26 static int g_mime_email_from_buffer_id = 0;
27 static int g_mime_email_subject_buffer_id = 0;
28 static int g_mime_email_to_buffer_id = 0;
29 static int g_mime_email_cc_buffer_id = 0;
30 static int g_mime_email_date_buffer_id = 0;
31 static int g_mime_email_message_id_buffer_id = 0;
32 static int g_mime_email_x_mailer_buffer_id = 0;
33 static int g_mime_email_url_buffer_id = 0;
34 static int g_mime_email_received_buffer_id = 0;
55 const uint8_t *b_email_from = NULL;
56 uint32_t b_email_from_len = 0;
61 if (SCDetectMimeEmailGetData(tx->
mime_state, &b_email_from, &b_email_from_len,
"from") != 1)
89 const uint8_t *b_email_sub = NULL;
90 uint32_t b_email_sub_len = 0;
95 if (SCDetectMimeEmailGetData(tx->
mime_state, &b_email_sub, &b_email_sub_len,
"subject") !=
124 const uint8_t *b_email_to = NULL;
125 uint32_t b_email_to_len = 0;
128 if (SCDetectMimeEmailGetData(tx->
mime_state, &b_email_to, &b_email_to_len,
"to") != 1)
132 if (b_email_to == NULL || b_email_to_len == 0)
160 const uint8_t *b_email_cc = NULL;
161 uint32_t b_email_cc_len = 0;
166 if (SCDetectMimeEmailGetData(tx->
mime_state, &b_email_cc, &b_email_cc_len,
"cc") != 1)
194 const uint8_t *b_email_date = NULL;
195 uint32_t b_email_date_len = 0;
200 if (SCDetectMimeEmailGetData(tx->
mime_state, &b_email_date, &b_email_date_len,
"date") != 1)
228 const uint8_t *b_email_msg_id = NULL;
229 uint32_t b_email_msg_id_len = 0;
234 if (SCDetectMimeEmailGetData(
235 tx->
mime_state, &b_email_msg_id, &b_email_msg_id_len,
"message-id") != 1)
263 const uint8_t *b_email_x_mailer = NULL;
264 uint32_t b_email_x_mailer_len = 0;
269 if (SCDetectMimeEmailGetData(
270 tx->
mime_state, &b_email_x_mailer, &b_email_x_mailer_len,
"x-mailer") != 1)
292 const int list_id, uint32_t idx)
300 const uint8_t *b_email_url = NULL;
301 uint32_t b_email_url_len = 0;
308 if (SCDetectMimeEmailGetUrl(tx->
mime_state, &b_email_url, &b_email_url_len, idx) != 1) {
331 const int list_id, uint32_t idx)
339 const uint8_t *b_email_received = NULL;
340 uint32_t b_email_received_len = 0;
347 if (SCDetectMimeEmailGetDataArray(
348 tx->
mime_state, &b_email_received, &b_email_received_len,
"received", idx) != 1) {
360 SCSigTableElmt kw = { 0 };
362 kw.name =
"email.from";
363 kw.desc =
"'From' field from an email";
364 kw.url =
"/rules/email-keywords.html#email.from";
365 kw.Setup = (int (*)(
void *,
void *,
const char *))DetectMimeEmailFromSetup;
368 g_mime_email_from_buffer_id =
371 GetMimeEmailFromData);
373 kw.name =
"email.subject";
374 kw.desc =
"'Subject' field from an email";
375 kw.url =
"/rules/email-keywords.html#email.subject";
376 kw.Setup = (int (*)(
void *,
void *,
const char *))DetectMimeEmailSubjectSetup;
382 GetMimeEmailSubjectData);
384 kw.name =
"email.to";
385 kw.desc =
"'To' field from an email";
386 kw.url =
"/rules/email-keywords.html#email.to";
387 kw.Setup = (int (*)(
void *,
void *,
const char *))DetectMimeEmailToSetup;
390 g_mime_email_to_buffer_id =
395 kw.name =
"email.cc";
396 kw.desc =
"'Cc' field from an email";
397 kw.url =
"/rules/email-keywords.html#email.cc";
398 kw.Setup = (int (*)(
void *,
void *,
const char *))DetectMimeEmailCcSetup;
401 g_mime_email_cc_buffer_id =
406 kw.name =
"email.date";
407 kw.desc =
"'Date' field from an email";
408 kw.url =
"/rules/email-keywords.html#email.date";
409 kw.Setup = (int (*)(
void *,
void *,
const char *))DetectMimeEmailDateSetup;
412 g_mime_email_date_buffer_id =
415 GetMimeEmailDateData);
417 kw.name =
"email.message_id";
418 kw.desc =
"'Message-Id' field from an email";
419 kw.url =
"/rules/email-keywords.html#email.message_id";
420 kw.Setup = (int (*)(
void *,
void *,
const char *))DetectMimeEmailMessageIdSetup;
426 GetMimeEmailMessageIdData);
428 kw.name =
"email.x_mailer";
429 kw.desc =
"'X-Mailer' field from an email";
430 kw.url =
"/rules/email-keywords.html#email.x_mailer";
431 kw.Setup = (int (*)(
void *,
void *,
const char *))DetectMimeEmailXMailerSetup;
437 GetMimeEmailXMailerData);
439 kw.name =
"email.url";
440 kw.desc =
"'Url' extracted from an email";
441 kw.url =
"/rules/email-keywords.html#email.url";
442 kw.Setup = (int (*)(
void *,
void *,
const char *))DetectMimeEmailUrlSetup;
445 g_mime_email_url_buffer_id =
448 GetMimeEmailUrlData);
450 kw.name =
"email.received";
451 kw.desc =
"'Received' field from an email";
452 kw.url =
"/rules/email-keywords.html#email.received";
453 kw.Setup = (int (*)(
void *,
void *,
const char *))DetectMimeEmailReceivedSetup;
459 GetMimeEmailReceivedData);