suricata
detect-engine-register.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2017 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  */
23 
24 #include "detect-smb-ntlmssp.h"
25 #include "suricata-common.h"
26 #include "suricata.h"
27 #include "detect.h"
28 #include "flow.h"
29 #include "flow-private.h"
30 #include "flow-bit.h"
31 
32 #include "detect-parse.h"
33 #include "detect-engine.h"
34 #include "detect-engine-profile.h"
35 
36 #include "detect-engine-alert.h"
37 #include "detect-engine-siggroup.h"
38 #include "detect-engine-address.h"
39 #include "detect-engine-proto.h"
40 #include "detect-engine-port.h"
41 #include "detect-engine-mpm.h"
42 #include "detect-engine-iponly.h"
45 
46 #include "rust.h"
47 
48 #include "detect-engine-payload.h"
50 #include "detect-dns-opcode.h"
51 #include "detect-dns-rcode.h"
52 #include "detect-dns-rrtype.h"
53 #include "detect-dns-query.h"
54 #include "detect-dns-answer-name.h"
55 #include "detect-dns-query-name.h"
56 #include "detect-tls-sni.h"
57 #include "detect-tls-certs.h"
59 #include "detect-tls-cert-issuer.h"
61 #include "detect-tls-cert-serial.h"
62 #include "detect-tls-alpn.h"
64 #include "detect-tls-random.h"
65 #include "detect-tls-ja3-hash.h"
66 #include "detect-tls-ja3-string.h"
67 #include "detect-tls-ja3s-hash.h"
68 #include "detect-tls-ja3s-string.h"
69 #include "detect-engine-state.h"
70 #include "detect-engine-analyzer.h"
71 
72 #include "detect-http-cookie.h"
73 #include "detect-http-method.h"
74 #include "detect-http-ua.h"
75 #include "detect-http-host.h"
76 
77 #include "detect-mark.h"
78 #include "detect-nfs-procedure.h"
79 #include "detect-nfs-version.h"
80 
81 #include "detect-engine-event.h"
82 #include "decode.h"
83 
84 #include "detect-config.h"
85 
86 #include "detect-smb-share.h"
87 #include "detect-smb-version.h"
88 
89 #include "detect-base64-decode.h"
90 #include "detect-base64-data.h"
91 #include "detect-ipaddr.h"
92 #include "detect-ipopts.h"
93 #include "detect-tcp-flags.h"
94 #include "detect-fragbits.h"
95 #include "detect-fragoffset.h"
96 #include "detect-gid.h"
97 #include "detect-tcp-ack.h"
98 #include "detect-tcp-seq.h"
99 #include "detect-content.h"
100 #include "detect-uricontent.h"
101 #include "detect-pcre.h"
102 #include "detect-depth.h"
103 #include "detect-nocase.h"
104 #include "detect-rawbytes.h"
105 #include "detect-bytetest.h"
106 #include "detect-bytemath.h"
107 #include "detect-bytejump.h"
108 #include "detect-sameip.h"
109 #include "detect-l3proto.h"
110 #include "detect-ipproto.h"
111 #include "detect-within.h"
112 #include "detect-distance.h"
113 #include "detect-offset.h"
114 #include "detect-sid.h"
115 #include "detect-prefilter.h"
116 #include "detect-priority.h"
117 #include "detect-classtype.h"
118 #include "detect-reference.h"
119 #include "detect-tag.h"
120 #include "detect-threshold.h"
121 #include "detect-metadata.h"
122 #include "detect-msg.h"
123 #include "detect-rev.h"
124 #include "detect-flow.h"
125 #include "detect-flow-age.h"
126 #include "detect-flow-pkts.h"
127 #include "detect-requires.h"
128 #include "detect-tcp-window.h"
129 #include "detect-ftpbounce.h"
130 #include "detect-isdataat.h"
131 #include "detect-id.h"
132 #include "detect-rpc.h"
133 #include "detect-asn1.h"
134 #include "detect-filename.h"
135 #include "detect-filestore.h"
136 #include "detect-filemagic.h"
137 #include "detect-filemd5.h"
138 #include "detect-filesha1.h"
139 #include "detect-filesha256.h"
140 #include "detect-filesize.h"
141 #include "detect-dataset.h"
142 #include "detect-datarep.h"
143 #include "detect-dsize.h"
144 #include "detect-flowvar.h"
145 #include "detect-flowint.h"
146 #include "detect-pktvar.h"
147 #include "detect-noalert.h"
148 #include "detect-flowbits.h"
149 #include "detect-hostbits.h"
150 #include "detect-xbits.h"
151 #include "detect-csum.h"
152 #include "detect-stream_size.h"
153 #include "detect-engine-sigorder.h"
154 #include "detect-ttl.h"
155 #include "detect-fast-pattern.h"
156 #include "detect-itype.h"
157 #include "detect-icode.h"
158 #include "detect-icmp-id.h"
159 #include "detect-icmp-seq.h"
160 #include "detect-icmpv4hdr.h"
161 #include "detect-dce-iface.h"
162 #include "detect-dce-opnum.h"
163 #include "detect-dce-stub-data.h"
164 #include "detect-urilen.h"
165 #include "detect-bsize.h"
166 #include "detect-detection-filter.h"
167 #include "detect-http-client-body.h"
168 #include "detect-http-server-body.h"
169 #include "detect-http-header.h"
171 #include "detect-http-headers.h"
172 #include "detect-http-raw-header.h"
173 #include "detect-http-uri.h"
174 #include "detect-http-protocol.h"
175 #include "detect-http-start.h"
176 #include "detect-http-stat-msg.h"
179 #include "detect-http2.h"
180 #include "detect-byte-extract.h"
181 #include "detect-file-data.h"
182 #include "detect-pkt-data.h"
183 #include "detect-replace.h"
184 #include "detect-tos.h"
185 #include "detect-app-layer-event.h"
186 #include "detect-lua.h"
187 #include "detect-iprep.h"
188 #include "detect-geoip.h"
190 #include "detect-template.h"
191 #include "detect-template2.h"
192 #include "detect-tcphdr.h"
193 #include "detect-tcpmss.h"
194 #include "detect-udphdr.h"
195 #include "detect-icmpv6hdr.h"
196 #include "detect-icmpv6-mtu.h"
197 #include "detect-ipv4hdr.h"
198 #include "detect-ipv6hdr.h"
199 #include "detect-krb5-cname.h"
200 #include "detect-krb5-errcode.h"
201 #include "detect-krb5-msgtype.h"
202 #include "detect-krb5-sname.h"
204 #include "detect-sip-method.h"
205 #include "detect-sip-uri.h"
206 #include "detect-sip-protocol.h"
207 #include "detect-sip-stat-code.h"
208 #include "detect-sip-stat-msg.h"
209 #include "detect-sip-request-line.h"
211 #include "detect-rfb-secresult.h"
212 #include "detect-rfb-sectype.h"
213 #include "detect-rfb-name.h"
214 #include "detect-target.h"
216 #include "detect-mqtt-type.h"
217 #include "detect-mqtt-flags.h"
218 #include "detect-mqtt-qos.h"
220 #include "detect-mqtt-reason-code.h"
233 #include "detect-quic-sni.h"
234 #include "detect-quic-ua.h"
235 #include "detect-quic-version.h"
236 #include "detect-quic-cyu-hash.h"
237 #include "detect-quic-cyu-string.h"
238 #include "detect-ja4-hash.h"
239 
240 #include "detect-bypass.h"
241 #include "detect-ftpdata.h"
243 
247 #include "detect-transform-md5.h"
248 #include "detect-transform-sha1.h"
249 #include "detect-transform-sha256.h"
253 #include "detect-transform-xor.h"
256 #include "detect-transform-base64.h"
257 
258 #include "util-rule-vars.h"
259 
260 #include "app-layer.h"
261 #include "app-layer-protos.h"
262 #include "app-layer-htp.h"
263 #include "app-layer-smtp.h"
264 #include "detect-frame.h"
265 #include "detect-tls.h"
267 #include "detect-tls-version.h"
268 #include "detect-ssh-proto.h"
270 #include "detect-ssh-software.h"
272 #include "detect-ssh-hassh.h"
273 #include "detect-ssh-hassh-server.h"
274 #include "detect-ssh-hassh-string.h"
276 #include "detect-http-stat-code.h"
277 #include "detect-ssl-version.h"
278 #include "detect-ssl-state.h"
279 #include "detect-modbus.h"
280 #include "detect-dnp3.h"
281 #include "detect-ike-exch-type.h"
282 #include "detect-ike-spi.h"
283 #include "detect-ike-vendor.h"
284 #include "detect-ike-chosen-sa.h"
289 
290 #include "action-globals.h"
291 #include "tm-threads.h"
292 
293 #include "pkt-var.h"
294 
295 #include "conf.h"
296 #include "conf-yaml-loader.h"
297 
298 #include "stream-tcp.h"
299 #include "stream-tcp-inline.h"
300 
301 #include "util-lua.h"
302 #include "util-var-name.h"
304 #include "util-threshold-config.h"
305 #include "util-print.h"
306 #include "util-unittest.h"
307 #include "util-unittest-helper.h"
308 #include "util-debug.h"
309 #include "util-hashlist.h"
310 #include "util-privs.h"
311 #include "util-profiling.h"
312 #include "util-validate.h"
313 #include "util-optimize.h"
314 #include "util-path.h"
315 #include "util-mpm-ac.h"
316 #include "runmodes.h"
317 
320 
321 static void PrintFeatureList(const SigTableElmt *e, char sep)
322 {
323  const uint16_t flags = e->flags;
324 
325  int prev = 0;
326  if (flags & SIGMATCH_NOOPT) {
327  printf("No option");
328  prev = 1;
329  }
331  if (prev == 1)
332  printf("%c", sep);
333  printf("compatible with IP only rule");
334  prev = 1;
335  }
337  if (prev == 1)
338  printf("%c", sep);
339  printf("compatible with decoder event only rule");
340  prev = 1;
341  }
343  if (prev == 1)
344  printf("%c", sep);
345  printf("content modifier");
346  prev = 1;
347  }
349  if (prev == 1)
350  printf("%c", sep);
351  printf("sticky buffer");
352  prev = 1;
353  }
354  if (e->Transform) {
355  if (prev == 1)
356  printf("%c", sep);
357  printf("transform");
358  prev = 1;
359  }
360  if (e->SupportsPrefilter) {
361  if (prev == 1)
362  printf("%c", sep);
363  printf("prefilter");
364  prev = 1;
365  }
366  if (prev == 0) {
367  printf("none");
368  }
369 }
370 
371 static void SigMultilinePrint(int i, const char *prefix)
372 {
373  if (sigmatch_table[i].desc) {
374  printf("%sDescription: %s\n", prefix, sigmatch_table[i].desc);
375  }
376  printf("%sFeatures: ", prefix);
377  PrintFeatureList(&sigmatch_table[i], ',');
378  if (sigmatch_table[i].url) {
379  printf("\n%sDocumentation: %s%s", prefix, GetDocURL(), sigmatch_table[i].url);
380  }
381  if (sigmatch_table[i].alternative) {
382  printf("\n%sReplaced by: %s", prefix, sigmatch_table[sigmatch_table[i].alternative].name);
383  }
384  printf("\n");
385 }
386 
387 int SigTableList(const char *keyword)
388 {
389  size_t size = DETECT_TBLSIZE;
390  size_t i;
391 
392  if (keyword == NULL) {
393  printf("=====Supported keywords=====\n");
394  for (i = 0; i < size; i++) {
395  const char *name = sigmatch_table[i].name;
396  if (name != NULL && strlen(name) > 0) {
397  if (name[0] == '_' || strcmp(name, "template") == 0)
398  continue;
399 
401  printf("- %s (not built-in)\n", name);
402  } else {
403  printf("- %s\n", name);
404  }
405  }
406  }
407  } else if (strcmp("csv", keyword) == 0) {
408  printf("name;description;app layer;features;documentation\n");
409  for (i = 0; i < size; i++) {
410  const char *name = sigmatch_table[i].name;
411  if (name != NULL && strlen(name) > 0) {
413  continue;
414  }
415  if (name[0] == '_' || strcmp(name, "template") == 0)
416  continue;
417 
418  printf("%s;", name);
419  if (sigmatch_table[i].desc) {
420  printf("%s", sigmatch_table[i].desc);
421  }
422  /* Build feature */
423  printf(";Unset;"); // this used to be alproto
424  PrintFeatureList(&sigmatch_table[i], ':');
425  printf(";");
426  if (sigmatch_table[i].url) {
427  printf("%s%s", GetDocURL(), sigmatch_table[i].url);
428  }
429  printf(";");
430  printf("\n");
431  }
432  }
433  } else if (strcmp("all", keyword) == 0) {
434  for (i = 0; i < size; i++) {
435  const char *name = sigmatch_table[i].name;
436  if (name != NULL && strlen(name) > 0) {
437  if (name[0] == '_' || strcmp(name, "template") == 0)
438  continue;
439  printf("%s:\n", sigmatch_table[i].name);
440  SigMultilinePrint(i, "\t");
441  }
442  }
443  } else {
444  for (i = 0; i < size; i++) {
445  if ((sigmatch_table[i].name != NULL) &&
446  strcmp(sigmatch_table[i].name, keyword) == 0) {
447  printf("= %s =\n", sigmatch_table[i].name);
449  printf("Not built-in\n");
450  return TM_ECODE_FAILED;
451  }
452  SigMultilinePrint(i, "");
453  return TM_ECODE_DONE;
454  }
455  }
456  printf("Non existing keyword\n");
457  return TM_ECODE_FAILED;
458  }
459  return TM_ECODE_DONE;
460 }
461 
462 static void DetectFileHandlerRegister(void)
463 {
464  for (int i = 0; i < DETECT_TBLSIZE_STATIC; i++) {
465  if (filehandler_table[i].name)
467  }
468 }
469 
470 void SigTableCleanup(void)
471 {
472  if (sigmatch_table != NULL) {
474  sigmatch_table = NULL;
475  DETECT_TBLSIZE = 0;
476  }
477 }
478 
479 void SigTableSetup(void)
480 {
481  if (sigmatch_table == NULL) {
484  if (sigmatch_table == NULL) {
485  DETECT_TBLSIZE = 0;
486  FatalError("Could not allocate sigmatch_table");
487  return;
488  }
489  }
490 
505 
506  /* NOTE: the order of these currently affects inspect
507  * engine registration order and ultimately the order
508  * of inspect engines in the rule. Which in turn affects
509  * state keeping */
525 
533 
536 
540 
549 
558 
569 
574 
576  /* end of order dependent regs */
577 
579 
720 
723 
738 
739  DetectFileHandlerRegister();
740 
741  ScDetectSNMPRegister();
742  ScDetectDHCPRegister();
743  ScDetectWebsocketRegister();
744  ScDetectEnipRegister();
745 
746  /* close keyword registration */
748 }
749 
750 #ifdef UNITTESTS
752 {
753  /* register the tests */
754  for (int i = 0; i < DETECT_TBLSIZE; i++) {
755  g_ut_modules++;
756  if (sigmatch_table[i].RegisterTests != NULL) {
758  g_ut_covered++;
759  } else {
760  SCLogDebug("detection plugin %s has no unittest "
761  "registration function.", sigmatch_table[i].name);
762 
763  if (coverage_unittests)
764  SCLogWarning("detection plugin %s has no unittest "
765  "registration function.",
766  sigmatch_table[i].name);
767  }
768  }
769 }
770 #endif
detect-mqtt-flags.h
DETECT_TBLSIZE_STATIC
@ DETECT_TBLSIZE_STATIC
Definition: detect-engine-register.h:353
detect-tcp-flags.h
detect-ssh-hassh-server-string.h
DetectSshVersionRegister
void DetectSshVersionRegister(void)
Registration function for keyword: ssh.protoversion.
Definition: detect-ssh-proto-version.c:78
DetectDceStubDataRegister
void DetectDceStubDataRegister(void)
Registers the keyword handlers for the "dce_stub_data" keyword.
Definition: detect-dce-stub-data.c:117
DetectFragBitsRegister
void DetectFragBitsRegister(void)
Registration function for fragbits: keyword.
Definition: detect-fragbits.c:85
DetectHttpHHRegister
void DetectHttpHHRegister(void)
Registers the keyword handlers for the "http_host" keyword.
Definition: detect-http-host.c:88
DetectITypeRegister
void DetectITypeRegister(void)
Registration function for itype: keyword.
Definition: detect-itype.c:57
detect-icmpv4hdr.h
DetectAppLayerEventRegister
void DetectAppLayerEventRegister(void)
Registers the keyword handlers for the "app-layer-event" keyword.
Definition: detect-app-layer-event.c:71
tm-threads.h
DetectDsizeRegister
void DetectDsizeRegister(void)
Registration function for dsize: keyword.
Definition: detect-dsize.c:61
DetectMQTTReasonCodeRegister
void DetectMQTTReasonCodeRegister(void)
Registration function for mqtt.reason_code: keyword.
Definition: detect-mqtt-reason-code.c:52
detect-transform-xor.h
detect-content.h
detect-target.h
DetectMsgRegister
void DetectMsgRegister(void)
Definition: detect-msg.c:42
detect-quic-cyu-string.h
DetectTlsJa3HashRegister
void DetectTlsJa3HashRegister(void)
Registration function for keyword: ja3_hash.
Definition: detect-tls-ja3-hash.c:83
DetectMQTTProtocolVersionRegister
void DetectMQTTProtocolVersionRegister(void)
Registration function for mqtt.protocol_version: keyword.
Definition: detect-mqtt-protocol-version.c:50
detect-ssh-hassh-string.h
DetectTemplateRegister
void DetectTemplateRegister(void)
Registration function for template: keyword.
Definition: detect-template.c:55
detect-engine.h
DetectTransformSha256Register
void DetectTransformSha256Register(void)
Definition: detect-transform-sha256.c:45
detect-app-layer-protocol.h
detect-dce-iface.h
SIGMATCH_INFO_STICKY_BUFFER
#define SIGMATCH_INFO_STICKY_BUFFER
Definition: detect.h:1509
DetectGeoipRegister
void DetectGeoipRegister(void)
Registration function for geoip keyword (no libgeoip support)
Definition: detect-geoip.c:54
detect-engine-proto.h
DetectNfsVersionRegister
void DetectNfsVersionRegister(void)
Registration function for nfs_procedure keyword.
Definition: detect-nfs-version.c:62
DetectXbitsRegister
void DetectXbitsRegister(void)
Definition: detect-xbits.c:69
DetectTlsJa3SHashRegister
void DetectTlsJa3SHashRegister(void)
Registration function for keyword: ja3s.hash.
Definition: detect-tls-ja3s-hash.c:83
detect-dsize.h
DetectRevRegister
void DetectRevRegister(void)
Definition: detect-rev.c:34
detect-noalert.h
sigmatch_table
SigTableElmt * sigmatch_table
Definition: detect-parse.c:127
detect-gid.h
DetectIkeExchTypeRegister
void DetectIkeExchTypeRegister(void)
Registration function for ike.exchtype keyword.
Definition: detect-ike-exch-type.c:50
DetectConfigRegister
void DetectConfigRegister(void)
Registration function for keyword: filestore.
Definition: detect-config.c:76
stream-tcp-inline.h
DetectRfbSecresultRegister
void DetectRfbSecresultRegister(void)
Registration function for rfb.secresult: keyword.
Definition: detect-rfb-secresult.c:57
detect-priority.h
util-hashlist.h
DetectTcpmssRegister
void DetectTcpmssRegister(void)
Registration function for tcpmss: keyword.
Definition: detect-tcpmss.c:51
detect-sip-request-line.h
detect-filesha1.h
g_ut_modules
int g_ut_modules
Definition: suricata.c:889
detect-sid.h
DetectTlsSerialRegister
void DetectTlsSerialRegister(void)
Registration function for keyword: tls.cert_serial.
Definition: detect-tls-cert-serial.c:72
detect-engine-siggroup.h
SIGMATCH_INFO_CONTENT_MODIFIER
#define SIGMATCH_INFO_CONTENT_MODIFIER
Definition: detect.h:1507
DetectSidRegister
void DetectSidRegister(void)
Definition: detect-sid.c:40
DetectIkeNonceRegister
void DetectIkeNonceRegister(void)
Definition: detect-ike-nonce-payload.c:92
SigTableElmt_::name
const char * name
Definition: detect.h:1301
DetectSshSoftwareVersionRegister
void DetectSshSoftwareVersionRegister(void)
Registration function for keyword: ssh.softwareversion.
Definition: detect-ssh-software-version.c:83
stream-tcp.h
detect-template-rust-buffer.h
detect-engine-event.h
detect-tls-cert-validity.h
detect-mark.h
detect-pktvar.h
detect-nfs-version.h
DetectMQTTQosRegister
void DetectMQTTQosRegister(void)
Registration function for mqtt.qos: keyword.
Definition: detect-mqtt-qos.c:49
DetectQuicCyuHashRegister
void DetectQuicCyuHashRegister(void)
Definition: detect-quic-cyu-hash.c:125
detect-mqtt-connect-username.h
DetectTlsFingerprintRegister
void DetectTlsFingerprintRegister(void)
Registration function for keyword: tls.cert_fingerprint.
Definition: detect-tls-cert-fingerprint.c:72
DetectSmbNtlmsspDomainRegister
void DetectSmbNtlmsspDomainRegister(void)
Definition: detect-smb-ntlmssp.c:134
DetectHttpServerBodyRegister
void DetectHttpServerBodyRegister(void)
Registers the keyword handlers for the "http_server_body" keyword.
Definition: detect-http-server-body.c:68
detect-tls-cert-fingerprint.h
DetectMQTTSubscribeTopicRegister
void DetectMQTTSubscribeTopicRegister(void)
Registration function for keyword: mqtt.subscribe.topic.
Definition: detect-mqtt-subscribe-topic.c:93
DetectMQTTConnectProtocolStringRegister
void DetectMQTTConnectProtocolStringRegister(void)
Definition: detect-mqtt-connect-protocol-string.c:72
DetectHttpHeadersRegister
void DetectHttpHeadersRegister(void)
Definition: detect-http-headers.c:29
DetectHttpStartRegister
void DetectHttpStartRegister(void)
Registers the keyword handlers for the "http_start" keyword.
Definition: detect-http-start.c:182
DetectDNP3Register
void DetectDNP3Register(void)
Definition: detect-dnp3.c:546
DetectHttpUriRegister
void DetectHttpUriRegister(void)
Registration function for keywords: http_uri and http.uri.
Definition: detect-http-uri.c:89
DetectGidRegister
void DetectGidRegister(void)
Registration function for gid: keyword.
Definition: detect-gid.c:48
detect-ike-nonce-payload-length.h
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
DetectHttpRequestHeaderRegister
void DetectHttpRequestHeaderRegister(void)
Definition: detect-http-header.c:628
detect-transform-strip-whitespace.h
detect-isdataat.h
detect-ssh-software.h
DetectQuicUaRegister
void DetectQuicUaRegister(void)
Registration function for quic.ua: keyword.
Definition: detect-quic-ua.c:71
DetectMQTTConnectUsernameRegister
void DetectMQTTConnectUsernameRegister(void)
Definition: detect-mqtt-connect-username.c:72
DetectIPProtoRegister
void DetectIPProtoRegister(void)
Registration function for ip_proto keyword.
Definition: detect-ipproto.c:60
SigTableSetup
void SigTableSetup(void)
Definition: detect-engine-register.c:479
DetectMQTTConnectClientIDRegister
void DetectMQTTConnectClientIDRegister(void)
Definition: detect-mqtt-connect-clientid.c:72
detect-classtype.h
detect-smb-share.h
util-lua.h
DetectICMPv6hdrRegister
void DetectICMPv6hdrRegister(void)
Registration function for icmpv6.hdr: keyword.
Definition: detect-icmpv6hdr.c:51
DetectSshHasshRegister
void DetectSshHasshRegister(void)
Registration function for hassh keyword.
Definition: detect-ssh-hassh.c:193
DetectTlsJa3StringRegister
void DetectTlsJa3StringRegister(void)
Registration function for keyword: ja3.string.
Definition: detect-tls-ja3-string.c:79
TM_ECODE_DONE
@ TM_ECODE_DONE
Definition: tm-threads-common.h:86
detect-bsize.h
action-globals.h
DetectTlsRandomRegister
void DetectTlsRandomRegister(void)
Registration function for keyword: tls.random.
Definition: detect-tls-random.c:112
DetectPriorityRegister
void DetectPriorityRegister(void)
Registers the handler functions for the "priority" keyword.
Definition: detect-priority.c:49
detect-smb-ntlmssp.h
DetectDceIfaceRegister
void DetectDceIfaceRegister(void)
Registers the keyword handlers for the "dce_iface" keyword.
Definition: detect-dce-iface.c:69
flow-private.h
DetectFilesizeRegister
void DetectFilesizeRegister(void)
Registration function for filesize: keyword.
Definition: detect-filesize.c:61
DetectHttpProtocolRegister
void DetectHttpProtocolRegister(void)
Registers the keyword handlers for the "http.protocol" keyword.
Definition: detect-http-protocol.c:158
detect-rfb-sectype.h
DetectFragOffsetRegister
void DetectFragOffsetRegister(void)
Registration function for fragoffset.
Definition: detect-fragoffset.c:60
DetectRpcRegister
void DetectRpcRegister(void)
Registration function for rpc keyword.
Definition: detect-rpc.c:61
detect-tcpmss.h
SigTableElmt_::flags
uint16_t flags
Definition: detect.h:1295
DetectMQTTUnsubscribeTopicRegister
void DetectMQTTUnsubscribeTopicRegister(void)
Registration function for keyword: mqtt.unsubscribe.topic.
Definition: detect-mqtt-unsubscribe-topic.c:93
DetectSameipRegister
void DetectSameipRegister(void)
Registration function for sameip: keyword.
Definition: detect-sameip.c:51
detect-template2.h
DetectSmbVersionRegister
void DetectSmbVersionRegister(void)
Registers the keyword handlers for the "smb_version" keyword.
Definition: detect-smb-version.c:135
detect-ftpbounce.h
detect-transform-sha256.h
DetectFileRegisterFileProtocols
void DetectFileRegisterFileProtocols(DetectFileHandlerTableElmt *reg)
Definition: detect-parse.c:79
detect-ssh-hassh-server.h
detect-dns-opcode.h
g_ut_covered
int g_ut_covered
Definition: suricata.c:890
DetectSshHasshStringRegister
void DetectSshHasshStringRegister(void)
Registration function for hassh.string keyword.
Definition: detect-ssh-hassh-string.c:123
detect-mqtt-connect-protocol-string.h
DetectIcmpv4HdrRegister
void DetectIcmpv4HdrRegister(void)
Registration function for icmpv4.hdr: keyword.
Definition: detect-icmpv4hdr.c:46
detect-tls-ja3-string.h
detect-filemd5.h
DetectTransformDotPrefixRegister
void DetectTransformDotPrefixRegister(void)
Definition: detect-transform-dotprefix.c:46
SIGMATCH_DEONLY_COMPAT
#define SIGMATCH_DEONLY_COMPAT
Definition: detect.h:1489
detect-tls-random.h
detect-tcp-seq.h
detect-http-header.h
detect-lua.h
detect-flowint.h
DetectSipRequestLineRegister
void DetectSipRequestLineRegister(void)
Definition: detect-sip-request-line.c:93
DetectTransformToLowerRegister
void DetectTransformToLowerRegister(void)
Definition: detect-transform-casechange.c:160
flow-bit.h
DetectTcphdrRegister
void DetectTcphdrRegister(void)
Registration function for tcp.hdr: keyword.
Definition: detect-tcphdr.c:50
util-var-name.h
detect-dnp3.h
rust.h
detect-http-client-body.h
DetectFlowBytesToClientRegister
void DetectFlowBytesToClientRegister(void)
Definition: detect-flow-pkts.c:207
DetectDatarepRegister
void DetectDatarepRegister(void)
Definition: detect-datarep.c:52
DetectFlowBytesToServerRegister
void DetectFlowBytesToServerRegister(void)
Definition: detect-flow-pkts.c:251
detect-file-data.h
detect-mqtt-subscribe-topic.h
util-privs.h
DetectHostbitsRegister
void DetectHostbitsRegister(void)
Definition: detect-hostbits.c:81
detect-flow-age.h
DetectTlsValidityRegister
void DetectTlsValidityRegister(void)
Registration function for tls validity keywords.
Definition: detect-tls-cert-validity.c:80
DetectIpOptsRegister
void DetectIpOptsRegister(void)
Registration function for ipopts: keyword.
Definition: detect-ipopts.c:47
DetectSshHasshServerRegister
void DetectSshHasshServerRegister(void)
Registration function for hasshServer keyword.
Definition: detect-ssh-hassh-server.c:191
detect-icmpv6-mtu.h
DetectDnsAnswerNameRegister
void DetectDnsAnswerNameRegister(void)
Definition: detect-dns-answer-name.c:72
detect-rev.h
DetectUricontentRegister
void DetectUricontentRegister(void)
Registration function for uricontent: keyword.
Definition: detect-uricontent.c:67
detect-tag.h
detect-ftpdata.h
detect-tls-sni.h
detect-engine-payload.h
DetectMetadataRegister
void DetectMetadataRegister(void)
Definition: detect-metadata.c:44
detect-l3proto.h
DetectSipResponseLineRegister
void DetectSipResponseLineRegister(void)
Definition: detect-sip-response-line.c:93
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:85
SigTableElmt_
element in sigmatch type table.
Definition: detect.h:1267
DetectRfbSectypeRegister
void DetectRfbSectypeRegister(void)
Registration function for rfb.sectype keyword.
Definition: detect-rfb-sectype.c:48
filehandler_table
DetectFileHandlerTableElmt filehandler_table[DETECT_TBLSIZE_STATIC]
Definition: detect-parse.c:77
detect-pcre.h
DetectMQTTConnectPasswordRegister
void DetectMQTTConnectPasswordRegister(void)
Definition: detect-mqtt-connect-password.c:72
DetectHttpHeaderNamesRegister
void DetectHttpHeaderNamesRegister(void)
Registers the keyword handlers for the "http.header_names" keyword.
Definition: detect-http-header-names.c:211
detect-depth.h
detect-engine-prefilter.h
detect-icmpv6hdr.h
DetectFilemagicRegister
void DetectFilemagicRegister(void)
Registration function for keyword: filemagic.
Definition: detect-filemagic.c:73
DetectDnsRrtypeRegister
void DetectDnsRrtypeRegister(void)
Definition: detect-dns-rrtype.c:68
util-unittest.h
DetectTlsSniRegister
void DetectTlsSniRegister(void)
Registration function for keyword: tls.sni.
Definition: detect-tls-sni.c:65
DetectTargetRegister
void DetectTargetRegister(void)
Registration function for target keyword.
Definition: detect-target.c:51
DetectBufferTypeCloseRegistration
void DetectBufferTypeCloseRegistration(void)
Definition: detect-engine.c:1798
SIGMATCH_NOT_BUILT
#define SIGMATCH_NOT_BUILT
Definition: detect.h:1491
detect-filename.h
util-unittest-helper.h
detect-mqtt-connect-password.h
detect-stream_size.h
DetectSipStatMsgRegister
void DetectSipStatMsgRegister(void)
Definition: detect-sip-stat-msg.c:96
detect-http-ua.h
detect-asn1.h
DetectMQTTConnectWillMessageRegister
void DetectMQTTConnectWillMessageRegister(void)
Definition: detect-mqtt-connect-willmessage.c:72
detect-flowvar.h
detect-base64-data.h
detect-krb5-errcode.h
SigTableRegisterTests
void SigTableRegisterTests(void)
Definition: detect-engine-register.c:751
detect-udphdr.h
detect-http-protocol.h
detect-reference.h
DetectHttpResponseHeaderRegister
void DetectHttpResponseHeaderRegister(void)
Definition: detect-http-header.c:661
detect-rpc.h
detect-sameip.h
detect-dce-stub-data.h
detect-dns-query.h
DetectTransformStripWhitespaceRegister
void DetectTransformStripWhitespaceRegister(void)
Definition: detect-transform-strip-whitespace.c:45
DetectSeqRegister
void DetectSeqRegister(void)
Registration function for ack: keyword.
Definition: detect-tcp-seq.c:53
DetectAsn1Register
void DetectAsn1Register(void)
Registration function for asn1.
Definition: detect-asn1.c:48
DetectFlowAgeRegister
void DetectFlowAgeRegister(void)
Definition: detect-flow-age.c:86
detect-krb5-msgtype.h
DetectBsizeRegister
void DetectBsizeRegister(void)
Registration function for bsize: keyword.
Definition: detect-bsize.c:98
DetectSmbShareRegister
void DetectSmbShareRegister(void)
Definition: detect-smb-share.c:139
app-layer-htp.h
detect-xbits.h
DetectFlowPktsToClientRegister
void DetectFlowPktsToClientRegister(void)
Definition: detect-flow-pkts.c:87
DetectDnsRcodeRegister
void DetectDnsRcodeRegister(void)
Definition: detect-dns-rcode.c:68
detect-app-layer-event.h
DetectBytejumpRegister
void DetectBytejumpRegister(void)
Definition: detect-bytejump.c:72
detect-ike-nonce-payload.h
decode.h
DetectICMPv6mtuRegister
void DetectICMPv6mtuRegister(void)
Registration function for icmpv6.mtu: keyword.
Definition: detect-icmpv6-mtu.c:48
detect-ssh-hassh.h
util-debug.h
detect-transform-pcrexform.h
SigTableCleanup
void SigTableCleanup(void)
Definition: detect-engine-register.c:470
detect-http-header-names.h
detect-transform-compress-whitespace.h
DetectTlsVersionRegister
void DetectTlsVersionRegister(void)
Registration function for keyword: tls.version.
Definition: detect-tls-version.c:73
DetectReplaceRegister
void DetectReplaceRegister(void)
Definition: detect-replace.c:58
detect-detection-filter.h
DetectICodeRegister
void DetectICodeRegister(void)
Registration function for icode: keyword.
Definition: detect-icode.c:60
detect-iprep.h
detect-rawbytes.h
DetectWindowRegister
void DetectWindowRegister(void)
Registration function for window: keyword.
Definition: detect-tcp-window.c:59
detect-http2.h
DetectL3ProtoRegister
void DetectL3ProtoRegister(void)
Registration function for ip_proto keyword.
Definition: detect-l3proto.c:54
detect-fragbits.h
DetectKrb5ErrCodeRegister
void DetectKrb5ErrCodeRegister(void)
Registration function for krb5_err_code: keyword.
Definition: detect-krb5-errcode.c:58
detect-ipv6hdr.h
DetectWithinRegister
void DetectWithinRegister(void)
Definition: detect-within.c:52
DetectContentRegister
void DetectContentRegister(void)
Definition: detect-content.c:58
detect-http-response-line.h
detect-tos.h
util-print.h
DetectSshProtocolRegister
void DetectSshProtocolRegister(void)
Definition: detect-ssh-proto.c:95
detect-filemagic.h
detect-transform-md5.h
detect-engine-mpm.h
DetectIcmpIdRegister
void DetectIcmpIdRegister(void)
Registration function for icode: icmp_id.
Definition: detect-icmp-id.c:59
DETECT_TBLSIZE_IDX
int DETECT_TBLSIZE_IDX
Definition: detect-engine-register.c:319
detect.h
DetectSslStateRegister
void DetectSslStateRegister(void)
Registers the keyword handlers for the "ssl_state" keyword.
Definition: detect-ssl-state.c:73
detect-http-start.h
DetectLuaRegister
void DetectLuaRegister(void)
Registration function for keyword: lua.
Definition: detect-lua.c:78
detect-ja4-hash.h
pkt-var.h
DetectIkeVendorRegister
void DetectIkeVendorRegister(void)
Registration function for ike.vendor keyword.
Definition: detect-ike-vendor.c:70
detect-quic-version.h
DetectFiledataRegister
void DetectFiledataRegister(void)
Registration function for keyword: file_data.
Definition: detect-file-data.c:71
detect-prefilter.h
DetectIpv6hdrRegister
void DetectIpv6hdrRegister(void)
Registration function for ipv6.hdr: keyword.
Definition: detect-ipv6hdr.c:50
DetectIkeKeyExchangeRegister
void DetectIkeKeyExchangeRegister(void)
Definition: detect-ike-key-exchange-payload.c:92
detect-http-uri.h
detect-tcp-window.h
detect-transform-strip-pseudo-headers.h
detect-engine-port.h
DetectIcmpSeqRegister
void DetectIcmpSeqRegister(void)
Registration function for icmp_seq.
Definition: detect-icmp-seq.c:58
DetectIdRegister
void DetectIdRegister(void)
Registration function for keyword: id.
Definition: detect-id.c:65
DetectHttpUARegister
void DetectHttpUARegister(void)
Registers the keyword handlers for the "http_user_agent" keyword.
Definition: detect-http-ua.c:79
detect-ike-vendor.h
detect-mqtt-unsubscribe-topic.h
detect-mqtt-publish-topic.h
DetectRfbNameRegister
void DetectRfbNameRegister(void)
Definition: detect-rfb-name.c:91
SCLogWarning
#define SCLogWarning(...)
Macro used to log WARNING messages.
Definition: util-debug.h:249
detect-itype.h
DetectFlowPktsToServerRegister
void DetectFlowPktsToServerRegister(void)
Definition: detect-flow-pkts.c:161
detect-requires.h
detect-engine-profile.h
detect-sip-protocol.h
DetectPktDataRegister
void DetectPktDataRegister(void)
Registration function for keyword: file_data.
Definition: detect-pkt-data.c:53
util-profiling.h
detect-mqtt-connack-sessionpresent.h
DetectMQTTTypeRegister
void DetectMQTTTypeRegister(void)
Registration function for mqtt.type: keyword.
Definition: detect-mqtt-type.c:48
util-rule-vars.h
DetectRequiresRegister
void DetectRequiresRegister(void)
Definition: detect-requires.c:44
detect-frame.h
DetectFlowbitsRegister
void DetectFlowbitsRegister(void)
Definition: detect-flowbits.c:65
DetectDnsQueryNameRegister
void DetectDnsQueryNameRegister(void)
Definition: detect-dns-query-name.c:72
DetectDatasetRegister
void DetectDatasetRegister(void)
Definition: detect-dataset.c:49
DetectUdphdrRegister
void DetectUdphdrRegister(void)
Registration function for udp.hdr: keyword.
Definition: detect-udphdr.c:49
conf-yaml-loader.h
DetectBytetestRegister
void DetectBytetestRegister(void)
Definition: detect-bytetest.c:77
DetectTlsSubjectAltNameRegister
void DetectTlsSubjectAltNameRegister(void)
Registration function for keyword: tls.subjectaltname.
Definition: detect-tls-subjectaltname.c:64
detect-modbus.h
DetectDepthRegister
void DetectDepthRegister(void)
Definition: detect-depth.c:48
detect-bytejump.h
detect-id.h
conf.h
detect-engine-alert.h
detect-dns-answer-name.h
DetectSipMethodRegister
void DetectSipMethodRegister(void)
Definition: detect-sip-method.c:127
detect-ike-spi.h
detect-ipproto.h
DetectTransformPcrexformRegister
void DetectTransformPcrexformRegister(void)
Definition: detect-transform-pcrexform.c:46
detect-krb5-ticket-encryption.h
detect-nfs-procedure.h
detect-engine-state.h
Data structures and function prototypes for keeping state for the detection engine.
detect-filestore.h
detect-http-stat-code.h
detect-replace.h
detect-krb5-cname.h
DetectMarkRegister
void DetectMarkRegister(void)
Registration function for nfq_set_mark: keyword.
Definition: detect-mark.c:56
DetectReferenceRegister
void DetectReferenceRegister(void)
Registration function for the reference: keyword.
Definition: detect-reference.c:58
detect-sip-method.h
DetectFileSha256Register
void DetectFileSha256Register(void)
Registration function for keyword: filesha256.
Definition: detect-filesha256.c:44
DetectPrefilterRegister
void DetectPrefilterRegister(void)
Definition: detect-prefilter.c:37
util-mpm-ac.h
detect-krb5-sname.h
DetectTlsCertsRegister
void DetectTlsCertsRegister(void)
Registration function for keyword: tls.certs.
Definition: detect-tls-certs.c:113
DetectFtpbounceRegister
void DetectFtpbounceRegister(void)
Registration function for ftpbounce: keyword.
Definition: detect-ftpbounce.c:61
detect-flowbits.h
runmodes.h
DetectKrb5TicketEncryptionRegister
void DetectKrb5TicketEncryptionRegister(void)
Definition: detect-krb5-ticket-encryption.c:68
detect-ssl-version.h
detect-offset.h
DetectOffsetRegister
void DetectOffsetRegister(void)
Definition: detect-offset.c:46
detect-nocase.h
detect-http-host.h
detect-fragoffset.h
detect-ttl.h
detect-sip-stat-code.h
detect-transform-dotprefix.h
detect-mqtt-connect-willmessage.h
DetectSshSoftwareRegister
void DetectSshSoftwareRegister(void)
Definition: detect-ssh-software.c:96
DetectQuicSniRegister
void DetectQuicSniRegister(void)
Registration function for quic.sni: keyword.
Definition: detect-quic-sni.c:71
DetectSipProtocolRegister
void DetectSipProtocolRegister(void)
Definition: detect-sip-protocol.c:93
detect-engine-analyzer.h
detect-rfb-secresult.h
DetectSipUriRegister
void DetectSipUriRegister(void)
Definition: detect-sip-uri.c:106
detect-engine-content-inspection.h
detect-quic-cyu-hash.h
detect-http-server-body.h
detect-mqtt-publish-message.h
detect-ssh-software-version.h
detect-bypass.h
DetectBypassRegister
void DetectBypassRegister(void)
Registration function for keyword: bypass.
Definition: detect-bypass.c:59
DetectAckRegister
void DetectAckRegister(void)
Registration function for ack: keyword.
Definition: detect-tcp-ack.c:56
DetectFilestoreRegister
void DetectFilestoreRegister(void)
Registration function for keyword: filestore.
Definition: detect-filestore.c:79
detect-mqtt-type.h
DetectTlsRegister
void DetectTlsRegister(void)
Registration function for keyword: tls.version.
Definition: detect-tls.c:101
DetectTagRegister
void DetectTagRegister(void)
Registration function for keyword tag.
Definition: detect-tag.c:69
DetectHttpResponseLineRegister
void DetectHttpResponseLineRegister(void)
Registers the keyword handlers for the "http_response_line" keyword.
Definition: detect-http-response-line.c:99
detect-ike-key-exchange-payload.h
detect-fast-pattern.h
DetectTlsIssuerRegister
void DetectTlsIssuerRegister(void)
Registration function for keyword: tls.cert_issuer.
Definition: detect-tls-cert-issuer.c:68
DetectTransformUrlDecodeRegister
void DetectTransformUrlDecodeRegister(void)
Definition: detect-transform-urldecode.c:45
DetectSmbNtlmsspUserRegister
void DetectSmbNtlmsspUserRegister(void)
Definition: detect-smb-ntlmssp.c:77
detect-mqtt-qos.h
detect-ssh-proto-version.h
DetectBase64DataRegister
void DetectBase64DataRegister(void)
Definition: detect-base64-data.c:33
flags
uint8_t flags
Definition: decode-gre.h:0
DetectHttpStatCodeRegister
void DetectHttpStatCodeRegister(void)
Registration function for keyword: http_stat_code.
Definition: detect-http-stat-code.c:81
DetectDceOpnumRegister
void DetectDceOpnumRegister(void)
Registers the keyword handlers for the "dce_opnum" keyword.
Definition: detect-dce-opnum.c:70
detect-dns-rcode.h
DetectKrb5CNameRegister
void DetectKrb5CNameRegister(void)
Definition: detect-krb5-cname.c:82
DetectHttpHeaderRegister
void DetectHttpHeaderRegister(void)
Registers the keyword handlers for the "http_header" keyword.
Definition: detect-http-header.c:411
detect-transform-casechange.h
detect-tls.h
suricata-common.h
DetectMQTTFlagsRegister
void DetectMQTTFlagsRegister(void)
Registration function for mqtt.flags: keyword.
Definition: detect-mqtt-flags.c:55
detect-dns-rrtype.h
detect-smb-version.h
util-path.h
detect-mqtt-reason-code.h
detect-byte-extract.h
DETECT_TBLSIZE_STEP
#define DETECT_TBLSIZE_STEP
Definition: detect-engine-register.h:359
DetectTlsAlpnRegister
void DetectTlsAlpnRegister(void)
Registration function for keyword: tls.alpn.
Definition: detect-tls-alpn.c:64
detect-metadata.h
DetectKrb5SNameRegister
void DetectKrb5SNameRegister(void)
Definition: detect-krb5-sname.c:82
detect-sip-response-line.h
SigTableElmt_::Transform
void(* Transform)(InspectionBuffer *, void *context)
Definition: detect.h:1282
DetectHttpClientBodyRegister
void DetectHttpClientBodyRegister(void)
Registers the keyword handlers for the "http_client_body" keyword.
Definition: detect-http-client-body.c:84
DetectIkeSpiRegister
void DetectIkeSpiRegister(void)
Definition: detect-ike-spi.c:130
detect-http-headers.h
DetectDnsOpcodeRegister
void DetectDnsOpcodeRegister(void)
Definition: detect-dns-opcode.c:73
DetectCsumRegister
void DetectCsumRegister(void)
Registers handlers for all the checksum keywords. The checksum keywords that are registered are ipv4-...
Definition: detect-csum.c:139
DetectTransformSha1Register
void DetectTransformSha1Register(void)
Definition: detect-transform-sha1.c:45
DetectUrilenRegister
void DetectUrilenRegister(void)
Registration function for urilen: keyword.
Definition: detect-urilen.c:61
detect-tls-cert-subject.h
detect-sip-stat-msg.h
DetectIkeNoncePayloadLengthRegister
void DetectIkeNoncePayloadLengthRegister(void)
Registration function for ike.nonce_payload_length keyword.
Definition: detect-ike-nonce-payload-length.c:49
detect-tls-version.h
detect-dataset.h
detect-template.h
util-classification-config.h
DetectHttp2Register
void DetectHttp2Register(void)
Definition: detect-http2.c:110
detect-rfb-name.h
detect-transform-base64.h
FatalError
#define FatalError(...)
Definition: util-debug.h:502
DetectNfsProcedureRegister
void DetectNfsProcedureRegister(void)
Registration function for nfs_procedure keyword.
Definition: detect-nfs-procedure.c:64
DetectIpv4hdrRegister
void DetectIpv4hdrRegister(void)
Registration function for ipv4.hdr: keyword.
Definition: detect-ipv4hdr.c:50
DetectHttpRequestLineRegister
void DetectHttpRequestLineRegister(void)
Registers the keyword handlers for the "http_request_line" keyword.
Definition: detect-http-request-line.c:99
DetectFileSha1Register
void DetectFileSha1Register(void)
Registration function for keyword: filesha1.
Definition: detect-filesha1.c:44
DetectFlowRegister
void DetectFlowRegister(void)
Registration function for flow: keyword.
Definition: detect-flow.c:65
DetectDnsQueryRegister
void DetectDnsQueryRegister(void)
Registration function for keyword: dns_query.
Definition: detect-dns-query.c:97
detect-hostbits.h
DetectSshHasshServerStringRegister
void DetectSshHasshServerStringRegister(void)
Registration function for hasshServer.string keyword.
Definition: detect-ssh-hassh-server-string.c:123
DetectRawbytesRegister
void DetectRawbytesRegister(void)
Definition: detect-rawbytes.c:43
detect-sip-uri.h
DetectTosRegister
void DetectTosRegister(void)
Register Tos keyword.
Definition: detect-tos.c:64
util-optimize.h
detect-ike-exch-type.h
detect-tls-alpn.h
detect-tls-certs.h
util-validate.h
DetectBytemathRegister
void DetectBytemathRegister(void)
Registers the keyword handlers for the "byte_math" keyword.
Definition: detect-bytemath.c:71
detect-flow.h
detect-quic-ua.h
detect-base64-decode.h
DetectEngineEventRegister
void DetectEngineEventRegister(void)
Registration function for decode-event: keyword.
Definition: detect-engine-event.c:62
DetectFlagsRegister
void DetectFlagsRegister(void)
Registration function for flags: keyword.
Definition: detect-tcp-flags.c:76
detect-http-raw-header.h
detect-engine-sigorder.h
detect-quic-sni.h
DetectKrb5MsgTypeRegister
void DetectKrb5MsgTypeRegister(void)
Registration function for krb5_msg_type: keyword.
Definition: detect-krb5-msgtype.c:58
detect-mqtt-connect-clientid.h
DetectFlowvarRegister
void DetectFlowvarRegister(void)
Definition: detect-flowvar.c:54
detect-tcp-ack.h
detect-http-method.h
detect-within.h
DetectNoalertRegister
void DetectNoalertRegister(void)
Definition: detect-noalert.c:49
detect-tls-cert-issuer.h
DETECT_TBLSIZE
int DETECT_TBLSIZE
Definition: detect-engine-register.c:318
detect-datarep.h
detect-http-request-line.h
SCFree
#define SCFree(p)
Definition: util-mem.h:61
DetectQuicCyuStringRegister
void DetectQuicCyuStringRegister(void)
Definition: detect-quic-cyu-string.c:81
SigTableElmt_::SupportsPrefilter
bool(* SupportsPrefilter)(const Signature *s)
Definition: detect.h:1288
DetectTransformStripPseudoHeadersRegister
void DetectTransformStripPseudoHeadersRegister(void)
Definition: detect-transform-strip-pseudo-headers.c:88
DetectQuicVersionRegister
void DetectQuicVersionRegister(void)
Registration function for quic.version: keyword.
Definition: detect-quic-version.c:71
detect-tcphdr.h
DetectMQTTPublishTopicRegister
void DetectMQTTPublishTopicRegister(void)
Definition: detect-mqtt-publish-topic.c:72
detect-tls-ja3s-hash.h
DetectSmbNamedPipeRegister
void DetectSmbNamedPipeRegister(void)
Definition: detect-smb-share.c:78
DetectStreamSizeRegister
void DetectStreamSizeRegister(void)
Registration function for stream_size: keyword.
Definition: detect-stream_size.c:58
detect-engine-iponly.h
detect-parse.h
DetectDetectionFilterRegister
void DetectDetectionFilterRegister(void)
Registration function for detection_filter: keyword.
Definition: detect-detection-filter.c:67
detect-icode.h
DetectMQTTConnackSessionPresentRegister
void DetectMQTTConnackSessionPresentRegister(void)
Registration function for mqtt.connack.session_present: keyword.
Definition: detect-mqtt-connack-sessionpresent.c:51
detect-mqtt-connect-willtopic.h
detect-pkt-data.h
detect-threshold.h
DetectSipStatCodeRegister
void DetectSipStatCodeRegister(void)
Definition: detect-sip-stat-code.c:96
DetectDistanceRegister
void DetectDistanceRegister(void)
Definition: detect-distance.c:56
DetectTlsJa3SStringRegister
void DetectTlsJa3SStringRegister(void)
Registration function for keyword: ja3s.string.
Definition: detect-tls-ja3s-string.c:79
detect-geoip.h
detect-ssh-proto.h
DetectThresholdRegister
void DetectThresholdRegister(void)
Registration function for threshold: keyword.
Definition: detect-threshold.c:86
detect-tls-ja3-hash.h
DetectFlowintRegister
void DetectFlowintRegister(void)
Definition: detect-flowint.c:64
detect-filesize.h
DetectByteExtractRegister
void DetectByteExtractRegister(void)
Registers the keyword handlers for the "byte_extract" keyword.
Definition: detect-byte-extract.c:69
detect-icmp-id.h
DetectAppLayerProtocolRegister
void DetectAppLayerProtocolRegister(void)
Definition: detect-app-layer-protocol.c:332
app-layer-protos.h
detect-ssl-state.h
detect-ipopts.h
DetectTlsCertChainLenRegister
void DetectTlsCertChainLenRegister(void)
Definition: detect-tls-certs.c:246
detect-tls-ja3s-string.h
detect-urilen.h
suricata.h
DetectIPAddrBufferRegister
void DetectIPAddrBufferRegister(void)
Definition: detect-ipaddr.c:53
detect-ipv4hdr.h
GetDocURL
const char * GetDocURL(void)
Definition: suricata.c:1115
DetectFastPatternRegister
void DetectFastPatternRegister(void)
Registration function for fast_pattern keyword.
Definition: detect-fast-pattern.c:184
DetectHttpStatMsgRegister
void DetectHttpStatMsgRegister(void)
Registration function for keyword: http_stat_msg.
Definition: detect-http-stat-msg.c:91
DetectMQTTConnectFlagsRegister
void DetectMQTTConnectFlagsRegister(void)
Registration function for mqtt.connect.flags: keyword.
Definition: detect-mqtt-connect-flags.c:59
DetectPktvarRegister
void DetectPktvarRegister(void)
Definition: detect-pktvar.c:48
detect-uricontent.h
DetectSslVersionRegister
void DetectSslVersionRegister(void)
Registration function for keyword: ssl_version.
Definition: detect-ssl-version.c:67
DetectModbusRegister
void DetectModbusRegister(void)
Registration function for Modbus keyword.
Definition: detect-modbus.c:120
DetectMQTTPublishMessageRegister
void DetectMQTTPublishMessageRegister(void)
Definition: detect-mqtt-publish-message.c:72
detect-flow-pkts.h
detect-mqtt-protocol-version.h
SIGMATCH_NOOPT
#define SIGMATCH_NOOPT
Definition: detect.h:1485
detect-tls-cert-serial.h
DetectTransformCompressWhitespaceRegister
void DetectTransformCompressWhitespaceRegister(void)
Definition: detect-transform-compress-whitespace.c:45
detect-csum.h
detect-transform-sha1.h
app-layer-smtp.h
DetectNocaseRegister
void DetectNocaseRegister(void)
Definition: detect-nocase.c:39
DetectJa4HashRegister
void DetectJa4HashRegister(void)
Registration function for keyword: ja4.hash.
Definition: detect-ja4-hash.c:65
detect-mqtt-connect-flags.h
coverage_unittests
int coverage_unittests
Definition: suricata.c:888
detect-transform-header-lowercase.h
detect-transform-urldecode.h
DetectTransformToUpperRegister
void DetectTransformToUpperRegister(void)
Definition: detect-transform-casechange.c:149
DetectTemplateRustBufferRegister
void DetectTemplateRustBufferRegister(void)
Definition: detect-template-rust-buffer.c:78
detect-ike-chosen-sa.h
detect-distance.h
flow.h
DetectBase64DecodeRegister
void DetectBase64DecodeRegister(void)
Definition: detect-base64-decode.c:48
detect-ipaddr.h
DetectFilenameRegister
void DetectFilenameRegister(void)
Registration function for keyword: filename.
Definition: detect-filename.c:79
detect-ike-key-exchange-payload-length.h
DetectMQTTConnectWillTopicRegister
void DetectMQTTConnectWillTopicRegister(void)
Definition: detect-mqtt-connect-willtopic.c:72
DetectIPRepRegister
void DetectIPRepRegister(void)
Definition: detect-iprep.c:63
DetectIkeChosenSaRegister
void DetectIkeChosenSaRegister(void)
Registration function for ike.ChosenSa keyword.
Definition: detect-ike-chosen-sa.c:66
detect-engine-dcepayload.h
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
DetectIkeKeyExchangePayloadLengthRegister
void DetectIkeKeyExchangePayloadLengthRegister(void)
Registration function for ike.key_exchange_payload_length keyword.
Definition: detect-ike-key-exchange-payload-length.c:49
detect-config.h
DetectTransformMd5Register
void DetectTransformMd5Register(void)
Definition: detect-transform-md5.c:44
DetectTransformHeaderLowercaseRegister
void DetectTransformHeaderLowercaseRegister(void)
Definition: detect-transform-header-lowercase.c:78
DetectFtpdataRegister
void DetectFtpdataRegister(void)
Registration function for ftpcommand: keyword.
Definition: detect-ftpdata.c:59
detect-tls-subjectaltname.h
DetectHttpMethodRegister
void DetectHttpMethodRegister(void)
Registration function for keyword: http_method.
Definition: detect-http-method.c:79
SIGMATCH_IPONLY_COMPAT
#define SIGMATCH_IPONLY_COMPAT
Definition: detect.h:1487
DetectTtlRegister
void DetectTtlRegister(void)
Registration function for ttl: keyword.
Definition: detect-ttl.c:54
DetectTemplate2Register
void DetectTemplate2Register(void)
Registration function for template2: keyword.
Definition: detect-template2.c:51
DetectTlsSubjectRegister
void DetectTlsSubjectRegister(void)
Registration function for keyword: tls.cert_subject.
Definition: detect-tls-cert-subject.c:68
detect-http-stat-msg.h
DetectPcreRegister
void DetectPcreRegister(void)
Definition: detect-pcre.c:96
DetectClasstypeRegister
void DetectClasstypeRegister(void)
Registers the handler functions for the "Classtype" keyword.
Definition: detect-classtype.c:51
detect-dns-query-name.h
detect-engine-address.h
detect-dce-opnum.h
util-threshold-config.h
SigTableList
int SigTableList(const char *keyword)
Definition: detect-engine-register.c:387
SigTableElmt_::RegisterTests
void(* RegisterTests)(void)
Definition: detect.h:1293
detect-engine-threshold.h
DetectIsdataatRegister
void DetectIsdataatRegister(void)
Registration function for isdataat: keyword.
Definition: detect-isdataat.c:67
detect-icmp-seq.h
detect-bytemath.h
app-layer.h
detect-bytetest.h
DetectTransformFromBase64DecodeRegister
void DetectTransformFromBase64DecodeRegister(void)
Definition: detect-transform-base64.c:50
DetectFileMd5Register
void DetectFileMd5Register(void)
Registration function for keyword: filemd5.
Definition: detect-filemd5.c:44
DetectHttpRawHeaderRegister
void DetectHttpRawHeaderRegister(void)
Registers the keyword handlers for the "http_raw_header" keyword.
Definition: detect-http-raw-header.c:78
DetectTransformXorRegister
void DetectTransformXorRegister(void)
Definition: detect-transform-xor.c:45
detect-filesha256.h
DetectFrameRegister
void DetectFrameRegister(void)
Registration function for keyword: ja3_hash.
Definition: detect-frame.c:187
detect-msg.h