules/thresholding.html#threshold";
sigmatch_table[DETECT_THRESHOLD].Match = DetectThresholdMatch;
sigmatch_table[DETECT_THRESHOLD].Setup = DetectThresholdSetup;
sigmatch_table[DETECT_THRESHOLD].Free = DetectThresholdFree;

8
src/detect-tls-cert-validity.c
Unescape Escape View File

@ -81,7 +81,7 @@ void DetectTlsValidityRegister (void)
{
sigmatch_table[DETECT_AL_TLS_NOTBEFORE].name = "tls_cert_notbefore";
sigmatch_table[DETECT_AL_TLS_NOTBEFORE].desc = "match TLS certificate notBefore field";
sigmatch_table[DETECT_AL_TLS_NOTBEFORE].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/TLS-keywords#tlsnotbefore";
sigmatch_table[DETECT_AL_TLS_NOTBEFORE].url = DOC_URL DOC_VERSION "/rules/tls-keywords.html#tlsnotbefore";
sigmatch_table[DETECT_AL_TLS_NOTBEFORE].Match = NULL;
sigmatch_table[DETECT_AL_TLS_NOTBEFORE].AppLayerTxMatch = DetectTlsValidityMatch;
sigmatch_table[DETECT_AL_TLS_NOTBEFORE].Setup = DetectTlsNotBeforeSetup;
@ -90,7 +90,7 @@ void DetectTlsValidityRegister (void)
sigmatch_table[DETECT_AL_TLS_NOTAFTER].name = "tls_cert_notafter";
sigmatch_table[DETECT_AL_TLS_NOTAFTER].desc = "match TLS certificate notAfter field";
sigmatch_table[DETECT_AL_TLS_NOTAFTER].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/TLS-keywords#tlsnotafter";
sigmatch_table[DETECT_AL_TLS_NOTAFTER].url = DOC_URL DOC_VERSION "/rules/tls-keywords.html#tlsnotafter";
sigmatch_table[DETECT_AL_TLS_NOTAFTER].Match = NULL;
sigmatch_table[DETECT_AL_TLS_NOTAFTER].AppLayerTxMatch = DetectTlsValidityMatch;
sigmatch_table[DETECT_AL_TLS_NOTAFTER].Setup = DetectTlsNotAfterSetup;
@ -99,7 +99,7 @@ void DetectTlsValidityRegister (void)
sigmatch_table[DETECT_AL_TLS_EXPIRED].name = "tls_cert_expired";
sigmatch_table[DETECT_AL_TLS_EXPIRED].desc = "match expired TLS certificates";
sigmatch_table[DETECT_AL_TLS_EXPIRED].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/TLS-keywords#tlsexpired";
sigmatch_table[DETECT_AL_TLS_EXPIRED].url = DOC_URL DOC_VERSION "/rules/tls-keywords.html#tlsexpired";
sigmatch_table[DETECT_AL_TLS_EXPIRED].Match = NULL;
sigmatch_table[DETECT_AL_TLS_EXPIRED].AppLayerTxMatch = DetectTlsValidityMatch;
sigmatch_table[DETECT_AL_TLS_EXPIRED].Setup = DetectTlsExpiredSetup;
@ -109,7 +109,7 @@ void DetectTlsValidityRegister (void)
sigmatch_table[DETECT_AL_TLS_VALID].name = "tls_cert_valid";
sigmatch_table[DETECT_AL_TLS_VALID].desc = "match valid TLS certificates";
sigmatch_table[DETECT_AL_TLS_VALID].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/TLS-keywords#tlsvalid";
sigmatch_table[DETECT_AL_TLS_VALID].url = DOC_URL DOC_VERSION "/rules/tls-keywords.html#tlsvalid";
sigmatch_table[DETECT_AL_TLS_VALID].Match = NULL;
sigmatch_table[DETECT_AL_TLS_VALID].AppLayerTxMatch = DetectTlsValidityMatch;
sigmatch_table[DETECT_AL_TLS_VALID].Setup = DetectTlsValidSetup;

2
src/detect-tls-version.c
Unescape Escape View File

@ -71,7 +71,7 @@ void DetectTlsVersionRegister (void)
{
sigmatch_table[DETECT_AL_TLS_VERSION].name = "tls.version";
sigmatch_table[DETECT_AL_TLS_VERSION].desc = "match on TLS/SSL version";
sigmatch_table[DETECT_AL_TLS_VERSION].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/TLS-keywords#tlsversion";
sigmatch_table[DETECT_AL_TLS_VERSION].url = DOC_URL DOC_VERSION "/rules/tls-keywords.html#tlsversion";
sigmatch_table[DETECT_AL_TLS_VERSION].Match = NULL;
sigmatch_table[DETECT_AL_TLS_VERSION].AppLayerMatch = DetectTlsVersionMatch;
sigmatch_table[DETECT_AL_TLS_VERSION].Setup = DetectTlsVersionSetup;

8
src/detect-tls.c
Unescape Escape View File

@ -95,7 +95,7 @@ void DetectTlsRegister (void)
{
sigmatch_table[DETECT_AL_TLS_SUBJECT].name = "tls.subject";
sigmatch_table[DETECT_AL_TLS_SUBJECT].desc = "match TLS/SSL certificate Subject field";
sigmatch_table[DETECT_AL_TLS_SUBJECT].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/TLS-keywords#tlssubject";
sigmatch_table[DETECT_AL_TLS_SUBJECT].url = DOC_URL DOC_VERSION "/rules/tls-keywords.html#tlssubject";
sigmatch_table[DETECT_AL_TLS_SUBJECT].Match = NULL;
sigmatch_table[DETECT_AL_TLS_SUBJECT].AppLayerMatch = DetectTlsSubjectMatch;
sigmatch_table[DETECT_AL_TLS_SUBJECT].Setup = DetectTlsSubjectSetup;
@ -104,7 +104,7 @@ void DetectTlsRegister (void)
sigmatch_table[DETECT_AL_TLS_ISSUERDN].name = "tls.issuerdn";
sigmatch_table[DETECT_AL_TLS_ISSUERDN].desc = "match TLS/SSL certificate IssuerDN field";
sigmatch_table[DETECT_AL_TLS_ISSUERDN].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/TLS-keywords#tlsissuerdn";
sigmatch_table[DETECT_AL_TLS_ISSUERDN].url = DOC_URL DOC_VERSION "/rules/tls-keywords.html#tlsissuerdn";
sigmatch_table[DETECT_AL_TLS_ISSUERDN].Match = NULL;
sigmatch_table[DETECT_AL_TLS_ISSUERDN].AppLayerMatch = DetectTlsIssuerDNMatch;
sigmatch_table[DETECT_AL_TLS_ISSUERDN].Setup = DetectTlsIssuerDNSetup;
@ -113,7 +113,7 @@ void DetectTlsRegister (void)
sigmatch_table[DETECT_AL_TLS_FINGERPRINT].name = "tls.fingerprint";
sigmatch_table[DETECT_AL_TLS_FINGERPRINT].desc = "match TLS/SSL certificate SHA1 fingerprint";
sigmatch_table[DETECT_AL_TLS_FINGERPRINT].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/TLS-keywords#tlsfingerprint";
sigmatch_table[DETECT_AL_TLS_FINGERPRINT].url = DOC_URL DOC_VERSION "/rules/tls-keywords.html#tlsfingerprint";
sigmatch_table[DETECT_AL_TLS_FINGERPRINT].Match = NULL;
sigmatch_table[DETECT_AL_TLS_FINGERPRINT].AppLayerMatch = DetectTlsFingerprintMatch;
sigmatch_table[DETECT_AL_TLS_FINGERPRINT].Setup = DetectTlsFingerprintSetup;
@ -122,7 +122,7 @@ void DetectTlsRegister (void)
sigmatch_table[DETECT_AL_TLS_STORE].name = "tls.store";
sigmatch_table[DETECT_AL_TLS_STORE].desc = "store TLS/SSL certificate on disk";
sigmatch_table[DETECT_AL_TLS_STORE].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/TLS-keywords#tlsstore";
sigmatch_table[DETECT_AL_TLS_STORE].url = DOC_URL DOC_VERSION "/rules/tls-keywords.html#tlsstore";
sigmatch_table[DETECT_AL_TLS_STORE].Match = NULL;
sigmatch_table[DETECT_AL_TLS_STORE].AppLayerMatch = DetectTlsStoreMatch;
sigmatch_table[DETECT_AL_TLS_STORE].Setup = DetectTlsStoreSetup;

2
src/detect-ttl.c
Unescape Escape View File

@ -59,7 +59,7 @@ void DetectTtlRegister(void)
{
sigmatch_table[DETECT_TTL].name = "ttl";
sigmatch_table[DETECT_TTL].desc = "check for a specific IP time-to-live value";
sigmatch_table[DETECT_TTL].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Header_keywords#ttl";
sigmatch_table[DETECT_TTL].url = DOC_URL DOC_VERSION "/rules/header-keywords.html#ttl";
sigmatch_table[DETECT_TTL].Match = DetectTtlMatch;
sigmatch_table[DETECT_TTL].Setup = DetectTtlSetup;
sigmatch_table[DETECT_TTL].Free = DetectTtlFree;

2
src/detect-urilen.c
Unescape Escape View File

@ -61,7 +61,7 @@ void DetectUrilenRegister(void)
{
sigmatch_table[DETECT_AL_URILEN].name = "urilen";
sigmatch_table[DETECT_AL_URILEN].desc = "match on the length of the HTTP uri";
sigmatch_table[DETECT_AL_URILEN].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/HTTP-keywords#Urilen";
sigmatch_table[DETECT_AL_URILEN].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#urilen";
sigmatch_table[DETECT_AL_URILEN].Match = NULL;
sigmatch_table[DETECT_AL_URILEN].AppLayerMatch = NULL /**< We handle this at detect-engine-uri.c now */;
sigmatch_table[DETECT_AL_URILEN].Setup = DetectUrilenSetup;

2
src/detect-window.c
Unescape Escape View File

@ -59,7 +59,7 @@ void DetectWindowRegister (void)
{
sigmatch_table[DETECT_WINDOW].name = "window";
sigmatch_table[DETECT_WINDOW].desc = "check for a specific TCP window size";
sigmatch_table[DETECT_WINDOW].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Header_keywords#Window";
sigmatch_table[DETECT_WINDOW].url = DOC_URL DOC_VERSION "/rules/header-keywords.html#window";
sigmatch_table[DETECT_WINDOW].Match = DetectWindowMatch;
sigmatch_table[DETECT_WINDOW].Setup = DetectWindowSetup;
sigmatch_table[DETECT_WINDOW].Free = DetectWindowFree;

2
src/detect-within.c
Unescape Escape View File

@ -50,7 +50,7 @@ void DetectWithinRegister(void)
{
sigmatch_table[DETECT_WITHIN].name = "within";
sigmatch_table[DETECT_WITHIN].desc = "indicate that this content match has to be within a certain distance of the previous content keyword match";
sigmatch_table[DETECT_WITHIN].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Payload_keywords#Within";
sigmatch_table[DETECT_WITHIN].url = DOC_URL DOC_VERSION "/rules/payload-keywords.html#within";
sigmatch_table[DETECT_WITHIN].Match = NULL;
sigmatch_table[DETECT_WITHIN].Setup = DetectWithinSetup;
sigmatch_table[DETECT_WITHIN].Free = NULL;

2
src/detect-xbits.c
Unescape Escape View File

@ -66,7 +66,7 @@ void DetectXbitsRegister (void)
{
sigmatch_table[DETECT_XBITS].name = "xbits";
sigmatch_table[DETECT_XBITS].desc = "operate on bits";
// sigmatch_table[DETECT_XBITS].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Flow-keywords#Flowbits";
// sigmatch_table[DETECT_XBITS].url = DOC_URL DOC_VERSION "/rules/flow-keywords.html#flowbits";
sigmatch_table[DETECT_XBITS].Match = DetectXbitMatch;
sigmatch_table[DETECT_XBITS].Setup = DetectXbitSetup;
sigmatch_table[DETECT_XBITS].Free = DetectXbitFree;

8
src/suricata.h
Unescape Escape View File

@ -85,6 +85,14 @@
#define DEFAULT_PID_BASENAME "suricata.pid"
#define DEFAULT_PID_FILENAME DEFAULT_PID_DIR DEFAULT_PID_BASENAME
#define DOC_URL "http://suricata.readthedocs.io/en/"
#if defined RELEASE
#define DOC_VERSION PROG_VER
#else
#define DOC_VERSION "latest"
#endif
/* runtime engine control flags */
#define SURICATA_STOP (1 << 0) /**< gracefully stop the engine: process all
outstanding packets first */

Write Preview
Loading…
Cancel
Save