suricata
detect-engine-register.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2017 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  */
23 
24 #include "detect-smb-ntlmssp.h"
25 #include "suricata-common.h"
26 #include "suricata.h"
27 #include "detect.h"
28 #include "flow.h"
29 #include "flow-private.h"
30 #include "flow-bit.h"
31 
32 #include "detect-parse.h"
33 #include "detect-engine.h"
34 #include "detect-engine-profile.h"
35 
36 #include "detect-engine-alert.h"
37 #include "detect-engine-siggroup.h"
38 #include "detect-engine-address.h"
39 #include "detect-engine-proto.h"
40 #include "detect-engine-port.h"
41 #include "detect-engine-mpm.h"
42 #include "detect-engine-iponly.h"
45 
46 #include "rust.h"
47 
48 #include "detect-engine-payload.h"
50 #include "detect-dns-opcode.h"
51 #include "detect-dns-rcode.h"
52 #include "detect-dns-rrtype.h"
53 #include "detect-dns-query.h"
54 #include "detect-dns-answer-name.h"
55 #include "detect-dns-query-name.h"
56 #include "detect-tls-sni.h"
57 #include "detect-tls-certs.h"
59 #include "detect-tls-cert-issuer.h"
61 #include "detect-tls-cert-serial.h"
62 #include "detect-tls-alpn.h"
64 #include "detect-tls-random.h"
65 #include "detect-tls-ja3-hash.h"
66 #include "detect-tls-ja3-string.h"
67 #include "detect-tls-ja3s-hash.h"
68 #include "detect-tls-ja3s-string.h"
69 #include "detect-engine-state.h"
70 #include "detect-engine-analyzer.h"
71 
72 #include "detect-http-cookie.h"
73 #include "detect-http-method.h"
74 #include "detect-http-ua.h"
75 #include "detect-http-host.h"
76 
77 #include "detect-mark.h"
78 #include "detect-nfs-procedure.h"
79 #include "detect-nfs-version.h"
80 
81 #include "detect-engine-event.h"
82 #include "decode.h"
83 
84 #include "detect-config.h"
85 
86 #include "detect-smb-share.h"
87 #include "detect-smb-version.h"
88 
89 #include "detect-base64-decode.h"
90 #include "detect-base64-data.h"
91 #include "detect-ipaddr.h"
92 #include "detect-ipopts.h"
93 #include "detect-tcp-flags.h"
94 #include "detect-fragbits.h"
95 #include "detect-fragoffset.h"
96 #include "detect-gid.h"
97 #include "detect-tcp-ack.h"
98 #include "detect-tcp-seq.h"
99 #include "detect-content.h"
100 #include "detect-uricontent.h"
101 #include "detect-pcre.h"
102 #include "detect-depth.h"
103 #include "detect-nocase.h"
104 #include "detect-rawbytes.h"
105 #include "detect-bytetest.h"
106 #include "detect-bytemath.h"
107 #include "detect-bytejump.h"
108 #include "detect-sameip.h"
109 #include "detect-l3proto.h"
110 #include "detect-ipproto.h"
111 #include "detect-within.h"
112 #include "detect-distance.h"
113 #include "detect-offset.h"
114 #include "detect-sid.h"
115 #include "detect-prefilter.h"
116 #include "detect-priority.h"
117 #include "detect-classtype.h"
118 #include "detect-reference.h"
119 #include "detect-tag.h"
120 #include "detect-threshold.h"
121 #include "detect-metadata.h"
122 #include "detect-msg.h"
123 #include "detect-rev.h"
124 #include "detect-flow.h"
125 #include "detect-flow-age.h"
126 #include "detect-flow-pkts.h"
127 #include "detect-requires.h"
128 #include "detect-tcp-window.h"
129 #include "detect-ftpbounce.h"
130 #include "detect-isdataat.h"
131 #include "detect-id.h"
132 #include "detect-rpc.h"
133 #include "detect-asn1.h"
134 #include "detect-filename.h"
135 #include "detect-filestore.h"
136 #include "detect-filemagic.h"
137 #include "detect-filemd5.h"
138 #include "detect-filesha1.h"
139 #include "detect-filesha256.h"
140 #include "detect-filesize.h"
141 #include "detect-dataset.h"
142 #include "detect-datarep.h"
143 #include "detect-dsize.h"
144 #include "detect-flowvar.h"
145 #include "detect-flowint.h"
146 #include "detect-pktvar.h"
147 #include "detect-noalert.h"
148 #include "detect-flowbits.h"
149 #include "detect-hostbits.h"
150 #include "detect-xbits.h"
151 #include "detect-csum.h"
152 #include "detect-stream_size.h"
153 #include "detect-engine-sigorder.h"
154 #include "detect-ttl.h"
155 #include "detect-fast-pattern.h"
156 #include "detect-itype.h"
157 #include "detect-icode.h"
158 #include "detect-icmp-id.h"
159 #include "detect-icmp-seq.h"
160 #include "detect-icmpv4hdr.h"
161 #include "detect-dce-iface.h"
162 #include "detect-dce-opnum.h"
163 #include "detect-dce-stub-data.h"
164 #include "detect-urilen.h"
165 #include "detect-bsize.h"
166 #include "detect-detection-filter.h"
167 #include "detect-http-client-body.h"
168 #include "detect-http-server-body.h"
169 #include "detect-http-header.h"
171 #include "detect-http-headers.h"
172 #include "detect-http-raw-header.h"
173 #include "detect-http-uri.h"
174 #include "detect-http-protocol.h"
175 #include "detect-http-start.h"
176 #include "detect-http-stat-msg.h"
179 #include "detect-http2.h"
180 #include "detect-byte-extract.h"
181 #include "detect-file-data.h"
182 #include "detect-pkt-data.h"
183 #include "detect-replace.h"
184 #include "detect-tos.h"
185 #include "detect-app-layer-event.h"
186 #include "detect-lua.h"
187 #include "detect-iprep.h"
188 #include "detect-geoip.h"
190 #include "detect-template.h"
191 #include "detect-template2.h"
192 #include "detect-tcphdr.h"
193 #include "detect-tcpmss.h"
194 #include "detect-udphdr.h"
195 #include "detect-icmpv6hdr.h"
196 #include "detect-icmpv6-mtu.h"
197 #include "detect-ipv4hdr.h"
198 #include "detect-ipv6hdr.h"
199 #include "detect-krb5-cname.h"
200 #include "detect-krb5-errcode.h"
201 #include "detect-krb5-msgtype.h"
202 #include "detect-krb5-sname.h"
204 #include "detect-sip-method.h"
205 #include "detect-sip-uri.h"
206 #include "detect-target.h"
207 #include "detect-quic-sni.h"
208 #include "detect-quic-ua.h"
209 #include "detect-quic-version.h"
210 #include "detect-quic-cyu-hash.h"
211 #include "detect-quic-cyu-string.h"
212 #include "detect-ja4-hash.h"
213 
214 #include "detect-bypass.h"
215 #include "detect-ftpdata.h"
217 
219 #include "detect-transform-base64.h"
220 
221 #include "util-rule-vars.h"
222 
223 #include "app-layer.h"
224 #include "app-layer-protos.h"
225 #include "app-layer-htp.h"
226 #include "app-layer-smtp.h"
227 #include "detect-frame.h"
228 #include "detect-tls.h"
230 #include "detect-tls-version.h"
231 #include "detect-ssh-proto.h"
233 #include "detect-ssh-software.h"
235 #include "detect-ssh-hassh.h"
236 #include "detect-ssh-hassh-server.h"
237 #include "detect-ssh-hassh-string.h"
239 #include "detect-http-stat-code.h"
240 #include "detect-ssl-version.h"
241 #include "detect-ssl-state.h"
242 #include "detect-modbus.h"
243 #include "detect-dnp3.h"
244 #include "detect-ike-exch-type.h"
245 #include "detect-ike-spi.h"
246 #include "detect-ike-vendor.h"
247 #include "detect-ike-chosen-sa.h"
252 
253 #include "action-globals.h"
254 #include "tm-threads.h"
255 
256 #include "pkt-var.h"
257 
258 #include "conf.h"
259 #include "conf-yaml-loader.h"
260 
261 #include "stream-tcp.h"
262 #include "stream-tcp-inline.h"
263 
264 #include "util-lua.h"
265 #include "util-var-name.h"
267 #include "util-threshold-config.h"
268 #include "util-print.h"
269 #include "util-unittest.h"
270 #include "util-unittest-helper.h"
271 #include "util-debug.h"
272 #include "util-hashlist.h"
273 #include "util-privs.h"
274 #include "util-profiling.h"
275 #include "util-validate.h"
276 #include "util-optimize.h"
277 #include "util-path.h"
278 #include "util-mpm-ac.h"
279 #include "runmodes.h"
280 
283 
284 static void PrintFeatureList(const SigTableElmt *e, char sep)
285 {
286  const uint16_t flags = e->flags;
287 
288  int prev = 0;
289  if (flags & SIGMATCH_NOOPT) {
290  printf("No option");
291  prev = 1;
292  }
294  if (prev == 1)
295  printf("%c", sep);
296  printf("compatible with IP only rule");
297  prev = 1;
298  }
300  if (prev == 1)
301  printf("%c", sep);
302  printf("compatible with decoder event only rule");
303  prev = 1;
304  }
306  if (prev == 1)
307  printf("%c", sep);
308  printf("content modifier");
309  prev = 1;
310  }
312  if (prev == 1)
313  printf("%c", sep);
314  printf("sticky buffer");
315  prev = 1;
316  }
317  if (e->Transform) {
318  if (prev == 1)
319  printf("%c", sep);
320  printf("transform");
321  prev = 1;
322  }
323  if (e->SupportsPrefilter) {
324  if (prev == 1)
325  printf("%c", sep);
326  printf("prefilter");
327  prev = 1;
328  }
329  if (prev == 0) {
330  printf("none");
331  }
332 }
333 
334 static void SigMultilinePrint(int i, const char *prefix)
335 {
336  if (sigmatch_table[i].desc) {
337  printf("%sDescription: %s\n", prefix, sigmatch_table[i].desc);
338  }
339  printf("%sFeatures: ", prefix);
340  PrintFeatureList(&sigmatch_table[i], ',');
341  if (sigmatch_table[i].url) {
342  printf("\n%sDocumentation: %s%s", prefix, GetDocURL(), sigmatch_table[i].url);
343  }
344  if (sigmatch_table[i].alternative) {
345  printf("\n%sReplaced by: %s", prefix, sigmatch_table[sigmatch_table[i].alternative].name);
346  }
347  printf("\n");
348 }
349 
350 /** \brief Check if a keyword exists. */
351 bool SigTableHasKeyword(const char *keyword)
352 {
353  for (int i = 0; i < DETECT_TBLSIZE; i++) {
355  continue;
356  }
357 
358  const char *name = sigmatch_table[i].name;
359 
360  if (name == NULL || strlen(name) == 0) {
361  continue;
362  }
363 
364  if (strcmp(keyword, name) == 0) {
365  return true;
366  }
367  }
368 
369  return false;
370 }
371 
372 int SigTableList(const char *keyword)
373 {
374  size_t size = DETECT_TBLSIZE;
375  size_t i;
376 
377  if (keyword == NULL) {
378  printf("=====Supported keywords=====\n");
379  for (i = 0; i < size; i++) {
380  const char *name = sigmatch_table[i].name;
381  if (name != NULL && strlen(name) > 0) {
382  if (name[0] == '_' || strcmp(name, "template") == 0)
383  continue;
384 
386  printf("- %s (not built-in)\n", name);
387  } else {
388  printf("- %s\n", name);
389  }
390  }
391  }
392  } else if (strcmp("csv", keyword) == 0) {
393  printf("name;description;app layer;features;documentation\n");
394  for (i = 0; i < size; i++) {
395  const char *name = sigmatch_table[i].name;
396  if (name != NULL && strlen(name) > 0) {
398  continue;
399  }
400  if (name[0] == '_' || strcmp(name, "template") == 0)
401  continue;
402 
403  printf("%s;", name);
404  if (sigmatch_table[i].desc) {
405  printf("%s", sigmatch_table[i].desc);
406  }
407  /* Build feature */
408  printf(";Unset;"); // this used to be alproto
409  PrintFeatureList(&sigmatch_table[i], ':');
410  printf(";");
411  if (sigmatch_table[i].url) {
412  printf("%s%s", GetDocURL(), sigmatch_table[i].url);
413  }
414  printf(";");
415  printf("\n");
416  }
417  }
418  } else if (strcmp("all", keyword) == 0) {
419  for (i = 0; i < size; i++) {
420  const char *name = sigmatch_table[i].name;
421  if (name != NULL && strlen(name) > 0) {
422  if (name[0] == '_' || strcmp(name, "template") == 0)
423  continue;
424  printf("%s:\n", sigmatch_table[i].name);
425  SigMultilinePrint(i, "\t");
426  }
427  }
428  } else {
429  for (i = 0; i < size; i++) {
430  if ((sigmatch_table[i].name != NULL) &&
431  strcmp(sigmatch_table[i].name, keyword) == 0) {
432  printf("= %s =\n", sigmatch_table[i].name);
434  printf("Not built-in\n");
435  return TM_ECODE_FAILED;
436  }
437  SigMultilinePrint(i, "");
438  return TM_ECODE_DONE;
439  }
440  }
441  printf("Non existing keyword\n");
442  return TM_ECODE_FAILED;
443  }
444  return TM_ECODE_DONE;
445 }
446 
447 static void DetectFileHandlerRegister(void)
448 {
449  for (int i = 0; i < DETECT_TBLSIZE_STATIC; i++) {
450  if (filehandler_table[i].name)
452  }
453 }
454 
455 void SigTableCleanup(void)
456 {
457  if (sigmatch_table != NULL) {
459  sigmatch_table = NULL;
460  DETECT_TBLSIZE = 0;
461  }
462 }
463 
464 void SigTableInit(void)
465 {
466  if (sigmatch_table == NULL) {
469  if (sigmatch_table == NULL) {
470  DETECT_TBLSIZE = 0;
471  FatalError("Could not allocate sigmatch_table");
472  }
473  }
474 }
475 
476 void SigTableSetup(void)
477 {
492 
493  /* NOTE: the order of these currently affects inspect
494  * engine registration order and ultimately the order
495  * of inspect engines in the rule. Which in turn affects
496  * state keeping */
512 
520 
523 
527 
536 
545 
556 
561 
563  /* end of order dependent regs */
564 
566 
681 
684 
685  DetectTransformCompressWhitespaceRegister();
686  DetectTransformStripWhitespaceRegister();
687  DetectTransformStripPseudoHeadersRegister();
688  DetectTransformMd5Register();
689  DetectTransformSha1Register();
690  DetectTransformSha256Register();
691  DetectTransformDotPrefixRegister();
693  DetectTransformUrlDecodeRegister();
694  DetectTransformXorRegister();
695  DetectTransformToLowerRegister();
696  DetectTransformToUpperRegister();
697  DetectTransformHeaderLowercaseRegister();
699 
700  DetectFileHandlerRegister();
701 
702  ScDetectSNMPRegister();
703  ScDetectDHCPRegister();
704  ScDetectWebsocketRegister();
705  ScDetectEnipRegister();
706  ScDetectMqttRegister();
707  ScDetectRfbRegister();
708  ScDetectSipRegister();
709  ScDetectTemplateRegister();
710 
711  /* close keyword registration */
713 }
714 
715 #ifdef UNITTESTS
717 {
718  /* register the tests */
719  for (int i = 0; i < DETECT_TBLSIZE; i++) {
720  g_ut_modules++;
721  if (sigmatch_table[i].RegisterTests != NULL) {
723  g_ut_covered++;
724  } else {
725  SCLogDebug("detection plugin %s has no unittest "
726  "registration function.", sigmatch_table[i].name);
727 
728  if (coverage_unittests)
729  SCLogWarning("detection plugin %s has no unittest "
730  "registration function.",
731  sigmatch_table[i].name);
732  }
733  }
734 }
735 #endif
DETECT_TBLSIZE_STATIC
@ DETECT_TBLSIZE_STATIC
Definition: detect-engine-register.h:335
detect-tcp-flags.h
detect-ssh-hassh-server-string.h
DetectSshVersionRegister
void DetectSshVersionRegister(void)
Registration function for keyword: ssh.protoversion.
Definition: detect-ssh-proto-version.c:39
DetectDceStubDataRegister
void DetectDceStubDataRegister(void)
Registers the keyword handlers for the "dce_stub_data" keyword.
Definition: detect-dce-stub-data.c:117
DetectFragBitsRegister
void DetectFragBitsRegister(void)
Registration function for fragbits: keyword.
Definition: detect-fragbits.c:85
DetectHttpHHRegister
void DetectHttpHHRegister(void)
Registers the keyword handlers for the "http_host" keyword.
Definition: detect-http-host.c:88
DetectITypeRegister
void DetectITypeRegister(void)
Registration function for itype: keyword.
Definition: detect-itype.c:57
detect-icmpv4hdr.h
DetectAppLayerEventRegister
void DetectAppLayerEventRegister(void)
Registers the keyword handlers for the "app-layer-event" keyword.
Definition: detect-app-layer-event.c:71
tm-threads.h
DetectDsizeRegister
void DetectDsizeRegister(void)
Registration function for dsize: keyword.
Definition: detect-dsize.c:61
detect-content.h
detect-target.h
DetectMsgRegister
void DetectMsgRegister(void)
Definition: detect-msg.c:42
detect-quic-cyu-string.h
DetectTlsJa3HashRegister
void DetectTlsJa3HashRegister(void)
Registration function for keyword: ja3_hash.
Definition: detect-tls-ja3-hash.c:83
detect-ssh-hassh-string.h
DetectTemplateRegister
void DetectTemplateRegister(void)
Registration function for template: keyword.
Definition: detect-template.c:55
detect-engine.h
detect-app-layer-protocol.h
detect-dce-iface.h
SIGMATCH_INFO_STICKY_BUFFER
#define SIGMATCH_INFO_STICKY_BUFFER
Definition: detect.h:1517
DetectGeoipRegister
void DetectGeoipRegister(void)
Registration function for geoip keyword (no libgeoip support)
Definition: detect-geoip.c:54
detect-engine-proto.h
DetectNfsVersionRegister
void DetectNfsVersionRegister(void)
Registration function for nfs_procedure keyword.
Definition: detect-nfs-version.c:62
DetectXbitsRegister
void DetectXbitsRegister(void)
Definition: detect-xbits.c:69
DetectTlsJa3SHashRegister
void DetectTlsJa3SHashRegister(void)
Registration function for keyword: ja3s.hash.
Definition: detect-tls-ja3s-hash.c:83
detect-dsize.h
DetectRevRegister
void DetectRevRegister(void)
Definition: detect-rev.c:34
detect-noalert.h
sigmatch_table
SigTableElmt * sigmatch_table
Definition: detect-parse.c:128
detect-gid.h
DetectIkeExchTypeRegister
void DetectIkeExchTypeRegister(void)
Registration function for ike.exchtype keyword.
Definition: detect-ike-exch-type.c:50
DetectConfigRegister
void DetectConfigRegister(void)
Registration function for keyword: filestore.
Definition: detect-config.c:76
stream-tcp-inline.h
detect-priority.h
util-hashlist.h
DetectTcpmssRegister
void DetectTcpmssRegister(void)
Registration function for tcpmss: keyword.
Definition: detect-tcpmss.c:51
detect-filesha1.h
g_ut_modules
int g_ut_modules
Definition: suricata.c:890
detect-sid.h
DetectTlsSerialRegister
void DetectTlsSerialRegister(void)
Registration function for keyword: tls.cert_serial.
Definition: detect-tls-cert-serial.c:72
detect-engine-siggroup.h
SIGMATCH_INFO_CONTENT_MODIFIER
#define SIGMATCH_INFO_CONTENT_MODIFIER
Definition: detect.h:1515
DetectSidRegister
void DetectSidRegister(void)
Definition: detect-sid.c:40
DetectIkeNonceRegister
void DetectIkeNonceRegister(void)
Definition: detect-ike-nonce-payload.c:92
SigTableElmt_::name
const char * name
Definition: detect.h:1309
DetectSshSoftwareVersionRegister
void DetectSshSoftwareVersionRegister(void)
Registration function for keyword: ssh.softwareversion.
Definition: detect-ssh-software-version.c:39
stream-tcp.h
detect-engine-event.h
detect-tls-cert-validity.h
detect-mark.h
detect-pktvar.h
detect-nfs-version.h
DetectQuicCyuHashRegister
void DetectQuicCyuHashRegister(void)
Definition: detect-quic-cyu-hash.c:125
DetectTlsFingerprintRegister
void DetectTlsFingerprintRegister(void)
Registration function for keyword: tls.cert_fingerprint.
Definition: detect-tls-cert-fingerprint.c:72
DetectSmbNtlmsspDomainRegister
void DetectSmbNtlmsspDomainRegister(void)
Definition: detect-smb-ntlmssp.c:134
DetectHttpServerBodyRegister
void DetectHttpServerBodyRegister(void)
Registers the keyword handlers for the "http_server_body" keyword.
Definition: detect-http-server-body.c:68
detect-tls-cert-fingerprint.h
DetectHttpHeadersRegister
void DetectHttpHeadersRegister(void)
Definition: detect-http-headers.c:29
DetectHttpStartRegister
void DetectHttpStartRegister(void)
Registers the keyword handlers for the "http_start" keyword.
Definition: detect-http-start.c:182
DetectDNP3Register
void DetectDNP3Register(void)
Definition: detect-dnp3.c:546
DetectHttpUriRegister
void DetectHttpUriRegister(void)
Registration function for keywords: http_uri and http.uri.
Definition: detect-http-uri.c:89
DetectGidRegister
void DetectGidRegister(void)
Registration function for gid: keyword.
Definition: detect-gid.c:48
detect-ike-nonce-payload-length.h
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
DetectHttpRequestHeaderRegister
void DetectHttpRequestHeaderRegister(void)
Definition: detect-http-header.c:627
detect-isdataat.h
detect-ssh-software.h
DetectQuicUaRegister
void DetectQuicUaRegister(void)
Registration function for quic.ua: keyword.
Definition: detect-quic-ua.c:71
DetectIPProtoRegister
void DetectIPProtoRegister(void)
Registration function for ip_proto keyword.
Definition: detect-ipproto.c:60
SigTableSetup
void SigTableSetup(void)
Definition: detect-engine-register.c:476
detect-classtype.h
detect-smb-share.h
util-lua.h
DetectICMPv6hdrRegister
void DetectICMPv6hdrRegister(void)
Registration function for icmpv6.hdr: keyword.
Definition: detect-icmpv6hdr.c:51
DetectSshHasshRegister
void DetectSshHasshRegister(void)
Registration function for hassh keyword.
Definition: detect-ssh-hassh.c:193
DetectTlsJa3StringRegister
void DetectTlsJa3StringRegister(void)
Registration function for keyword: ja3.string.
Definition: detect-tls-ja3-string.c:79
TM_ECODE_DONE
@ TM_ECODE_DONE
Definition: tm-threads-common.h:82
detect-bsize.h
action-globals.h
DetectTlsRandomRegister
void DetectTlsRandomRegister(void)
Registration function for keyword: tls.random.
Definition: detect-tls-random.c:112
DetectPriorityRegister
void DetectPriorityRegister(void)
Registers the handler functions for the "priority" keyword.
Definition: detect-priority.c:49
detect-smb-ntlmssp.h
DetectHttpRawHeaderRegister
void DetectHttpRawHeaderRegister(void)
Registers the keyword handlers for the "http_raw_header" keyword.
Definition: detect-http-raw-header.c:78
DetectDceIfaceRegister
void DetectDceIfaceRegister(void)
Registers the keyword handlers for the "dce_iface" keyword.
Definition: detect-dce-iface.c:69
flow-private.h
DetectFilesizeRegister
void DetectFilesizeRegister(void)
Registration function for filesize: keyword.
Definition: detect-filesize.c:61
DetectHttpProtocolRegister
void DetectHttpProtocolRegister(void)
Registers the keyword handlers for the "http.protocol" keyword.
Definition: detect-http-protocol.c:158
DetectFragOffsetRegister
void DetectFragOffsetRegister(void)
Registration function for fragoffset.
Definition: detect-fragoffset.c:60
DetectRpcRegister
void DetectRpcRegister(void)
Registration function for rpc keyword.
Definition: detect-rpc.c:61
detect-tcpmss.h
SigTableElmt_::flags
uint16_t flags
Definition: detect.h:1303
SigTableInit
void SigTableInit(void)
Definition: detect-engine-register.c:464
DetectSameipRegister
void DetectSameipRegister(void)
Registration function for sameip: keyword.
Definition: detect-sameip.c:51
detect-template2.h
DetectSmbVersionRegister
void DetectSmbVersionRegister(void)
Registers the keyword handlers for the "smb_version" keyword.
Definition: detect-smb-version.c:135
detect-ftpbounce.h
DetectFileRegisterFileProtocols
void DetectFileRegisterFileProtocols(DetectFileHandlerTableElmt *reg)
Definition: detect-parse.c:80
detect-ssh-hassh-server.h
detect-dns-opcode.h
g_ut_covered
int g_ut_covered
Definition: suricata.c:891
DetectSshHasshStringRegister
void DetectSshHasshStringRegister(void)
Registration function for hassh.string keyword.
Definition: detect-ssh-hassh-string.c:123
DetectIcmpv4HdrRegister
void DetectIcmpv4HdrRegister(void)
Registration function for icmpv4.hdr: keyword.
Definition: detect-icmpv4hdr.c:47
detect-tls-ja3-string.h
detect-filemd5.h
SIGMATCH_DEONLY_COMPAT
#define SIGMATCH_DEONLY_COMPAT
Definition: detect.h:1497
detect-tls-random.h
detect-tcp-seq.h
detect-http-header.h
detect-lua.h
detect-flowint.h
flow-bit.h
DetectTcphdrRegister
void DetectTcphdrRegister(void)
Registration function for tcp.hdr: keyword.
Definition: detect-tcphdr.c:50
util-var-name.h
detect-dnp3.h
rust.h
detect-http-client-body.h
DetectFlowBytesToClientRegister
void DetectFlowBytesToClientRegister(void)
Definition: detect-flow-pkts.c:207
DetectDatarepRegister
void DetectDatarepRegister(void)
Definition: detect-datarep.c:52
DetectFlowBytesToServerRegister
void DetectFlowBytesToServerRegister(void)
Definition: detect-flow-pkts.c:251
detect-file-data.h
util-privs.h
DetectHostbitsRegister
void DetectHostbitsRegister(void)
Definition: detect-hostbits.c:81
detect-flow-age.h
DetectTlsValidityRegister
void DetectTlsValidityRegister(void)
Registration function for tls validity keywords.
Definition: detect-tls-cert-validity.c:80
DetectIpOptsRegister
void DetectIpOptsRegister(void)
Registration function for ipopts: keyword.
Definition: detect-ipopts.c:47
DetectSshHasshServerRegister
void DetectSshHasshServerRegister(void)
Registration function for hasshServer keyword.
Definition: detect-ssh-hassh-server.c:191
detect-icmpv6-mtu.h
DetectDnsAnswerNameRegister
void DetectDnsAnswerNameRegister(void)
Definition: detect-dns-answer-name.c:72
detect-rev.h
DetectUricontentRegister
void DetectUricontentRegister(void)
Registration function for uricontent: keyword.
Definition: detect-uricontent.c:67
detect-tag.h
detect-ftpdata.h
detect-tls-sni.h
detect-engine-payload.h
DetectMetadataRegister
void DetectMetadataRegister(void)
Definition: detect-metadata.c:44
detect-l3proto.h
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:81
SigTableElmt_
element in sigmatch type table.
Definition: detect.h:1275
filehandler_table
DetectFileHandlerTableElmt filehandler_table[DETECT_TBLSIZE_STATIC]
Definition: detect-parse.c:78
detect-pcre.h
DetectHttpHeaderNamesRegister
void DetectHttpHeaderNamesRegister(void)
Registers the keyword handlers for the "http.header_names" keyword.
Definition: detect-http-header-names.c:211
detect-depth.h
detect-engine-prefilter.h
detect-icmpv6hdr.h
DetectFilemagicRegister
void DetectFilemagicRegister(void)
Registration function for keyword: filemagic.
Definition: detect-filemagic.c:73
DetectDnsRrtypeRegister
void DetectDnsRrtypeRegister(void)
Definition: detect-dns-rrtype.c:68
util-unittest.h
DetectTlsSniRegister
void DetectTlsSniRegister(void)
Registration function for keyword: tls.sni.
Definition: detect-tls-sni.c:65
DetectTargetRegister
void DetectTargetRegister(void)
Registration function for target keyword.
Definition: detect-target.c:51
DetectBufferTypeCloseRegistration
void DetectBufferTypeCloseRegistration(void)
Definition: detect-engine.c:1818
SIGMATCH_NOT_BUILT
#define SIGMATCH_NOT_BUILT
Definition: detect.h:1499
detect-filename.h
util-unittest-helper.h
detect-stream_size.h
detect-http-ua.h
detect-asn1.h
detect-flowvar.h
detect-base64-data.h
detect-krb5-errcode.h
SigTableRegisterTests
void SigTableRegisterTests(void)
Definition: detect-engine-register.c:716
detect-udphdr.h
detect-http-protocol.h
detect-reference.h
DetectHttpResponseHeaderRegister
void DetectHttpResponseHeaderRegister(void)
Definition: detect-http-header.c:660
detect-rpc.h
detect-sameip.h
detect-dce-stub-data.h
detect-dns-query.h
DetectSeqRegister
void DetectSeqRegister(void)
Registration function for ack: keyword.
Definition: detect-tcp-seq.c:53
DetectAsn1Register
void DetectAsn1Register(void)
Registration function for asn1.
Definition: detect-asn1.c:48
DetectFlowAgeRegister
void DetectFlowAgeRegister(void)
Definition: detect-flow-age.c:86
detect-krb5-msgtype.h
DetectBsizeRegister
void DetectBsizeRegister(void)
Registration function for bsize: keyword.
Definition: detect-bsize.c:98
DetectSmbShareRegister
void DetectSmbShareRegister(void)
Definition: detect-smb-share.c:139
app-layer-htp.h
detect-xbits.h
DetectFlowPktsToClientRegister
void DetectFlowPktsToClientRegister(void)
Definition: detect-flow-pkts.c:87
DetectDnsRcodeRegister
void DetectDnsRcodeRegister(void)
Definition: detect-dns-rcode.c:68
detect-app-layer-event.h
DetectBytejumpRegister
void DetectBytejumpRegister(void)
Definition: detect-bytejump.c:72
detect-ike-nonce-payload.h
decode.h
DetectICMPv6mtuRegister
void DetectICMPv6mtuRegister(void)
Registration function for icmpv6.mtu: keyword.
Definition: detect-icmpv6-mtu.c:48
detect-ssh-hassh.h
util-debug.h
detect-transform-pcrexform.h
SigTableCleanup
void SigTableCleanup(void)
Definition: detect-engine-register.c:455
detect-http-header-names.h
DetectTlsVersionRegister
void DetectTlsVersionRegister(void)
Registration function for keyword: tls.version.
Definition: detect-tls-version.c:73
DetectReplaceRegister
void DetectReplaceRegister(void)
Definition: detect-replace.c:58
detect-detection-filter.h
DetectICodeRegister
void DetectICodeRegister(void)
Registration function for icode: keyword.
Definition: detect-icode.c:60
detect-iprep.h
detect-rawbytes.h
DetectWindowRegister
void DetectWindowRegister(void)
Registration function for window: keyword.
Definition: detect-tcp-window.c:59
detect-http2.h
DetectL3ProtoRegister
void DetectL3ProtoRegister(void)
Registration function for ip_proto keyword.
Definition: detect-l3proto.c:54
detect-fragbits.h
DetectKrb5ErrCodeRegister
void DetectKrb5ErrCodeRegister(void)
Registration function for krb5_err_code: keyword.
Definition: detect-krb5-errcode.c:58
detect-ipv6hdr.h
DetectWithinRegister
void DetectWithinRegister(void)
Definition: detect-within.c:52
DetectContentRegister
void DetectContentRegister(void)
Definition: detect-content.c:58
detect-http-response-line.h
detect-tos.h
util-print.h
DetectSshProtocolRegister
void DetectSshProtocolRegister(void)
Definition: detect-ssh-proto.c:95
detect-filemagic.h
detect-engine-mpm.h
DetectIcmpIdRegister
void DetectIcmpIdRegister(void)
Registration function for icode: icmp_id.
Definition: detect-icmp-id.c:59
DETECT_TBLSIZE_IDX
int DETECT_TBLSIZE_IDX
Definition: detect-engine-register.c:282
detect.h
DetectSslStateRegister
void DetectSslStateRegister(void)
Registers the keyword handlers for the "ssl_state" keyword.
Definition: detect-ssl-state.c:73
detect-http-start.h
DetectLuaRegister
void DetectLuaRegister(void)
Registration function for keyword: lua.
Definition: detect-lua.c:78
detect-ja4-hash.h
pkt-var.h
DetectIkeVendorRegister
void DetectIkeVendorRegister(void)
Registration function for ike.vendor keyword.
Definition: detect-ike-vendor.c:70
detect-quic-version.h
DetectFiledataRegister
void DetectFiledataRegister(void)
Registration function for keyword: file_data.
Definition: detect-file-data.c:71
detect-prefilter.h
DetectIpv6hdrRegister
void DetectIpv6hdrRegister(void)
Registration function for ipv6.hdr: keyword.
Definition: detect-ipv6hdr.c:50
DetectIkeKeyExchangeRegister
void DetectIkeKeyExchangeRegister(void)
Definition: detect-ike-key-exchange-payload.c:92
detect-http-uri.h
detect-tcp-window.h
detect-engine-port.h
DetectIcmpSeqRegister
void DetectIcmpSeqRegister(void)
Registration function for icmp_seq.
Definition: detect-icmp-seq.c:58
DetectIdRegister
void DetectIdRegister(void)
Registration function for keyword: id.
Definition: detect-id.c:65
DetectHttpUARegister
void DetectHttpUARegister(void)
Registers the keyword handlers for the "http_user_agent" keyword.
Definition: detect-http-ua.c:79
SigTableHasKeyword
bool SigTableHasKeyword(const char *keyword)
Check if a keyword exists.
Definition: detect-engine-register.c:351
detect-ike-vendor.h
SCLogWarning
#define SCLogWarning(...)
Macro used to log WARNING messages.
Definition: util-debug.h:249
detect-itype.h
DetectFlowPktsToServerRegister
void DetectFlowPktsToServerRegister(void)
Definition: detect-flow-pkts.c:161
detect-requires.h
detect-engine-profile.h
DetectPktDataRegister
void DetectPktDataRegister(void)
Registration function for keyword: file_data.
Definition: detect-pkt-data.c:53
util-profiling.h
util-rule-vars.h
DetectRequiresRegister
void DetectRequiresRegister(void)
Definition: detect-requires.c:44
detect-frame.h
DetectFlowbitsRegister
void DetectFlowbitsRegister(void)
Definition: detect-flowbits.c:65
DetectDnsQueryNameRegister
void DetectDnsQueryNameRegister(void)
Definition: detect-dns-query-name.c:72
DetectDatasetRegister
void DetectDatasetRegister(void)
Definition: detect-dataset.c:55
DetectUdphdrRegister
void DetectUdphdrRegister(void)
Registration function for udp.hdr: keyword.
Definition: detect-udphdr.c:49
conf-yaml-loader.h
DetectBytetestRegister
void DetectBytetestRegister(void)
Definition: detect-bytetest.c:77
DetectTlsSubjectAltNameRegister
void DetectTlsSubjectAltNameRegister(void)
Registration function for keyword: tls.subjectaltname.
Definition: detect-tls-subjectaltname.c:64
detect-modbus.h
DetectDepthRegister
void DetectDepthRegister(void)
Definition: detect-depth.c:48
detect-bytejump.h
detect-id.h
conf.h
detect-engine-alert.h
detect-dns-answer-name.h
DetectSipMethodRegister
void DetectSipMethodRegister(void)
Definition: detect-sip-method.c:127
detect-ike-spi.h
detect-ipproto.h
DetectTransformPcrexformRegister
void DetectTransformPcrexformRegister(void)
Definition: detect-transform-pcrexform.c:46
detect-krb5-ticket-encryption.h
detect-nfs-procedure.h
detect-engine-state.h
Data structures and function prototypes for keeping state for the detection engine.
detect-filestore.h
detect-http-stat-code.h
detect-replace.h
detect-krb5-cname.h
DetectMarkRegister
void DetectMarkRegister(void)
Registration function for nfq_set_mark: keyword.
Definition: detect-mark.c:56
DetectReferenceRegister
void DetectReferenceRegister(void)
Registration function for the reference: keyword.
Definition: detect-reference.c:61
detect-sip-method.h
DetectFileSha256Register
void DetectFileSha256Register(void)
Registration function for keyword: filesha256.
Definition: detect-filesha256.c:44
DetectPrefilterRegister
void DetectPrefilterRegister(void)
Definition: detect-prefilter.c:37
util-mpm-ac.h
detect-krb5-sname.h
DetectTlsCertsRegister
void DetectTlsCertsRegister(void)
Registration function for keyword: tls.certs.
Definition: detect-tls-certs.c:113
DetectFtpbounceRegister
void DetectFtpbounceRegister(void)
Registration function for ftpbounce: keyword.
Definition: detect-ftpbounce.c:61
detect-flowbits.h
runmodes.h
DetectKrb5TicketEncryptionRegister
void DetectKrb5TicketEncryptionRegister(void)
Definition: detect-krb5-ticket-encryption.c:68
detect-ssl-version.h
detect-offset.h
DetectOffsetRegister
void DetectOffsetRegister(void)
Definition: detect-offset.c:46
detect-nocase.h
detect-http-host.h
detect-fragoffset.h
detect-ttl.h
DetectSshSoftwareRegister
void DetectSshSoftwareRegister(void)
Definition: detect-ssh-software.c:96
DetectQuicSniRegister
void DetectQuicSniRegister(void)
Registration function for quic.sni: keyword.
Definition: detect-quic-sni.c:71
detect-engine-analyzer.h
DetectSipUriRegister
void DetectSipUriRegister(void)
Definition: detect-sip-uri.c:106
detect-engine-content-inspection.h
detect-quic-cyu-hash.h
detect-http-server-body.h
detect-ssh-software-version.h
detect-bypass.h
DetectBypassRegister
void DetectBypassRegister(void)
Registration function for keyword: bypass.
Definition: detect-bypass.c:59
DetectAckRegister
void DetectAckRegister(void)
Registration function for ack: keyword.
Definition: detect-tcp-ack.c:56
DetectFilestoreRegister
void DetectFilestoreRegister(void)
Registration function for keyword: filestore.
Definition: detect-filestore.c:79
DetectTlsRegister
void DetectTlsRegister(void)
Registration function for keyword: tls.version.
Definition: detect-tls.c:101
DetectTagRegister
void DetectTagRegister(void)
Registration function for keyword tag.
Definition: detect-tag.c:69
DetectHttpResponseLineRegister
void DetectHttpResponseLineRegister(void)
Registers the keyword handlers for the "http_response_line" keyword.
Definition: detect-http-response-line.c:99
detect-ike-key-exchange-payload.h
detect-fast-pattern.h
DetectTlsIssuerRegister
void DetectTlsIssuerRegister(void)
Registration function for keyword: tls.cert_issuer.
Definition: detect-tls-cert-issuer.c:68
DetectSmbNtlmsspUserRegister
void DetectSmbNtlmsspUserRegister(void)
Definition: detect-smb-ntlmssp.c:77
detect-ssh-proto-version.h
DetectBase64DataRegister
void DetectBase64DataRegister(void)
Definition: detect-base64-data.c:33
flags
uint8_t flags
Definition: decode-gre.h:0
DetectHttpStatCodeRegister
void DetectHttpStatCodeRegister(void)
Registration function for keyword: http_stat_code.
Definition: detect-http-stat-code.c:81
DetectDceOpnumRegister
void DetectDceOpnumRegister(void)
Registers the keyword handlers for the "dce_opnum" keyword.
Definition: detect-dce-opnum.c:70
detect-dns-rcode.h
DetectKrb5CNameRegister
void DetectKrb5CNameRegister(void)
Definition: detect-krb5-cname.c:82
DetectHttpHeaderRegister
void DetectHttpHeaderRegister(void)
Registers the keyword handlers for the "http_header" keyword.
Definition: detect-http-header.c:410
detect-tls.h
suricata-common.h
detect-dns-rrtype.h
detect-smb-version.h
util-path.h
detect-byte-extract.h
DETECT_TBLSIZE_STEP
#define DETECT_TBLSIZE_STEP
Definition: detect-engine-register.h:341
DetectTlsAlpnRegister
void DetectTlsAlpnRegister(void)
Registration function for keyword: tls.alpn.
Definition: detect-tls-alpn.c:64
detect-metadata.h
DetectKrb5SNameRegister
void DetectKrb5SNameRegister(void)
Definition: detect-krb5-sname.c:82
SigTableElmt_::Transform
void(* Transform)(InspectionBuffer *, void *context)
Definition: detect.h:1290
DetectHttpClientBodyRegister
void DetectHttpClientBodyRegister(void)
Registers the keyword handlers for the "http_client_body" keyword.
Definition: detect-http-client-body.c:84
DetectIkeSpiRegister
void DetectIkeSpiRegister(void)
Definition: detect-ike-spi.c:130
detect-http-headers.h
DetectDnsOpcodeRegister
void DetectDnsOpcodeRegister(void)
Definition: detect-dns-opcode.c:73
DetectCsumRegister
void DetectCsumRegister(void)
Registers handlers for all the checksum keywords. The checksum keywords that are registered are ipv4-...
Definition: detect-csum.c:139
DetectUrilenRegister
void DetectUrilenRegister(void)
Registration function for urilen: keyword.
Definition: detect-urilen.c:61
detect-tls-cert-subject.h
DetectIkeNoncePayloadLengthRegister
void DetectIkeNoncePayloadLengthRegister(void)
Registration function for ike.nonce_payload_length keyword.
Definition: detect-ike-nonce-payload-length.c:49
detect-tls-version.h
detect-dataset.h
detect-template.h
util-classification-config.h
DetectHttp2Register
void DetectHttp2Register(void)
Definition: detect-http2.c:110
detect-transform-base64.h
FatalError
#define FatalError(...)
Definition: util-debug.h:502
DetectNfsProcedureRegister
void DetectNfsProcedureRegister(void)
Registration function for nfs_procedure keyword.
Definition: detect-nfs-procedure.c:64
DetectIpv4hdrRegister
void DetectIpv4hdrRegister(void)
Registration function for ipv4.hdr: keyword.
Definition: detect-ipv4hdr.c:50
DetectHttpRequestLineRegister
void DetectHttpRequestLineRegister(void)
Registers the keyword handlers for the "http_request_line" keyword.
Definition: detect-http-request-line.c:99
DetectFileSha1Register
void DetectFileSha1Register(void)
Registration function for keyword: filesha1.
Definition: detect-filesha1.c:44
DetectFlowRegister
void DetectFlowRegister(void)
Registration function for flow: keyword.
Definition: detect-flow.c:65
DetectDnsQueryRegister
void DetectDnsQueryRegister(void)
Registration function for keyword: dns_query.
Definition: detect-dns-query.c:97
detect-hostbits.h
DetectSshHasshServerStringRegister
void DetectSshHasshServerStringRegister(void)
Registration function for hasshServer.string keyword.
Definition: detect-ssh-hassh-server-string.c:123
DetectRawbytesRegister
void DetectRawbytesRegister(void)
Definition: detect-rawbytes.c:43
detect-sip-uri.h
DetectTosRegister
void DetectTosRegister(void)
Register Tos keyword.
Definition: detect-tos.c:64
util-optimize.h
detect-ike-exch-type.h
detect-tls-alpn.h
detect-tls-certs.h
util-validate.h
DetectBytemathRegister
void DetectBytemathRegister(void)
Registers the keyword handlers for the "byte_math" keyword.
Definition: detect-bytemath.c:71
detect-flow.h
detect-quic-ua.h
detect-base64-decode.h
DetectEngineEventRegister
void DetectEngineEventRegister(void)
Registration function for decode-event: keyword.
Definition: detect-engine-event.c:127
DetectFlagsRegister
void DetectFlagsRegister(void)
Registration function for flags: keyword.
Definition: detect-tcp-flags.c:76
detect-http-raw-header.h
detect-engine-sigorder.h
detect-quic-sni.h
DetectKrb5MsgTypeRegister
void DetectKrb5MsgTypeRegister(void)
Registration function for krb5_msg_type: keyword.
Definition: detect-krb5-msgtype.c:58
DetectFlowvarRegister
void DetectFlowvarRegister(void)
Definition: detect-flowvar.c:54
detect-tcp-ack.h
detect-http-method.h
detect-within.h
DetectNoalertRegister
void DetectNoalertRegister(void)
Definition: detect-noalert.c:49
detect-tls-cert-issuer.h
DETECT_TBLSIZE
int DETECT_TBLSIZE
Definition: detect-engine-register.c:281
detect-datarep.h
detect-http-request-line.h
SCFree
#define SCFree(p)
Definition: util-mem.h:61
DetectQuicCyuStringRegister
void DetectQuicCyuStringRegister(void)
Definition: detect-quic-cyu-string.c:81
SigTableElmt_::SupportsPrefilter
bool(* SupportsPrefilter)(const Signature *s)
Definition: detect.h:1296
DetectQuicVersionRegister
void DetectQuicVersionRegister(void)
Registration function for quic.version: keyword.
Definition: detect-quic-version.c:71
detect-tcphdr.h
detect-tls-ja3s-hash.h
DetectSmbNamedPipeRegister
void DetectSmbNamedPipeRegister(void)
Definition: detect-smb-share.c:78
DetectStreamSizeRegister
void DetectStreamSizeRegister(void)
Registration function for stream_size: keyword.
Definition: detect-stream_size.c:58
detect-engine-iponly.h
detect-parse.h
DetectDetectionFilterRegister
void DetectDetectionFilterRegister(void)
Registration function for detection_filter: keyword.
Definition: detect-detection-filter.c:67
detect-icode.h
detect-pkt-data.h
detect-threshold.h
DetectDistanceRegister
void DetectDistanceRegister(void)
Definition: detect-distance.c:56
DetectTlsJa3SStringRegister
void DetectTlsJa3SStringRegister(void)
Registration function for keyword: ja3s.string.
Definition: detect-tls-ja3s-string.c:79
detect-geoip.h
detect-ssh-proto.h
DetectThresholdRegister
void DetectThresholdRegister(void)
Registration function for threshold: keyword.
Definition: detect-threshold.c:86
detect-tls-ja3-hash.h
DetectFlowintRegister
void DetectFlowintRegister(void)
Definition: detect-flowint.c:67
detect-filesize.h
DetectByteExtractRegister
void DetectByteExtractRegister(void)
Registers the keyword handlers for the "byte_extract" keyword.
Definition: detect-byte-extract.c:69
detect-icmp-id.h
DetectAppLayerProtocolRegister
void DetectAppLayerProtocolRegister(void)
Definition: detect-app-layer-protocol.c:348
app-layer-protos.h
detect-ssl-state.h
detect-ipopts.h
DetectTlsCertChainLenRegister
void DetectTlsCertChainLenRegister(void)
Definition: detect-tls-certs.c:246
detect-tls-ja3s-string.h
detect-urilen.h
suricata.h
DetectIPAddrBufferRegister
void DetectIPAddrBufferRegister(void)
Definition: detect-ipaddr.c:53
detect-ipv4hdr.h
GetDocURL
const char * GetDocURL(void)
Definition: suricata.c:1108
DetectFastPatternRegister
void DetectFastPatternRegister(void)
Registration function for fast_pattern keyword.
Definition: detect-fast-pattern.c:184
DetectHttpStatMsgRegister
void DetectHttpStatMsgRegister(void)
Registration function for keyword: http_stat_msg.
Definition: detect-http-stat-msg.c:91
DetectPktvarRegister
void DetectPktvarRegister(void)
Definition: detect-pktvar.c:48
detect-uricontent.h
DetectSslVersionRegister
void DetectSslVersionRegister(void)
Registration function for keyword: ssl_version.
Definition: detect-ssl-version.c:67
DetectModbusRegister
void DetectModbusRegister(void)
Registration function for Modbus keyword.
Definition: detect-modbus.c:120
detect-flow-pkts.h
SIGMATCH_NOOPT
#define SIGMATCH_NOOPT
Definition: detect.h:1493
detect-tls-cert-serial.h
detect-csum.h
app-layer-smtp.h
DetectNocaseRegister
void DetectNocaseRegister(void)
Definition: detect-nocase.c:39
DetectJa4HashRegister
void DetectJa4HashRegister(void)
Registration function for keyword: ja4.hash.
Definition: detect-ja4-hash.c:65
coverage_unittests
int coverage_unittests
Definition: suricata.c:889
detect-ike-chosen-sa.h
detect-distance.h
flow.h
DetectBase64DecodeRegister
void DetectBase64DecodeRegister(void)
Definition: detect-base64-decode.c:48
detect-ipaddr.h
DetectFilenameRegister
void DetectFilenameRegister(void)
Registration function for keyword: filename.
Definition: detect-filename.c:79
detect-ike-key-exchange-payload-length.h
DetectIPRepRegister
void DetectIPRepRegister(void)
Definition: detect-iprep.c:63
DetectIkeChosenSaRegister
void DetectIkeChosenSaRegister(void)
Registration function for ike.ChosenSa keyword.
Definition: detect-ike-chosen-sa.c:66
detect-engine-dcepayload.h
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
DetectIkeKeyExchangePayloadLengthRegister
void DetectIkeKeyExchangePayloadLengthRegister(void)
Registration function for ike.key_exchange_payload_length keyword.
Definition: detect-ike-key-exchange-payload-length.c:49
detect-config.h
DetectFtpdataRegister
void DetectFtpdataRegister(void)
Registration function for ftpcommand: keyword.
Definition: detect-ftpdata.c:59
detect-tls-subjectaltname.h
DetectHttpMethodRegister
void DetectHttpMethodRegister(void)
Registration function for keyword: http_method.
Definition: detect-http-method.c:79
SIGMATCH_IPONLY_COMPAT
#define SIGMATCH_IPONLY_COMPAT
Definition: detect.h:1495
DetectTtlRegister
void DetectTtlRegister(void)
Registration function for ttl: keyword.
Definition: detect-ttl.c:54
DetectTemplate2Register
void DetectTemplate2Register(void)
Registration function for template2: keyword.
Definition: detect-template2.c:51
DetectTlsSubjectRegister
void DetectTlsSubjectRegister(void)
Registration function for keyword: tls.cert_subject.
Definition: detect-tls-cert-subject.c:68
detect-http-stat-msg.h
DetectPcreRegister
void DetectPcreRegister(void)
Definition: detect-pcre.c:96
DetectClasstypeRegister
void DetectClasstypeRegister(void)
Registers the handler functions for the "Classtype" keyword.
Definition: detect-classtype.c:51
detect-dns-query-name.h
detect-engine-address.h
detect-dce-opnum.h
util-threshold-config.h
SigTableList
int SigTableList(const char *keyword)
Definition: detect-engine-register.c:372
SigTableElmt_::RegisterTests
void(* RegisterTests)(void)
Definition: detect.h:1301
detect-engine-threshold.h
DetectIsdataatRegister
void DetectIsdataatRegister(void)
Registration function for isdataat: keyword.
Definition: detect-isdataat.c:156
detect-icmp-seq.h
detect-bytemath.h
app-layer.h
detect-bytetest.h
DetectTransformFromBase64DecodeRegister
void DetectTransformFromBase64DecodeRegister(void)
Definition: detect-transform-base64.c:49
DetectFileMd5Register
void DetectFileMd5Register(void)
Registration function for keyword: filemd5.
Definition: detect-filemd5.c:44
detect-filesha256.h
DetectFrameRegister
void DetectFrameRegister(void)
Registration function for keyword: ja3_hash.
Definition: detect-frame.c:187
detect-msg.h