suricata
detect-engine-register.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2017 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  */
23 
24 #include "suricata-common.h"
25 #include "suricata.h"
26 #include "debug.h"
27 #include "detect.h"
28 #include "flow.h"
29 #include "flow-private.h"
30 #include "flow-bit.h"
31 
32 #include "detect-parse.h"
33 #include "detect-engine.h"
34 #include "detect-engine-profile.h"
35 
36 #include "detect-engine-alert.h"
37 #include "detect-engine-siggroup.h"
38 #include "detect-engine-address.h"
39 #include "detect-engine-proto.h"
40 #include "detect-engine-port.h"
41 #include "detect-engine-mpm.h"
42 #include "detect-engine-iponly.h"
45 
46 #include "detect-engine-payload.h"
48 #include "detect-dns-query.h"
49 #include "detect-tls-sni.h"
50 #include "detect-tls-certs.h"
52 #include "detect-tls-cert-issuer.h"
54 #include "detect-tls-cert-serial.h"
55 #include "detect-tls-ja3-hash.h"
56 #include "detect-tls-ja3-string.h"
57 #include "detect-tls-ja3s-hash.h"
58 #include "detect-tls-ja3s-string.h"
59 #include "detect-engine-state.h"
60 #include "detect-engine-analyzer.h"
61 
62 #include "detect-http-cookie.h"
63 #include "detect-http-method.h"
64 #include "detect-http-ua.h"
65 #include "detect-http-host.h"
66 
67 #include "detect-nfs-procedure.h"
68 #include "detect-nfs-version.h"
69 
70 #include "detect-engine-event.h"
71 #include "decode.h"
72 
73 #include "detect-smb-share.h"
74 
75 #include "detect-base64-decode.h"
76 #include "detect-base64-data.h"
77 #include "detect-ipopts.h"
78 #include "detect-tcp-flags.h"
79 #include "detect-fragbits.h"
80 #include "detect-fragoffset.h"
81 #include "detect-gid.h"
82 #include "detect-tcp-ack.h"
83 #include "detect-tcp-seq.h"
84 #include "detect-content.h"
85 #include "detect-uricontent.h"
86 #include "detect-pcre.h"
87 #include "detect-depth.h"
88 #include "detect-nocase.h"
89 #include "detect-rawbytes.h"
90 #include "detect-bytetest.h"
91 #include "detect-bytejump.h"
92 #include "detect-sameip.h"
93 #include "detect-l3proto.h"
94 #include "detect-ipproto.h"
95 #include "detect-within.h"
96 #include "detect-distance.h"
97 #include "detect-offset.h"
98 #include "detect-sid.h"
99 #include "detect-prefilter.h"
100 #include "detect-priority.h"
101 #include "detect-classtype.h"
102 #include "detect-reference.h"
103 #include "detect-tag.h"
104 #include "detect-threshold.h"
105 #include "detect-metadata.h"
106 #include "detect-msg.h"
107 #include "detect-rev.h"
108 #include "detect-flow.h"
109 #include "detect-tcp-window.h"
110 #include "detect-ftpbounce.h"
111 #include "detect-isdataat.h"
112 #include "detect-id.h"
113 #include "detect-rpc.h"
114 #include "detect-asn1.h"
115 #include "detect-filename.h"
116 #include "detect-fileext.h"
117 #include "detect-filestore.h"
118 #include "detect-filemagic.h"
119 #include "detect-filemd5.h"
120 #include "detect-filesha1.h"
121 #include "detect-filesha256.h"
122 #include "detect-filesize.h"
123 #include "detect-dsize.h"
124 #include "detect-flowvar.h"
125 #include "detect-flowint.h"
126 #include "detect-pktvar.h"
127 #include "detect-noalert.h"
128 #include "detect-flowbits.h"
129 #include "detect-hostbits.h"
130 #include "detect-xbits.h"
131 #include "detect-csum.h"
132 #include "detect-stream_size.h"
133 #include "detect-engine-sigorder.h"
134 #include "detect-ttl.h"
135 #include "detect-fast-pattern.h"
136 #include "detect-itype.h"
137 #include "detect-icode.h"
138 #include "detect-icmp-id.h"
139 #include "detect-icmp-seq.h"
140 #include "detect-dce-iface.h"
141 #include "detect-dce-opnum.h"
142 #include "detect-dce-stub-data.h"
143 #include "detect-urilen.h"
144 #include "detect-bsize.h"
145 #include "detect-detection-filter.h"
146 #include "detect-http-client-body.h"
147 #include "detect-http-server-body.h"
148 #include "detect-http-header.h"
150 #include "detect-http-headers.h"
151 #include "detect-http-raw-header.h"
152 #include "detect-http-uri.h"
153 #include "detect-http-protocol.h"
154 #include "detect-http-start.h"
155 #include "detect-http-stat-msg.h"
158 #include "detect-byte-extract.h"
159 #include "detect-file-data.h"
160 #include "detect-pkt-data.h"
161 #include "detect-replace.h"
162 #include "detect-tos.h"
163 #include "detect-app-layer-event.h"
164 #include "detect-lua.h"
165 #include "detect-iprep.h"
166 #include "detect-geoip.h"
168 #include "detect-template.h"
169 #include "detect-template2.h"
170 #include "detect-tcphdr.h"
171 #include "detect-tcpmss.h"
172 #include "detect-udphdr.h"
173 #include "detect-krb5-cname.h"
174 #include "detect-krb5-errcode.h"
175 #include "detect-krb5-msgtype.h"
176 #include "detect-krb5-sname.h"
177 #include "detect-target.h"
179 #include "detect-snmp-version.h"
180 #include "detect-snmp-community.h"
181 #include "detect-snmp-pdu_type.h"
182 #include "detect-template-buffer.h"
183 #include "detect-bypass.h"
184 #include "detect-ftpdata.h"
186 
189 #include "detect-transform-md5.h"
190 #include "detect-transform-sha1.h"
191 #include "detect-transform-sha256.h"
192 
193 #include "util-rule-vars.h"
194 
195 #include "app-layer.h"
196 #include "app-layer-protos.h"
197 #include "app-layer-htp.h"
198 #include "app-layer-smtp.h"
199 #include "app-layer-template.h"
200 #include "detect-tls.h"
202 #include "detect-tls-version.h"
203 #include "detect-ssh-proto.h"
205 #include "detect-ssh-software.h"
207 #include "detect-http-stat-code.h"
208 #include "detect-ssl-version.h"
209 #include "detect-ssl-state.h"
210 #include "detect-modbus.h"
211 #include "detect-cipservice.h"
212 #include "detect-dnp3.h"
213 
214 #include "action-globals.h"
215 #include "tm-threads.h"
216 
217 #include "pkt-var.h"
218 
219 #include "conf.h"
220 #include "conf-yaml-loader.h"
221 
222 #include "stream-tcp.h"
223 #include "stream-tcp-inline.h"
224 
225 #include "util-lua.h"
226 #include "util-var-name.h"
228 #include "util-threshold-config.h"
229 #include "util-print.h"
230 #include "util-unittest.h"
231 #include "util-unittest-helper.h"
232 #include "util-debug.h"
233 #include "util-hashlist.h"
234 #include "util-privs.h"
235 #include "util-profiling.h"
236 #include "util-validate.h"
237 #include "util-optimize.h"
238 #include "util-path.h"
239 #include "util-mpm-ac.h"
240 #include "runmodes.h"
241 
242 static void PrintFeatureList(const SigTableElmt *e, char sep)
243 {
244  const uint16_t flags = e->flags;
245 
246  int prev = 0;
247  if (flags & SIGMATCH_NOOPT) {
248  printf("No option");
249  prev = 1;
250  }
251  if (flags & SIGMATCH_IPONLY_COMPAT) {
252  if (prev == 1)
253  printf("%c", sep);
254  printf("compatible with IP only rule");
255  prev = 1;
256  }
257  if (flags & SIGMATCH_DEONLY_COMPAT) {
258  if (prev == 1)
259  printf("%c", sep);
260  printf("compatible with decoder event only rule");
261  prev = 1;
262  }
263  if (flags & SIGMATCH_INFO_CONTENT_MODIFIER) {
264  if (prev == 1)
265  printf("%c", sep);
266  printf("content modifier");
267  prev = 1;
268  }
269  if (flags & SIGMATCH_INFO_STICKY_BUFFER) {
270  if (prev == 1)
271  printf("%c", sep);
272  printf("sticky buffer");
273  prev = 1;
274  }
275  if (e->Transform) {
276  if (prev == 1)
277  printf("%c", sep);
278  printf("transform");
279  prev = 1;
280  }
281  if (e->SupportsPrefilter) {
282  if (prev == 1)
283  printf("%c", sep);
284  printf("prefilter");
285  prev = 1;
286  }
287  if (prev == 0) {
288  printf("none");
289  }
290 }
291 
292 static void SigMultilinePrint(int i, const char *prefix)
293 {
294  if (sigmatch_table[i].desc) {
295  printf("%sDescription: %s\n", prefix, sigmatch_table[i].desc);
296  }
297  printf("%sFeatures: ", prefix);
298  PrintFeatureList(&sigmatch_table[i], ',');
299  if (sigmatch_table[i].url) {
300  printf("\n%sDocumentation: %s", prefix, sigmatch_table[i].url);
301  }
302  if (sigmatch_table[i].alternative) {
303  printf("\n%sReplaced by: %s", prefix, sigmatch_table[sigmatch_table[i].alternative].name);
304  }
305  printf("\n");
306 }
307 
308 void SigTableList(const char *keyword)
309 {
310  size_t size = sizeof(sigmatch_table) / sizeof(SigTableElmt);
311  size_t i;
312 
313  if (keyword == NULL) {
314  printf("=====Supported keywords=====\n");
315  for (i = 0; i < size; i++) {
316  const char *name = sigmatch_table[i].name;
317  if (name != NULL && strlen(name) > 0) {
318  if (name[0] == '_' || strcmp(name, "template") == 0)
319  continue;
320 
321  if (sigmatch_table[i].flags & SIGMATCH_NOT_BUILT) {
322  printf("- %s (not built-in)\n", name);
323  } else {
324  printf("- %s\n", name);
325  }
326  }
327  }
328  } else if (strcmp("csv", keyword) == 0) {
329  printf("name;description;app layer;features;documentation\n");
330  for (i = 0; i < size; i++) {
331  const char *name = sigmatch_table[i].name;
332  if (name != NULL && strlen(name) > 0) {
333  if (sigmatch_table[i].flags & SIGMATCH_NOT_BUILT) {
334  continue;
335  }
336  if (name[0] == '_' || strcmp(name, "template") == 0)
337  continue;
338 
339  printf("%s;", name);
340  if (sigmatch_table[i].desc) {
341  printf("%s", sigmatch_table[i].desc);
342  }
343  /* Build feature */
344  printf(";Unset;"); // this used to be alproto
345  PrintFeatureList(&sigmatch_table[i], ':');
346  printf(";");
347  if (sigmatch_table[i].url) {
348  printf("%s", sigmatch_table[i].url);
349  }
350  printf(";");
351  printf("\n");
352  }
353  }
354  } else if (strcmp("all", keyword) == 0) {
355  for (i = 0; i < size; i++) {
356  const char *name = sigmatch_table[i].name;
357  if (name != NULL && strlen(name) > 0) {
358  if (name[0] == '_' || strcmp(name, "template") == 0)
359  continue;
360  printf("%s:\n", sigmatch_table[i].name);
361  SigMultilinePrint(i, "\t");
362  }
363  }
364  } else {
365  for (i = 0; i < size; i++) {
366  if ((sigmatch_table[i].name != NULL) &&
367  strcmp(sigmatch_table[i].name, keyword) == 0) {
368  printf("= %s =\n", sigmatch_table[i].name);
369  if (sigmatch_table[i].flags & SIGMATCH_NOT_BUILT) {
370  printf("Not built-in\n");
371  return;
372  }
373  SigMultilinePrint(i, "");
374  return;
375  }
376  }
377  }
378  return;
379 }
380 
381 void SigTableSetup(void)
382 {
383  memset(sigmatch_table, 0, sizeof(sigmatch_table));
384 
399 
400  /* NOTE: the order of these currently affects inspect
401  * engine registration order and ultimately the order
402  * of inspect engines in the rule. Which in turn affects
403  * state keeping */
417 
426 
429 
432 
438 
445 
450 
452  /* end of order dependent regs */
453 
543 
549 
550  /* close keyword registration */
552 }
553 
555 {
556  /* register the tests */
557  int i = 0;
558  for (i = 0; i < DETECT_TBLSIZE; i++) {
559  g_ut_modules++;
560  if (sigmatch_table[i].RegisterTests != NULL) {
562  g_ut_covered++;
563  } else {
564  SCLogDebug("detection plugin %s has no unittest "
565  "registration function.", sigmatch_table[i].name);
566 
567  if (coverage_unittests)
568  SCLogWarning(SC_WARN_NO_UNITTESTS, "detection plugin %s has no unittest "
569  "registration function.", sigmatch_table[i].name);
570  }
571  }
572 }
void DetectAsn1Register(void)
Registration function for asn1.
Definition: detect-asn1.c:54
void DetectContentRegister(void)
void DetectDceIfaceRegister(void)
Registers the keyword handlers for the "dce_iface" keyword.
void DetectFileMd5Register(void)
Registration function for keyword: filemd5.
void DetectGidRegister(void)
Registration function for gid: keyword.
Definition: detect-gid.c:45
void DetectFastPatternRegister(void)
Registration function for fast_pattern keyword.
void DetectTcpmssRegister(void)
Registration function for tcpmss: keyword.
Definition: detect-tcpmss.c:56
void DetectTlsSubjectRegister(void)
Registration function for keyword: tls.cert_subject.
void SigTableSetup(void)
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
Definition: detect.h:1431
uint16_t flags
void DetectTlsSerialRegister(void)
Registration function for keyword: tls.cert_serial.
#define SCLogDebug(...)
Definition: util-debug.h:335
void DetectRawbytesRegister(void)
void DetectSNMPPduTypeRegister(void)
void DetectTtlRegister(void)
Registration function for ttl: keyword.
Definition: detect-ttl.c:60
void DetectSidRegister(void)
Definition: detect-sid.c:38
void DetectDNP3Register(void)
Definition: detect-dnp3.c:581
void DetectHttpHeadersRegister(void)
void DetectSmbShareRegister(void)
void DetectRevRegister(void)
Definition: detect-rev.c:34
void DetectTcphdrRegister(void)
Registration function for tcphdr: keyword.
Definition: detect-tcphdr.c:45
#define SIGMATCH_DEONLY_COMPAT
Definition: detect.h:1358
void DetectTemplateBufferRegister(void)
void DetectBytetestRegister(void)
void DetectFtpdataRegister(void)
Registration function for ftpcommand: keyword.
_Bool(* SupportsPrefilter)(const Signature *s)
Definition: detect.h:1172
void DetectDnsQueryRegister(void)
Registration function for keyword: dns_query.
void DetectWindowRegister(void)
Registration function for window: keyword.
void DetectTemplateRustBufferRegister(void)
void DetectFileSha1Register(void)
Registration function for keyword: filesha1.
void DetectFragBitsRegister(void)
Registration function for fragbits: keyword.
void DetectRpcRegister(void)
Registration function for rpc keyword.
Definition: detect-rpc.c:60
void DetectTargetRegister(void)
Registration function for target keyword.
Definition: detect-target.c:50
void DetectHttpHHRegister(void)
Registers the keyword handlers for the "http_host" keyword.
void DetectBase64DecodeRegister(void)
void DetectHttpRequestLineRegister(void)
Registers the keyword handlers for the "http_request_line" keyword.
void DetectDepthRegister(void)
Definition: detect-depth.c:47
void DetectTransformMd5Register(void)
void DetectSeqRegister(void)
Registration function for ack: keyword.
void DetectL3ProtoRegister(void)
Registration function for ip_proto keyword.
void DetectDceStubDataRegister(void)
Registers the keyword handlers for the "dce_stub_data" keyword.
#define SIGMATCH_INFO_CONTENT_MODIFIER
Definition: detect.h:1376
int g_ut_covered
Definition: suricata.c:863
void DetectSslVersionRegister(void)
Registration function for keyword: ssl_version.
void DetectTlsJa3SStringRegister(void)
Registration function for keyword: ja3s.string.
void DetectHttpHeaderRegister(void)
Registers the keyword handlers for the "http_header" keyword.
void DetectHttpClientBodyRegister(void)
Registers the keyword handlers for the "http_client_body" keyword.
element in sigmatch type table.
Definition: detect.h:1151
void DetectHttpStatCodeRegister(void)
Registration function for keyword: http_stat_code.
void DetectFileextRegister(void)
Registration function for keyword: fileext.
const char * name
Definition: detect.h:1184
void DetectBufferTypeCloseRegistration(void)
void DetectHttpHeaderNamesRegister(void)
Registers the keyword handlers for the "http.header_names" keyword.
void DetectIcmpIdRegister(void)
Registration function for icode: icmp_id.
void DetectFlowRegister(void)
Registration function for flow: keyword.
Definition: detect-flow.c:64
void DetectPrefilterRegister(void)
void DetectFragOffsetRegister(void)
Registration function for fragoffset.
void DetectNoalertRegister(void)
void(* Transform)(InspectionBuffer *)
Definition: detect.h:1167
void DetectTlsValidityRegister(void)
Registration function for tls validity keywords.
void DetectSslStateRegister(void)
Registers the keyword handlers for the "ssl_state" keyword.
void DetectTemplateRegister(void)
Registration function for template: keyword.
void DetectIPRepRegister(void)
Definition: detect-iprep.c:61
void DetectDsizeRegister(void)
Registration function for dsize: keyword.
Definition: detect-dsize.c:65
void DetectIPProtoRegister(void)
Registration function for ip_proto keyword.
void DetectPcreRegister(void)
Definition: detect-pcre.c:86
void DetectKrb5SNameRegister(void)
#define SIGMATCH_INFO_STICKY_BUFFER
Definition: detect.h:1378
void DetectUricontentRegister(void)
Registration function for uricontent: keyword.
void DetectFilenameRegister(void)
Registration function for keyword: filename.
void DetectIpOptsRegister(void)
Registration function for ipopts: keyword.
Definition: detect-ipopts.c:55
void DetectFilesizeRegister(void)
Registration function for filesize: keyword.
#define SIGMATCH_NOT_BUILT
Definition: detect.h:1360
Data structures and function prototypes for keeping state for the detection engine.
void DetectPktDataRegister(void)
Registration function for keyword: file_data.
void DetectOffsetRegister(void)
Definition: detect-offset.c:45
void DetectITypeRegister(void)
Registration function for itype: keyword.
Definition: detect-itype.c:61
void SigTableRegisterTests(void)
void DetectSshSoftwareRegister(void)
void DetectFileSha256Register(void)
Registration function for keyword: filesha256.
void DetectAckRegister(void)
Registration function for ack: keyword.
void DetectKrb5ErrCodeRegister(void)
void DetectPriorityRegister(void)
Registers the handler functions for the "priority" keyword.
void DetectLuaRegister(void)
Registration function for keyword: lua.
Definition: detect-lua.c:74
void DetectWithinRegister(void)
Definition: detect-within.c:51
void DetectDetectionFilterRegister(void)
Registration function for detection_filter: keyword.
void DetectBase64DataRegister(void)
void DetectFiledataRegister(void)
Registration function for keyword: file_data.
void DetectGeoipRegister(void)
Registration function for geoip keyword (no libgeoip support)
Definition: detect-geoip.c:52
void DetectBytejumpRegister(void)
void DetectTlsFingerprintRegister(void)
Registration function for keyword: tls.cert_fingerprint.
void DetectHttpUARegister(void)
Registers the keyword handlers for the "http_user_agent" keyword.
void DetectDceOpnumRegister(void)
Registers the keyword handlers for the "dce_opnum" keyword.
void DetectReplaceRegister(void)
void DetectUdphdrRegister(void)
Registration function for tcphdr: keyword.
Definition: detect-udphdr.c:45
void DetectHttpResponseLineRegister(void)
Registers the keyword handlers for the "http_response_line" keyword.
void DetectHttpMethodRegister(void)
Registration function for keyword: http_method.
void DetectSshVersionRegister(void)
Registration function for keyword: ssh.protoversion.
void DetectTransformSha1Register(void)
#define SCLogWarning(err_code,...)
Macro used to log WARNING messages.
Definition: util-debug.h:281
void DetectNfsVersionRegister(void)
Registration function for nfs_procedure keyword.
void DetectXbitsRegister(void)
Definition: detect-xbits.c:65
void DetectTransformCompressWhitespaceRegister(void)
void DetectTosRegister(void)
Register Tos keyword.
Definition: detect-tos.c:63
void DetectTlsCertsRegister(void)
Registration function for keyword: tls.certs.
void DetectHttpRawHeaderRegister(void)
Registers the keyword handlers for the "http_raw_header" keyword.
void DetectHttpProtocolRegister(void)
Registers the keyword handlers for the "http.protocol" keyword.
void DetectMarkRegister(void)
Registration function for nfq_set_mark: keyword.
Definition: detect-mark.c:54
void DetectTlsSniRegister(void)
Registration function for keyword: tls.sni.
void DetectTagRegister(void)
Registration function for keyword tag.
Definition: detect-tag.c:69
int coverage_unittests
Definition: suricata.c:861
void DetectFtpbounceRegister(void)
Registration function for ftpbounce: keyword.
int g_ut_modules
Definition: suricata.c:862
void DetectTlsJa3HashRegister(void)
Registration function for keyword: ja3_hash.
void DetectKrb5MsgTypeRegister(void)
void DetectEnipCommandRegister(void)
Registration function for enip_command: keyword.
void DetectTlsJa3SHashRegister(void)
Registration function for keyword: ja3s.hash.
void DetectAppLayerEventRegister(void)
Registers the keyword handlers for the "app-layer-event" keyword.
void DetectCsumRegister(void)
Registers handlers for all the checksum keywords. The checksum keywords that are registered are ipv4-...
Definition: detect-csum.c:128
void DetectReferenceRegister(void)
Registration function for the reference: keyword.
void DetectBsizeRegister(void)
Registration function for bsize: keyword.
Definition: detect-bsize.c:50
void DetectSNMPVersionRegister(void)
Registration function for snmp.procedure keyword.
void DetectTlsJa3StringRegister(void)
Registration function for keyword: ja3.string.
#define SIGMATCH_NOOPT
Definition: detect.h:1354
void DetectHttpStatMsgRegister(void)
Registration function for keyword: http_stat_msg.
void DetectTlsRegister(void)
Registration function for keyword: tls.version.
Definition: detect-tls.c:116
void DetectHostbitsRegister(void)
void DetectMetadataRegister(void)
void DetectICodeRegister(void)
Registration function for icode: keyword.
Definition: detect-icode.c:61
void DetectAppLayerProtocolRegister(void)
void DetectFilemagicRegister(void)
Registration function for keyword: filemagic.
void DetectDistanceRegister(void)
void DetectByteExtractRegister(void)
Registers the keyword handlers for the "byte_extract" keyword.
void DetectBypassRegister(void)
Registration function for keyword: bypass.
Definition: detect-bypass.c:61
void DetectTransformSha256Register(void)
void DetectTlsIssuerRegister(void)
Registration function for keyword: tls.cert_issuer.
void DetectTemplate2Register(void)
Registration function for template2: keyword.
void DetectModbusRegister(void)
Registration function for Modbus keyword.
void DetectPktvarRegister(void)
Definition: detect-pktvar.c:47
void DetectHttpUriRegister(void)
Registration function for keywords: http_uri and http.uri.
#define SIGMATCH_IPONLY_COMPAT
Definition: detect.h:1356
void DetectEngineEventRegister(void)
Registration function for decode-event: keyword.
void DetectNfsProcedureRegister(void)
Registration function for nfs_procedure keyword.
void SigTableList(const char *keyword)
void DetectNocaseRegister(void)
Definition: detect-nocase.c:38
void DetectThresholdRegister(void)
Registration function for threshold: keyword.
void DetectSshSoftwareVersionRegister(void)
Registration function for keyword: ssh.softwareversion.
void DetectFlowbitsRegister(void)
void DetectTransformStripWhitespaceRegister(void)
void DetectIsdataatRegister(void)
Registration function for isdataat: keyword.
void DetectUrilenRegister(void)
Registration function for urilen: keyword.
Definition: detect-urilen.c:65
void DetectHttpStartRegister(void)
Registers the keyword handlers for the "http_header" keyword.
void DetectMsgRegister(void)
Definition: detect-msg.c:40
void DetectKrb5CNameRegister(void)
uint16_t flags
Definition: detect.h:1178
void DetectSameipRegister(void)
Registration function for sameip: keyword.
Definition: detect-sameip.c:49
void DetectSshProtocolRegister(void)
void DetectStreamSizeRegister(void)
Registration function for stream_size: keyword.
void DetectTlsVersionRegister(void)
Registration function for keyword: tls.version.
void(* RegisterTests)(void)
Definition: detect.h:1176
void DetectSNMPCommunityRegister(void)
void DetectFlagsRegister(void)
Registration function for flags: keyword.
void DetectIcmpSeqRegister(void)
Registration function for icmp_seq.
void DetectClasstypeRegister(void)
Registers the handler functions for the "Classtype" keyword.
void DetectFlowvarRegister(void)
void DetectCipServiceRegister(void)
Registration function for cip_service: keyword.
void DetectIdRegister(void)
Registration function for keyword: id.
Definition: detect-id.c:64
void DetectFilestoreRegister(void)
Registration function for keyword: filestore.
void DetectSmbNamedPipeRegister(void)
void DetectHttpServerBodyRegister(void)
Registers the keyword handlers for the "http_server_body" keyword.
void DetectFlowintRegister(void)