suricata
detect-engine-register.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2017 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  */
23 
24 #include "suricata-common.h"
25 #include "suricata.h"
26 #include "debug.h"
27 #include "detect.h"
28 #include "flow.h"
29 #include "flow-private.h"
30 #include "flow-bit.h"
31 
32 #include "detect-parse.h"
33 #include "detect-engine.h"
34 #include "detect-engine-profile.h"
35 
36 #include "detect-engine-alert.h"
37 #include "detect-engine-siggroup.h"
38 #include "detect-engine-address.h"
39 #include "detect-engine-proto.h"
40 #include "detect-engine-port.h"
41 #include "detect-engine-mpm.h"
42 #include "detect-engine-iponly.h"
45 
46 #include "detect-engine-payload.h"
48 #include "detect-dns-query.h"
49 #include "detect-tls-sni.h"
50 #include "detect-tls-certs.h"
52 #include "detect-tls-cert-issuer.h"
54 #include "detect-tls-cert-serial.h"
55 #include "detect-tls-ja3-hash.h"
56 #include "detect-tls-ja3-string.h"
57 #include "detect-tls-ja3s-hash.h"
58 #include "detect-tls-ja3s-string.h"
59 #include "detect-engine-state.h"
60 #include "detect-engine-analyzer.h"
61 
62 #include "detect-http-cookie.h"
63 #include "detect-http-method.h"
64 #include "detect-http-ua.h"
65 #include "detect-http-host.h"
66 
67 #include "detect-nfs-procedure.h"
68 #include "detect-nfs-version.h"
69 
70 #include "detect-engine-event.h"
71 #include "decode.h"
72 
73 #include "detect-smb-share.h"
74 
75 #include "detect-base64-decode.h"
76 #include "detect-base64-data.h"
77 #include "detect-ipopts.h"
78 #include "detect-tcp-flags.h"
79 #include "detect-fragbits.h"
80 #include "detect-fragoffset.h"
81 #include "detect-gid.h"
82 #include "detect-tcp-ack.h"
83 #include "detect-tcp-seq.h"
84 #include "detect-content.h"
85 #include "detect-uricontent.h"
86 #include "detect-pcre.h"
87 #include "detect-depth.h"
88 #include "detect-nocase.h"
89 #include "detect-rawbytes.h"
90 #include "detect-bytetest.h"
91 #include "detect-bytejump.h"
92 #include "detect-sameip.h"
93 #include "detect-l3proto.h"
94 #include "detect-ipproto.h"
95 #include "detect-within.h"
96 #include "detect-distance.h"
97 #include "detect-offset.h"
98 #include "detect-sid.h"
99 #include "detect-prefilter.h"
100 #include "detect-priority.h"
101 #include "detect-classtype.h"
102 #include "detect-reference.h"
103 #include "detect-tag.h"
104 #include "detect-threshold.h"
105 #include "detect-metadata.h"
106 #include "detect-msg.h"
107 #include "detect-rev.h"
108 #include "detect-flow.h"
109 #include "detect-tcp-window.h"
110 #include "detect-ftpbounce.h"
111 #include "detect-isdataat.h"
112 #include "detect-id.h"
113 #include "detect-rpc.h"
114 #include "detect-asn1.h"
115 #include "detect-filename.h"
116 #include "detect-fileext.h"
117 #include "detect-filestore.h"
118 #include "detect-filemagic.h"
119 #include "detect-filemd5.h"
120 #include "detect-filesha1.h"
121 #include "detect-filesha256.h"
122 #include "detect-filesize.h"
123 #include "detect-dsize.h"
124 #include "detect-flowvar.h"
125 #include "detect-flowint.h"
126 #include "detect-pktvar.h"
127 #include "detect-noalert.h"
128 #include "detect-flowbits.h"
129 #include "detect-hostbits.h"
130 #include "detect-xbits.h"
131 #include "detect-csum.h"
132 #include "detect-stream_size.h"
133 #include "detect-engine-sigorder.h"
134 #include "detect-ttl.h"
135 #include "detect-fast-pattern.h"
136 #include "detect-itype.h"
137 #include "detect-icode.h"
138 #include "detect-icmp-id.h"
139 #include "detect-icmp-seq.h"
140 #include "detect-dce-iface.h"
141 #include "detect-dce-opnum.h"
142 #include "detect-dce-stub-data.h"
143 #include "detect-urilen.h"
144 #include "detect-bsize.h"
145 #include "detect-detection-filter.h"
146 #include "detect-http-client-body.h"
147 #include "detect-http-server-body.h"
148 #include "detect-http-header.h"
150 #include "detect-http-headers.h"
151 #include "detect-http-raw-header.h"
152 #include "detect-http-uri.h"
153 #include "detect-http-protocol.h"
154 #include "detect-http-start.h"
155 #include "detect-http-stat-msg.h"
158 #include "detect-byte-extract.h"
159 #include "detect-file-data.h"
160 #include "detect-pkt-data.h"
161 #include "detect-replace.h"
162 #include "detect-tos.h"
163 #include "detect-app-layer-event.h"
164 #include "detect-lua.h"
165 #include "detect-iprep.h"
166 #include "detect-geoip.h"
168 #include "detect-template.h"
169 #include "detect-template2.h"
170 #include "detect-tcphdr.h"
171 #include "detect-tcpmss.h"
172 #include "detect-udphdr.h"
173 #include "detect-ipv4hdr.h"
174 #include "detect-ipv6hdr.h"
175 #include "detect-krb5-cname.h"
176 #include "detect-krb5-errcode.h"
177 #include "detect-krb5-msgtype.h"
178 #include "detect-krb5-sname.h"
179 #include "detect-target.h"
181 #include "detect-snmp-version.h"
182 #include "detect-snmp-community.h"
183 #include "detect-snmp-pdu_type.h"
184 #include "detect-template-buffer.h"
185 #include "detect-bypass.h"
186 #include "detect-ftpdata.h"
188 
191 #include "detect-transform-md5.h"
192 #include "detect-transform-sha1.h"
193 #include "detect-transform-sha256.h"
194 
195 #include "util-rule-vars.h"
196 
197 #include "app-layer.h"
198 #include "app-layer-protos.h"
199 #include "app-layer-htp.h"
200 #include "app-layer-smtp.h"
201 #include "app-layer-template.h"
202 #include "detect-tls.h"
204 #include "detect-tls-version.h"
205 #include "detect-ssh-proto.h"
207 #include "detect-ssh-software.h"
209 #include "detect-http-stat-code.h"
210 #include "detect-ssl-version.h"
211 #include "detect-ssl-state.h"
212 #include "detect-modbus.h"
213 #include "detect-cipservice.h"
214 #include "detect-dnp3.h"
215 
216 #include "action-globals.h"
217 #include "tm-threads.h"
218 
219 #include "pkt-var.h"
220 
221 #include "conf.h"
222 #include "conf-yaml-loader.h"
223 
224 #include "stream-tcp.h"
225 #include "stream-tcp-inline.h"
226 
227 #include "util-lua.h"
228 #include "util-var-name.h"
230 #include "util-threshold-config.h"
231 #include "util-print.h"
232 #include "util-unittest.h"
233 #include "util-unittest-helper.h"
234 #include "util-debug.h"
235 #include "util-hashlist.h"
236 #include "util-privs.h"
237 #include "util-profiling.h"
238 #include "util-validate.h"
239 #include "util-optimize.h"
240 #include "util-path.h"
241 #include "util-mpm-ac.h"
242 #include "runmodes.h"
243 
244 static void PrintFeatureList(const SigTableElmt *e, char sep)
245 {
246  const uint16_t flags = e->flags;
247 
248  int prev = 0;
249  if (flags & SIGMATCH_NOOPT) {
250  printf("No option");
251  prev = 1;
252  }
253  if (flags & SIGMATCH_IPONLY_COMPAT) {
254  if (prev == 1)
255  printf("%c", sep);
256  printf("compatible with IP only rule");
257  prev = 1;
258  }
259  if (flags & SIGMATCH_DEONLY_COMPAT) {
260  if (prev == 1)
261  printf("%c", sep);
262  printf("compatible with decoder event only rule");
263  prev = 1;
264  }
265  if (flags & SIGMATCH_INFO_CONTENT_MODIFIER) {
266  if (prev == 1)
267  printf("%c", sep);
268  printf("content modifier");
269  prev = 1;
270  }
271  if (flags & SIGMATCH_INFO_STICKY_BUFFER) {
272  if (prev == 1)
273  printf("%c", sep);
274  printf("sticky buffer");
275  prev = 1;
276  }
277  if (e->Transform) {
278  if (prev == 1)
279  printf("%c", sep);
280  printf("transform");
281  prev = 1;
282  }
283  if (e->SupportsPrefilter) {
284  if (prev == 1)
285  printf("%c", sep);
286  printf("prefilter");
287  prev = 1;
288  }
289  if (prev == 0) {
290  printf("none");
291  }
292 }
293 
294 static void SigMultilinePrint(int i, const char *prefix)
295 {
296  if (sigmatch_table[i].desc) {
297  printf("%sDescription: %s\n", prefix, sigmatch_table[i].desc);
298  }
299  printf("%sFeatures: ", prefix);
300  PrintFeatureList(&sigmatch_table[i], ',');
301  if (sigmatch_table[i].url) {
302  printf("\n%sDocumentation: %s", prefix, sigmatch_table[i].url);
303  }
304  if (sigmatch_table[i].alternative) {
305  printf("\n%sReplaced by: %s", prefix, sigmatch_table[sigmatch_table[i].alternative].name);
306  }
307  printf("\n");
308 }
309 
310 void SigTableList(const char *keyword)
311 {
312  size_t size = sizeof(sigmatch_table) / sizeof(SigTableElmt);
313  size_t i;
314 
315  if (keyword == NULL) {
316  printf("=====Supported keywords=====\n");
317  for (i = 0; i < size; i++) {
318  const char *name = sigmatch_table[i].name;
319  if (name != NULL && strlen(name) > 0) {
320  if (name[0] == '_' || strcmp(name, "template") == 0)
321  continue;
322 
323  if (sigmatch_table[i].flags & SIGMATCH_NOT_BUILT) {
324  printf("- %s (not built-in)\n", name);
325  } else {
326  printf("- %s\n", name);
327  }
328  }
329  }
330  } else if (strcmp("csv", keyword) == 0) {
331  printf("name;description;app layer;features;documentation\n");
332  for (i = 0; i < size; i++) {
333  const char *name = sigmatch_table[i].name;
334  if (name != NULL && strlen(name) > 0) {
335  if (sigmatch_table[i].flags & SIGMATCH_NOT_BUILT) {
336  continue;
337  }
338  if (name[0] == '_' || strcmp(name, "template") == 0)
339  continue;
340 
341  printf("%s;", name);
342  if (sigmatch_table[i].desc) {
343  printf("%s", sigmatch_table[i].desc);
344  }
345  /* Build feature */
346  printf(";Unset;"); // this used to be alproto
347  PrintFeatureList(&sigmatch_table[i], ':');
348  printf(";");
349  if (sigmatch_table[i].url) {
350  printf("%s", sigmatch_table[i].url);
351  }
352  printf(";");
353  printf("\n");
354  }
355  }
356  } else if (strcmp("all", keyword) == 0) {
357  for (i = 0; i < size; i++) {
358  const char *name = sigmatch_table[i].name;
359  if (name != NULL && strlen(name) > 0) {
360  if (name[0] == '_' || strcmp(name, "template") == 0)
361  continue;
362  printf("%s:\n", sigmatch_table[i].name);
363  SigMultilinePrint(i, "\t");
364  }
365  }
366  } else {
367  for (i = 0; i < size; i++) {
368  if ((sigmatch_table[i].name != NULL) &&
369  strcmp(sigmatch_table[i].name, keyword) == 0) {
370  printf("= %s =\n", sigmatch_table[i].name);
371  if (sigmatch_table[i].flags & SIGMATCH_NOT_BUILT) {
372  printf("Not built-in\n");
373  return;
374  }
375  SigMultilinePrint(i, "");
376  return;
377  }
378  }
379  }
380  return;
381 }
382 
383 void SigTableSetup(void)
384 {
385  memset(sigmatch_table, 0, sizeof(sigmatch_table));
386 
401 
402  /* NOTE: the order of these currently affects inspect
403  * engine registration order and ultimately the order
404  * of inspect engines in the rule. Which in turn affects
405  * state keeping */
419 
428 
431 
434 
440 
447 
452 
454  /* end of order dependent regs */
455 
547 
553 
554  /* close keyword registration */
556 }
557 
559 {
560  /* register the tests */
561  int i = 0;
562  for (i = 0; i < DETECT_TBLSIZE; i++) {
563  g_ut_modules++;
564  if (sigmatch_table[i].RegisterTests != NULL) {
566  g_ut_covered++;
567  } else {
568  SCLogDebug("detection plugin %s has no unittest "
569  "registration function.", sigmatch_table[i].name);
570 
571  if (coverage_unittests)
572  SCLogWarning(SC_WARN_NO_UNITTESTS, "detection plugin %s has no unittest "
573  "registration function.", sigmatch_table[i].name);
574  }
575  }
576 }
void DetectAsn1Register(void)
Registration function for asn1.
Definition: detect-asn1.c:54
void DetectContentRegister(void)
void DetectDceIfaceRegister(void)
Registers the keyword handlers for the "dce_iface" keyword.
void DetectFileMd5Register(void)
Registration function for keyword: filemd5.
void DetectGidRegister(void)
Registration function for gid: keyword.
Definition: detect-gid.c:45
void DetectFastPatternRegister(void)
Registration function for fast_pattern keyword.
void DetectTcpmssRegister(void)
Registration function for tcpmss: keyword.
Definition: detect-tcpmss.c:56
void DetectTlsSubjectRegister(void)
Registration function for keyword: tls.cert_subject.
void SigTableSetup(void)
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
Definition: detect.h:1439
uint16_t flags
void DetectTlsSerialRegister(void)
Registration function for keyword: tls.cert_serial.
#define SCLogDebug(...)
Definition: util-debug.h:335
void DetectRawbytesRegister(void)
void DetectSNMPPduTypeRegister(void)
void DetectTtlRegister(void)
Registration function for ttl: keyword.
Definition: detect-ttl.c:60
void DetectSidRegister(void)
Definition: detect-sid.c:38
void DetectDNP3Register(void)
Definition: detect-dnp3.c:581
void DetectHttpHeadersRegister(void)
void DetectSmbShareRegister(void)
void DetectRevRegister(void)
Definition: detect-rev.c:34
void DetectTcphdrRegister(void)
Registration function for tcp.hdr: keyword.
Definition: detect-tcphdr.c:50
#define SIGMATCH_DEONLY_COMPAT
Definition: detect.h:1366
void DetectTemplateBufferRegister(void)
void DetectBytetestRegister(void)
void DetectFtpdataRegister(void)
Registration function for ftpcommand: keyword.
_Bool(* SupportsPrefilter)(const Signature *s)
Definition: detect.h:1181
void DetectDnsQueryRegister(void)
Registration function for keyword: dns_query.
void DetectWindowRegister(void)
Registration function for window: keyword.
void DetectTemplateRustBufferRegister(void)
void DetectFileSha1Register(void)
Registration function for keyword: filesha1.
void DetectFragBitsRegister(void)
Registration function for fragbits: keyword.
void DetectRpcRegister(void)
Registration function for rpc keyword.
Definition: detect-rpc.c:60
void DetectTargetRegister(void)
Registration function for target keyword.
Definition: detect-target.c:50
void DetectHttpHHRegister(void)
Registers the keyword handlers for the "http_host" keyword.
void DetectBase64DecodeRegister(void)
void DetectHttpRequestLineRegister(void)
Registers the keyword handlers for the "http_request_line" keyword.
void DetectDepthRegister(void)
Definition: detect-depth.c:47
void DetectTransformMd5Register(void)
void DetectSeqRegister(void)
Registration function for ack: keyword.
void DetectL3ProtoRegister(void)
Registration function for ip_proto keyword.
void DetectDceStubDataRegister(void)
Registers the keyword handlers for the "dce_stub_data" keyword.
#define SIGMATCH_INFO_CONTENT_MODIFIER
Definition: detect.h:1384
int g_ut_covered
Definition: suricata.c:867
void DetectSslVersionRegister(void)
Registration function for keyword: ssl_version.
void DetectTlsJa3SStringRegister(void)
Registration function for keyword: ja3s.string.
void DetectHttpHeaderRegister(void)
Registers the keyword handlers for the "http_header" keyword.
void DetectHttpClientBodyRegister(void)
Registers the keyword handlers for the "http_client_body" keyword.
element in sigmatch type table.
Definition: detect.h:1161
void DetectHttpStatCodeRegister(void)
Registration function for keyword: http_stat_code.
void DetectFileextRegister(void)
Registration function for keyword: fileext.
const char * name
Definition: detect.h:1193
void DetectBufferTypeCloseRegistration(void)
void DetectHttpHeaderNamesRegister(void)
Registers the keyword handlers for the "http.header_names" keyword.
void DetectIcmpIdRegister(void)
Registration function for icode: icmp_id.
void DetectFlowRegister(void)
Registration function for flow: keyword.
Definition: detect-flow.c:64
void DetectPrefilterRegister(void)
void DetectFragOffsetRegister(void)
Registration function for fragoffset.
void DetectNoalertRegister(void)
void(* Transform)(InspectionBuffer *)
Definition: detect.h:1176
void DetectTlsValidityRegister(void)
Registration function for tls validity keywords.
void DetectSslStateRegister(void)
Registers the keyword handlers for the "ssl_state" keyword.
void DetectTemplateRegister(void)
Registration function for template: keyword.
void DetectIPRepRegister(void)
Definition: detect-iprep.c:61
void DetectDsizeRegister(void)
Registration function for dsize: keyword.
Definition: detect-dsize.c:65
void DetectIPProtoRegister(void)
Registration function for ip_proto keyword.
void DetectPcreRegister(void)
Definition: detect-pcre.c:86
void DetectKrb5SNameRegister(void)
#define SIGMATCH_INFO_STICKY_BUFFER
Definition: detect.h:1386
void DetectUricontentRegister(void)
Registration function for uricontent: keyword.
void DetectFilenameRegister(void)
Registration function for keyword: filename.
void DetectIpOptsRegister(void)
Registration function for ipopts: keyword.
Definition: detect-ipopts.c:55
void DetectFilesizeRegister(void)
Registration function for filesize: keyword.
#define SIGMATCH_NOT_BUILT
Definition: detect.h:1368
Data structures and function prototypes for keeping state for the detection engine.
void DetectPktDataRegister(void)
Registration function for keyword: file_data.
void DetectOffsetRegister(void)
Definition: detect-offset.c:45
void DetectITypeRegister(void)
Registration function for itype: keyword.
Definition: detect-itype.c:61
void SigTableRegisterTests(void)
void DetectSshSoftwareRegister(void)
void DetectFileSha256Register(void)
Registration function for keyword: filesha256.
void DetectAckRegister(void)
Registration function for ack: keyword.
void DetectKrb5ErrCodeRegister(void)
void DetectPriorityRegister(void)
Registers the handler functions for the "priority" keyword.
void DetectLuaRegister(void)
Registration function for keyword: lua.
Definition: detect-lua.c:74
void DetectWithinRegister(void)
Definition: detect-within.c:51
void DetectDetectionFilterRegister(void)
Registration function for detection_filter: keyword.
void DetectBase64DataRegister(void)
void DetectFiledataRegister(void)
Registration function for keyword: file_data.
void DetectGeoipRegister(void)
Registration function for geoip keyword (no libgeoip support)
Definition: detect-geoip.c:55
void DetectBytejumpRegister(void)
void DetectTlsFingerprintRegister(void)
Registration function for keyword: tls.cert_fingerprint.
void DetectHttpUARegister(void)
Registers the keyword handlers for the "http_user_agent" keyword.
void DetectDceOpnumRegister(void)
Registers the keyword handlers for the "dce_opnum" keyword.
void DetectReplaceRegister(void)
void DetectIpv6hdrRegister(void)
Registration function for ipv6.hdr: keyword.
void DetectUdphdrRegister(void)
Registration function for udp.hdr: keyword.
Definition: detect-udphdr.c:49
void DetectHttpResponseLineRegister(void)
Registers the keyword handlers for the "http_response_line" keyword.
void DetectHttpMethodRegister(void)
Registration function for keyword: http_method.
void DetectSshVersionRegister(void)
Registration function for keyword: ssh.protoversion.
void DetectTransformSha1Register(void)
#define SCLogWarning(err_code,...)
Macro used to log WARNING messages.
Definition: util-debug.h:281
void DetectNfsVersionRegister(void)
Registration function for nfs_procedure keyword.
void DetectXbitsRegister(void)
Definition: detect-xbits.c:65
void DetectTransformCompressWhitespaceRegister(void)
void DetectTosRegister(void)
Register Tos keyword.
Definition: detect-tos.c:63
void DetectTlsCertsRegister(void)
Registration function for keyword: tls.certs.
void DetectHttpRawHeaderRegister(void)
Registers the keyword handlers for the "http_raw_header" keyword.
void DetectHttpProtocolRegister(void)
Registers the keyword handlers for the "http.protocol" keyword.
void DetectMarkRegister(void)
Registration function for nfq_set_mark: keyword.
Definition: detect-mark.c:54
void DetectTlsSniRegister(void)
Registration function for keyword: tls.sni.
void DetectTagRegister(void)
Registration function for keyword tag.
Definition: detect-tag.c:69
int coverage_unittests
Definition: suricata.c:865
void DetectFtpbounceRegister(void)
Registration function for ftpbounce: keyword.
int g_ut_modules
Definition: suricata.c:866
void DetectTlsJa3HashRegister(void)
Registration function for keyword: ja3_hash.
void DetectKrb5MsgTypeRegister(void)
void DetectEnipCommandRegister(void)
Registration function for enip_command: keyword.
void DetectTlsJa3SHashRegister(void)
Registration function for keyword: ja3s.hash.
void DetectAppLayerEventRegister(void)
Registers the keyword handlers for the "app-layer-event" keyword.
void DetectCsumRegister(void)
Registers handlers for all the checksum keywords. The checksum keywords that are registered are ipv4-...
Definition: detect-csum.c:128
void DetectReferenceRegister(void)
Registration function for the reference: keyword.
void DetectBsizeRegister(void)
Registration function for bsize: keyword.
Definition: detect-bsize.c:50
void DetectSNMPVersionRegister(void)
Registration function for snmp.procedure keyword.
void DetectTlsJa3StringRegister(void)
Registration function for keyword: ja3.string.
#define SIGMATCH_NOOPT
Definition: detect.h:1362
void DetectHttpStatMsgRegister(void)
Registration function for keyword: http_stat_msg.
void DetectTlsRegister(void)
Registration function for keyword: tls.version.
Definition: detect-tls.c:116
void DetectHostbitsRegister(void)
void DetectMetadataRegister(void)
void DetectICodeRegister(void)
Registration function for icode: keyword.
Definition: detect-icode.c:61
void DetectAppLayerProtocolRegister(void)
void DetectFilemagicRegister(void)
Registration function for keyword: filemagic.
void DetectDistanceRegister(void)
void DetectByteExtractRegister(void)
Registers the keyword handlers for the "byte_extract" keyword.
void DetectBypassRegister(void)
Registration function for keyword: bypass.
Definition: detect-bypass.c:61
void DetectTransformSha256Register(void)
void DetectTlsIssuerRegister(void)
Registration function for keyword: tls.cert_issuer.
void DetectTemplate2Register(void)
Registration function for template2: keyword.
void DetectModbusRegister(void)
Registration function for Modbus keyword.
void DetectPktvarRegister(void)
Definition: detect-pktvar.c:47
void DetectHttpUriRegister(void)
Registration function for keywords: http_uri and http.uri.
#define SIGMATCH_IPONLY_COMPAT
Definition: detect.h:1364
void DetectEngineEventRegister(void)
Registration function for decode-event: keyword.
void DetectNfsProcedureRegister(void)
Registration function for nfs_procedure keyword.
void SigTableList(const char *keyword)
void DetectNocaseRegister(void)
Definition: detect-nocase.c:38
void DetectThresholdRegister(void)
Registration function for threshold: keyword.
void DetectSshSoftwareVersionRegister(void)
Registration function for keyword: ssh.softwareversion.
void DetectFlowbitsRegister(void)
void DetectTransformStripWhitespaceRegister(void)
void DetectIsdataatRegister(void)
Registration function for isdataat: keyword.
void DetectUrilenRegister(void)
Registration function for urilen: keyword.
Definition: detect-urilen.c:65
void DetectHttpStartRegister(void)
Registers the keyword handlers for the "http_header" keyword.
void DetectMsgRegister(void)
Definition: detect-msg.c:40
void DetectKrb5CNameRegister(void)
uint16_t flags
Definition: detect.h:1187
void DetectSameipRegister(void)
Registration function for sameip: keyword.
Definition: detect-sameip.c:49
void DetectIpv4hdrRegister(void)
Registration function for ipv4.hdr: keyword.
void DetectSshProtocolRegister(void)
void DetectStreamSizeRegister(void)
Registration function for stream_size: keyword.
void DetectTlsVersionRegister(void)
Registration function for keyword: tls.version.
void(* RegisterTests)(void)
Definition: detect.h:1185
void DetectSNMPCommunityRegister(void)
void DetectFlagsRegister(void)
Registration function for flags: keyword.
void DetectIcmpSeqRegister(void)
Registration function for icmp_seq.
void DetectClasstypeRegister(void)
Registers the handler functions for the "Classtype" keyword.
void DetectFlowvarRegister(void)
void DetectCipServiceRegister(void)
Registration function for cip_service: keyword.
void DetectIdRegister(void)
Registration function for keyword: id.
Definition: detect-id.c:64
void DetectFilestoreRegister(void)
Registration function for keyword: filestore.
void DetectSmbNamedPipeRegister(void)
void DetectHttpServerBodyRegister(void)
Registers the keyword handlers for the "http_server_body" keyword.
void DetectFlowintRegister(void)