detect: list-keywords cli shows integers

Ticket: 7875

doc/userguide/rules/integer-keywords.rst

@@ -22,6 +22,15 @@ case-insensitive suffix:
 The most direct example is to match for equality, but there are
 different modes.
 
+The list of integer keywords can be found by command
+``suricata --list-keywords=csv | grep "uint"``
+
+Some other keywords may use unsigned integers as part of their logic:
+* iprep
+* stream_size
+* flow.pkts
+* flow.bytes
+
 Comparison modes
 ----------------
 

rust/cbindgen.toml

@@ -119,6 +119,11 @@ exclude = [
     "SIGMATCH_NOOPT",
     "SIGMATCH_INFO_STICKY_BUFFER",
     "SIGMATCH_INFO_MULTI_BUFFER",
+    "SIGMATCH_INFO_UINT8",
+    "SIGMATCH_INFO_UINT16",
+    "SIGMATCH_INFO_UINT32",
+    "SIGMATCH_INFO_UINT64",
+    "SIGMATCH_INFO_MULTI_UINT",
     "FtpCommand",
 ]
 

rust/src/detect/mod.rs

@@ -130,6 +130,12 @@ pub(crate) const SIGMATCH_OPTIONAL_OPT: u32 = 0x10; // BIT_U16(4) in detect.h
 pub(crate) const SIGMATCH_QUOTES_MANDATORY: u32 = 0x40; // BIT_U16(6) in detect.h
 pub const SIGMATCH_INFO_STICKY_BUFFER: u32 = 0x200; // BIT_U16(9)
 pub const SIGMATCH_INFO_MULTI_BUFFER: u32 = 0x4000; // BIT_U16(14)
+pub const SIGMATCH_INFO_UINT8: u32 = 0x8000; // BIT_U32(15)
+pub const SIGMATCH_INFO_UINT16: u32 = 0x10000; // BIT_U32(16)
+pub const SIGMATCH_INFO_UINT32: u32 = 0x20000; // BIT_U32(17)
+pub const SIGMATCH_INFO_UINT64: u32 = 0x40000; // BIT_U32(18)
+pub const SIGMATCH_INFO_MULTI_UINT: u32 = 0x80000; // BIT_U32(19)
+
 
 #[repr(u8)]
 #[derive(Copy, Clone, Debug, PartialEq, Eq)]

rust/src/dhcp/detect.rs

@@ -22,6 +22,7 @@ use super::dhcp::{
 use super::parser::DHCPOptionWrapper;
 use crate::core::{STREAM_TOCLIENT, STREAM_TOSERVER};
 use crate::detect::uint::{DetectUintData, SCDetectU64Free, SCDetectU64Match, SCDetectU64Parse};
+use crate::detect::SIGMATCH_INFO_UINT64;
 use std::os::raw::{c_int, c_void};
 use suricata_sys::sys::{
     DetectEngineCtx, DetectEngineThreadCtx, Flow, SCDetectHelperBufferRegister,
@@ -173,7 +174,7 @@ pub unsafe extern "C" fn SCDetectDHCPRegister() {
         AppLayerTxMatch: Some(dhcp_detect_leasetime_match),
         Setup: Some(dhcp_detect_leasetime_setup),
         Free: Some(dhcp_detect_time_free),
-        flags: 0,
+        flags: SIGMATCH_INFO_UINT64,
     };
     G_DHCP_LEASE_TIME_KW_ID = SCDetectHelperKeywordRegister(&kw);
     G_DHCP_LEASE_TIME_BUFFER_ID = SCDetectHelperBufferRegister(
@@ -188,7 +189,7 @@ pub unsafe extern "C" fn SCDetectDHCPRegister() {
         AppLayerTxMatch: Some(dhcp_detect_rebindingtime_match),
         Setup: Some(dhcp_detect_rebindingtime_setup),
         Free: Some(dhcp_detect_time_free),
-        flags: 0,
+        flags: SIGMATCH_INFO_UINT64,
     };
     G_DHCP_REBINDING_TIME_KW_ID = SCDetectHelperKeywordRegister(&kw);
     G_DHCP_REBINDING_TIME_BUFFER_ID = SCDetectHelperBufferRegister(
@@ -203,7 +204,7 @@ pub unsafe extern "C" fn SCDetectDHCPRegister() {
         AppLayerTxMatch: Some(dhcp_detect_renewaltime_match),
         Setup: Some(dhcp_detect_renewaltime_setup),
         Free: Some(dhcp_detect_time_free),
-        flags: 0,
+        flags: SIGMATCH_INFO_UINT64,
     };
     G_DHCP_RENEWAL_TIME_KW_ID = SCDetectHelperKeywordRegister(&kw);
     G_DHCP_RENEWAL_TIME_BUFFER_ID = SCDetectHelperBufferRegister(

rust/src/dns/detect.rs

@@ -24,7 +24,10 @@ use crate::detect::uint::{
     detect_uint_match_at_index, DetectUintArrayData, DetectUintData, SCDetectU16Free,
     SCDetectU8Free, SCDetectU8Parse,
 };
-use crate::detect::{helper_keyword_register_multi_buffer, SigTableElmtStickyBuffer};
+use crate::detect::{
+    helper_keyword_register_multi_buffer, SigTableElmtStickyBuffer, SIGMATCH_INFO_MULTI_UINT,
+    SIGMATCH_INFO_UINT16, SIGMATCH_INFO_UINT8,
+};
 use crate::direction::Direction;
 use std::ffi::CStr;
 use std::os::raw::{c_int, c_void};
@@ -376,7 +379,7 @@ pub unsafe extern "C" fn SCDetectDNSRegister() {
         AppLayerTxMatch: Some(dns_opcode_match),
         Setup: Some(dns_opcode_setup),
         Free: Some(dns_opcode_free),
-        flags: 0,
+        flags: SIGMATCH_INFO_UINT8,
     };
     G_DNS_OPCODE_KW_ID = SCDetectHelperKeywordRegister(&kw);
     G_DNS_OPCODE_BUFFER_ID = SCDetectHelperBufferRegister(
@@ -408,7 +411,7 @@ pub unsafe extern "C" fn SCDetectDNSRegister() {
         AppLayerTxMatch: Some(dns_rcode_match),
         Setup: Some(dns_rcode_setup),
         Free: Some(dns_rcode_free),
-        flags: 0,
+        flags: SIGMATCH_INFO_UINT16,
     };
     G_DNS_RCODE_KW_ID = SCDetectHelperKeywordRegister(&kw);
     G_DNS_RCODE_BUFFER_ID = SCDetectHelperBufferRegister(
@@ -423,7 +426,7 @@ pub unsafe extern "C" fn SCDetectDNSRegister() {
         AppLayerTxMatch: Some(dns_rrtype_match),
         Setup: Some(dns_rrtype_setup),
         Free: Some(dns_rrtype_free),
-        flags: 0,
+        flags: SIGMATCH_INFO_UINT16 | SIGMATCH_INFO_MULTI_UINT,
     };
     G_DNS_RRTYPE_KW_ID = SCDetectHelperKeywordRegister(&kw);
     G_DNS_RRTYPE_BUFFER_ID = SCDetectHelperBufferRegister(

rust/src/enip/detect.rs

@@ -35,7 +35,10 @@ use crate::detect::uint::{
     SCDetectU16Parse, SCDetectU32Free, SCDetectU32Match, SCDetectU32Parse, SCDetectU8Free,
     SCDetectU8Match, SCDetectU8Parse,
 };
-use crate::detect::{helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer};
+use crate::detect::{
+    helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer, SIGMATCH_INFO_MULTI_UINT,
+    SIGMATCH_INFO_UINT16, SIGMATCH_INFO_UINT32, SIGMATCH_INFO_UINT8,
+};
 use suricata_sys::sys::{
     DetectEngineCtx, DetectEngineThreadCtx, Flow, SCDetectBufferSetActiveList,
     SCDetectHelperBufferMpmRegister, SCDetectHelperBufferRegister, SCDetectHelperKeywordRegister,
@@ -1365,7 +1368,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() {
         AppLayerTxMatch: Some(capabilities_match),
         Setup: Some(capabilities_setup),
         Free: Some(capabilities_free),
-        flags: 0,
+        flags: SIGMATCH_INFO_UINT16,
     };
     G_ENIP_CAPABILITIES_KW_ID = SCDetectHelperKeywordRegister(&kw);
     G_ENIP_CAPABILITIES_BUFFER_ID = SCDetectHelperBufferRegister(
@@ -1380,7 +1383,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() {
         AppLayerTxMatch: Some(cip_attribute_match),
         Setup: Some(cip_attribute_setup),
         Free: Some(cip_attribute_free),
-        flags: 0,
+        flags: SIGMATCH_INFO_UINT32 | SIGMATCH_INFO_MULTI_UINT,
     };
     G_ENIP_CIP_ATTRIBUTE_KW_ID = SCDetectHelperKeywordRegister(&kw);
     G_ENIP_CIP_ATTRIBUTE_BUFFER_ID = SCDetectHelperBufferRegister(
@@ -1395,7 +1398,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() {
         AppLayerTxMatch: Some(cip_class_match),
         Setup: Some(cip_class_setup),
         Free: Some(cip_class_free),
-        flags: 0,
+        flags: SIGMATCH_INFO_UINT32 | SIGMATCH_INFO_MULTI_UINT,
     };
     G_ENIP_CIP_CLASS_KW_ID = SCDetectHelperKeywordRegister(&kw);
     G_ENIP_CIP_CLASS_BUFFER_ID = SCDetectHelperBufferRegister(
@@ -1410,7 +1413,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() {
         AppLayerTxMatch: Some(vendor_id_match),
         Setup: Some(vendor_id_setup),
         Free: Some(vendor_id_free),
-        flags: 0,
+        flags: SIGMATCH_INFO_UINT16,
     };
     G_ENIP_VENDOR_ID_KW_ID = SCDetectHelperKeywordRegister(&kw);
     G_ENIP_VENDOR_ID_BUFFER_ID = SCDetectHelperBufferRegister(
@@ -1425,7 +1428,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() {
         AppLayerTxMatch: Some(status_match),
         Setup: Some(status_setup),
         Free: Some(status_free),
-        flags: 0,
+        flags: SIGMATCH_INFO_UINT32,
     };
     G_ENIP_STATUS_KW_ID = SCDetectHelperKeywordRegister(&kw);
     G_ENIP_STATUS_BUFFER_ID = SCDetectHelperBufferRegister(
@@ -1440,7 +1443,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() {
         AppLayerTxMatch: Some(state_match),
         Setup: Some(state_setup),
         Free: Some(state_free),
-        flags: 0,
+        flags: SIGMATCH_INFO_UINT8,
     };
     G_ENIP_STATE_KW_ID = SCDetectHelperKeywordRegister(&kw);
     G_ENIP_STATE_BUFFER_ID = SCDetectHelperBufferRegister(
@@ -1455,7 +1458,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() {
         AppLayerTxMatch: Some(serial_match),
         Setup: Some(serial_setup),
         Free: Some(serial_free),
-        flags: 0,
+        flags: SIGMATCH_INFO_UINT32,
     };
     G_ENIP_SERIAL_KW_ID = SCDetectHelperKeywordRegister(&kw);
     G_ENIP_SERIAL_BUFFER_ID = SCDetectHelperBufferRegister(
@@ -1470,7 +1473,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() {
         AppLayerTxMatch: Some(revision_match),
         Setup: Some(revision_setup),
         Free: Some(revision_free),
-        flags: 0,
+        flags: SIGMATCH_INFO_UINT16,
     };
     G_ENIP_REVISION_KW_ID = SCDetectHelperKeywordRegister(&kw);
     G_ENIP_REVISION_BUFFER_ID = SCDetectHelperBufferRegister(
@@ -1485,7 +1488,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() {
         AppLayerTxMatch: Some(protocol_version_match),
         Setup: Some(protocol_version_setup),
         Free: Some(protocol_version_free),
-        flags: 0,
+        flags: SIGMATCH_INFO_UINT16,
     };
     G_ENIP_PROTOCOL_VERSION_KW_ID = SCDetectHelperKeywordRegister(&kw);
     G_ENIP_PROTOCOL_VERSION_BUFFER_ID = SCDetectHelperBufferRegister(
@@ -1500,7 +1503,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() {
         AppLayerTxMatch: Some(product_code_match),
         Setup: Some(product_code_setup),
         Free: Some(product_code_free),
-        flags: 0,
+        flags: SIGMATCH_INFO_UINT16,
     };
     G_ENIP_PRODUCT_CODE_KW_ID = SCDetectHelperKeywordRegister(&kw);
     G_ENIP_PRODUCT_CODE_BUFFER_ID = SCDetectHelperBufferRegister(
@@ -1515,7 +1518,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() {
         AppLayerTxMatch: Some(command_match),
         Setup: Some(command_setup),
         Free: Some(command_free),
-        flags: 0,
+        flags: SIGMATCH_INFO_UINT16,
     };
     G_ENIP_COMMAND_KW_ID = SCDetectHelperKeywordRegister(&kw);
     G_ENIP_COMMAND_BUFFER_ID = SCDetectHelperBufferRegister(
@@ -1530,7 +1533,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() {
         AppLayerTxMatch: Some(identity_status_match),
         Setup: Some(identity_status_setup),
         Free: Some(identity_status_free),
-        flags: 0,
+        flags: SIGMATCH_INFO_UINT16,
     };
     G_ENIP_IDENTITY_STATUS_KW_ID = SCDetectHelperKeywordRegister(&kw);
     G_ENIP_IDENTITY_STATUS_BUFFER_ID = SCDetectHelperBufferRegister(
@@ -1545,7 +1548,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() {
         AppLayerTxMatch: Some(device_type_match),
         Setup: Some(device_type_setup),
         Free: Some(device_type_free),
-        flags: 0,
+        flags: SIGMATCH_INFO_UINT16,
     };
     G_ENIP_DEVICE_TYPE_KW_ID = SCDetectHelperKeywordRegister(&kw);
     G_ENIP_DEVICE_TYPE_BUFFER_ID = SCDetectHelperBufferRegister(
@@ -1560,7 +1563,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() {
         AppLayerTxMatch: Some(cip_status_match),
         Setup: Some(cip_status_setup),
         Free: Some(cip_status_free),
-        flags: 0,
+        flags: SIGMATCH_INFO_UINT8 | SIGMATCH_INFO_MULTI_UINT,
     };
     G_ENIP_CIP_STATUS_KW_ID = SCDetectHelperKeywordRegister(&kw);
     G_ENIP_CIP_STATUS_BUFFER_ID = SCDetectHelperBufferRegister(
@@ -1575,7 +1578,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() {
         AppLayerTxMatch: Some(cip_instance_match),
         Setup: Some(cip_instance_setup),
         Free: Some(cip_instance_free),
-        flags: 0,
+        flags: SIGMATCH_INFO_UINT32 | SIGMATCH_INFO_MULTI_UINT,
     };
     G_ENIP_CIP_INSTANCE_KW_ID = SCDetectHelperKeywordRegister(&kw);
     G_ENIP_CIP_INSTANCE_BUFFER_ID = SCDetectHelperBufferRegister(
@@ -1591,7 +1594,7 @@ pub unsafe extern "C" fn SCDetectEnipRegister() {
         AppLayerTxMatch: Some(cip_extendedstatus_match),
         Setup: Some(cip_extendedstatus_setup),
         Free: Some(cip_extendedstatus_free),
-        flags: 0,
+        flags: SIGMATCH_INFO_UINT16 | SIGMATCH_INFO_MULTI_UINT,
     };
     G_ENIP_CIP_EXTENDEDSTATUS_KW_ID = SCDetectHelperKeywordRegister(&kw);
     G_ENIP_CIP_EXTENDEDSTATUS_BUFFER_ID = SCDetectHelperBufferRegister(

rust/src/ldap/detect.rs

@@ -24,7 +24,7 @@ use crate::detect::uint::{
 };
 use crate::detect::{
     helper_keyword_register_multi_buffer, helper_keyword_register_sticky_buffer,
-    SigTableElmtStickyBuffer,
+    SigTableElmtStickyBuffer, SIGMATCH_INFO_MULTI_UINT, SIGMATCH_INFO_UINT32, SIGMATCH_INFO_UINT8,
 };
 use crate::ldap::types::*;
 use ldap_parser::ldap::{LdapMessage, ProtocolOp};
@@ -519,7 +519,7 @@ pub unsafe extern "C" fn SCDetectLdapRegister() {
         AppLayerTxMatch: Some(ldap_detect_request_operation_match),
         Setup: Some(ldap_detect_request_operation_setup),
         Free: Some(ldap_detect_request_free),
-        flags: 0,
+        flags: SIGMATCH_INFO_UINT8,
     };
     G_LDAP_REQUEST_OPERATION_KW_ID = SCDetectHelperKeywordRegister(&kw);
     G_LDAP_REQUEST_OPERATION_BUFFER_ID = SCDetectHelperBufferRegister(
@@ -535,7 +535,7 @@ pub unsafe extern "C" fn SCDetectLdapRegister() {
         AppLayerTxMatch: Some(ldap_detect_responses_operation_match),
         Setup: Some(ldap_detect_responses_operation_setup),
         Free: Some(ldap_detect_responses_free),
-        flags: 0,
+        flags: SIGMATCH_INFO_UINT8 | SIGMATCH_INFO_MULTI_UINT,
     };
     G_LDAP_RESPONSES_OPERATION_KW_ID = SCDetectHelperKeywordRegister(&kw);
     G_LDAP_RESPONSES_OPERATION_BUFFER_ID = SCDetectHelperBufferRegister(
@@ -550,7 +550,7 @@ pub unsafe extern "C" fn SCDetectLdapRegister() {
         AppLayerTxMatch: Some(ldap_detect_responses_count_match),
         Setup: Some(ldap_detect_responses_count_setup),
         Free: Some(ldap_detect_responses_count_free),
-        flags: 0,
+        flags: SIGMATCH_INFO_UINT32,
     };
     G_LDAP_RESPONSES_COUNT_KW_ID = SCDetectHelperKeywordRegister(&kw);
     G_LDAP_RESPONSES_COUNT_BUFFER_ID = SCDetectHelperBufferRegister(
@@ -594,7 +594,7 @@ pub unsafe extern "C" fn SCDetectLdapRegister() {
         AppLayerTxMatch: Some(ldap_detect_responses_result_code_match),
         Setup: Some(ldap_detect_responses_result_code_setup),
         Free: Some(ldap_detect_responses_result_code_free),
-        flags: 0,
+        flags: SIGMATCH_INFO_UINT32 | SIGMATCH_INFO_MULTI_UINT,
     };
     G_LDAP_RESPONSES_RESULT_CODE_KW_ID = SCDetectHelperKeywordRegister(&kw);
     G_LDAP_RESPONSES_RESULT_CODE_BUFFER_ID = SCDetectHelperBufferRegister(

rust/src/mqtt/detect.rs

@@ -24,7 +24,7 @@ use crate::detect::uint::{
 };
 use crate::detect::{
     helper_keyword_register_multi_buffer, helper_keyword_register_sticky_buffer,
-    SigTableElmtStickyBuffer,
+    SigTableElmtStickyBuffer, SIGMATCH_INFO_MULTI_UINT, SIGMATCH_INFO_UINT8,
 };
 use suricata_sys::sys::{
     DetectEngineCtx, DetectEngineThreadCtx, Flow, SCDetectBufferSetActiveList,
@@ -1011,7 +1011,7 @@ pub unsafe extern "C" fn SCDetectMqttRegister() {
         AppLayerTxMatch: Some(mqtt_type_match),
         Setup: Some(mqtt_type_setup),
         Free: Some(mqtt_type_free),
-        flags: 0,
+        flags: SIGMATCH_INFO_UINT8 | SIGMATCH_INFO_MULTI_UINT,
     };
     G_MQTT_TYPE_KW_ID = SCDetectHelperKeywordRegister(&kw);
     G_MQTT_TYPE_BUFFER_ID = SCDetectHelperBufferRegister(
@@ -1051,7 +1051,7 @@ pub unsafe extern "C" fn SCDetectMqttRegister() {
         AppLayerTxMatch: Some(mqtt_reason_code_match),
         Setup: Some(mqtt_reason_code_setup),
         Free: Some(mqtt_reason_code_free),
-        flags: 0,
+        flags: SIGMATCH_INFO_UINT8 | SIGMATCH_INFO_MULTI_UINT,
     };
     G_MQTT_REASON_CODE_KW_ID = SCDetectHelperKeywordRegister(&kw);
     G_MQTT_REASON_CODE_BUFFER_ID = SCDetectHelperBufferRegister(
@@ -1126,7 +1126,7 @@ pub unsafe extern "C" fn SCDetectMqttRegister() {
         AppLayerTxMatch: Some(mqtt_protocol_version_match),
         Setup: Some(mqtt_protocol_version_setup),
         Free: Some(mqtt_protocol_version_free),
-        flags: 0,
+        flags: SIGMATCH_INFO_UINT8,
     };
     G_MQTT_PROTOCOL_VERSION_KW_ID = SCDetectHelperKeywordRegister(&kw);
     G_MQTT_PROTOCOL_VERSION_BUFFER_ID = SCDetectHelperBufferRegister(
@@ -1141,7 +1141,7 @@ pub unsafe extern "C" fn SCDetectMqttRegister() {
         AppLayerTxMatch: Some(mqtt_flags_match),
         Setup: Some(mqtt_flags_setup),
         Free: Some(mqtt_flags_free),
-        flags: 0,
+        flags: SIGMATCH_INFO_UINT8 | SIGMATCH_INFO_MULTI_UINT,
     };
     G_MQTT_FLAGS_KW_ID = SCDetectHelperKeywordRegister(&kw);
     G_MQTT_FLAGS_BUFFER_ID = SCDetectHelperBufferRegister(
@@ -1156,7 +1156,7 @@ pub unsafe extern "C" fn SCDetectMqttRegister() {
         AppLayerTxMatch: Some(mqtt_conn_flags_match),
         Setup: Some(mqtt_conn_flags_setup),
         Free: Some(mqtt_conn_flags_free),
-        flags: 0,
+        flags: SIGMATCH_INFO_UINT8 | SIGMATCH_INFO_MULTI_UINT,
     };
     G_MQTT_CONN_FLAGS_KW_ID = SCDetectHelperKeywordRegister(&kw);
     G_MQTT_CONN_FLAGS_BUFFER_ID = SCDetectHelperBufferRegister(

rust/src/rfb/detect.rs

@@ -23,7 +23,9 @@ use crate::core::{STREAM_TOCLIENT, STREAM_TOSERVER};
 use crate::detect::uint::{
     detect_match_uint, detect_parse_uint_enum, DetectUintData, SCDetectU32Free, SCDetectU32Parse,
 };
-use crate::detect::{helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer};
+use crate::detect::{
+    helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer, SIGMATCH_INFO_UINT32,
+};
 use std::ffi::CStr;
 use std::os::raw::{c_int, c_void};
 use std::ptr;
@@ -203,7 +205,7 @@ pub unsafe extern "C" fn SCDetectRfbRegister() {
         AppLayerTxMatch: Some(rfb_sec_type_match),
         Setup: Some(rfb_sec_type_setup),
         Free: Some(rfb_sec_type_free),
-        flags: 0,
+        flags: SIGMATCH_INFO_UINT32,
     };
     G_RFB_SEC_TYPE_KW_ID = SCDetectHelperKeywordRegister(&kw);
     G_RFB_SEC_TYPE_BUFFER_ID = SCDetectHelperBufferRegister(
@@ -218,7 +220,7 @@ pub unsafe extern "C" fn SCDetectRfbRegister() {
         AppLayerTxMatch: Some(rfb_sec_result_match),
         Setup: Some(rfb_sec_result_setup),
         Free: Some(rfb_sec_result_free),
-        flags: 0,
+        flags: SIGMATCH_INFO_UINT32,
     };
     G_RFB_SEC_RESULT_KW_ID = SCDetectHelperKeywordRegister(&kw);
     G_RFB_SEC_RESULT_BUFFER_ID = SCDetectHelperBufferRegister(

rust/src/snmp/detect.rs

@@ -20,7 +20,7 @@
 use super::snmp::{SNMPTransaction, ALPROTO_SNMP};
 use crate::core::{STREAM_TOCLIENT, STREAM_TOSERVER};
 use crate::detect::uint::{DetectUintData, SCDetectU32Free, SCDetectU32Match, SCDetectU32Parse};
-use crate::detect::{helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer};
+use crate::detect::{helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer, SIGMATCH_INFO_UINT32};
 use std::os::raw::{c_int, c_void};
 use suricata_sys::sys::{
     DetectEngineCtx, DetectEngineThreadCtx, Flow, SCDetectBufferSetActiveList,
@@ -176,7 +176,7 @@ pub(super) unsafe extern "C" fn detect_snmp_register() {
         AppLayerTxMatch: Some(snmp_detect_version_match),
         Setup: Some(snmp_detect_version_setup),
         Free: Some(snmp_detect_version_free),
-        flags: 0,
+        flags: SIGMATCH_INFO_UINT32,
     };
     G_SNMP_VERSION_KW_ID = SCDetectHelperKeywordRegister(&kw);
     G_SNMP_VERSION_BUFFER_ID = SCDetectHelperBufferRegister(
@@ -192,7 +192,7 @@ pub(super) unsafe extern "C" fn detect_snmp_register() {
         AppLayerTxMatch: Some(snmp_detect_pdutype_match),
         Setup: Some(snmp_detect_pdutype_setup),
         Free: Some(snmp_detect_pdutype_free),
-        flags: 0,
+        flags: SIGMATCH_INFO_UINT32,
     };
     G_SNMP_PDUTYPE_KW_ID = SCDetectHelperKeywordRegister(&kw);
     G_SNMP_PDUTYPE_BUFFER_ID = SCDetectHelperBufferRegister(

rust/src/websocket/detect.rs

@@ -21,7 +21,10 @@ use crate::detect::uint::{
     detect_parse_uint, detect_parse_uint_enum, DetectUintData, DetectUintMode, SCDetectU32Free,
     SCDetectU32Match, SCDetectU32Parse, SCDetectU8Free, SCDetectU8Match,
 };
-use crate::detect::{helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer};
+use crate::detect::{
+    helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer, SIGMATCH_INFO_UINT32,
+    SIGMATCH_INFO_UINT8,
+};
 use crate::websocket::parser::WebSocketOpcode;
 use suricata_sys::sys::{
     DetectEngineCtx, DetectEngineThreadCtx, Flow, SCDetectBufferSetActiveList,
@@ -273,7 +276,7 @@ pub unsafe extern "C" fn SCDetectWebsocketRegister() {
         AppLayerTxMatch: Some(websocket_detect_opcode_match),
         Setup: Some(websocket_detect_opcode_setup),
         Free: Some(websocket_detect_opcode_free),
-        flags: 0,
+        flags: SIGMATCH_INFO_UINT8,
     };
     G_WEBSOCKET_OPCODE_KW_ID = SCDetectHelperKeywordRegister(&kw);
     G_WEBSOCKET_OPCODE_BUFFER_ID = SCDetectHelperBufferRegister(
@@ -288,7 +291,7 @@ pub unsafe extern "C" fn SCDetectWebsocketRegister() {
         AppLayerTxMatch: Some(websocket_detect_mask_match),
         Setup: Some(websocket_detect_mask_setup),
         Free: Some(websocket_detect_mask_free),
-        flags: 0,
+        flags: SIGMATCH_INFO_UINT32,
     };
     G_WEBSOCKET_MASK_KW_ID = SCDetectHelperKeywordRegister(&kw);
     G_WEBSOCKET_MASK_BUFFER_ID = SCDetectHelperBufferRegister(
@@ -303,7 +306,7 @@ pub unsafe extern "C" fn SCDetectWebsocketRegister() {
         AppLayerTxMatch: Some(websocket_detect_flags_match),
         Setup: Some(websocket_detect_flags_setup),
         Free: Some(websocket_detect_flags_free),
-        flags: 0,
+        flags: SIGMATCH_INFO_UINT8,
     };
     G_WEBSOCKET_FLAGS_KW_ID = SCDetectHelperKeywordRegister(&kw);
     G_WEBSOCKET_FLAGS_BUFFER_ID = SCDetectHelperBufferRegister(

src/detect-bsize.c

@@ -105,7 +105,7 @@ void DetectBsizeRegister(void)
     sigmatch_table[DETECT_BSIZE].Match = NULL;
     sigmatch_table[DETECT_BSIZE].Setup = DetectBsizeSetup;
     sigmatch_table[DETECT_BSIZE].Free = DetectBsizeFree;
-    sigmatch_table[DETECT_BSIZE].flags = SIGMATCH_SUPPORT_FIREWALL;
+    sigmatch_table[DETECT_BSIZE].flags = SIGMATCH_SUPPORT_FIREWALL | SIGMATCH_INFO_UINT64;
 #ifdef UNITTESTS
     sigmatch_table[DETECT_BSIZE].RegisterTests = DetectBsizeRegisterTests;
 #endif

src/detect-dsize.c

@@ -66,7 +66,7 @@ void DetectDsizeRegister (void)
     sigmatch_table[DETECT_DSIZE].Match = DetectDsizeMatch;
     sigmatch_table[DETECT_DSIZE].Setup = DetectDsizeSetup;
     sigmatch_table[DETECT_DSIZE].Free  = DetectDsizeFree;
-    sigmatch_table[DETECT_DSIZE].flags = SIGMATCH_SUPPORT_FIREWALL;
+    sigmatch_table[DETECT_DSIZE].flags = SIGMATCH_SUPPORT_FIREWALL | SIGMATCH_INFO_UINT16;
 #ifdef UNITTESTS
     sigmatch_table[DETECT_DSIZE].RegisterTests = DsizeRegisterTests;
 #endif

src/detect-engine-register.c

@@ -335,6 +335,38 @@ static void PrintFeatureList(const SigTableElmt *e, char sep)
         printf("multi buffer");
         prev = 1;
     }
+    if (flags & SIGMATCH_INFO_UINT8) {
+        if (prev == 1)
+            printf("%c", sep);
+        if (flags & SIGMATCH_INFO_MULTI_UINT)
+            printf("multi ");
+        printf("uint8");
+        prev = 1;
+    }
+    if (flags & SIGMATCH_INFO_UINT16) {
+        if (prev == 1)
+            printf("%c", sep);
+        if (flags & SIGMATCH_INFO_MULTI_UINT)
+            printf("multi ");
+        printf("uint16");
+        prev = 1;
+    }
+    if (flags & SIGMATCH_INFO_UINT32) {
+        if (prev == 1)
+            printf("%c", sep);
+        if (flags & SIGMATCH_INFO_MULTI_UINT)
+            printf("multi ");
+        printf("uint32");
+        prev = 1;
+    }
+    if (flags & SIGMATCH_INFO_UINT64) {
+        if (prev == 1)
+            printf("%c", sep);
+        if (flags & SIGMATCH_INFO_MULTI_UINT)
+            printf("multi ");
+        printf("uint64");
+        prev = 1;
+    }
     if (e->Transform) {
         if (prev == 1)
             printf("%c", sep);

src/detect-filesize.c

@@ -66,7 +66,8 @@ void DetectFilesizeRegister(void)
     sigmatch_table[DETECT_FILESIZE].FileMatch = DetectFilesizeMatch;
     sigmatch_table[DETECT_FILESIZE].Setup = DetectFilesizeSetup;
     sigmatch_table[DETECT_FILESIZE].Free = DetectFilesizeFree;
-    sigmatch_table[DETECT_FILESIZE].flags = SIGMATCH_SUPPORT_DIR;
+    sigmatch_table[DETECT_FILESIZE].flags =
+            SIGMATCH_SUPPORT_DIR | SIGMATCH_INFO_UINT64 | SIGMATCH_INFO_MULTI_UINT;
 #ifdef UNITTESTS
     sigmatch_table[DETECT_FILESIZE].RegisterTests = DetectFilesizeRegisterTests;
 #endif

src/detect-flow-age.c

@@ -94,6 +94,7 @@ void DetectFlowAgeRegister(void)
     sigmatch_table[DETECT_FLOW_AGE].Match = DetectFlowAgeMatch;
     sigmatch_table[DETECT_FLOW_AGE].Setup = DetectFlowAgeSetup;
     sigmatch_table[DETECT_FLOW_AGE].Free = DetectFlowAgeFree;
+    sigmatch_table[DETECT_FLOW_AGE].flags = SIGMATCH_INFO_UINT32;
     sigmatch_table[DETECT_FLOW_AGE].SupportsPrefilter = PrefilterFlowAgeIsPrefilterable;
     sigmatch_table[DETECT_FLOW_AGE].SetupPrefilter = PrefilterSetupFlowAge;
 }

src/detect-flow-pkts.c

@@ -173,6 +173,7 @@ void DetectFlowPktsToServerRegister(void)
     sigmatch_table[DETECT_FLOW_PKTS_TO_SERVER].Match = DetectFlowPktsMatch;
     sigmatch_table[DETECT_FLOW_PKTS_TO_SERVER].Setup = DetectFlowPktsToServerSetup;
     sigmatch_table[DETECT_FLOW_PKTS_TO_SERVER].Free = DetectFlowPktsFree;
+    sigmatch_table[DETECT_FLOW_PKTS_TO_SERVER].flags = SIGMATCH_INFO_UINT32;
     sigmatch_table[DETECT_FLOW_PKTS_TO_SERVER].SupportsPrefilter = PrefilterFlowPktsIsPrefilterable;
     sigmatch_table[DETECT_FLOW_PKTS_TO_SERVER].SetupPrefilter = PrefilterSetupFlowPkts;
 }
@@ -186,6 +187,7 @@ void DetectFlowPktsToClientRegister(void)
     sigmatch_table[DETECT_FLOW_PKTS_TO_CLIENT].Match = DetectFlowPktsMatch;
     sigmatch_table[DETECT_FLOW_PKTS_TO_CLIENT].Setup = DetectFlowPktsToClientSetup;
     sigmatch_table[DETECT_FLOW_PKTS_TO_CLIENT].Free = DetectFlowPktsFree;
+    sigmatch_table[DETECT_FLOW_PKTS_TO_CLIENT].flags = SIGMATCH_INFO_UINT32;
     sigmatch_table[DETECT_FLOW_PKTS_TO_CLIENT].SupportsPrefilter = PrefilterFlowPktsIsPrefilterable;
     sigmatch_table[DETECT_FLOW_PKTS_TO_CLIENT].SetupPrefilter = PrefilterSetupFlowPkts;
 }
@@ -287,6 +289,7 @@ void DetectFlowBytesToServerRegister(void)
     sigmatch_table[DETECT_FLOW_BYTES_TO_SERVER].Match = DetectFlowBytesMatch;
     sigmatch_table[DETECT_FLOW_BYTES_TO_SERVER].Setup = DetectFlowBytesToServerSetup;
     sigmatch_table[DETECT_FLOW_BYTES_TO_SERVER].Free = DetectFlowBytesFree;
+    sigmatch_table[DETECT_FLOW_BYTES_TO_SERVER].flags = SIGMATCH_INFO_UINT64;
 }
 
 void DetectFlowBytesToClientRegister(void)
@@ -298,4 +301,5 @@ void DetectFlowBytesToClientRegister(void)
     sigmatch_table[DETECT_FLOW_BYTES_TO_CLIENT].Match = DetectFlowBytesMatch;
     sigmatch_table[DETECT_FLOW_BYTES_TO_CLIENT].Setup = DetectFlowBytesToClientSetup;
     sigmatch_table[DETECT_FLOW_BYTES_TO_CLIENT].Free = DetectFlowBytesFree;
+    sigmatch_table[DETECT_FLOW_BYTES_TO_CLIENT].flags = SIGMATCH_INFO_UINT64;
 }

src/detect-ftp-dynamic-port.c

@@ -103,6 +103,7 @@ void DetectFtpDynamicPortRegister(void)
     sigmatch_table[DETECT_FTP_DYNPORT].url = "/rules/" KEYWORD_DOC;
     sigmatch_table[DETECT_FTP_DYNPORT].Setup = DetectFtpDynamicPortSetup;
     sigmatch_table[DETECT_FTP_DYNPORT].Free = DetectFtpDynamicPortFree;
+    sigmatch_table[DETECT_FTP_DYNPORT].flags = SIGMATCH_INFO_UINT16;
     sigmatch_table[DETECT_FTP_DYNPORT].AppLayerTxMatch = DetectFtpDynamicPortMatch;
 
     DetectAppLayerInspectEngineRegister(

src/detect-http2.c

@@ -132,6 +132,8 @@ void DetectHttp2Register(void)
     sigmatch_table[DETECT_HTTP2_PRIORITY].AppLayerTxMatch = DetectHTTP2priorityMatch;
     sigmatch_table[DETECT_HTTP2_PRIORITY].Setup = DetectHTTP2prioritySetup;
     sigmatch_table[DETECT_HTTP2_PRIORITY].Free = DetectHTTP2priorityFree;
+    sigmatch_table[DETECT_HTTP2_PRIORITY].flags =
+            SIGMATCH_INFO_UINT8 | SIGMATCH_INFO_MULTI_UINT | SIGMATCH_INFO_MULTI_UINT;
 #ifdef UNITTESTS
     sigmatch_table[DETECT_HTTP2_PRIORITY].RegisterTests = DetectHTTP2priorityRegisterTests;
 #endif
@@ -143,6 +145,7 @@ void DetectHttp2Register(void)
     sigmatch_table[DETECT_HTTP2_WINDOW].AppLayerTxMatch = DetectHTTP2windowMatch;
     sigmatch_table[DETECT_HTTP2_WINDOW].Setup = DetectHTTP2windowSetup;
     sigmatch_table[DETECT_HTTP2_WINDOW].Free = DetectHTTP2windowFree;
+    sigmatch_table[DETECT_HTTP2_WINDOW].flags = SIGMATCH_INFO_UINT32 | SIGMATCH_INFO_MULTI_UINT;
 #ifdef UNITTESTS
     sigmatch_table[DETECT_HTTP2_WINDOW].RegisterTests = DetectHTTP2windowRegisterTests;
 #endif
@@ -154,6 +157,7 @@ void DetectHttp2Register(void)
     sigmatch_table[DETECT_HTTP2_SIZEUPDATE].AppLayerTxMatch = DetectHTTP2sizeUpdateMatch;
     sigmatch_table[DETECT_HTTP2_SIZEUPDATE].Setup = DetectHTTP2sizeUpdateSetup;
     sigmatch_table[DETECT_HTTP2_SIZEUPDATE].Free = DetectHTTP2sizeUpdateFree;
+    sigmatch_table[DETECT_HTTP2_SIZEUPDATE].flags = SIGMATCH_INFO_UINT64;
 #ifdef UNITTESTS
     sigmatch_table[DETECT_HTTP2_SIZEUPDATE].RegisterTests = DetectHTTP2sizeUpdateRegisterTests;
 #endif

src/detect-icmpv6-mtu.c

@@ -53,6 +53,7 @@ void DetectICMPv6mtuRegister(void)
     sigmatch_table[DETECT_ICMPV6MTU].Match = DetectICMPv6mtuMatch;
     sigmatch_table[DETECT_ICMPV6MTU].Setup = DetectICMPv6mtuSetup;
     sigmatch_table[DETECT_ICMPV6MTU].Free = DetectICMPv6mtuFree;
+    sigmatch_table[DETECT_ICMPV6MTU].flags = SIGMATCH_INFO_UINT32;
 #ifdef UNITTESTS
     sigmatch_table[DETECT_ICMPV6MTU].RegisterTests = DetectICMPv6mtuRegisterTests;
 #endif

src/detect-icode.c

@@ -70,6 +70,7 @@ void DetectICodeRegister (void)
 #endif
     sigmatch_table[DETECT_ICODE].SupportsPrefilter = PrefilterICodeIsPrefilterable;
     sigmatch_table[DETECT_ICODE].SetupPrefilter = PrefilterSetupICode;
+    sigmatch_table[DETECT_ICODE].flags = SIGMATCH_SUPPORT_FIREWALL | SIGMATCH_INFO_UINT8;
 }
 
 /**

src/detect-ike-exch-type.c

@@ -56,6 +56,7 @@ void DetectIkeExchTypeRegister(void)
     sigmatch_table[DETECT_IKE_EXCH_TYPE].AppLayerTxMatch = DetectIkeExchTypeMatch;
     sigmatch_table[DETECT_IKE_EXCH_TYPE].Setup = DetectIkeExchTypeSetup;
     sigmatch_table[DETECT_IKE_EXCH_TYPE].Free = DetectIkeExchTypeFree;
+    sigmatch_table[DETECT_IKE_EXCH_TYPE].flags = SIGMATCH_INFO_UINT8;
 
     DetectAppLayerInspectEngineRegister("ike.exchtype", ALPROTO_IKE, SIG_FLAG_TOSERVER, 1,
             DetectEngineInspectGenericList, NULL);

src/detect-ike-key-exchange-payload-length.c

@@ -59,6 +59,7 @@ void DetectIkeKeyExchangePayloadLengthRegister(void)
             DetectIkeKeyExchangePayloadLengthSetup;
     sigmatch_table[DETECT_IKE_KEY_EXCHANGE_PAYLOAD_LENGTH].Free =
             DetectIkeKeyExchangePayloadLengthFree;
+    sigmatch_table[DETECT_IKE_KEY_EXCHANGE_PAYLOAD_LENGTH].flags = SIGMATCH_INFO_UINT32;
 
     DetectAppLayerInspectEngineRegister("ike.key_exchange_payload_length", ALPROTO_IKE,
             SIG_FLAG_TOSERVER, 1, DetectEngineInspectGenericList, NULL);

src/detect-ike-nonce-payload-length.c

@@ -56,6 +56,7 @@ void DetectIkeNoncePayloadLengthRegister(void)
             DetectIkeNoncePayloadLengthMatch;
     sigmatch_table[DETECT_IKE_NONCE_PAYLOAD_LENGTH].Setup = DetectIkeNoncePayloadLengthSetup;
     sigmatch_table[DETECT_IKE_NONCE_PAYLOAD_LENGTH].Free = DetectIkeNoncePayloadLengthFree;
+    sigmatch_table[DETECT_IKE_NONCE_PAYLOAD_LENGTH].flags = SIGMATCH_INFO_UINT32;
 
     DetectAppLayerInspectEngineRegister("ike.nonce_payload_length", ALPROTO_IKE, SIG_FLAG_TOSERVER,
             1, DetectEngineInspectGenericList, NULL);

src/detect-itype.c

@@ -62,7 +62,7 @@ void DetectITypeRegister (void)
     sigmatch_table[DETECT_ITYPE].Match = DetectITypeMatch;
     sigmatch_table[DETECT_ITYPE].Setup = DetectITypeSetup;
     sigmatch_table[DETECT_ITYPE].Free = DetectITypeFree;
-    sigmatch_table[DETECT_ITYPE].flags = SIGMATCH_SUPPORT_FIREWALL;
+    sigmatch_table[DETECT_ITYPE].flags = SIGMATCH_SUPPORT_FIREWALL | SIGMATCH_INFO_UINT8;
 #ifdef UNITTESTS
     sigmatch_table[DETECT_ITYPE].RegisterTests = DetectITypeRegisterTests;
 #endif

src/detect-nfs-procedure.c

@@ -70,6 +70,7 @@ void DetectNfsProcedureRegister (void)
     sigmatch_table[DETECT_NFS_PROCEDURE].AppLayerTxMatch = DetectNfsProcedureMatch;
     sigmatch_table[DETECT_NFS_PROCEDURE].Setup = DetectNfsProcedureSetup;
     sigmatch_table[DETECT_NFS_PROCEDURE].Free = DetectNfsProcedureFree;
+    sigmatch_table[DETECT_NFS_PROCEDURE].flags = SIGMATCH_INFO_UINT32 | SIGMATCH_INFO_MULTI_UINT;
 #ifdef UNITTESTS
     sigmatch_table[DETECT_NFS_PROCEDURE].RegisterTests = DetectNfsProcedureRegisterTests;
 #endif

src/detect-nfs-version.c

@@ -68,6 +68,7 @@ void DetectNfsVersionRegister (void)
     sigmatch_table[DETECT_NFS_VERSION].AppLayerTxMatch = DetectNfsVersionMatch;
     sigmatch_table[DETECT_NFS_VERSION].Setup = DetectNfsVersionSetup;
     sigmatch_table[DETECT_NFS_VERSION].Free = DetectNfsVersionFree;
+    sigmatch_table[DETECT_NFS_VERSION].flags = SIGMATCH_INFO_UINT32;
     // unit tests were the same as DetectNfsProcedureRegisterTests
 
     g_nfs_request_buffer_id = DetectBufferTypeGetByName("nfs_request");

src/detect-tcp-wscale.c

@@ -54,7 +54,7 @@ void DetectTcpWscaleRegister(void)
     sigmatch_table[DETECT_TCP_WSCALE].Free = DetectTcpWscaleFree;
     sigmatch_table[DETECT_TCP_WSCALE].SupportsPrefilter = PrefilterTcpWscaleIsPrefilterable;
     sigmatch_table[DETECT_TCP_WSCALE].SetupPrefilter = PrefilterSetupTcpWscale;
-    sigmatch_table[DETECT_TCP_WSCALE].flags = SIGMATCH_SUPPORT_FIREWALL;
+    sigmatch_table[DETECT_TCP_WSCALE].flags = SIGMATCH_SUPPORT_FIREWALL | SIGMATCH_INFO_UINT8;
     sigmatch_table[DETECT_TCP_WSCALE].tables =
             (DETECT_TABLE_PACKET_PRE_FLOW_FLAG | DETECT_TABLE_PACKET_PRE_STREAM_FLAG |
                     DETECT_TABLE_PACKET_FILTER_FLAG | DETECT_TABLE_PACKET_TD_FLAG);

src/detect-tcpmss.c

@@ -56,6 +56,7 @@ void DetectTcpmssRegister(void)
     sigmatch_table[DETECT_TCPMSS].Match = DetectTcpmssMatch;
     sigmatch_table[DETECT_TCPMSS].Setup = DetectTcpmssSetup;
     sigmatch_table[DETECT_TCPMSS].Free = DetectTcpmssFree;
+    sigmatch_table[DETECT_TCPMSS].flags = SIGMATCH_INFO_UINT16;
     sigmatch_table[DETECT_TCPMSS].SupportsPrefilter = PrefilterTcpmssIsPrefilterable;
     sigmatch_table[DETECT_TCPMSS].SetupPrefilter = PrefilterSetupTcpmss;
 }

src/detect-template2.c

@@ -58,6 +58,7 @@ void DetectTemplate2Register(void)
     sigmatch_table[DETECT_TEMPLATE2].Free = DetectTemplate2Free;
     sigmatch_table[DETECT_TEMPLATE2].SupportsPrefilter = PrefilterTemplate2IsPrefilterable;
     sigmatch_table[DETECT_TEMPLATE2].SetupPrefilter = PrefilterSetupTemplate2;
+    sigmatch_table[DETECT_TEMPLATE2].flags = SIGMATCH_INFO_UINT8;
 }
 
 /**

src/detect-tls-certs.c

@@ -243,6 +243,7 @@ void DetectTlsCertChainLenRegister(void)
     sigmatch_table[KEYWORD_ID].AppLayerTxMatch = DetectTLSCertChainLenMatch;
     sigmatch_table[KEYWORD_ID].Setup = DetectTLSCertChainLenSetup;
     sigmatch_table[KEYWORD_ID].Free = DetectTLSCertChainLenFree;
+    sigmatch_table[KEYWORD_ID].flags = SIGMATCH_INFO_UINT32;
 
     g_tls_cert_buffer_id = DetectBufferTypeGetByName(BUFFER_NAME);
 }

src/detect-ttl.c

@@ -64,6 +64,7 @@ void DetectTtlRegister(void)
 #endif
     sigmatch_table[DETECT_TTL].SupportsPrefilter = PrefilterTtlIsPrefilterable;
     sigmatch_table[DETECT_TTL].SetupPrefilter = PrefilterSetupTtl;
+    sigmatch_table[DETECT_TTL].flags = SIGMATCH_INFO_UINT8;
 }
 
 /**

src/detect-vlan.c

@@ -137,6 +137,7 @@ void DetectVlanIdRegister(void)
     sigmatch_table[DETECT_VLAN_ID].Match = DetectVlanIdMatch;
     sigmatch_table[DETECT_VLAN_ID].Setup = DetectVlanIdSetup;
     sigmatch_table[DETECT_VLAN_ID].Free = DetectVlanIdFree;
+    sigmatch_table[DETECT_VLAN_ID].flags = SIGMATCH_INFO_UINT16 | SIGMATCH_INFO_MULTI_UINT;
     sigmatch_table[DETECT_VLAN_ID].SupportsPrefilter = PrefilterVlanIdIsPrefilterable;
     sigmatch_table[DETECT_VLAN_ID].SetupPrefilter = PrefilterSetupVlanId;
 }
@@ -216,4 +217,5 @@ void DetectVlanLayersRegister(void)
     sigmatch_table[DETECT_VLAN_LAYERS].Free = DetectVlanLayersFree;
     sigmatch_table[DETECT_VLAN_LAYERS].SupportsPrefilter = PrefilterVlanLayersIsPrefilterable;
     sigmatch_table[DETECT_VLAN_LAYERS].SetupPrefilter = PrefilterSetupVlanLayers;
+    sigmatch_table[DETECT_VLAN_LAYERS].flags = SIGMATCH_INFO_UINT8;
 }

src/detect.h

@@ -1682,6 +1682,16 @@ typedef struct SigGroupHead_ {
 #define SIGMATCH_SUPPORT_DIR BIT_U32(13)
 /** keyword is a multi buffer */
 #define SIGMATCH_INFO_MULTI_BUFFER BIT_U32(14)
+/** keyword is a unsigned 8-bit integer */
+#define SIGMATCH_INFO_UINT8 BIT_U32(15)
+/** keyword is a unsigned 16-bit integer */
+#define SIGMATCH_INFO_UINT16 BIT_U32(16)
+/** keyword is a unsigned 32-bit integer */
+#define SIGMATCH_INFO_UINT32 BIT_U32(17)
+/** keyword is a unsigned 64-bit integer */
+#define SIGMATCH_INFO_UINT64 BIT_U32(18)
+/** keyword is a multi uint */
+#define SIGMATCH_INFO_MULTI_UINT BIT_U32(19)
 
 enum DetectEngineTenantSelectors
 {