diff --git a/doc/userguide/rules/integer-keywords.rst b/doc/userguide/rules/integer-keywords.rst index 13b993c38b..cd59a44ff6 100644 --- a/doc/userguide/rules/integer-keywords.rst +++ b/doc/userguide/rules/integer-keywords.rst @@ -22,6 +22,15 @@ case-insensitive suffix: The most direct example is to match for equality, but there are different modes. +The list of integer keywords can be found by command +``suricata --list-keywords=csv | grep "uint"`` + +Some other keywords may use unsigned integers as part of their logic: +* iprep +* stream_size +* flow.pkts +* flow.bytes + Comparison modes ---------------- diff --git a/rust/cbindgen.toml b/rust/cbindgen.toml index 83d5f79973..f3211803a7 100644 --- a/rust/cbindgen.toml +++ b/rust/cbindgen.toml @@ -119,6 +119,11 @@ exclude = [ "SIGMATCH_NOOPT", "SIGMATCH_INFO_STICKY_BUFFER", "SIGMATCH_INFO_MULTI_BUFFER", + "SIGMATCH_INFO_UINT8", + "SIGMATCH_INFO_UINT16", + "SIGMATCH_INFO_UINT32", + "SIGMATCH_INFO_UINT64", + "SIGMATCH_INFO_MULTI_UINT", "FtpCommand", ] diff --git a/rust/src/detect/mod.rs b/rust/src/detect/mod.rs index ee92e5646a..d5e86037fb 100644 --- a/rust/src/detect/mod.rs +++ b/rust/src/detect/mod.rs @@ -130,6 +130,12 @@ pub(crate) const SIGMATCH_OPTIONAL_OPT: u32 = 0x10; // BIT_U16(4) in detect.h pub(crate) const SIGMATCH_QUOTES_MANDATORY: u32 = 0x40; // BIT_U16(6) in detect.h pub const SIGMATCH_INFO_STICKY_BUFFER: u32 = 0x200; // BIT_U16(9) pub const SIGMATCH_INFO_MULTI_BUFFER: u32 = 0x4000; // BIT_U16(14) +pub const SIGMATCH_INFO_UINT8: u32 = 0x8000; // BIT_U32(15) +pub const SIGMATCH_INFO_UINT16: u32 = 0x10000; // BIT_U32(16) +pub const SIGMATCH_INFO_UINT32: u32 = 0x20000; // BIT_U32(17) +pub const SIGMATCH_INFO_UINT64: u32 = 0x40000; // BIT_U32(18) +pub const SIGMATCH_INFO_MULTI_UINT: u32 = 0x80000; // BIT_U32(19) + #[repr(u8)] #[derive(Copy, Clone, Debug, PartialEq, Eq)] diff --git a/rust/src/dhcp/detect.rs b/rust/src/dhcp/detect.rs index 9507e1c747..0c419edf16 100644 --- a/rust/src/dhcp/detect.rs +++ b/rust/src/dhcp/detect.rs @@ -22,6 +22,7 @@ use super::dhcp::{ use super::parser::DHCPOptionWrapper; use crate::core::{STREAM_TOCLIENT, STREAM_TOSERVER}; use crate::detect::uint::{DetectUintData, SCDetectU64Free, SCDetectU64Match, SCDetectU64Parse}; +use crate::detect::SIGMATCH_INFO_UINT64; use std::os::raw::{c_int, c_void}; use suricata_sys::sys::{ DetectEngineCtx, DetectEngineThreadCtx, Flow, SCDetectHelperBufferRegister, @@ -173,7 +174,7 @@ pub unsafe extern "C" fn SCDetectDHCPRegister() { AppLayerTxMatch: Some(dhcp_detect_leasetime_match), Setup: Some(dhcp_detect_leasetime_setup), Free: Some(dhcp_detect_time_free), - flags: 0, + flags: SIGMATCH_INFO_UINT64, }; G_DHCP_LEASE_TIME_KW_ID = SCDetectHelperKeywordRegister(&kw); G_DHCP_LEASE_TIME_BUFFER_ID = SCDetectHelperBufferRegister( @@ -188,7 +189,7 @@ pub unsafe extern "C" fn SCDetectDHCPRegister() { AppLayerTxMatch: Some(dhcp_detect_rebindingtime_match), Setup: Some(dhcp_detect_rebindingtime_setup), Free: Some(dhcp_detect_time_free), - flags: 0, + flags: SIGMATCH_INFO_UINT64, }; G_DHCP_REBINDING_TIME_KW_ID = SCDetectHelperKeywordRegister(&kw); G_DHCP_REBINDING_TIME_BUFFER_ID = SCDetectHelperBufferRegister( @@ -203,7 +204,7 @@ pub unsafe extern "C" fn SCDetectDHCPRegister() { AppLayerTxMatch: Some(dhcp_detect_renewaltime_match), Setup: Some(dhcp_detect_renewaltime_setup), Free: Some(dhcp_detect_time_free), - flags: 0, + flags: SIGMATCH_INFO_UINT64, }; G_DHCP_RENEWAL_TIME_KW_ID = SCDetectHelperKeywordRegister(&kw); G_DHCP_RENEWAL_TIME_BUFFER_ID = SCDetectHelperBufferRegister( diff --git a/rust/src/dns/detect.rs b/rust/src/dns/detect.rs index 691903e198..d6f0fc9ac5 100644 --- a/rust/src/dns/detect.rs +++ b/rust/src/dns/detect.rs @@ -24,7 +24,10 @@ use crate::detect::uint::{ detect_uint_match_at_index, DetectUintArrayData, DetectUintData, SCDetectU16Free, SCDetectU8Free, SCDetectU8Parse, }; -use crate::detect::{helper_keyword_register_multi_buffer, SigTableElmtStickyBuffer}; +use crate::detect::{ + helper_keyword_register_multi_buffer, SigTableElmtStickyBuffer, SIGMATCH_INFO_MULTI_UINT, + SIGMATCH_INFO_UINT16, SIGMATCH_INFO_UINT8, +}; use crate::direction::Direction; use std::ffi::CStr; use std::os::raw::{c_int, c_void}; @@ -376,7 +379,7 @@ pub unsafe extern "C" fn SCDetectDNSRegister() { AppLayerTxMatch: Some(dns_opcode_match), Setup: Some(dns_opcode_setup), Free: Some(dns_opcode_free), - flags: 0, + flags: SIGMATCH_INFO_UINT8, }; G_DNS_OPCODE_KW_ID = SCDetectHelperKeywordRegister(&kw); G_DNS_OPCODE_BUFFER_ID = SCDetectHelperBufferRegister( @@ -408,7 +411,7 @@ pub unsafe extern "C" fn SCDetectDNSRegister() { AppLayerTxMatch: Some(dns_rcode_match), Setup: Some(dns_rcode_setup), Free: Some(dns_rcode_free), - flags: 0, + flags: SIGMATCH_INFO_UINT16, }; G_DNS_RCODE_KW_ID = SCDetectHelperKeywordRegister(&kw); G_DNS_RCODE_BUFFER_ID = SCDetectHelperBufferRegister( @@ -423,7 +426,7 @@ pub unsafe extern "C" fn SCDetectDNSRegister() { AppLayerTxMatch: Some(dns_rrtype_match), Setup: Some(dns_rrtype_setup), Free: Some(dns_rrtype_free), - flags: 0, + flags: SIGMATCH_INFO_UINT16 | SIGMATCH_INFO_MULTI_UINT, }; G_DNS_RRTYPE_KW_ID = SCDetectHelperKeywordRegister(&kw); G_DNS_RRTYPE_BUFFER_ID = SCDetectHelperBufferRegister( diff --git a/rust/src/enip/detect.rs b/rust/src/enip/detect.rs index bac624b5ff..d5c6b7059e 100644 --- a/rust/src/enip/detect.rs +++ b/rust/src/enip/detect.rs @@ -35,7 +35,10 @@ use crate::detect::uint::{ SCDetectU16Parse, SCDetectU32Free, SCDetectU32Match, SCDetectU32Parse, SCDetectU8Free, SCDetectU8Match, SCDetectU8Parse, }; -use crate::detect::{helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer}; +use crate::detect::{ + helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer, SIGMATCH_INFO_MULTI_UINT, + SIGMATCH_INFO_UINT16, SIGMATCH_INFO_UINT32, SIGMATCH_INFO_UINT8, +}; use suricata_sys::sys::{ DetectEngineCtx, DetectEngineThreadCtx, Flow, SCDetectBufferSetActiveList, SCDetectHelperBufferMpmRegister, SCDetectHelperBufferRegister, SCDetectHelperKeywordRegister, @@ -1365,7 +1368,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() { AppLayerTxMatch: Some(capabilities_match), Setup: Some(capabilities_setup), Free: Some(capabilities_free), - flags: 0, + flags: SIGMATCH_INFO_UINT16, }; G_ENIP_CAPABILITIES_KW_ID = SCDetectHelperKeywordRegister(&kw); G_ENIP_CAPABILITIES_BUFFER_ID = SCDetectHelperBufferRegister( @@ -1380,7 +1383,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() { AppLayerTxMatch: Some(cip_attribute_match), Setup: Some(cip_attribute_setup), Free: Some(cip_attribute_free), - flags: 0, + flags: SIGMATCH_INFO_UINT32 | SIGMATCH_INFO_MULTI_UINT, }; G_ENIP_CIP_ATTRIBUTE_KW_ID = SCDetectHelperKeywordRegister(&kw); G_ENIP_CIP_ATTRIBUTE_BUFFER_ID = SCDetectHelperBufferRegister( @@ -1395,7 +1398,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() { AppLayerTxMatch: Some(cip_class_match), Setup: Some(cip_class_setup), Free: Some(cip_class_free), - flags: 0, + flags: SIGMATCH_INFO_UINT32 | SIGMATCH_INFO_MULTI_UINT, }; G_ENIP_CIP_CLASS_KW_ID = SCDetectHelperKeywordRegister(&kw); G_ENIP_CIP_CLASS_BUFFER_ID = SCDetectHelperBufferRegister( @@ -1410,7 +1413,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() { AppLayerTxMatch: Some(vendor_id_match), Setup: Some(vendor_id_setup), Free: Some(vendor_id_free), - flags: 0, + flags: SIGMATCH_INFO_UINT16, }; G_ENIP_VENDOR_ID_KW_ID = SCDetectHelperKeywordRegister(&kw); G_ENIP_VENDOR_ID_BUFFER_ID = SCDetectHelperBufferRegister( @@ -1425,7 +1428,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() { AppLayerTxMatch: Some(status_match), Setup: Some(status_setup), Free: Some(status_free), - flags: 0, + flags: SIGMATCH_INFO_UINT32, }; G_ENIP_STATUS_KW_ID = SCDetectHelperKeywordRegister(&kw); G_ENIP_STATUS_BUFFER_ID = SCDetectHelperBufferRegister( @@ -1440,7 +1443,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() { AppLayerTxMatch: Some(state_match), Setup: Some(state_setup), Free: Some(state_free), - flags: 0, + flags: SIGMATCH_INFO_UINT8, }; G_ENIP_STATE_KW_ID = SCDetectHelperKeywordRegister(&kw); G_ENIP_STATE_BUFFER_ID = SCDetectHelperBufferRegister( @@ -1455,7 +1458,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() { AppLayerTxMatch: Some(serial_match), Setup: Some(serial_setup), Free: Some(serial_free), - flags: 0, + flags: SIGMATCH_INFO_UINT32, }; G_ENIP_SERIAL_KW_ID = SCDetectHelperKeywordRegister(&kw); G_ENIP_SERIAL_BUFFER_ID = SCDetectHelperBufferRegister( @@ -1470,7 +1473,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() { AppLayerTxMatch: Some(revision_match), Setup: Some(revision_setup), Free: Some(revision_free), - flags: 0, + flags: SIGMATCH_INFO_UINT16, }; G_ENIP_REVISION_KW_ID = SCDetectHelperKeywordRegister(&kw); G_ENIP_REVISION_BUFFER_ID = SCDetectHelperBufferRegister( @@ -1485,7 +1488,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() { AppLayerTxMatch: Some(protocol_version_match), Setup: Some(protocol_version_setup), Free: Some(protocol_version_free), - flags: 0, + flags: SIGMATCH_INFO_UINT16, }; G_ENIP_PROTOCOL_VERSION_KW_ID = SCDetectHelperKeywordRegister(&kw); G_ENIP_PROTOCOL_VERSION_BUFFER_ID = SCDetectHelperBufferRegister( @@ -1500,7 +1503,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() { AppLayerTxMatch: Some(product_code_match), Setup: Some(product_code_setup), Free: Some(product_code_free), - flags: 0, + flags: SIGMATCH_INFO_UINT16, }; G_ENIP_PRODUCT_CODE_KW_ID = SCDetectHelperKeywordRegister(&kw); G_ENIP_PRODUCT_CODE_BUFFER_ID = SCDetectHelperBufferRegister( @@ -1515,7 +1518,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() { AppLayerTxMatch: Some(command_match), Setup: Some(command_setup), Free: Some(command_free), - flags: 0, + flags: SIGMATCH_INFO_UINT16, }; G_ENIP_COMMAND_KW_ID = SCDetectHelperKeywordRegister(&kw); G_ENIP_COMMAND_BUFFER_ID = SCDetectHelperBufferRegister( @@ -1530,7 +1533,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() { AppLayerTxMatch: Some(identity_status_match), Setup: Some(identity_status_setup), Free: Some(identity_status_free), - flags: 0, + flags: SIGMATCH_INFO_UINT16, }; G_ENIP_IDENTITY_STATUS_KW_ID = SCDetectHelperKeywordRegister(&kw); G_ENIP_IDENTITY_STATUS_BUFFER_ID = SCDetectHelperBufferRegister( @@ -1545,7 +1548,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() { AppLayerTxMatch: Some(device_type_match), Setup: Some(device_type_setup), Free: Some(device_type_free), - flags: 0, + flags: SIGMATCH_INFO_UINT16, }; G_ENIP_DEVICE_TYPE_KW_ID = SCDetectHelperKeywordRegister(&kw); G_ENIP_DEVICE_TYPE_BUFFER_ID = SCDetectHelperBufferRegister( @@ -1560,7 +1563,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() { AppLayerTxMatch: Some(cip_status_match), Setup: Some(cip_status_setup), Free: Some(cip_status_free), - flags: 0, + flags: SIGMATCH_INFO_UINT8 | SIGMATCH_INFO_MULTI_UINT, }; G_ENIP_CIP_STATUS_KW_ID = SCDetectHelperKeywordRegister(&kw); G_ENIP_CIP_STATUS_BUFFER_ID = SCDetectHelperBufferRegister( @@ -1575,7 +1578,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() { AppLayerTxMatch: Some(cip_instance_match), Setup: Some(cip_instance_setup), Free: Some(cip_instance_free), - flags: 0, + flags: SIGMATCH_INFO_UINT32 | SIGMATCH_INFO_MULTI_UINT, }; G_ENIP_CIP_INSTANCE_KW_ID = SCDetectHelperKeywordRegister(&kw); G_ENIP_CIP_INSTANCE_BUFFER_ID = SCDetectHelperBufferRegister( @@ -1591,7 +1594,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() { AppLayerTxMatch: Some(cip_extendedstatus_match), Setup: Some(cip_extendedstatus_setup), Free: Some(cip_extendedstatus_free), - flags: 0, + flags: SIGMATCH_INFO_UINT16 | SIGMATCH_INFO_MULTI_UINT, }; G_ENIP_CIP_EXTENDEDSTATUS_KW_ID = SCDetectHelperKeywordRegister(&kw); G_ENIP_CIP_EXTENDEDSTATUS_BUFFER_ID = SCDetectHelperBufferRegister( diff --git a/rust/src/ldap/detect.rs b/rust/src/ldap/detect.rs index bc95edbc92..b022e7d5db 100644 --- a/rust/src/ldap/detect.rs +++ b/rust/src/ldap/detect.rs @@ -24,7 +24,7 @@ use crate::detect::uint::{ }; use crate::detect::{ helper_keyword_register_multi_buffer, helper_keyword_register_sticky_buffer, - SigTableElmtStickyBuffer, + SigTableElmtStickyBuffer, SIGMATCH_INFO_MULTI_UINT, SIGMATCH_INFO_UINT32, SIGMATCH_INFO_UINT8, }; use crate::ldap::types::*; use ldap_parser::ldap::{LdapMessage, ProtocolOp}; @@ -519,7 +519,7 @@ pub unsafe extern "C" fn SCDetectLdapRegister() { AppLayerTxMatch: Some(ldap_detect_request_operation_match), Setup: Some(ldap_detect_request_operation_setup), Free: Some(ldap_detect_request_free), - flags: 0, + flags: SIGMATCH_INFO_UINT8, }; G_LDAP_REQUEST_OPERATION_KW_ID = SCDetectHelperKeywordRegister(&kw); G_LDAP_REQUEST_OPERATION_BUFFER_ID = SCDetectHelperBufferRegister( @@ -535,7 +535,7 @@ pub unsafe extern "C" fn SCDetectLdapRegister() { AppLayerTxMatch: Some(ldap_detect_responses_operation_match), Setup: Some(ldap_detect_responses_operation_setup), Free: Some(ldap_detect_responses_free), - flags: 0, + flags: SIGMATCH_INFO_UINT8 | SIGMATCH_INFO_MULTI_UINT, }; G_LDAP_RESPONSES_OPERATION_KW_ID = SCDetectHelperKeywordRegister(&kw); G_LDAP_RESPONSES_OPERATION_BUFFER_ID = SCDetectHelperBufferRegister( @@ -550,7 +550,7 @@ pub unsafe extern "C" fn SCDetectLdapRegister() { AppLayerTxMatch: Some(ldap_detect_responses_count_match), Setup: Some(ldap_detect_responses_count_setup), Free: Some(ldap_detect_responses_count_free), - flags: 0, + flags: SIGMATCH_INFO_UINT32, }; G_LDAP_RESPONSES_COUNT_KW_ID = SCDetectHelperKeywordRegister(&kw); G_LDAP_RESPONSES_COUNT_BUFFER_ID = SCDetectHelperBufferRegister( @@ -594,7 +594,7 @@ pub unsafe extern "C" fn SCDetectLdapRegister() { AppLayerTxMatch: Some(ldap_detect_responses_result_code_match), Setup: Some(ldap_detect_responses_result_code_setup), Free: Some(ldap_detect_responses_result_code_free), - flags: 0, + flags: SIGMATCH_INFO_UINT32 | SIGMATCH_INFO_MULTI_UINT, }; G_LDAP_RESPONSES_RESULT_CODE_KW_ID = SCDetectHelperKeywordRegister(&kw); G_LDAP_RESPONSES_RESULT_CODE_BUFFER_ID = SCDetectHelperBufferRegister( diff --git a/rust/src/mqtt/detect.rs b/rust/src/mqtt/detect.rs index 2282fe0ee2..fecadb9bcf 100644 --- a/rust/src/mqtt/detect.rs +++ b/rust/src/mqtt/detect.rs @@ -24,7 +24,7 @@ use crate::detect::uint::{ }; use crate::detect::{ helper_keyword_register_multi_buffer, helper_keyword_register_sticky_buffer, - SigTableElmtStickyBuffer, + SigTableElmtStickyBuffer, SIGMATCH_INFO_MULTI_UINT, SIGMATCH_INFO_UINT8, }; use suricata_sys::sys::{ DetectEngineCtx, DetectEngineThreadCtx, Flow, SCDetectBufferSetActiveList, @@ -1011,7 +1011,7 @@ pub unsafe extern "C" fn SCDetectMqttRegister() { AppLayerTxMatch: Some(mqtt_type_match), Setup: Some(mqtt_type_setup), Free: Some(mqtt_type_free), - flags: 0, + flags: SIGMATCH_INFO_UINT8 | SIGMATCH_INFO_MULTI_UINT, }; G_MQTT_TYPE_KW_ID = SCDetectHelperKeywordRegister(&kw); G_MQTT_TYPE_BUFFER_ID = SCDetectHelperBufferRegister( @@ -1051,7 +1051,7 @@ pub unsafe extern "C" fn SCDetectMqttRegister() { AppLayerTxMatch: Some(mqtt_reason_code_match), Setup: Some(mqtt_reason_code_setup), Free: Some(mqtt_reason_code_free), - flags: 0, + flags: SIGMATCH_INFO_UINT8 | SIGMATCH_INFO_MULTI_UINT, }; G_MQTT_REASON_CODE_KW_ID = SCDetectHelperKeywordRegister(&kw); G_MQTT_REASON_CODE_BUFFER_ID = SCDetectHelperBufferRegister( @@ -1126,7 +1126,7 @@ pub unsafe extern "C" fn SCDetectMqttRegister() { AppLayerTxMatch: Some(mqtt_protocol_version_match), Setup: Some(mqtt_protocol_version_setup), Free: Some(mqtt_protocol_version_free), - flags: 0, + flags: SIGMATCH_INFO_UINT8, }; G_MQTT_PROTOCOL_VERSION_KW_ID = SCDetectHelperKeywordRegister(&kw); G_MQTT_PROTOCOL_VERSION_BUFFER_ID = SCDetectHelperBufferRegister( @@ -1141,7 +1141,7 @@ pub unsafe extern "C" fn SCDetectMqttRegister() { AppLayerTxMatch: Some(mqtt_flags_match), Setup: Some(mqtt_flags_setup), Free: Some(mqtt_flags_free), - flags: 0, + flags: SIGMATCH_INFO_UINT8 | SIGMATCH_INFO_MULTI_UINT, }; G_MQTT_FLAGS_KW_ID = SCDetectHelperKeywordRegister(&kw); G_MQTT_FLAGS_BUFFER_ID = SCDetectHelperBufferRegister( @@ -1156,7 +1156,7 @@ pub unsafe extern "C" fn SCDetectMqttRegister() { AppLayerTxMatch: Some(mqtt_conn_flags_match), Setup: Some(mqtt_conn_flags_setup), Free: Some(mqtt_conn_flags_free), - flags: 0, + flags: SIGMATCH_INFO_UINT8 | SIGMATCH_INFO_MULTI_UINT, }; G_MQTT_CONN_FLAGS_KW_ID = SCDetectHelperKeywordRegister(&kw); G_MQTT_CONN_FLAGS_BUFFER_ID = SCDetectHelperBufferRegister( diff --git a/rust/src/rfb/detect.rs b/rust/src/rfb/detect.rs index 087ddca333..5face090d5 100644 --- a/rust/src/rfb/detect.rs +++ b/rust/src/rfb/detect.rs @@ -23,7 +23,9 @@ use crate::core::{STREAM_TOCLIENT, STREAM_TOSERVER}; use crate::detect::uint::{ detect_match_uint, detect_parse_uint_enum, DetectUintData, SCDetectU32Free, SCDetectU32Parse, }; -use crate::detect::{helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer}; +use crate::detect::{ + helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer, SIGMATCH_INFO_UINT32, +}; use std::ffi::CStr; use std::os::raw::{c_int, c_void}; use std::ptr; @@ -203,7 +205,7 @@ pub unsafe extern "C" fn SCDetectRfbRegister() { AppLayerTxMatch: Some(rfb_sec_type_match), Setup: Some(rfb_sec_type_setup), Free: Some(rfb_sec_type_free), - flags: 0, + flags: SIGMATCH_INFO_UINT32, }; G_RFB_SEC_TYPE_KW_ID = SCDetectHelperKeywordRegister(&kw); G_RFB_SEC_TYPE_BUFFER_ID = SCDetectHelperBufferRegister( @@ -218,7 +220,7 @@ pub unsafe extern "C" fn SCDetectRfbRegister() { AppLayerTxMatch: Some(rfb_sec_result_match), Setup: Some(rfb_sec_result_setup), Free: Some(rfb_sec_result_free), - flags: 0, + flags: SIGMATCH_INFO_UINT32, }; G_RFB_SEC_RESULT_KW_ID = SCDetectHelperKeywordRegister(&kw); G_RFB_SEC_RESULT_BUFFER_ID = SCDetectHelperBufferRegister( diff --git a/rust/src/snmp/detect.rs b/rust/src/snmp/detect.rs index 15012d6551..c0c6404fdc 100644 --- a/rust/src/snmp/detect.rs +++ b/rust/src/snmp/detect.rs @@ -20,7 +20,7 @@ use super::snmp::{SNMPTransaction, ALPROTO_SNMP}; use crate::core::{STREAM_TOCLIENT, STREAM_TOSERVER}; use crate::detect::uint::{DetectUintData, SCDetectU32Free, SCDetectU32Match, SCDetectU32Parse}; -use crate::detect::{helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer}; +use crate::detect::{helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer, SIGMATCH_INFO_UINT32}; use std::os::raw::{c_int, c_void}; use suricata_sys::sys::{ DetectEngineCtx, DetectEngineThreadCtx, Flow, SCDetectBufferSetActiveList, @@ -176,7 +176,7 @@ pub(super) unsafe extern "C" fn detect_snmp_register() { AppLayerTxMatch: Some(snmp_detect_version_match), Setup: Some(snmp_detect_version_setup), Free: Some(snmp_detect_version_free), - flags: 0, + flags: SIGMATCH_INFO_UINT32, }; G_SNMP_VERSION_KW_ID = SCDetectHelperKeywordRegister(&kw); G_SNMP_VERSION_BUFFER_ID = SCDetectHelperBufferRegister( @@ -192,7 +192,7 @@ pub(super) unsafe extern "C" fn detect_snmp_register() { AppLayerTxMatch: Some(snmp_detect_pdutype_match), Setup: Some(snmp_detect_pdutype_setup), Free: Some(snmp_detect_pdutype_free), - flags: 0, + flags: SIGMATCH_INFO_UINT32, }; G_SNMP_PDUTYPE_KW_ID = SCDetectHelperKeywordRegister(&kw); G_SNMP_PDUTYPE_BUFFER_ID = SCDetectHelperBufferRegister( diff --git a/rust/src/websocket/detect.rs b/rust/src/websocket/detect.rs index 1c607df8fe..cfed49ed46 100644 --- a/rust/src/websocket/detect.rs +++ b/rust/src/websocket/detect.rs @@ -21,7 +21,10 @@ use crate::detect::uint::{ detect_parse_uint, detect_parse_uint_enum, DetectUintData, DetectUintMode, SCDetectU32Free, SCDetectU32Match, SCDetectU32Parse, SCDetectU8Free, SCDetectU8Match, }; -use crate::detect::{helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer}; +use crate::detect::{ + helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer, SIGMATCH_INFO_UINT32, + SIGMATCH_INFO_UINT8, +}; use crate::websocket::parser::WebSocketOpcode; use suricata_sys::sys::{ DetectEngineCtx, DetectEngineThreadCtx, Flow, SCDetectBufferSetActiveList, @@ -273,7 +276,7 @@ pub unsafe extern "C" fn SCDetectWebsocketRegister() { AppLayerTxMatch: Some(websocket_detect_opcode_match), Setup: Some(websocket_detect_opcode_setup), Free: Some(websocket_detect_opcode_free), - flags: 0, + flags: SIGMATCH_INFO_UINT8, }; G_WEBSOCKET_OPCODE_KW_ID = SCDetectHelperKeywordRegister(&kw); G_WEBSOCKET_OPCODE_BUFFER_ID = SCDetectHelperBufferRegister( @@ -288,7 +291,7 @@ pub unsafe extern "C" fn SCDetectWebsocketRegister() { AppLayerTxMatch: Some(websocket_detect_mask_match), Setup: Some(websocket_detect_mask_setup), Free: Some(websocket_detect_mask_free), - flags: 0, + flags: SIGMATCH_INFO_UINT32, }; G_WEBSOCKET_MASK_KW_ID = SCDetectHelperKeywordRegister(&kw); G_WEBSOCKET_MASK_BUFFER_ID = SCDetectHelperBufferRegister( @@ -303,7 +306,7 @@ pub unsafe extern "C" fn SCDetectWebsocketRegister() { AppLayerTxMatch: Some(websocket_detect_flags_match), Setup: Some(websocket_detect_flags_setup), Free: Some(websocket_detect_flags_free), - flags: 0, + flags: SIGMATCH_INFO_UINT8, }; G_WEBSOCKET_FLAGS_KW_ID = SCDetectHelperKeywordRegister(&kw); G_WEBSOCKET_FLAGS_BUFFER_ID = SCDetectHelperBufferRegister( diff --git a/src/detect-bsize.c b/src/detect-bsize.c index ffc2e6d70c..728328272f 100644 --- a/src/detect-bsize.c +++ b/src/detect-bsize.c @@ -105,7 +105,7 @@ void DetectBsizeRegister(void) sigmatch_table[DETECT_BSIZE].Match = NULL; sigmatch_table[DETECT_BSIZE].Setup = DetectBsizeSetup; sigmatch_table[DETECT_BSIZE].Free = DetectBsizeFree; - sigmatch_table[DETECT_BSIZE].flags = SIGMATCH_SUPPORT_FIREWALL; + sigmatch_table[DETECT_BSIZE].flags = SIGMATCH_SUPPORT_FIREWALL | SIGMATCH_INFO_UINT64; #ifdef UNITTESTS sigmatch_table[DETECT_BSIZE].RegisterTests = DetectBsizeRegisterTests; #endif diff --git a/src/detect-dsize.c b/src/detect-dsize.c index ec6cf1c01a..113c760ed2 100644 --- a/src/detect-dsize.c +++ b/src/detect-dsize.c @@ -66,7 +66,7 @@ void DetectDsizeRegister (void) sigmatch_table[DETECT_DSIZE].Match = DetectDsizeMatch; sigmatch_table[DETECT_DSIZE].Setup = DetectDsizeSetup; sigmatch_table[DETECT_DSIZE].Free = DetectDsizeFree; - sigmatch_table[DETECT_DSIZE].flags = SIGMATCH_SUPPORT_FIREWALL; + sigmatch_table[DETECT_DSIZE].flags = SIGMATCH_SUPPORT_FIREWALL | SIGMATCH_INFO_UINT16; #ifdef UNITTESTS sigmatch_table[DETECT_DSIZE].RegisterTests = DsizeRegisterTests; #endif diff --git a/src/detect-engine-register.c b/src/detect-engine-register.c index f5ffce4d64..86c8304f5d 100644 --- a/src/detect-engine-register.c +++ b/src/detect-engine-register.c @@ -335,6 +335,38 @@ static void PrintFeatureList(const SigTableElmt *e, char sep) printf("multi buffer"); prev = 1; } + if (flags & SIGMATCH_INFO_UINT8) { + if (prev == 1) + printf("%c", sep); + if (flags & SIGMATCH_INFO_MULTI_UINT) + printf("multi "); + printf("uint8"); + prev = 1; + } + if (flags & SIGMATCH_INFO_UINT16) { + if (prev == 1) + printf("%c", sep); + if (flags & SIGMATCH_INFO_MULTI_UINT) + printf("multi "); + printf("uint16"); + prev = 1; + } + if (flags & SIGMATCH_INFO_UINT32) { + if (prev == 1) + printf("%c", sep); + if (flags & SIGMATCH_INFO_MULTI_UINT) + printf("multi "); + printf("uint32"); + prev = 1; + } + if (flags & SIGMATCH_INFO_UINT64) { + if (prev == 1) + printf("%c", sep); + if (flags & SIGMATCH_INFO_MULTI_UINT) + printf("multi "); + printf("uint64"); + prev = 1; + } if (e->Transform) { if (prev == 1) printf("%c", sep); diff --git a/src/detect-filesize.c b/src/detect-filesize.c index 1d866bbb23..f2efe02e44 100644 --- a/src/detect-filesize.c +++ b/src/detect-filesize.c @@ -66,7 +66,8 @@ void DetectFilesizeRegister(void) sigmatch_table[DETECT_FILESIZE].FileMatch = DetectFilesizeMatch; sigmatch_table[DETECT_FILESIZE].Setup = DetectFilesizeSetup; sigmatch_table[DETECT_FILESIZE].Free = DetectFilesizeFree; - sigmatch_table[DETECT_FILESIZE].flags = SIGMATCH_SUPPORT_DIR; + sigmatch_table[DETECT_FILESIZE].flags = + SIGMATCH_SUPPORT_DIR | SIGMATCH_INFO_UINT64 | SIGMATCH_INFO_MULTI_UINT; #ifdef UNITTESTS sigmatch_table[DETECT_FILESIZE].RegisterTests = DetectFilesizeRegisterTests; #endif diff --git a/src/detect-flow-age.c b/src/detect-flow-age.c index 255364f1d7..c4e691ac07 100644 --- a/src/detect-flow-age.c +++ b/src/detect-flow-age.c @@ -94,6 +94,7 @@ void DetectFlowAgeRegister(void) sigmatch_table[DETECT_FLOW_AGE].Match = DetectFlowAgeMatch; sigmatch_table[DETECT_FLOW_AGE].Setup = DetectFlowAgeSetup; sigmatch_table[DETECT_FLOW_AGE].Free = DetectFlowAgeFree; + sigmatch_table[DETECT_FLOW_AGE].flags = SIGMATCH_INFO_UINT32; sigmatch_table[DETECT_FLOW_AGE].SupportsPrefilter = PrefilterFlowAgeIsPrefilterable; sigmatch_table[DETECT_FLOW_AGE].SetupPrefilter = PrefilterSetupFlowAge; } diff --git a/src/detect-flow-pkts.c b/src/detect-flow-pkts.c index b7cf3ae34d..ea3c007a11 100644 --- a/src/detect-flow-pkts.c +++ b/src/detect-flow-pkts.c @@ -173,6 +173,7 @@ void DetectFlowPktsToServerRegister(void) sigmatch_table[DETECT_FLOW_PKTS_TO_SERVER].Match = DetectFlowPktsMatch; sigmatch_table[DETECT_FLOW_PKTS_TO_SERVER].Setup = DetectFlowPktsToServerSetup; sigmatch_table[DETECT_FLOW_PKTS_TO_SERVER].Free = DetectFlowPktsFree; + sigmatch_table[DETECT_FLOW_PKTS_TO_SERVER].flags = SIGMATCH_INFO_UINT32; sigmatch_table[DETECT_FLOW_PKTS_TO_SERVER].SupportsPrefilter = PrefilterFlowPktsIsPrefilterable; sigmatch_table[DETECT_FLOW_PKTS_TO_SERVER].SetupPrefilter = PrefilterSetupFlowPkts; } @@ -186,6 +187,7 @@ void DetectFlowPktsToClientRegister(void) sigmatch_table[DETECT_FLOW_PKTS_TO_CLIENT].Match = DetectFlowPktsMatch; sigmatch_table[DETECT_FLOW_PKTS_TO_CLIENT].Setup = DetectFlowPktsToClientSetup; sigmatch_table[DETECT_FLOW_PKTS_TO_CLIENT].Free = DetectFlowPktsFree; + sigmatch_table[DETECT_FLOW_PKTS_TO_CLIENT].flags = SIGMATCH_INFO_UINT32; sigmatch_table[DETECT_FLOW_PKTS_TO_CLIENT].SupportsPrefilter = PrefilterFlowPktsIsPrefilterable; sigmatch_table[DETECT_FLOW_PKTS_TO_CLIENT].SetupPrefilter = PrefilterSetupFlowPkts; } @@ -287,6 +289,7 @@ void DetectFlowBytesToServerRegister(void) sigmatch_table[DETECT_FLOW_BYTES_TO_SERVER].Match = DetectFlowBytesMatch; sigmatch_table[DETECT_FLOW_BYTES_TO_SERVER].Setup = DetectFlowBytesToServerSetup; sigmatch_table[DETECT_FLOW_BYTES_TO_SERVER].Free = DetectFlowBytesFree; + sigmatch_table[DETECT_FLOW_BYTES_TO_SERVER].flags = SIGMATCH_INFO_UINT64; } void DetectFlowBytesToClientRegister(void) @@ -298,4 +301,5 @@ void DetectFlowBytesToClientRegister(void) sigmatch_table[DETECT_FLOW_BYTES_TO_CLIENT].Match = DetectFlowBytesMatch; sigmatch_table[DETECT_FLOW_BYTES_TO_CLIENT].Setup = DetectFlowBytesToClientSetup; sigmatch_table[DETECT_FLOW_BYTES_TO_CLIENT].Free = DetectFlowBytesFree; + sigmatch_table[DETECT_FLOW_BYTES_TO_CLIENT].flags = SIGMATCH_INFO_UINT64; } diff --git a/src/detect-ftp-dynamic-port.c b/src/detect-ftp-dynamic-port.c index e13a36ccad..595102ebb7 100644 --- a/src/detect-ftp-dynamic-port.c +++ b/src/detect-ftp-dynamic-port.c @@ -103,6 +103,7 @@ void DetectFtpDynamicPortRegister(void) sigmatch_table[DETECT_FTP_DYNPORT].url = "/rules/" KEYWORD_DOC; sigmatch_table[DETECT_FTP_DYNPORT].Setup = DetectFtpDynamicPortSetup; sigmatch_table[DETECT_FTP_DYNPORT].Free = DetectFtpDynamicPortFree; + sigmatch_table[DETECT_FTP_DYNPORT].flags = SIGMATCH_INFO_UINT16; sigmatch_table[DETECT_FTP_DYNPORT].AppLayerTxMatch = DetectFtpDynamicPortMatch; DetectAppLayerInspectEngineRegister( diff --git a/src/detect-http2.c b/src/detect-http2.c index 5182df1a7b..ae577dd4d6 100644 --- a/src/detect-http2.c +++ b/src/detect-http2.c @@ -132,6 +132,8 @@ void DetectHttp2Register(void) sigmatch_table[DETECT_HTTP2_PRIORITY].AppLayerTxMatch = DetectHTTP2priorityMatch; sigmatch_table[DETECT_HTTP2_PRIORITY].Setup = DetectHTTP2prioritySetup; sigmatch_table[DETECT_HTTP2_PRIORITY].Free = DetectHTTP2priorityFree; + sigmatch_table[DETECT_HTTP2_PRIORITY].flags = + SIGMATCH_INFO_UINT8 | SIGMATCH_INFO_MULTI_UINT | SIGMATCH_INFO_MULTI_UINT; #ifdef UNITTESTS sigmatch_table[DETECT_HTTP2_PRIORITY].RegisterTests = DetectHTTP2priorityRegisterTests; #endif @@ -143,6 +145,7 @@ void DetectHttp2Register(void) sigmatch_table[DETECT_HTTP2_WINDOW].AppLayerTxMatch = DetectHTTP2windowMatch; sigmatch_table[DETECT_HTTP2_WINDOW].Setup = DetectHTTP2windowSetup; sigmatch_table[DETECT_HTTP2_WINDOW].Free = DetectHTTP2windowFree; + sigmatch_table[DETECT_HTTP2_WINDOW].flags = SIGMATCH_INFO_UINT32 | SIGMATCH_INFO_MULTI_UINT; #ifdef UNITTESTS sigmatch_table[DETECT_HTTP2_WINDOW].RegisterTests = DetectHTTP2windowRegisterTests; #endif @@ -154,6 +157,7 @@ void DetectHttp2Register(void) sigmatch_table[DETECT_HTTP2_SIZEUPDATE].AppLayerTxMatch = DetectHTTP2sizeUpdateMatch; sigmatch_table[DETECT_HTTP2_SIZEUPDATE].Setup = DetectHTTP2sizeUpdateSetup; sigmatch_table[DETECT_HTTP2_SIZEUPDATE].Free = DetectHTTP2sizeUpdateFree; + sigmatch_table[DETECT_HTTP2_SIZEUPDATE].flags = SIGMATCH_INFO_UINT64; #ifdef UNITTESTS sigmatch_table[DETECT_HTTP2_SIZEUPDATE].RegisterTests = DetectHTTP2sizeUpdateRegisterTests; #endif diff --git a/src/detect-icmpv6-mtu.c b/src/detect-icmpv6-mtu.c index 34beb50b50..863d2b96fa 100644 --- a/src/detect-icmpv6-mtu.c +++ b/src/detect-icmpv6-mtu.c @@ -53,6 +53,7 @@ void DetectICMPv6mtuRegister(void) sigmatch_table[DETECT_ICMPV6MTU].Match = DetectICMPv6mtuMatch; sigmatch_table[DETECT_ICMPV6MTU].Setup = DetectICMPv6mtuSetup; sigmatch_table[DETECT_ICMPV6MTU].Free = DetectICMPv6mtuFree; + sigmatch_table[DETECT_ICMPV6MTU].flags = SIGMATCH_INFO_UINT32; #ifdef UNITTESTS sigmatch_table[DETECT_ICMPV6MTU].RegisterTests = DetectICMPv6mtuRegisterTests; #endif diff --git a/src/detect-icode.c b/src/detect-icode.c index 0149e546c2..8dbd655ef9 100644 --- a/src/detect-icode.c +++ b/src/detect-icode.c @@ -70,6 +70,7 @@ void DetectICodeRegister (void) #endif sigmatch_table[DETECT_ICODE].SupportsPrefilter = PrefilterICodeIsPrefilterable; sigmatch_table[DETECT_ICODE].SetupPrefilter = PrefilterSetupICode; + sigmatch_table[DETECT_ICODE].flags = SIGMATCH_SUPPORT_FIREWALL | SIGMATCH_INFO_UINT8; } /** diff --git a/src/detect-ike-exch-type.c b/src/detect-ike-exch-type.c index de53414ea1..46fb1e1ac0 100644 --- a/src/detect-ike-exch-type.c +++ b/src/detect-ike-exch-type.c @@ -56,6 +56,7 @@ void DetectIkeExchTypeRegister(void) sigmatch_table[DETECT_IKE_EXCH_TYPE].AppLayerTxMatch = DetectIkeExchTypeMatch; sigmatch_table[DETECT_IKE_EXCH_TYPE].Setup = DetectIkeExchTypeSetup; sigmatch_table[DETECT_IKE_EXCH_TYPE].Free = DetectIkeExchTypeFree; + sigmatch_table[DETECT_IKE_EXCH_TYPE].flags = SIGMATCH_INFO_UINT8; DetectAppLayerInspectEngineRegister("ike.exchtype", ALPROTO_IKE, SIG_FLAG_TOSERVER, 1, DetectEngineInspectGenericList, NULL); diff --git a/src/detect-ike-key-exchange-payload-length.c b/src/detect-ike-key-exchange-payload-length.c index e918cd3bdb..2264765db5 100644 --- a/src/detect-ike-key-exchange-payload-length.c +++ b/src/detect-ike-key-exchange-payload-length.c @@ -59,6 +59,7 @@ void DetectIkeKeyExchangePayloadLengthRegister(void) DetectIkeKeyExchangePayloadLengthSetup; sigmatch_table[DETECT_IKE_KEY_EXCHANGE_PAYLOAD_LENGTH].Free = DetectIkeKeyExchangePayloadLengthFree; + sigmatch_table[DETECT_IKE_KEY_EXCHANGE_PAYLOAD_LENGTH].flags = SIGMATCH_INFO_UINT32; DetectAppLayerInspectEngineRegister("ike.key_exchange_payload_length", ALPROTO_IKE, SIG_FLAG_TOSERVER, 1, DetectEngineInspectGenericList, NULL); diff --git a/src/detect-ike-nonce-payload-length.c b/src/detect-ike-nonce-payload-length.c index 09a5f7b3dd..df9758607a 100644 --- a/src/detect-ike-nonce-payload-length.c +++ b/src/detect-ike-nonce-payload-length.c @@ -56,6 +56,7 @@ void DetectIkeNoncePayloadLengthRegister(void) DetectIkeNoncePayloadLengthMatch; sigmatch_table[DETECT_IKE_NONCE_PAYLOAD_LENGTH].Setup = DetectIkeNoncePayloadLengthSetup; sigmatch_table[DETECT_IKE_NONCE_PAYLOAD_LENGTH].Free = DetectIkeNoncePayloadLengthFree; + sigmatch_table[DETECT_IKE_NONCE_PAYLOAD_LENGTH].flags = SIGMATCH_INFO_UINT32; DetectAppLayerInspectEngineRegister("ike.nonce_payload_length", ALPROTO_IKE, SIG_FLAG_TOSERVER, 1, DetectEngineInspectGenericList, NULL); diff --git a/src/detect-itype.c b/src/detect-itype.c index b7372cbcb8..5f9ca7dad8 100644 --- a/src/detect-itype.c +++ b/src/detect-itype.c @@ -62,7 +62,7 @@ void DetectITypeRegister (void) sigmatch_table[DETECT_ITYPE].Match = DetectITypeMatch; sigmatch_table[DETECT_ITYPE].Setup = DetectITypeSetup; sigmatch_table[DETECT_ITYPE].Free = DetectITypeFree; - sigmatch_table[DETECT_ITYPE].flags = SIGMATCH_SUPPORT_FIREWALL; + sigmatch_table[DETECT_ITYPE].flags = SIGMATCH_SUPPORT_FIREWALL | SIGMATCH_INFO_UINT8; #ifdef UNITTESTS sigmatch_table[DETECT_ITYPE].RegisterTests = DetectITypeRegisterTests; #endif diff --git a/src/detect-nfs-procedure.c b/src/detect-nfs-procedure.c index 2d82523f0c..6d91946868 100644 --- a/src/detect-nfs-procedure.c +++ b/src/detect-nfs-procedure.c @@ -70,6 +70,7 @@ void DetectNfsProcedureRegister (void) sigmatch_table[DETECT_NFS_PROCEDURE].AppLayerTxMatch = DetectNfsProcedureMatch; sigmatch_table[DETECT_NFS_PROCEDURE].Setup = DetectNfsProcedureSetup; sigmatch_table[DETECT_NFS_PROCEDURE].Free = DetectNfsProcedureFree; + sigmatch_table[DETECT_NFS_PROCEDURE].flags = SIGMATCH_INFO_UINT32 | SIGMATCH_INFO_MULTI_UINT; #ifdef UNITTESTS sigmatch_table[DETECT_NFS_PROCEDURE].RegisterTests = DetectNfsProcedureRegisterTests; #endif diff --git a/src/detect-nfs-version.c b/src/detect-nfs-version.c index c2946f5fee..8dccff6811 100644 --- a/src/detect-nfs-version.c +++ b/src/detect-nfs-version.c @@ -68,6 +68,7 @@ void DetectNfsVersionRegister (void) sigmatch_table[DETECT_NFS_VERSION].AppLayerTxMatch = DetectNfsVersionMatch; sigmatch_table[DETECT_NFS_VERSION].Setup = DetectNfsVersionSetup; sigmatch_table[DETECT_NFS_VERSION].Free = DetectNfsVersionFree; + sigmatch_table[DETECT_NFS_VERSION].flags = SIGMATCH_INFO_UINT32; // unit tests were the same as DetectNfsProcedureRegisterTests g_nfs_request_buffer_id = DetectBufferTypeGetByName("nfs_request"); diff --git a/src/detect-tcp-wscale.c b/src/detect-tcp-wscale.c index b0785f77eb..637dc94ca6 100644 --- a/src/detect-tcp-wscale.c +++ b/src/detect-tcp-wscale.c @@ -54,7 +54,7 @@ void DetectTcpWscaleRegister(void) sigmatch_table[DETECT_TCP_WSCALE].Free = DetectTcpWscaleFree; sigmatch_table[DETECT_TCP_WSCALE].SupportsPrefilter = PrefilterTcpWscaleIsPrefilterable; sigmatch_table[DETECT_TCP_WSCALE].SetupPrefilter = PrefilterSetupTcpWscale; - sigmatch_table[DETECT_TCP_WSCALE].flags = SIGMATCH_SUPPORT_FIREWALL; + sigmatch_table[DETECT_TCP_WSCALE].flags = SIGMATCH_SUPPORT_FIREWALL | SIGMATCH_INFO_UINT8; sigmatch_table[DETECT_TCP_WSCALE].tables = (DETECT_TABLE_PACKET_PRE_FLOW_FLAG | DETECT_TABLE_PACKET_PRE_STREAM_FLAG | DETECT_TABLE_PACKET_FILTER_FLAG | DETECT_TABLE_PACKET_TD_FLAG); diff --git a/src/detect-tcpmss.c b/src/detect-tcpmss.c index 632f04d2a0..361210ee98 100644 --- a/src/detect-tcpmss.c +++ b/src/detect-tcpmss.c @@ -56,6 +56,7 @@ void DetectTcpmssRegister(void) sigmatch_table[DETECT_TCPMSS].Match = DetectTcpmssMatch; sigmatch_table[DETECT_TCPMSS].Setup = DetectTcpmssSetup; sigmatch_table[DETECT_TCPMSS].Free = DetectTcpmssFree; + sigmatch_table[DETECT_TCPMSS].flags = SIGMATCH_INFO_UINT16; sigmatch_table[DETECT_TCPMSS].SupportsPrefilter = PrefilterTcpmssIsPrefilterable; sigmatch_table[DETECT_TCPMSS].SetupPrefilter = PrefilterSetupTcpmss; } diff --git a/src/detect-template2.c b/src/detect-template2.c index 746ad0be7a..4920941418 100644 --- a/src/detect-template2.c +++ b/src/detect-template2.c @@ -58,6 +58,7 @@ void DetectTemplate2Register(void) sigmatch_table[DETECT_TEMPLATE2].Free = DetectTemplate2Free; sigmatch_table[DETECT_TEMPLATE2].SupportsPrefilter = PrefilterTemplate2IsPrefilterable; sigmatch_table[DETECT_TEMPLATE2].SetupPrefilter = PrefilterSetupTemplate2; + sigmatch_table[DETECT_TEMPLATE2].flags = SIGMATCH_INFO_UINT8; } /** diff --git a/src/detect-tls-certs.c b/src/detect-tls-certs.c index 36c986e65f..4fe7ce7edb 100644 --- a/src/detect-tls-certs.c +++ b/src/detect-tls-certs.c @@ -243,6 +243,7 @@ void DetectTlsCertChainLenRegister(void) sigmatch_table[KEYWORD_ID].AppLayerTxMatch = DetectTLSCertChainLenMatch; sigmatch_table[KEYWORD_ID].Setup = DetectTLSCertChainLenSetup; sigmatch_table[KEYWORD_ID].Free = DetectTLSCertChainLenFree; + sigmatch_table[KEYWORD_ID].flags = SIGMATCH_INFO_UINT32; g_tls_cert_buffer_id = DetectBufferTypeGetByName(BUFFER_NAME); } diff --git a/src/detect-ttl.c b/src/detect-ttl.c index f96f3b93d1..44e370fe4a 100644 --- a/src/detect-ttl.c +++ b/src/detect-ttl.c @@ -64,6 +64,7 @@ void DetectTtlRegister(void) #endif sigmatch_table[DETECT_TTL].SupportsPrefilter = PrefilterTtlIsPrefilterable; sigmatch_table[DETECT_TTL].SetupPrefilter = PrefilterSetupTtl; + sigmatch_table[DETECT_TTL].flags = SIGMATCH_INFO_UINT8; } /** diff --git a/src/detect-vlan.c b/src/detect-vlan.c index 62aa1eea48..8e8d237528 100644 --- a/src/detect-vlan.c +++ b/src/detect-vlan.c @@ -137,6 +137,7 @@ void DetectVlanIdRegister(void) sigmatch_table[DETECT_VLAN_ID].Match = DetectVlanIdMatch; sigmatch_table[DETECT_VLAN_ID].Setup = DetectVlanIdSetup; sigmatch_table[DETECT_VLAN_ID].Free = DetectVlanIdFree; + sigmatch_table[DETECT_VLAN_ID].flags = SIGMATCH_INFO_UINT16 | SIGMATCH_INFO_MULTI_UINT; sigmatch_table[DETECT_VLAN_ID].SupportsPrefilter = PrefilterVlanIdIsPrefilterable; sigmatch_table[DETECT_VLAN_ID].SetupPrefilter = PrefilterSetupVlanId; } @@ -216,4 +217,5 @@ void DetectVlanLayersRegister(void) sigmatch_table[DETECT_VLAN_LAYERS].Free = DetectVlanLayersFree; sigmatch_table[DETECT_VLAN_LAYERS].SupportsPrefilter = PrefilterVlanLayersIsPrefilterable; sigmatch_table[DETECT_VLAN_LAYERS].SetupPrefilter = PrefilterSetupVlanLayers; + sigmatch_table[DETECT_VLAN_LAYERS].flags = SIGMATCH_INFO_UINT8; } diff --git a/src/detect.h b/src/detect.h index 2172d011c5..6dc49dbbb8 100644 --- a/src/detect.h +++ b/src/detect.h @@ -1682,6 +1682,16 @@ typedef struct SigGroupHead_ { #define SIGMATCH_SUPPORT_DIR BIT_U32(13) /** keyword is a multi buffer */ #define SIGMATCH_INFO_MULTI_BUFFER BIT_U32(14) +/** keyword is a unsigned 8-bit integer */ +#define SIGMATCH_INFO_UINT8 BIT_U32(15) +/** keyword is a unsigned 16-bit integer */ +#define SIGMATCH_INFO_UINT16 BIT_U32(16) +/** keyword is a unsigned 32-bit integer */ +#define SIGMATCH_INFO_UINT32 BIT_U32(17) +/** keyword is a unsigned 64-bit integer */ +#define SIGMATCH_INFO_UINT64 BIT_U32(18) +/** keyword is a multi uint */ +#define SIGMATCH_INFO_MULTI_UINT BIT_U32(19) enum DetectEngineTenantSelectors {