suricata
detect-engine-register.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2017 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  */
23 
24 #include "detect-smb-ntlmssp.h"
25 #include "suricata-common.h"
26 #include "suricata.h"
27 #include "detect.h"
28 #include "flow.h"
29 #include "flow-private.h"
30 #include "flow-bit.h"
31 
32 #include "detect-parse.h"
33 #include "detect-engine.h"
34 #include "detect-engine-profile.h"
35 
36 #include "detect-engine-alert.h"
37 #include "detect-engine-siggroup.h"
38 #include "detect-engine-address.h"
39 #include "detect-engine-proto.h"
40 #include "detect-engine-port.h"
41 #include "detect-engine-mpm.h"
42 #include "detect-engine-iponly.h"
45 
46 #include "rust.h"
47 
48 #include "detect-engine-payload.h"
50 #include "detect-dns-opcode.h"
51 #include "detect-dns-rcode.h"
52 #include "detect-dns-rrtype.h"
53 #include "detect-dns-query.h"
54 #include "detect-dns-answer-name.h"
55 #include "detect-dns-query-name.h"
56 #include "detect-tls-sni.h"
57 #include "detect-tls-certs.h"
59 #include "detect-tls-cert-issuer.h"
61 #include "detect-tls-cert-serial.h"
62 #include "detect-tls-random.h"
63 #include "detect-tls-ja3-hash.h"
64 #include "detect-tls-ja3-string.h"
65 #include "detect-tls-ja3s-hash.h"
66 #include "detect-tls-ja3s-string.h"
67 #include "detect-engine-state.h"
68 #include "detect-engine-analyzer.h"
69 
70 #include "detect-http-cookie.h"
71 #include "detect-http-method.h"
72 #include "detect-http-ua.h"
73 #include "detect-http-host.h"
74 
75 #include "detect-mark.h"
76 #include "detect-nfs-procedure.h"
77 #include "detect-nfs-version.h"
78 
79 #include "detect-engine-event.h"
80 #include "decode.h"
81 
82 #include "detect-config.h"
83 
84 #include "detect-smb-share.h"
85 #include "detect-smb-version.h"
86 
87 #include "detect-base64-decode.h"
88 #include "detect-base64-data.h"
89 #include "detect-ipaddr.h"
90 #include "detect-ipopts.h"
91 #include "detect-tcp-flags.h"
92 #include "detect-fragbits.h"
93 #include "detect-fragoffset.h"
94 #include "detect-gid.h"
95 #include "detect-tcp-ack.h"
96 #include "detect-tcp-seq.h"
97 #include "detect-content.h"
98 #include "detect-uricontent.h"
99 #include "detect-pcre.h"
100 #include "detect-depth.h"
101 #include "detect-nocase.h"
102 #include "detect-rawbytes.h"
103 #include "detect-bytetest.h"
104 #include "detect-bytemath.h"
105 #include "detect-bytejump.h"
106 #include "detect-sameip.h"
107 #include "detect-l3proto.h"
108 #include "detect-ipproto.h"
109 #include "detect-within.h"
110 #include "detect-distance.h"
111 #include "detect-offset.h"
112 #include "detect-sid.h"
113 #include "detect-prefilter.h"
114 #include "detect-priority.h"
115 #include "detect-classtype.h"
116 #include "detect-reference.h"
117 #include "detect-tag.h"
118 #include "detect-threshold.h"
119 #include "detect-metadata.h"
120 #include "detect-msg.h"
121 #include "detect-rev.h"
122 #include "detect-flow.h"
123 #include "detect-flow-age.h"
124 #include "detect-flow-pkts.h"
125 #include "detect-requires.h"
126 #include "detect-tcp-window.h"
127 #include "detect-ftpbounce.h"
128 #include "detect-isdataat.h"
129 #include "detect-id.h"
130 #include "detect-rpc.h"
131 #include "detect-asn1.h"
132 #include "detect-filename.h"
133 #include "detect-filestore.h"
134 #include "detect-filemagic.h"
135 #include "detect-filemd5.h"
136 #include "detect-filesha1.h"
137 #include "detect-filesha256.h"
138 #include "detect-filesize.h"
139 #include "detect-dataset.h"
140 #include "detect-datarep.h"
141 #include "detect-dsize.h"
142 #include "detect-flowvar.h"
143 #include "detect-flowint.h"
144 #include "detect-pktvar.h"
145 #include "detect-noalert.h"
146 #include "detect-flowbits.h"
147 #include "detect-hostbits.h"
148 #include "detect-xbits.h"
149 #include "detect-csum.h"
150 #include "detect-stream_size.h"
151 #include "detect-engine-sigorder.h"
152 #include "detect-ttl.h"
153 #include "detect-fast-pattern.h"
154 #include "detect-itype.h"
155 #include "detect-icode.h"
156 #include "detect-icmp-id.h"
157 #include "detect-icmp-seq.h"
158 #include "detect-icmpv4hdr.h"
159 #include "detect-dce-iface.h"
160 #include "detect-dce-opnum.h"
161 #include "detect-dce-stub-data.h"
162 #include "detect-urilen.h"
163 #include "detect-bsize.h"
164 #include "detect-detection-filter.h"
165 #include "detect-http-client-body.h"
166 #include "detect-http-server-body.h"
167 #include "detect-http-header.h"
169 #include "detect-http-headers.h"
170 #include "detect-http-raw-header.h"
171 #include "detect-http-uri.h"
172 #include "detect-http-protocol.h"
173 #include "detect-http-start.h"
174 #include "detect-http-stat-msg.h"
177 #include "detect-http2.h"
178 #include "detect-byte-extract.h"
179 #include "detect-file-data.h"
180 #include "detect-pkt-data.h"
181 #include "detect-replace.h"
182 #include "detect-tos.h"
183 #include "detect-app-layer-event.h"
184 #include "detect-lua.h"
185 #include "detect-iprep.h"
186 #include "detect-geoip.h"
188 #include "detect-template.h"
189 #include "detect-template2.h"
190 #include "detect-tcphdr.h"
191 #include "detect-tcpmss.h"
192 #include "detect-udphdr.h"
193 #include "detect-icmpv6hdr.h"
194 #include "detect-icmpv6-mtu.h"
195 #include "detect-ipv4hdr.h"
196 #include "detect-ipv6hdr.h"
197 #include "detect-krb5-cname.h"
198 #include "detect-krb5-errcode.h"
199 #include "detect-krb5-msgtype.h"
200 #include "detect-krb5-sname.h"
202 #include "detect-sip-method.h"
203 #include "detect-sip-uri.h"
204 #include "detect-sip-protocol.h"
205 #include "detect-sip-stat-code.h"
206 #include "detect-sip-stat-msg.h"
207 #include "detect-sip-request-line.h"
209 #include "detect-rfb-secresult.h"
210 #include "detect-rfb-sectype.h"
211 #include "detect-rfb-name.h"
212 #include "detect-target.h"
214 #include "detect-dhcp-leasetime.h"
217 #include "detect-snmp-usm.h"
218 #include "detect-snmp-version.h"
219 #include "detect-snmp-community.h"
220 #include "detect-snmp-pdu_type.h"
221 #include "detect-mqtt-type.h"
222 #include "detect-mqtt-flags.h"
223 #include "detect-mqtt-qos.h"
225 #include "detect-mqtt-reason-code.h"
238 #include "detect-quic-sni.h"
239 #include "detect-quic-ua.h"
240 #include "detect-quic-version.h"
241 #include "detect-quic-cyu-hash.h"
242 #include "detect-quic-cyu-string.h"
243 
244 #include "detect-bypass.h"
245 #include "detect-ftpdata.h"
247 
251 #include "detect-transform-md5.h"
252 #include "detect-transform-sha1.h"
253 #include "detect-transform-sha256.h"
257 #include "detect-transform-xor.h"
260 
261 #include "util-rule-vars.h"
262 
263 #include "app-layer.h"
264 #include "app-layer-protos.h"
265 #include "app-layer-htp.h"
266 #include "app-layer-smtp.h"
267 #include "detect-frame.h"
268 #include "detect-tls.h"
270 #include "detect-tls-version.h"
271 #include "detect-ssh-proto.h"
273 #include "detect-ssh-software.h"
275 #include "detect-ssh-hassh.h"
276 #include "detect-ssh-hassh-server.h"
277 #include "detect-ssh-hassh-string.h"
279 #include "detect-http-stat-code.h"
280 #include "detect-ssl-version.h"
281 #include "detect-ssl-state.h"
282 #include "detect-modbus.h"
283 #include "detect-cipservice.h"
284 #include "detect-dnp3.h"
285 #include "detect-ike-exch-type.h"
286 #include "detect-ike-spi.h"
287 #include "detect-ike-vendor.h"
288 #include "detect-ike-chosen-sa.h"
293 
294 #include "action-globals.h"
295 #include "tm-threads.h"
296 
297 #include "pkt-var.h"
298 
299 #include "conf.h"
300 #include "conf-yaml-loader.h"
301 
302 #include "stream-tcp.h"
303 #include "stream-tcp-inline.h"
304 
305 #include "util-lua.h"
306 #include "util-var-name.h"
308 #include "util-threshold-config.h"
309 #include "util-print.h"
310 #include "util-unittest.h"
311 #include "util-unittest-helper.h"
312 #include "util-debug.h"
313 #include "util-hashlist.h"
314 #include "util-privs.h"
315 #include "util-profiling.h"
316 #include "util-validate.h"
317 #include "util-optimize.h"
318 #include "util-path.h"
319 #include "util-mpm-ac.h"
320 #include "runmodes.h"
321 
322 static void PrintFeatureList(const SigTableElmt *e, char sep)
323 {
324  const uint16_t flags = e->flags;
325 
326  int prev = 0;
327  if (flags & SIGMATCH_NOOPT) {
328  printf("No option");
329  prev = 1;
330  }
332  if (prev == 1)
333  printf("%c", sep);
334  printf("compatible with IP only rule");
335  prev = 1;
336  }
338  if (prev == 1)
339  printf("%c", sep);
340  printf("compatible with decoder event only rule");
341  prev = 1;
342  }
344  if (prev == 1)
345  printf("%c", sep);
346  printf("content modifier");
347  prev = 1;
348  }
350  if (prev == 1)
351  printf("%c", sep);
352  printf("sticky buffer");
353  prev = 1;
354  }
355  if (e->Transform) {
356  if (prev == 1)
357  printf("%c", sep);
358  printf("transform");
359  prev = 1;
360  }
361  if (e->SupportsPrefilter) {
362  if (prev == 1)
363  printf("%c", sep);
364  printf("prefilter");
365  prev = 1;
366  }
367  if (prev == 0) {
368  printf("none");
369  }
370 }
371 
372 static void SigMultilinePrint(int i, const char *prefix)
373 {
374  if (sigmatch_table[i].desc) {
375  printf("%sDescription: %s\n", prefix, sigmatch_table[i].desc);
376  }
377  printf("%sFeatures: ", prefix);
378  PrintFeatureList(&sigmatch_table[i], ',');
379  if (sigmatch_table[i].url) {
380  printf("\n%sDocumentation: %s%s", prefix, GetDocURL(), sigmatch_table[i].url);
381  }
382  if (sigmatch_table[i].alternative) {
383  printf("\n%sReplaced by: %s", prefix, sigmatch_table[sigmatch_table[i].alternative].name);
384  }
385  printf("\n");
386 }
387 
388 int SigTableList(const char *keyword)
389 {
390  size_t size = sizeof(sigmatch_table) / sizeof(SigTableElmt);
391  size_t i;
392 
393  if (keyword == NULL) {
394  printf("=====Supported keywords=====\n");
395  for (i = 0; i < size; i++) {
396  const char *name = sigmatch_table[i].name;
397  if (name != NULL && strlen(name) > 0) {
398  if (name[0] == '_' || strcmp(name, "template") == 0)
399  continue;
400 
402  printf("- %s (not built-in)\n", name);
403  } else {
404  printf("- %s\n", name);
405  }
406  }
407  }
408  } else if (strcmp("csv", keyword) == 0) {
409  printf("name;description;app layer;features;documentation\n");
410  for (i = 0; i < size; i++) {
411  const char *name = sigmatch_table[i].name;
412  if (name != NULL && strlen(name) > 0) {
414  continue;
415  }
416  if (name[0] == '_' || strcmp(name, "template") == 0)
417  continue;
418 
419  printf("%s;", name);
420  if (sigmatch_table[i].desc) {
421  printf("%s", sigmatch_table[i].desc);
422  }
423  /* Build feature */
424  printf(";Unset;"); // this used to be alproto
425  PrintFeatureList(&sigmatch_table[i], ':');
426  printf(";");
427  if (sigmatch_table[i].url) {
428  printf("%s%s", GetDocURL(), sigmatch_table[i].url);
429  }
430  printf(";");
431  printf("\n");
432  }
433  }
434  } else if (strcmp("all", keyword) == 0) {
435  for (i = 0; i < size; i++) {
436  const char *name = sigmatch_table[i].name;
437  if (name != NULL && strlen(name) > 0) {
438  if (name[0] == '_' || strcmp(name, "template") == 0)
439  continue;
440  printf("%s:\n", sigmatch_table[i].name);
441  SigMultilinePrint(i, "\t");
442  }
443  }
444  } else {
445  for (i = 0; i < size; i++) {
446  if ((sigmatch_table[i].name != NULL) &&
447  strcmp(sigmatch_table[i].name, keyword) == 0) {
448  printf("= %s =\n", sigmatch_table[i].name);
450  printf("Not built-in\n");
451  return TM_ECODE_FAILED;
452  }
453  SigMultilinePrint(i, "");
454  return TM_ECODE_DONE;
455  }
456  }
457  printf("Non existing keyword\n");
458  return TM_ECODE_FAILED;
459  }
460  return TM_ECODE_DONE;
461 }
462 
463 static void DetectFileHandlerRegister(void)
464 {
465  for (int i = 0; i < DETECT_TBLSIZE; i++) {
466  if (filehandler_table[i].name)
468  }
469 }
470 
471 void SigTableSetup(void)
472 {
473  memset(sigmatch_table, 0, sizeof(sigmatch_table));
474 
489 
490  /* NOTE: the order of these currently affects inspect
491  * engine registration order and ultimately the order
492  * of inspect engines in the rule. Which in turn affects
493  * state keeping */
509 
517 
520 
524 
535 
544 
553 
558 
560  /* end of order dependent regs */
561 
563 
710 
713 
727 
728  DetectFileHandlerRegister();
729 
730  /* close keyword registration */
732 }
733 
734 #ifdef UNITTESTS
736 {
737  /* register the tests */
738  for (int i = 0; i < DETECT_TBLSIZE; i++) {
739  g_ut_modules++;
740  if (sigmatch_table[i].RegisterTests != NULL) {
742  g_ut_covered++;
743  } else {
744  SCLogDebug("detection plugin %s has no unittest "
745  "registration function.", sigmatch_table[i].name);
746 
747  if (coverage_unittests)
748  SCLogWarning("detection plugin %s has no unittest "
749  "registration function.",
750  sigmatch_table[i].name);
751  }
752  }
753 }
754 #endif
detect-mqtt-flags.h
detect-tcp-flags.h
detect-ssh-hassh-server-string.h
DetectSshVersionRegister
void DetectSshVersionRegister(void)
Registration function for keyword: ssh.protoversion.
Definition: detect-ssh-proto-version.c:78
DetectDceStubDataRegister
void DetectDceStubDataRegister(void)
Registers the keyword handlers for the "dce_stub_data" keyword.
Definition: detect-dce-stub-data.c:118
DetectFragBitsRegister
void DetectFragBitsRegister(void)
Registration function for fragbits: keyword.
Definition: detect-fragbits.c:85
DetectHttpHHRegister
void DetectHttpHHRegister(void)
Registers the keyword handlers for the "http_host" keyword.
Definition: detect-http-host.c:88
DetectITypeRegister
void DetectITypeRegister(void)
Registration function for itype: keyword.
Definition: detect-itype.c:57
detect-icmpv4hdr.h
DetectAppLayerEventRegister
void DetectAppLayerEventRegister(void)
Registers the keyword handlers for the "app-layer-event" keyword.
Definition: detect-app-layer-event.c:71
tm-threads.h
DetectDsizeRegister
void DetectDsizeRegister(void)
Registration function for dsize: keyword.
Definition: detect-dsize.c:61
DetectMQTTReasonCodeRegister
void DetectMQTTReasonCodeRegister(void)
Registration function for mqtt.reason_code: keyword.
Definition: detect-mqtt-reason-code.c:52
detect-transform-xor.h
detect-content.h
detect-target.h
DetectMsgRegister
void DetectMsgRegister(void)
Definition: detect-msg.c:42
detect-quic-cyu-string.h
DetectTlsJa3HashRegister
void DetectTlsJa3HashRegister(void)
Registration function for keyword: ja3_hash.
Definition: detect-tls-ja3-hash.c:73
DetectMQTTProtocolVersionRegister
void DetectMQTTProtocolVersionRegister(void)
Registration function for mqtt.protocol_version: keyword.
Definition: detect-mqtt-protocol-version.c:50
detect-ssh-hassh-string.h
DetectTemplateRegister
void DetectTemplateRegister(void)
Registration function for template: keyword.
Definition: detect-template.c:55
detect-engine.h
DetectTransformSha256Register
void DetectTransformSha256Register(void)
Definition: detect-transform-sha256.c:45
detect-app-layer-protocol.h
detect-dce-iface.h
SIGMATCH_INFO_STICKY_BUFFER
#define SIGMATCH_INFO_STICKY_BUFFER
Definition: detect.h:1497
DetectGeoipRegister
void DetectGeoipRegister(void)
Registration function for geoip keyword (no libgeoip support)
Definition: detect-geoip.c:54
detect-engine-proto.h
DetectNfsVersionRegister
void DetectNfsVersionRegister(void)
Registration function for nfs_procedure keyword.
Definition: detect-nfs-version.c:62
DetectXbitsRegister
void DetectXbitsRegister(void)
Definition: detect-xbits.c:68
DetectTlsJa3SHashRegister
void DetectTlsJa3SHashRegister(void)
Registration function for keyword: ja3s.hash.
Definition: detect-tls-ja3s-hash.c:73
detect-dsize.h
DetectRevRegister
void DetectRevRegister(void)
Definition: detect-rev.c:34
detect-noalert.h
detect-gid.h
DetectIkeExchTypeRegister
void DetectIkeExchTypeRegister(void)
Registration function for ike.exchtype keyword.
Definition: detect-ike-exch-type.c:50
DetectConfigRegister
void DetectConfigRegister(void)
Registration function for keyword: filestore.
Definition: detect-config.c:76
stream-tcp-inline.h
DetectRfbSecresultRegister
void DetectRfbSecresultRegister(void)
Registration function for rfb.secresult: keyword.
Definition: detect-rfb-secresult.c:57
detect-priority.h
util-hashlist.h
DetectTcpmssRegister
void DetectTcpmssRegister(void)
Registration function for tcpmss: keyword.
Definition: detect-tcpmss.c:51
detect-sip-request-line.h
detect-filesha1.h
g_ut_modules
int g_ut_modules
Definition: suricata.c:883
detect-sid.h
DetectTlsSerialRegister
void DetectTlsSerialRegister(void)
Registration function for keyword: tls.cert_serial.
Definition: detect-tls-cert-serial.c:72
detect-engine-siggroup.h
SIGMATCH_INFO_CONTENT_MODIFIER
#define SIGMATCH_INFO_CONTENT_MODIFIER
Definition: detect.h:1495
DetectSidRegister
void DetectSidRegister(void)
Definition: detect-sid.c:40
DetectIkeNonceRegister
void DetectIkeNonceRegister(void)
Definition: detect-ike-nonce-payload.c:92
SigTableElmt_::name
const char * name
Definition: detect.h:1293
DetectSshSoftwareVersionRegister
void DetectSshSoftwareVersionRegister(void)
Registration function for keyword: ssh.softwareversion.
Definition: detect-ssh-software-version.c:83
stream-tcp.h
detect-template-rust-buffer.h
detect-engine-event.h
detect-tls-cert-validity.h
detect-mark.h
detect-pktvar.h
detect-nfs-version.h
DetectMQTTQosRegister
void DetectMQTTQosRegister(void)
Registration function for mqtt.qos: keyword.
Definition: detect-mqtt-qos.c:49
detect-dhcp-rebinding-time.h
DetectQuicCyuHashRegister
void DetectQuicCyuHashRegister(void)
Definition: detect-quic-cyu-hash.c:221
detect-mqtt-connect-username.h
DetectTlsFingerprintRegister
void DetectTlsFingerprintRegister(void)
Registration function for keyword: tls.cert_fingerprint.
Definition: detect-tls-cert-fingerprint.c:72
DetectSmbNtlmsspDomainRegister
void DetectSmbNtlmsspDomainRegister(void)
Definition: detect-smb-ntlmssp.c:134
DetectHttpServerBodyRegister
void DetectHttpServerBodyRegister(void)
Registers the keyword handlers for the "http_server_body" keyword.
Definition: detect-http-server-body.c:68
detect-tls-cert-fingerprint.h
DetectMQTTSubscribeTopicRegister
void DetectMQTTSubscribeTopicRegister(void)
Registration function for keyword: mqtt.subscribe.topic.
Definition: detect-mqtt-subscribe-topic.c:186
DetectMQTTConnectProtocolStringRegister
void DetectMQTTConnectProtocolStringRegister(void)
Definition: detect-mqtt-connect-protocol-string.c:72
DetectHttpHeadersRegister
void DetectHttpHeadersRegister(void)
Definition: detect-http-headers.c:29
DetectHttpStartRegister
void DetectHttpStartRegister(void)
Registers the keyword handlers for the "http_start" keyword.
Definition: detect-http-start.c:182
DetectDNP3Register
void DetectDNP3Register(void)
Definition: detect-dnp3.c:546
DetectHttpUriRegister
void DetectHttpUriRegister(void)
Registration function for keywords: http_uri and http.uri.
Definition: detect-http-uri.c:89
DetectGidRegister
void DetectGidRegister(void)
Registration function for gid: keyword.
Definition: detect-gid.c:48
detect-ike-nonce-payload-length.h
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
DetectHttpRequestHeaderRegister
void DetectHttpRequestHeaderRegister(void)
Definition: detect-http-header.c:783
detect-transform-strip-whitespace.h
detect-isdataat.h
detect-ssh-software.h
DetectQuicUaRegister
void DetectQuicUaRegister(void)
Registration function for quic.ua: keyword.
Definition: detect-quic-ua.c:72
DetectMQTTConnectUsernameRegister
void DetectMQTTConnectUsernameRegister(void)
Definition: detect-mqtt-connect-username.c:72
DetectIPProtoRegister
void DetectIPProtoRegister(void)
Registration function for ip_proto keyword.
Definition: detect-ipproto.c:60
SigTableSetup
void SigTableSetup(void)
Definition: detect-engine-register.c:471
DetectMQTTConnectClientIDRegister
void DetectMQTTConnectClientIDRegister(void)
Definition: detect-mqtt-connect-clientid.c:72
detect-classtype.h
detect-smb-share.h
util-lua.h
DetectICMPv6hdrRegister
void DetectICMPv6hdrRegister(void)
Registration function for icmpv6.hdr: keyword.
Definition: detect-icmpv6hdr.c:51
DetectSshHasshRegister
void DetectSshHasshRegister(void)
Registration function for hassh keyword.
Definition: detect-ssh-hassh.c:193
DetectTlsJa3StringRegister
void DetectTlsJa3StringRegister(void)
Registration function for keyword: ja3.string.
Definition: detect-tls-ja3-string.c:69
TM_ECODE_DONE
@ TM_ECODE_DONE
Definition: tm-threads-common.h:86
detect-bsize.h
action-globals.h
DetectTlsRandomRegister
void DetectTlsRandomRegister(void)
Registration function for keyword: tls.random.
Definition: detect-tls-random.c:112
DetectPriorityRegister
void DetectPriorityRegister(void)
Registers the handler functions for the "priority" keyword.
Definition: detect-priority.c:49
detect-smb-ntlmssp.h
DetectDceIfaceRegister
void DetectDceIfaceRegister(void)
Registers the keyword handlers for the "dce_iface" keyword.
Definition: detect-dce-iface.c:69
DETECT_TBLSIZE
@ DETECT_TBLSIZE
Definition: detect-engine-register.h:352
flow-private.h
DetectFilesizeRegister
void DetectFilesizeRegister(void)
Registration function for filesize: keyword.
Definition: detect-filesize.c:61
DetectHttpProtocolRegister
void DetectHttpProtocolRegister(void)
Registers the keyword handlers for the "http.protocol" keyword.
Definition: detect-http-protocol.c:134
detect-rfb-sectype.h
DetectFragOffsetRegister
void DetectFragOffsetRegister(void)
Registration function for fragoffset.
Definition: detect-fragoffset.c:60
DetectRpcRegister
void DetectRpcRegister(void)
Registration function for rpc keyword.
Definition: detect-rpc.c:61
detect-tcpmss.h
SigTableElmt_::flags
uint16_t flags
Definition: detect.h:1287
DetectMQTTUnsubscribeTopicRegister
void DetectMQTTUnsubscribeTopicRegister(void)
Registration function for keyword: mqtt.unsubscribe.topic.
Definition: detect-mqtt-unsubscribe-topic.c:186
DetectSameipRegister
void DetectSameipRegister(void)
Registration function for sameip: keyword.
Definition: detect-sameip.c:51
detect-template2.h
DetectSmbVersionRegister
void DetectSmbVersionRegister(void)
Registers the keyword handlers for the "smb_version" keyword.
Definition: detect-smb-version.c:136
detect-ftpbounce.h
detect-transform-sha256.h
DetectFileRegisterFileProtocols
void DetectFileRegisterFileProtocols(DetectFileHandlerTableElmt *reg)
Definition: detect-parse.c:79
detect-ssh-hassh-server.h
detect-dns-opcode.h
g_ut_covered
int g_ut_covered
Definition: suricata.c:884
DetectSshHasshStringRegister
void DetectSshHasshStringRegister(void)
Registration function for hassh.string keyword.
Definition: detect-ssh-hassh-string.c:123
detect-mqtt-connect-protocol-string.h
DetectIcmpv4HdrRegister
void DetectIcmpv4HdrRegister(void)
Registration function for icmpv4.hdr: keyword.
Definition: detect-icmpv4hdr.c:46
detect-tls-ja3-string.h
detect-filemd5.h
DetectTransformDotPrefixRegister
void DetectTransformDotPrefixRegister(void)
Definition: detect-transform-dotprefix.c:46
SIGMATCH_DEONLY_COMPAT
#define SIGMATCH_DEONLY_COMPAT
Definition: detect.h:1477
detect-tls-random.h
detect-tcp-seq.h
detect-http-header.h
detect-lua.h
detect-flowint.h
DetectSipRequestLineRegister
void DetectSipRequestLineRegister(void)
Definition: detect-sip-request-line.c:94
DetectTransformToLowerRegister
void DetectTransformToLowerRegister(void)
Definition: detect-transform-casechange.c:160
flow-bit.h
DetectTcphdrRegister
void DetectTcphdrRegister(void)
Registration function for tcp.hdr: keyword.
Definition: detect-tcphdr.c:50
util-var-name.h
detect-dnp3.h
rust.h
detect-http-client-body.h
DetectFlowBytesToClientRegister
void DetectFlowBytesToClientRegister(void)
Definition: detect-flow-pkts.c:205
DetectDatarepRegister
void DetectDatarepRegister(void)
Definition: detect-datarep.c:52
DetectFlowBytesToServerRegister
void DetectFlowBytesToServerRegister(void)
Definition: detect-flow-pkts.c:249
detect-file-data.h
detect-mqtt-subscribe-topic.h
util-privs.h
DetectHostbitsRegister
void DetectHostbitsRegister(void)
Definition: detect-hostbits.c:80
detect-flow-age.h
DetectTlsValidityRegister
void DetectTlsValidityRegister(void)
Registration function for tls validity keywords.
Definition: detect-tls-cert-validity.c:80
DetectIpOptsRegister
void DetectIpOptsRegister(void)
Registration function for ipopts: keyword.
Definition: detect-ipopts.c:56
DetectSshHasshServerRegister
void DetectSshHasshServerRegister(void)
Registration function for hasshServer keyword.
Definition: detect-ssh-hassh-server.c:191
detect-icmpv6-mtu.h
DetectDnsAnswerNameRegister
void DetectDnsAnswerNameRegister(void)
Definition: detect-dns-answer-name.c:145
detect-rev.h
DetectUricontentRegister
void DetectUricontentRegister(void)
Registration function for uricontent: keyword.
Definition: detect-uricontent.c:67
detect-tag.h
detect-ftpdata.h
detect-tls-sni.h
detect-engine-payload.h
DetectMetadataRegister
void DetectMetadataRegister(void)
Definition: detect-metadata.c:44
detect-l3proto.h
DetectSipResponseLineRegister
void DetectSipResponseLineRegister(void)
Definition: detect-sip-response-line.c:94
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:85
SigTableElmt_
element in sigmatch type table.
Definition: detect.h:1259
DetectRfbSectypeRegister
void DetectRfbSectypeRegister(void)
Registration function for rfb.sectype keyword.
Definition: detect-rfb-sectype.c:48
DetectDHCPLeaseTimeRegister
void DetectDHCPLeaseTimeRegister(void)
Registration function for dhcp.procedure keyword.
Definition: detect-dhcp-leasetime.c:111
detect-pcre.h
DetectMQTTConnectPasswordRegister
void DetectMQTTConnectPasswordRegister(void)
Definition: detect-mqtt-connect-password.c:72
DetectHttpHeaderNamesRegister
void DetectHttpHeaderNamesRegister(void)
Registers the keyword handlers for the "http.header_names" keyword.
Definition: detect-http-header-names.c:211
detect-depth.h
detect-engine-prefilter.h
detect-icmpv6hdr.h
DetectFilemagicRegister
void DetectFilemagicRegister(void)
Registration function for keyword: filemagic.
Definition: detect-filemagic.c:73
DetectDnsRrtypeRegister
void DetectDnsRrtypeRegister(void)
Definition: detect-dns-rrtype.c:68
util-unittest.h
DetectTlsSniRegister
void DetectTlsSniRegister(void)
Registration function for keyword: tls.sni.
Definition: detect-tls-sni.c:65
DetectTargetRegister
void DetectTargetRegister(void)
Registration function for target keyword.
Definition: detect-target.c:51
DetectBufferTypeCloseRegistration
void DetectBufferTypeCloseRegistration(void)
Definition: detect-engine.c:1831
SIGMATCH_NOT_BUILT
#define SIGMATCH_NOT_BUILT
Definition: detect.h:1479
detect-filename.h
util-unittest-helper.h
detect-mqtt-connect-password.h
detect-stream_size.h
DetectSipStatMsgRegister
void DetectSipStatMsgRegister(void)
Definition: detect-sip-stat-msg.c:97
detect-http-ua.h
detect-asn1.h
DetectMQTTConnectWillMessageRegister
void DetectMQTTConnectWillMessageRegister(void)
Definition: detect-mqtt-connect-willmessage.c:72
detect-flowvar.h
detect-base64-data.h
detect-krb5-errcode.h
SigTableRegisterTests
void SigTableRegisterTests(void)
Definition: detect-engine-register.c:735
detect-udphdr.h
detect-http-protocol.h
detect-reference.h
DetectHttpResponseHeaderRegister
void DetectHttpResponseHeaderRegister(void)
Definition: detect-http-header.c:820
detect-rpc.h
detect-sameip.h
detect-dce-stub-data.h
detect-dns-query.h
DetectTransformStripWhitespaceRegister
void DetectTransformStripWhitespaceRegister(void)
Definition: detect-transform-strip-whitespace.c:45
DetectSeqRegister
void DetectSeqRegister(void)
Registration function for ack: keyword.
Definition: detect-tcp-seq.c:53
DetectAsn1Register
void DetectAsn1Register(void)
Registration function for asn1.
Definition: detect-asn1.c:48
DetectFlowAgeRegister
void DetectFlowAgeRegister(void)
Definition: detect-flow-age.c:86
detect-krb5-msgtype.h
DetectBsizeRegister
void DetectBsizeRegister(void)
Registration function for bsize: keyword.
Definition: detect-bsize.c:98
DetectSmbShareRegister
void DetectSmbShareRegister(void)
Definition: detect-smb-share.c:139
app-layer-htp.h
detect-xbits.h
DetectFlowPktsToClientRegister
void DetectFlowPktsToClientRegister(void)
Definition: detect-flow-pkts.c:86
DetectDnsRcodeRegister
void DetectDnsRcodeRegister(void)
Definition: detect-dns-rcode.c:68
detect-app-layer-event.h
DetectBytejumpRegister
void DetectBytejumpRegister(void)
Definition: detect-bytejump.c:72
detect-ike-nonce-payload.h
decode.h
DetectICMPv6mtuRegister
void DetectICMPv6mtuRegister(void)
Registration function for icmpv6.mtu: keyword.
Definition: detect-icmpv6-mtu.c:48
detect-ssh-hassh.h
util-debug.h
detect-transform-pcrexform.h
detect-http-header-names.h
detect-transform-compress-whitespace.h
DetectTlsVersionRegister
void DetectTlsVersionRegister(void)
Registration function for keyword: tls.version.
Definition: detect-tls-version.c:73
DetectReplaceRegister
void DetectReplaceRegister(void)
Definition: detect-replace.c:70
detect-detection-filter.h
DetectICodeRegister
void DetectICodeRegister(void)
Registration function for icode: keyword.
Definition: detect-icode.c:60
detect-iprep.h
detect-rawbytes.h
DetectWindowRegister
void DetectWindowRegister(void)
Registration function for window: keyword.
Definition: detect-tcp-window.c:59
detect-http2.h
DetectL3ProtoRegister
void DetectL3ProtoRegister(void)
Registration function for ip_proto keyword.
Definition: detect-l3proto.c:54
detect-fragbits.h
DetectKrb5ErrCodeRegister
void DetectKrb5ErrCodeRegister(void)
Registration function for krb5_err_code: keyword.
Definition: detect-krb5-errcode.c:59
detect-ipv6hdr.h
DetectWithinRegister
void DetectWithinRegister(void)
Definition: detect-within.c:52
DetectContentRegister
void DetectContentRegister(void)
Definition: detect-content.c:58
detect-http-response-line.h
detect-tos.h
util-print.h
DetectSshProtocolRegister
void DetectSshProtocolRegister(void)
Definition: detect-ssh-proto.c:95
detect-filemagic.h
detect-transform-md5.h
detect-engine-mpm.h
DetectIcmpIdRegister
void DetectIcmpIdRegister(void)
Registration function for icode: icmp_id.
Definition: detect-icmp-id.c:59
detect.h
DetectSslStateRegister
void DetectSslStateRegister(void)
Registers the keyword handlers for the "ssl_state" keyword.
Definition: detect-ssl-state.c:73
detect-http-start.h
DetectLuaRegister
void DetectLuaRegister(void)
Registration function for keyword: lua.
Definition: detect-lua.c:77
pkt-var.h
DetectIkeVendorRegister
void DetectIkeVendorRegister(void)
Registration function for ike.vendor keyword.
Definition: detect-ike-vendor.c:172
detect-quic-version.h
DetectFiledataRegister
void DetectFiledataRegister(void)
Registration function for keyword: file_data.
Definition: detect-file-data.c:71
detect-prefilter.h
DetectIpv6hdrRegister
void DetectIpv6hdrRegister(void)
Registration function for ipv6.hdr: keyword.
Definition: detect-ipv6hdr.c:50
DetectIkeKeyExchangeRegister
void DetectIkeKeyExchangeRegister(void)
Definition: detect-ike-key-exchange-payload.c:92
detect-http-uri.h
detect-tcp-window.h
detect-transform-strip-pseudo-headers.h
detect-engine-port.h
DetectIcmpSeqRegister
void DetectIcmpSeqRegister(void)
Registration function for icmp_seq.
Definition: detect-icmp-seq.c:58
DetectIdRegister
void DetectIdRegister(void)
Registration function for keyword: id.
Definition: detect-id.c:65
DetectHttpUARegister
void DetectHttpUARegister(void)
Registers the keyword handlers for the "http_user_agent" keyword.
Definition: detect-http-ua.c:79
detect-ike-vendor.h
detect-mqtt-unsubscribe-topic.h
detect-mqtt-publish-topic.h
DetectRfbNameRegister
void DetectRfbNameRegister(void)
Definition: detect-rfb-name.c:91
SCLogWarning
#define SCLogWarning(...)
Macro used to log WARNING messages.
Definition: util-debug.h:249
detect-itype.h
DetectFlowPktsToServerRegister
void DetectFlowPktsToServerRegister(void)
Definition: detect-flow-pkts.c:159
detect-requires.h
detect-engine-profile.h
detect-sip-protocol.h
DetectPktDataRegister
void DetectPktDataRegister(void)
Registration function for keyword: file_data.
Definition: detect-pkt-data.c:53
util-profiling.h
detect-mqtt-connack-sessionpresent.h
DetectMQTTTypeRegister
void DetectMQTTTypeRegister(void)
Registration function for mqtt.type: keyword.
Definition: detect-mqtt-type.c:48
util-rule-vars.h
DetectRequiresRegister
void DetectRequiresRegister(void)
Definition: detect-requires.c:44
detect-frame.h
DetectFlowbitsRegister
void DetectFlowbitsRegister(void)
Definition: detect-flowbits.c:64
DetectDnsQueryNameRegister
void DetectDnsQueryNameRegister(void)
Definition: detect-dns-query-name.c:145
DetectDatasetRegister
void DetectDatasetRegister(void)
Definition: detect-dataset.c:49
DetectUdphdrRegister
void DetectUdphdrRegister(void)
Registration function for udp.hdr: keyword.
Definition: detect-udphdr.c:49
conf-yaml-loader.h
DetectBytetestRegister
void DetectBytetestRegister(void)
Definition: detect-bytetest.c:77
DetectDHCPRenewalTimeRegister
void DetectDHCPRenewalTimeRegister(void)
Registration function for dhcp.procedure keyword.
Definition: detect-dhcp-renewal-time.c:111
detect-modbus.h
DetectDepthRegister
void DetectDepthRegister(void)
Definition: detect-depth.c:48
detect-bytejump.h
detect-snmp-usm.h
detect-id.h
conf.h
detect-engine-alert.h
detect-dns-answer-name.h
DetectSipMethodRegister
void DetectSipMethodRegister(void)
Definition: detect-sip-method.c:128
detect-ike-spi.h
detect-ipproto.h
DetectTransformPcrexformRegister
void DetectTransformPcrexformRegister(void)
Definition: detect-transform-pcrexform.c:46
DetectDHCPRebindingTimeRegister
void DetectDHCPRebindingTimeRegister(void)
Registration function for dhcp.procedure keyword.
Definition: detect-dhcp-rebinding-time.c:111
detect-krb5-ticket-encryption.h
detect-nfs-procedure.h
detect-engine-state.h
Data structures and function prototypes for keeping state for the detection engine.
detect-filestore.h
detect-http-stat-code.h
detect-replace.h
detect-krb5-cname.h
DetectMarkRegister
void DetectMarkRegister(void)
Registration function for nfq_set_mark: keyword.
Definition: detect-mark.c:56
DetectReferenceRegister
void DetectReferenceRegister(void)
Registration function for the reference: keyword.
Definition: detect-reference.c:58
detect-sip-method.h
DetectFileSha256Register
void DetectFileSha256Register(void)
Registration function for keyword: filesha256.
Definition: detect-filesha256.c:44
DetectPrefilterRegister
void DetectPrefilterRegister(void)
Definition: detect-prefilter.c:37
util-mpm-ac.h
detect-krb5-sname.h
DetectTlsCertsRegister
void DetectTlsCertsRegister(void)
Registration function for keyword: tls.certs.
Definition: detect-tls-certs.c:85
DetectFtpbounceRegister
void DetectFtpbounceRegister(void)
Registration function for ftpbounce: keyword.
Definition: detect-ftpbounce.c:61
detect-flowbits.h
detect-dhcp-renewal-time.h
runmodes.h
DetectKrb5TicketEncryptionRegister
void DetectKrb5TicketEncryptionRegister(void)
Definition: detect-krb5-ticket-encryption.c:68
detect-ssl-version.h
detect-offset.h
DetectOffsetRegister
void DetectOffsetRegister(void)
Definition: detect-offset.c:46
detect-nocase.h
detect-http-host.h
detect-fragoffset.h
detect-dhcp-leasetime.h
detect-ttl.h
detect-sip-stat-code.h
detect-transform-dotprefix.h
detect-mqtt-connect-willmessage.h
DetectSshSoftwareRegister
void DetectSshSoftwareRegister(void)
Definition: detect-ssh-software.c:96
DetectQuicSniRegister
void DetectQuicSniRegister(void)
Registration function for quic.sni: keyword.
Definition: detect-quic-sni.c:72
DetectSipProtocolRegister
void DetectSipProtocolRegister(void)
Definition: detect-sip-protocol.c:94
detect-engine-analyzer.h
detect-rfb-secresult.h
DetectSipUriRegister
void DetectSipUriRegister(void)
Definition: detect-sip-uri.c:107
detect-engine-content-inspection.h
detect-quic-cyu-hash.h
detect-http-server-body.h
detect-mqtt-publish-message.h
detect-ssh-software-version.h
detect-bypass.h
DetectBypassRegister
void DetectBypassRegister(void)
Registration function for keyword: bypass.
Definition: detect-bypass.c:59
DetectAckRegister
void DetectAckRegister(void)
Registration function for ack: keyword.
Definition: detect-tcp-ack.c:56
DetectFilestoreRegister
void DetectFilestoreRegister(void)
Registration function for keyword: filestore.
Definition: detect-filestore.c:79
detect-mqtt-type.h
DetectTlsRegister
void DetectTlsRegister(void)
Registration function for keyword: tls.version.
Definition: detect-tls.c:101
DetectTagRegister
void DetectTagRegister(void)
Registration function for keyword tag.
Definition: detect-tag.c:69
DetectHttpResponseLineRegister
void DetectHttpResponseLineRegister(void)
Registers the keyword handlers for the "http_response_line" keyword.
Definition: detect-http-response-line.c:99
detect-ike-key-exchange-payload.h
detect-fast-pattern.h
DetectTlsIssuerRegister
void DetectTlsIssuerRegister(void)
Registration function for keyword: tls.cert_issuer.
Definition: detect-tls-cert-issuer.c:68
DetectTransformUrlDecodeRegister
void DetectTransformUrlDecodeRegister(void)
Definition: detect-transform-urldecode.c:45
DetectSmbNtlmsspUserRegister
void DetectSmbNtlmsspUserRegister(void)
Definition: detect-smb-ntlmssp.c:77
detect-mqtt-qos.h
detect-ssh-proto-version.h
DetectBase64DataRegister
void DetectBase64DataRegister(void)
Definition: detect-base64-data.c:33
flags
uint8_t flags
Definition: decode-gre.h:0
DetectHttpStatCodeRegister
void DetectHttpStatCodeRegister(void)
Registration function for keyword: http_stat_code.
Definition: detect-http-stat-code.c:81
DetectDceOpnumRegister
void DetectDceOpnumRegister(void)
Registers the keyword handlers for the "dce_opnum" keyword.
Definition: detect-dce-opnum.c:70
detect-dns-rcode.h
DetectKrb5CNameRegister
void DetectKrb5CNameRegister(void)
Definition: detect-krb5-cname.c:181
DetectHttpHeaderRegister
void DetectHttpHeaderRegister(void)
Registers the keyword handlers for the "http_header" keyword.
Definition: detect-http-header.c:411
detect-transform-casechange.h
detect-tls.h
suricata-common.h
DetectMQTTFlagsRegister
void DetectMQTTFlagsRegister(void)
Registration function for mqtt.flags: keyword.
Definition: detect-mqtt-flags.c:55
detect-dns-rrtype.h
detect-smb-version.h
DetectCipServiceRegister
void DetectCipServiceRegister(void)
Registration function for cip_service: keyword.
Definition: detect-cipservice.c:53
util-path.h
detect-mqtt-reason-code.h
detect-byte-extract.h
detect-metadata.h
DetectKrb5SNameRegister
void DetectKrb5SNameRegister(void)
Definition: detect-krb5-sname.c:181
detect-sip-response-line.h
sigmatch_table
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
Definition: detect-parse.c:127
SigTableElmt_::Transform
void(* Transform)(InspectionBuffer *, void *context)
Definition: detect.h:1274
DetectHttpClientBodyRegister
void DetectHttpClientBodyRegister(void)
Registers the keyword handlers for the "http_client_body" keyword.
Definition: detect-http-client-body.c:84
DetectIkeSpiRegister
void DetectIkeSpiRegister(void)
Definition: detect-ike-spi.c:130
detect-http-headers.h
DetectDnsOpcodeRegister
void DetectDnsOpcodeRegister(void)
Definition: detect-dns-opcode.c:73
DetectCsumRegister
void DetectCsumRegister(void)
Registers handlers for all the checksum keywords. The checksum keywords that are registered are ipv4-...
Definition: detect-csum.c:139
DetectTransformSha1Register
void DetectTransformSha1Register(void)
Definition: detect-transform-sha1.c:45
DetectUrilenRegister
void DetectUrilenRegister(void)
Registration function for urilen: keyword.
Definition: detect-urilen.c:61
detect-tls-cert-subject.h
detect-sip-stat-msg.h
DetectIkeNoncePayloadLengthRegister
void DetectIkeNoncePayloadLengthRegister(void)
Registration function for ike.nonce_payload_length keyword.
Definition: detect-ike-nonce-payload-length.c:49
detect-tls-version.h
detect-dataset.h
detect-template.h
util-classification-config.h
DetectHttp2Register
void DetectHttp2Register(void)
Registration function for HTTP2 keywords.
Definition: detect-http2.c:106
detect-rfb-name.h
DetectNfsProcedureRegister
void DetectNfsProcedureRegister(void)
Registration function for nfs_procedure keyword.
Definition: detect-nfs-procedure.c:64
DetectIpv4hdrRegister
void DetectIpv4hdrRegister(void)
Registration function for ipv4.hdr: keyword.
Definition: detect-ipv4hdr.c:50
DetectHttpRequestLineRegister
void DetectHttpRequestLineRegister(void)
Registers the keyword handlers for the "http_request_line" keyword.
Definition: detect-http-request-line.c:99
DetectFileSha1Register
void DetectFileSha1Register(void)
Registration function for keyword: filesha1.
Definition: detect-filesha1.c:44
DetectFlowRegister
void DetectFlowRegister(void)
Registration function for flow: keyword.
Definition: detect-flow.c:65
DetectDnsQueryRegister
void DetectDnsQueryRegister(void)
Registration function for keyword: dns_query.
Definition: detect-dns-query.c:193
DetectEnipCommandRegister
void DetectEnipCommandRegister(void)
Registration function for enip_command: keyword.
Definition: detect-cipservice.c:299
detect-hostbits.h
DetectSshHasshServerStringRegister
void DetectSshHasshServerStringRegister(void)
Registration function for hasshServer.string keyword.
Definition: detect-ssh-hassh-server-string.c:123
DetectRawbytesRegister
void DetectRawbytesRegister(void)
Definition: detect-rawbytes.c:43
detect-sip-uri.h
detect-snmp-version.h
DetectTosRegister
void DetectTosRegister(void)
Register Tos keyword.
Definition: detect-tos.c:64
util-optimize.h
detect-ike-exch-type.h
detect-tls-certs.h
util-validate.h
DetectBytemathRegister
void DetectBytemathRegister(void)
Registers the keyword handlers for the "byte_math" keyword.
Definition: detect-bytemath.c:70
detect-flow.h
detect-quic-ua.h
detect-base64-decode.h
DetectEngineEventRegister
void DetectEngineEventRegister(void)
Registration function for decode-event: keyword.
Definition: detect-engine-event.c:62
DetectFlagsRegister
void DetectFlagsRegister(void)
Registration function for flags: keyword.
Definition: detect-tcp-flags.c:75
detect-http-raw-header.h
detect-engine-sigorder.h
detect-quic-sni.h
DetectKrb5MsgTypeRegister
void DetectKrb5MsgTypeRegister(void)
Registration function for krb5_msg_type: keyword.
Definition: detect-krb5-msgtype.c:59
detect-mqtt-connect-clientid.h
DetectFlowvarRegister
void DetectFlowvarRegister(void)
Definition: detect-flowvar.c:54
detect-tcp-ack.h
detect-http-method.h
detect-within.h
DetectNoalertRegister
void DetectNoalertRegister(void)
Definition: detect-noalert.c:33
detect-tls-cert-issuer.h
detect-datarep.h
detect-http-request-line.h
DetectQuicCyuStringRegister
void DetectQuicCyuStringRegister(void)
Definition: detect-quic-cyu-string.c:173
SigTableElmt_::SupportsPrefilter
bool(* SupportsPrefilter)(const Signature *s)
Definition: detect.h:1280
DetectTransformStripPseudoHeadersRegister
void DetectTransformStripPseudoHeadersRegister(void)
Definition: detect-transform-strip-pseudo-headers.c:88
DetectQuicVersionRegister
void DetectQuicVersionRegister(void)
Registration function for quic.version: keyword.
Definition: detect-quic-version.c:72
detect-tcphdr.h
DetectMQTTPublishTopicRegister
void DetectMQTTPublishTopicRegister(void)
Definition: detect-mqtt-publish-topic.c:72
detect-tls-ja3s-hash.h
DetectSNMPCommunityRegister
void DetectSNMPCommunityRegister(void)
Definition: detect-snmp-community.c:50
DetectSmbNamedPipeRegister
void DetectSmbNamedPipeRegister(void)
Definition: detect-smb-share.c:78
DetectStreamSizeRegister
void DetectStreamSizeRegister(void)
Registration function for stream_size: keyword.
Definition: detect-stream_size.c:57
detect-engine-iponly.h
detect-parse.h
DetectSNMPVersionRegister
void DetectSNMPVersionRegister(void)
Registration function for snmp.procedure keyword.
Definition: detect-snmp-version.c:50
DetectDetectionFilterRegister
void DetectDetectionFilterRegister(void)
Registration function for detection_filter: keyword.
Definition: detect-detection-filter.c:66
detect-icode.h
DetectMQTTConnackSessionPresentRegister
void DetectMQTTConnackSessionPresentRegister(void)
Registration function for mqtt.connack.session_present: keyword.
Definition: detect-mqtt-connack-sessionpresent.c:51
detect-mqtt-connect-willtopic.h
detect-pkt-data.h
detect-threshold.h
DetectSipStatCodeRegister
void DetectSipStatCodeRegister(void)
Definition: detect-sip-stat-code.c:97
DetectDistanceRegister
void DetectDistanceRegister(void)
Definition: detect-distance.c:56
DetectTlsJa3SStringRegister
void DetectTlsJa3SStringRegister(void)
Registration function for keyword: ja3s.string.
Definition: detect-tls-ja3s-string.c:69
detect-geoip.h
detect-ssh-proto.h
DetectThresholdRegister
void DetectThresholdRegister(void)
Registration function for threshold: keyword.
Definition: detect-threshold.c:79
DetectSNMPUsmRegister
void DetectSNMPUsmRegister(void)
Definition: detect-snmp-usm.c:60
detect-tls-ja3-hash.h
DetectFlowintRegister
void DetectFlowintRegister(void)
Definition: detect-flowint.c:64
detect-filesize.h
DetectByteExtractRegister
void DetectByteExtractRegister(void)
Registers the keyword handlers for the "byte_extract" keyword.
Definition: detect-byte-extract.c:101
detect-icmp-id.h
DetectAppLayerProtocolRegister
void DetectAppLayerProtocolRegister(void)
Definition: detect-app-layer-protocol.c:262
app-layer-protos.h
detect-ssl-state.h
DetectSNMPPduTypeRegister
void DetectSNMPPduTypeRegister(void)
Definition: detect-snmp-pdu_type.c:56
detect-ipopts.h
DetectTlsCertChainLenRegister
void DetectTlsCertChainLenRegister(void)
Definition: detect-tls-certs.c:345
detect-tls-ja3s-string.h
detect-urilen.h
suricata.h
DetectIPAddrBufferRegister
void DetectIPAddrBufferRegister(void)
Definition: detect-ipaddr.c:53
detect-ipv4hdr.h
GetDocURL
const char * GetDocURL(void)
Definition: suricata.c:1107
DetectFastPatternRegister
void DetectFastPatternRegister(void)
Registration function for fast_pattern keyword.
Definition: detect-fast-pattern.c:185
DetectHttpStatMsgRegister
void DetectHttpStatMsgRegister(void)
Registration function for keyword: http_stat_msg.
Definition: detect-http-stat-msg.c:91
DetectMQTTConnectFlagsRegister
void DetectMQTTConnectFlagsRegister(void)
Registration function for mqtt.connect.flags: keyword.
Definition: detect-mqtt-connect-flags.c:59
DetectPktvarRegister
void DetectPktvarRegister(void)
Definition: detect-pktvar.c:48
detect-uricontent.h
DetectSslVersionRegister
void DetectSslVersionRegister(void)
Registration function for keyword: ssl_version.
Definition: detect-ssl-version.c:67
DetectModbusRegister
void DetectModbusRegister(void)
Registration function for Modbus keyword.
Definition: detect-modbus.c:120
DetectMQTTPublishMessageRegister
void DetectMQTTPublishMessageRegister(void)
Definition: detect-mqtt-publish-message.c:72
detect-flow-pkts.h
filehandler_table
DetectFileHandlerTableElmt filehandler_table[DETECT_TBLSIZE]
Definition: detect-parse.c:77
detect-mqtt-protocol-version.h
SIGMATCH_NOOPT
#define SIGMATCH_NOOPT
Definition: detect.h:1473
detect-tls-cert-serial.h
DetectTransformCompressWhitespaceRegister
void DetectTransformCompressWhitespaceRegister(void)
Definition: detect-transform-compress-whitespace.c:45
detect-csum.h
detect-transform-sha1.h
app-layer-smtp.h
DetectNocaseRegister
void DetectNocaseRegister(void)
Definition: detect-nocase.c:39
detect-mqtt-connect-flags.h
coverage_unittests
int coverage_unittests
Definition: suricata.c:882
detect-transform-header-lowercase.h
detect-transform-urldecode.h
DetectTransformToUpperRegister
void DetectTransformToUpperRegister(void)
Definition: detect-transform-casechange.c:149
DetectTemplateRustBufferRegister
void DetectTemplateRustBufferRegister(void)
Definition: detect-template-rust-buffer.c:53
detect-ike-chosen-sa.h
detect-distance.h
flow.h
DetectBase64DecodeRegister
void DetectBase64DecodeRegister(void)
Definition: detect-base64-decode.c:48
detect-ipaddr.h
DetectFilenameRegister
void DetectFilenameRegister(void)
Registration function for keyword: filename.
Definition: detect-filename.c:79
detect-ike-key-exchange-payload-length.h
DetectMQTTConnectWillTopicRegister
void DetectMQTTConnectWillTopicRegister(void)
Definition: detect-mqtt-connect-willtopic.c:72
DetectIPRepRegister
void DetectIPRepRegister(void)
Definition: detect-iprep.c:63
DetectIkeChosenSaRegister
void DetectIkeChosenSaRegister(void)
Registration function for ike.ChosenSa keyword.
Definition: detect-ike-chosen-sa.c:66
detect-engine-dcepayload.h
DetectIkeKeyExchangePayloadLengthRegister
void DetectIkeKeyExchangePayloadLengthRegister(void)
Registration function for ike.key_exchange_payload_length keyword.
Definition: detect-ike-key-exchange-payload-length.c:49
detect-config.h
detect-cipservice.h
DetectTransformMd5Register
void DetectTransformMd5Register(void)
Definition: detect-transform-md5.c:44
DetectTransformHeaderLowercaseRegister
void DetectTransformHeaderLowercaseRegister(void)
Definition: detect-transform-header-lowercase.c:78
DetectFtpdataRegister
void DetectFtpdataRegister(void)
Registration function for ftpcommand: keyword.
Definition: detect-ftpdata.c:59
DetectHttpMethodRegister
void DetectHttpMethodRegister(void)
Registration function for keyword: http_method.
Definition: detect-http-method.c:79
SIGMATCH_IPONLY_COMPAT
#define SIGMATCH_IPONLY_COMPAT
Definition: detect.h:1475
DetectTtlRegister
void DetectTtlRegister(void)
Registration function for ttl: keyword.
Definition: detect-ttl.c:54
DetectTemplate2Register
void DetectTemplate2Register(void)
Registration function for template2: keyword.
Definition: detect-template2.c:51
DetectTlsSubjectRegister
void DetectTlsSubjectRegister(void)
Registration function for keyword: tls.cert_subject.
Definition: detect-tls-cert-subject.c:68
detect-http-stat-msg.h
DetectPcreRegister
void DetectPcreRegister(void)
Definition: detect-pcre.c:96
DetectClasstypeRegister
void DetectClasstypeRegister(void)
Registers the handler functions for the "Classtype" keyword.
Definition: detect-classtype.c:51
detect-dns-query-name.h
detect-engine-address.h
detect-dce-opnum.h
util-threshold-config.h
detect-snmp-pdu_type.h
SigTableList
int SigTableList(const char *keyword)
Definition: detect-engine-register.c:388
detect-snmp-community.h
SigTableElmt_::RegisterTests
void(* RegisterTests)(void)
Definition: detect.h:1285
detect-engine-threshold.h
DetectIsdataatRegister
void DetectIsdataatRegister(void)
Registration function for isdataat: keyword.
Definition: detect-isdataat.c:67
detect-icmp-seq.h
detect-bytemath.h
app-layer.h
detect-bytetest.h
DetectFileMd5Register
void DetectFileMd5Register(void)
Registration function for keyword: filemd5.
Definition: detect-filemd5.c:44
DetectHttpRawHeaderRegister
void DetectHttpRawHeaderRegister(void)
Registers the keyword handlers for the "http_raw_header" keyword.
Definition: detect-http-raw-header.c:78
DetectTransformXorRegister
void DetectTransformXorRegister(void)
Definition: detect-transform-xor.c:45
detect-filesha256.h
DetectFrameRegister
void DetectFrameRegister(void)
Registration function for keyword: ja3_hash.
Definition: detect-frame.c:187
detect-msg.h