25 static int g_mime_email_from_buffer_id = 0;
26 static int g_mime_email_subject_buffer_id = 0;
27 static int g_mime_email_to_buffer_id = 0;
28 static int g_mime_email_cc_buffer_id = 0;
49 const uint8_t *b_email_from = NULL;
50 uint32_t b_email_from_len = 0;
55 if (SCDetectMimeEmailGetData(tx->
mime_state, &b_email_from, &b_email_from_len,
"from") != 1)
83 const uint8_t *b_email_sub = NULL;
84 uint32_t b_email_sub_len = 0;
89 if (SCDetectMimeEmailGetData(tx->
mime_state, &b_email_sub, &b_email_sub_len,
"subject") !=
118 const uint8_t *b_email_to = NULL;
119 uint32_t b_email_to_len = 0;
122 if (SCDetectMimeEmailGetData(tx->
mime_state, &b_email_to, &b_email_to_len,
"to") != 1)
126 if (b_email_to == NULL || b_email_to_len == 0)
154 const uint8_t *b_email_cc = NULL;
155 uint32_t b_email_cc_len = 0;
160 if (SCDetectMimeEmailGetData(tx->
mime_state, &b_email_cc, &b_email_cc_len,
"cc") != 1)
171 SCSigTableElmt kw = { 0 };
173 kw.name =
"email.from";
174 kw.desc =
"'From' field from an email";
175 kw.url =
"/rules/email-keywords.html#email.from";
176 kw.Setup = (int (*)(
void *,
void *,
const char *))DetectMimeEmailFromSetup;
179 g_mime_email_from_buffer_id =
182 GetMimeEmailFromData);
184 kw.name =
"email.subject";
185 kw.desc =
"'Subject' field from an email";
186 kw.url =
"/rules/email-keywords.html#email.subject";
187 kw.Setup = (int (*)(
void *,
void *,
const char *))DetectMimeEmailSubjectSetup;
193 GetMimeEmailSubjectData);
195 kw.name =
"email.to";
196 kw.desc =
"'To' field from an email";
197 kw.url =
"/rules/email-keywords.html#email.to";
198 kw.Setup = (int (*)(
void *,
void *,
const char *))DetectMimeEmailToSetup;
201 g_mime_email_to_buffer_id =
206 kw.name =
"email.cc";
207 kw.desc =
"'Cc' field from an email";
208 kw.url =
"/rules/email-keywords.html#email.cc";
209 kw.Setup = (int (*)(
void *,
void *,
const char *))DetectMimeEmailCcSetup;
212 g_mime_email_cc_buffer_id =