suricata
detect-engine-register.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2017 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  */
23 
24 #include "suricata-common.h"
25 #include "suricata.h"
26 #include "debug.h"
27 #include "detect.h"
28 #include "flow.h"
29 #include "flow-private.h"
30 #include "flow-bit.h"
31 
32 #include "detect-parse.h"
33 #include "detect-engine.h"
34 #include "detect-engine-profile.h"
35 
36 #include "detect-engine-alert.h"
37 #include "detect-engine-siggroup.h"
38 #include "detect-engine-address.h"
39 #include "detect-engine-proto.h"
40 #include "detect-engine-port.h"
41 #include "detect-engine-mpm.h"
42 #include "detect-engine-iponly.h"
45 
46 #include "detect-engine-payload.h"
48 #include "detect-dns-opcode.h"
49 #include "detect-dns-query.h"
50 #include "detect-tls-sni.h"
51 #include "detect-tls-certs.h"
53 #include "detect-tls-cert-issuer.h"
55 #include "detect-tls-cert-serial.h"
56 #include "detect-tls-ja3-hash.h"
57 #include "detect-tls-ja3-string.h"
58 #include "detect-tls-ja3s-hash.h"
59 #include "detect-tls-ja3s-string.h"
60 #include "detect-engine-state.h"
61 #include "detect-engine-analyzer.h"
62 
63 #include "detect-http-cookie.h"
64 #include "detect-http-method.h"
65 #include "detect-http-ua.h"
66 #include "detect-http-host.h"
67 
68 #include "detect-nfs-procedure.h"
69 #include "detect-nfs-version.h"
70 
71 #include "detect-engine-event.h"
72 #include "decode.h"
73 
74 #include "detect-smb-share.h"
75 
76 #include "detect-base64-decode.h"
77 #include "detect-base64-data.h"
78 #include "detect-ipopts.h"
79 #include "detect-tcp-flags.h"
80 #include "detect-fragbits.h"
81 #include "detect-fragoffset.h"
82 #include "detect-gid.h"
83 #include "detect-tcp-ack.h"
84 #include "detect-tcp-seq.h"
85 #include "detect-content.h"
86 #include "detect-uricontent.h"
87 #include "detect-pcre.h"
88 #include "detect-depth.h"
89 #include "detect-nocase.h"
90 #include "detect-rawbytes.h"
91 #include "detect-bytetest.h"
92 #include "detect-bytejump.h"
93 #include "detect-sameip.h"
94 #include "detect-l3proto.h"
95 #include "detect-ipproto.h"
96 #include "detect-within.h"
97 #include "detect-distance.h"
98 #include "detect-offset.h"
99 #include "detect-sid.h"
100 #include "detect-prefilter.h"
101 #include "detect-priority.h"
102 #include "detect-classtype.h"
103 #include "detect-reference.h"
104 #include "detect-tag.h"
105 #include "detect-threshold.h"
106 #include "detect-metadata.h"
107 #include "detect-msg.h"
108 #include "detect-rev.h"
109 #include "detect-flow.h"
110 #include "detect-tcp-window.h"
111 #include "detect-ftpbounce.h"
112 #include "detect-isdataat.h"
113 #include "detect-id.h"
114 #include "detect-rpc.h"
115 #include "detect-asn1.h"
116 #include "detect-filename.h"
117 #include "detect-fileext.h"
118 #include "detect-filestore.h"
119 #include "detect-filemagic.h"
120 #include "detect-filemd5.h"
121 #include "detect-filesha1.h"
122 #include "detect-filesha256.h"
123 #include "detect-filesize.h"
124 #include "detect-dataset.h"
125 #include "detect-datarep.h"
126 #include "detect-dsize.h"
127 #include "detect-flowvar.h"
128 #include "detect-flowint.h"
129 #include "detect-pktvar.h"
130 #include "detect-noalert.h"
131 #include "detect-flowbits.h"
132 #include "detect-hostbits.h"
133 #include "detect-xbits.h"
134 #include "detect-csum.h"
135 #include "detect-stream_size.h"
136 #include "detect-engine-sigorder.h"
137 #include "detect-ttl.h"
138 #include "detect-fast-pattern.h"
139 #include "detect-itype.h"
140 #include "detect-icode.h"
141 #include "detect-icmp-id.h"
142 #include "detect-icmp-seq.h"
143 #include "detect-dce-iface.h"
144 #include "detect-dce-opnum.h"
145 #include "detect-dce-stub-data.h"
146 #include "detect-urilen.h"
147 #include "detect-bsize.h"
148 #include "detect-detection-filter.h"
149 #include "detect-http-client-body.h"
150 #include "detect-http-server-body.h"
151 #include "detect-http-header.h"
153 #include "detect-http-headers.h"
154 #include "detect-http-raw-header.h"
155 #include "detect-http-uri.h"
156 #include "detect-http-protocol.h"
157 #include "detect-http-start.h"
158 #include "detect-http-stat-msg.h"
161 #include "detect-byte-extract.h"
162 #include "detect-file-data.h"
163 #include "detect-pkt-data.h"
164 #include "detect-replace.h"
165 #include "detect-tos.h"
166 #include "detect-app-layer-event.h"
167 #include "detect-lua.h"
168 #include "detect-iprep.h"
169 #include "detect-geoip.h"
171 #include "detect-template.h"
172 #include "detect-template2.h"
173 #include "detect-tcphdr.h"
174 #include "detect-tcpmss.h"
175 #include "detect-udphdr.h"
176 #include "detect-icmpv6hdr.h"
177 #include "detect-icmpv6-mtu.h"
178 #include "detect-ipv4hdr.h"
179 #include "detect-ipv6hdr.h"
180 #include "detect-krb5-cname.h"
181 #include "detect-krb5-errcode.h"
182 #include "detect-krb5-msgtype.h"
183 #include "detect-krb5-sname.h"
184 #include "detect-sip-method.h"
185 #include "detect-sip-uri.h"
186 #include "detect-sip-protocol.h"
187 #include "detect-sip-stat-code.h"
188 #include "detect-sip-stat-msg.h"
189 #include "detect-sip-request-line.h"
191 #include "detect-rfb-secresult.h"
192 #include "detect-rfb-sectype.h"
193 #include "detect-rfb-name.h"
194 #include "detect-target.h"
196 #include "detect-snmp-version.h"
197 #include "detect-snmp-community.h"
198 #include "detect-snmp-pdu_type.h"
199 #include "detect-template-buffer.h"
200 #include "detect-bypass.h"
201 #include "detect-ftpdata.h"
203 
206 #include "detect-transform-md5.h"
207 #include "detect-transform-sha1.h"
208 #include "detect-transform-sha256.h"
210 
211 #include "util-rule-vars.h"
212 
213 #include "app-layer.h"
214 #include "app-layer-protos.h"
215 #include "app-layer-htp.h"
216 #include "app-layer-smtp.h"
217 #include "app-layer-template.h"
218 #include "detect-tls.h"
220 #include "detect-tls-version.h"
221 #include "detect-ssh-proto.h"
223 #include "detect-ssh-software.h"
225 #include "detect-http-stat-code.h"
226 #include "detect-ssl-version.h"
227 #include "detect-ssl-state.h"
228 #include "detect-modbus.h"
229 #include "detect-cipservice.h"
230 #include "detect-dnp3.h"
231 
232 #include "action-globals.h"
233 #include "tm-threads.h"
234 
235 #include "pkt-var.h"
236 
237 #include "conf.h"
238 #include "conf-yaml-loader.h"
239 
240 #include "stream-tcp.h"
241 #include "stream-tcp-inline.h"
242 
243 #include "util-lua.h"
244 #include "util-var-name.h"
246 #include "util-threshold-config.h"
247 #include "util-print.h"
248 #include "util-unittest.h"
249 #include "util-unittest-helper.h"
250 #include "util-debug.h"
251 #include "util-hashlist.h"
252 #include "util-privs.h"
253 #include "util-profiling.h"
254 #include "util-validate.h"
255 #include "util-optimize.h"
256 #include "util-path.h"
257 #include "util-mpm-ac.h"
258 #include "runmodes.h"
259 
260 static void PrintFeatureList(const SigTableElmt *e, char sep)
261 {
262  const uint16_t flags = e->flags;
263 
264  int prev = 0;
265  if (flags & SIGMATCH_NOOPT) {
266  printf("No option");
267  prev = 1;
268  }
270  if (prev == 1)
271  printf("%c", sep);
272  printf("compatible with IP only rule");
273  prev = 1;
274  }
276  if (prev == 1)
277  printf("%c", sep);
278  printf("compatible with decoder event only rule");
279  prev = 1;
280  }
282  if (prev == 1)
283  printf("%c", sep);
284  printf("content modifier");
285  prev = 1;
286  }
288  if (prev == 1)
289  printf("%c", sep);
290  printf("sticky buffer");
291  prev = 1;
292  }
293  if (e->Transform) {
294  if (prev == 1)
295  printf("%c", sep);
296  printf("transform");
297  prev = 1;
298  }
299  if (e->SupportsPrefilter) {
300  if (prev == 1)
301  printf("%c", sep);
302  printf("prefilter");
303  prev = 1;
304  }
305  if (prev == 0) {
306  printf("none");
307  }
308 }
309 
310 static void SigMultilinePrint(int i, const char *prefix)
311 {
312  if (sigmatch_table[i].desc) {
313  printf("%sDescription: %s\n", prefix, sigmatch_table[i].desc);
314  }
315  printf("%sFeatures: ", prefix);
316  PrintFeatureList(&sigmatch_table[i], ',');
317  if (sigmatch_table[i].url) {
318  printf("\n%sDocumentation: %s", prefix, sigmatch_table[i].url);
319  }
320  if (sigmatch_table[i].alternative) {
321  printf("\n%sReplaced by: %s", prefix, sigmatch_table[sigmatch_table[i].alternative].name);
322  }
323  printf("\n");
324 }
325 
326 void SigTableList(const char *keyword)
327 {
328  size_t size = sizeof(sigmatch_table) / sizeof(SigTableElmt);
329  size_t i;
330 
331  if (keyword == NULL) {
332  printf("=====Supported keywords=====\n");
333  for (i = 0; i < size; i++) {
334  const char *name = sigmatch_table[i].name;
335  if (name != NULL && strlen(name) > 0) {
336  if (name[0] == '_' || strcmp(name, "template") == 0)
337  continue;
338 
340  printf("- %s (not built-in)\n", name);
341  } else {
342  printf("- %s\n", name);
343  }
344  }
345  }
346  } else if (strcmp("csv", keyword) == 0) {
347  printf("name;description;app layer;features;documentation\n");
348  for (i = 0; i < size; i++) {
349  const char *name = sigmatch_table[i].name;
350  if (name != NULL && strlen(name) > 0) {
352  continue;
353  }
354  if (name[0] == '_' || strcmp(name, "template") == 0)
355  continue;
356 
357  printf("%s;", name);
358  if (sigmatch_table[i].desc) {
359  printf("%s", sigmatch_table[i].desc);
360  }
361  /* Build feature */
362  printf(";Unset;"); // this used to be alproto
363  PrintFeatureList(&sigmatch_table[i], ':');
364  printf(";");
365  if (sigmatch_table[i].url) {
366  printf("%s", sigmatch_table[i].url);
367  }
368  printf(";");
369  printf("\n");
370  }
371  }
372  } else if (strcmp("all", keyword) == 0) {
373  for (i = 0; i < size; i++) {
374  const char *name = sigmatch_table[i].name;
375  if (name != NULL && strlen(name) > 0) {
376  if (name[0] == '_' || strcmp(name, "template") == 0)
377  continue;
378  printf("%s:\n", sigmatch_table[i].name);
379  SigMultilinePrint(i, "\t");
380  }
381  }
382  } else {
383  for (i = 0; i < size; i++) {
384  if ((sigmatch_table[i].name != NULL) &&
385  strcmp(sigmatch_table[i].name, keyword) == 0) {
386  printf("= %s =\n", sigmatch_table[i].name);
388  printf("Not built-in\n");
389  return;
390  }
391  SigMultilinePrint(i, "");
392  return;
393  }
394  }
395  }
396  return;
397 }
398 
399 void SigTableSetup(void)
400 {
401  memset(sigmatch_table, 0, sizeof(sigmatch_table));
402 
417 
418  /* NOTE: the order of these currently affects inspect
419  * engine registration order and ultimately the order
420  * of inspect engines in the rule. Which in turn affects
421  * state keeping */
435 
444 
447 
450 
457 
464 
469 
471  /* end of order dependent regs */
472 
578 
585 
586  /* close keyword registration */
588 }
589 
591 {
592  /* register the tests */
593  int i = 0;
594  for (i = 0; i < DETECT_TBLSIZE; i++) {
595  g_ut_modules++;
596  if (sigmatch_table[i].RegisterTests != NULL) {
598  g_ut_covered++;
599  } else {
600  SCLogDebug("detection plugin %s has no unittest "
601  "registration function.", sigmatch_table[i].name);
602 
603  if (coverage_unittests)
604  SCLogWarning(SC_WARN_NO_UNITTESTS, "detection plugin %s has no unittest "
605  "registration function.", sigmatch_table[i].name);
606  }
607  }
608 }
detect-tcp-flags.h
DetectSshVersionRegister
void DetectSshVersionRegister(void)
Registration function for keyword: ssh.protoversion.
Definition: detect-ssh-proto-version.c:75
DetectDceStubDataRegister
void DetectDceStubDataRegister(void)
Registers the keyword handlers for the "dce_stub_data" keyword.
Definition: detect-dce-stub-data.c:121
DetectFragBitsRegister
void DetectFragBitsRegister(void)
Registration function for fragbits: keyword.
Definition: detect-fragbits.c:82
DetectHttpHHRegister
void DetectHttpHHRegister(void)
Registers the keyword handlers for the "http_host" keyword.
Definition: detect-http-host.c:82
DetectITypeRegister
void DetectITypeRegister(void)
Registration function for itype: keyword.
Definition: detect-itype.c:60
DetectAppLayerEventRegister
void DetectAppLayerEventRegister(void)
Registers the keyword handlers for the "app-layer-event" keyword.
Definition: detect-app-layer-event.c:66
tm-threads.h
DetectDsizeRegister
void DetectDsizeRegister(void)
Registration function for dsize: keyword.
Definition: detect-dsize.c:64
detect-content.h
detect-target.h
DetectMsgRegister
void DetectMsgRegister(void)
Definition: detect-msg.c:40
DetectTlsJa3HashRegister
void DetectTlsJa3HashRegister(void)
Registration function for keyword: ja3_hash.
Definition: detect-tls-ja3-hash.c:78
DetectTemplateRegister
void DetectTemplateRegister(void)
Registration function for template: keyword.
Definition: detect-template.c:54
detect-engine.h
DetectTransformSha256Register
void DetectTransformSha256Register(void)
Definition: detect-transform-sha256.c:43
detect-app-layer-protocol.h
detect-dce-iface.h
SIGMATCH_INFO_STICKY_BUFFER
#define SIGMATCH_INFO_STICKY_BUFFER
Definition: detect.h:1394
DetectGeoipRegister
void DetectGeoipRegister(void)
Registration function for geoip keyword (no libgeoip support)
Definition: detect-geoip.c:55
detect-engine-proto.h
DetectNfsVersionRegister
void DetectNfsVersionRegister(void)
Registration function for nfs_procedure keyword.
Definition: detect-nfs-version.c:89
DetectXbitsRegister
void DetectXbitsRegister(void)
Definition: detect-xbits.c:64
DetectTlsJa3SHashRegister
void DetectTlsJa3SHashRegister(void)
Registration function for keyword: ja3s.hash.
Definition: detect-tls-ja3s-hash.c:78
detect-dsize.h
DetectRevRegister
void DetectRevRegister(void)
Definition: detect-rev.c:34
detect-noalert.h
detect-gid.h
stream-tcp-inline.h
DetectRfbSecresultRegister
void DetectRfbSecresultRegister(void)
Registration function for rfb.secresult: keyword.
Definition: detect-rfb-secresult.c:61
detect-priority.h
util-hashlist.h
DetectTcpmssRegister
void DetectTcpmssRegister(void)
Registration function for tcpmss: keyword.
Definition: detect-tcpmss.c:55
detect-sip-request-line.h
detect-filesha1.h
g_ut_modules
int g_ut_modules
Definition: suricata.c:845
detect-sid.h
DetectTlsSerialRegister
void DetectTlsSerialRegister(void)
Registration function for keyword: tls.cert_serial.
Definition: detect-tls-cert-serial.c:74
detect-engine-siggroup.h
SIGMATCH_INFO_CONTENT_MODIFIER
#define SIGMATCH_INFO_CONTENT_MODIFIER
Definition: detect.h:1392
DetectSidRegister
void DetectSidRegister(void)
Definition: detect-sid.c:38
SigTableElmt_::name
const char * name
Definition: detect.h:1201
DetectSshSoftwareVersionRegister
void DetectSshSoftwareVersionRegister(void)
Registration function for keyword: ssh.softwareversion.
Definition: detect-ssh-software-version.c:89
stream-tcp.h
detect-template-rust-buffer.h
detect-engine-event.h
detect-tls-cert-validity.h
detect-pktvar.h
detect-nfs-version.h
DetectTlsFingerprintRegister
void DetectTlsFingerprintRegister(void)
Registration function for keyword: tls.cert_fingerprint.
Definition: detect-tls-cert-fingerprint.c:74
DetectHttpServerBodyRegister
void DetectHttpServerBodyRegister(void)
Registers the keyword handlers for the "http_server_body" keyword.
Definition: detect-http-server-body.c:72
detect-tls-cert-fingerprint.h
DetectHttpHeadersRegister
void DetectHttpHeadersRegister(void)
Definition: detect-http-headers.c:29
DetectHttpStartRegister
void DetectHttpStartRegister(void)
Registers the keyword handlers for the "http_header" keyword.
Definition: detect-http-start.c:375
DetectDNP3Register
void DetectDNP3Register(void)
Definition: detect-dnp3.c:589
DetectHttpUriRegister
void DetectHttpUriRegister(void)
Registration function for keywords: http_uri and http.uri.
Definition: detect-http-uri.c:88
DetectGidRegister
void DetectGidRegister(void)
Registration function for gid: keyword.
Definition: detect-gid.c:45
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:335
detect-transform-strip-whitespace.h
detect-isdataat.h
detect-ssh-software.h
DetectIPProtoRegister
void DetectIPProtoRegister(void)
Registration function for ip_proto keyword.
Definition: detect-ipproto.c:57
SigTableSetup
void SigTableSetup(void)
Definition: detect-engine-register.c:399
detect-classtype.h
detect-smb-share.h
DetectFileextRegister
void DetectFileextRegister(void)
Registration function for keyword: fileext.
Definition: detect-fileext.c:64
util-lua.h
DetectICMPv6hdrRegister
void DetectICMPv6hdrRegister(void)
Registration function for icmpv6.hdr: keyword.
Definition: detect-icmpv6hdr.c:50
DetectTlsJa3StringRegister
void DetectTlsJa3StringRegister(void)
Registration function for keyword: ja3.string.
Definition: detect-tls-ja3-string.c:74
detect-bsize.h
action-globals.h
DetectPriorityRegister
void DetectPriorityRegister(void)
Registers the handler functions for the "priority" keyword.
Definition: detect-priority.c:47
DetectDceIfaceRegister
void DetectDceIfaceRegister(void)
Registers the keyword handlers for the "dce_iface" keyword.
Definition: detect-dce-iface.c:73
DetectTemplateBufferRegister
void DetectTemplateBufferRegister(void)
Definition: detect-template-buffer.c:53
DETECT_TBLSIZE
@ DETECT_TBLSIZE
Definition: detect-engine-register.h:268
flow-private.h
DetectFilesizeRegister
void DetectFilesizeRegister(void)
Registration function for filesize: keyword.
Definition: detect-filesize.c:63
DetectHttpProtocolRegister
void DetectHttpProtocolRegister(void)
Registers the keyword handlers for the "http.protocol" keyword.
Definition: detect-http-protocol.c:122
detect-rfb-sectype.h
DetectFragOffsetRegister
void DetectFragOffsetRegister(void)
Registration function for fragoffset.
Definition: detect-fragoffset.c:58
DetectRpcRegister
void DetectRpcRegister(void)
Registration function for rpc keyword.
Definition: detect-rpc.c:59
detect-tcpmss.h
SigTableElmt_::flags
uint16_t flags
Definition: detect.h:1195
DetectSameipRegister
void DetectSameipRegister(void)
Registration function for sameip: keyword.
Definition: detect-sameip.c:49
detect-template2.h
detect-ftpbounce.h
detect-transform-sha256.h
detect-dns-opcode.h
g_ut_covered
int g_ut_covered
Definition: suricata.c:846
detect-tls-ja3-string.h
detect-filemd5.h
DetectTransformDotPrefixRegister
void DetectTransformDotPrefixRegister(void)
Definition: detect-transform-dotprefix.c:44
SIGMATCH_DEONLY_COMPAT
#define SIGMATCH_DEONLY_COMPAT
Definition: detect.h:1374
detect-tcp-seq.h
detect-http-header.h
detect-lua.h
detect-flowint.h
detect-fileext.h
DetectSipRequestLineRegister
void DetectSipRequestLineRegister(void)
Definition: detect-sip-request-line.c:95
flow-bit.h
DetectTcphdrRegister
void DetectTcphdrRegister(void)
Registration function for tcp.hdr: keyword.
Definition: detect-tcphdr.c:50
util-var-name.h
detect-dnp3.h
detect-http-client-body.h
DetectDatarepRegister
void DetectDatarepRegister(void)
Definition: detect-datarep.c:50
detect-file-data.h
util-privs.h
DetectHostbitsRegister
void DetectHostbitsRegister(void)
Definition: detect-hostbits.c:76
DetectTlsValidityRegister
void DetectTlsValidityRegister(void)
Registration function for tls validity keywords.
Definition: detect-tls-cert-validity.c:87
DetectIpOptsRegister
void DetectIpOptsRegister(void)
Registration function for ipopts: keyword.
Definition: detect-ipopts.c:54
detect-icmpv6-mtu.h
detect-rev.h
DetectUricontentRegister
void DetectUricontentRegister(void)
Registration function for uricontent: keyword.
Definition: detect-uricontent.c:68
detect-tag.h
detect-ftpdata.h
detect-tls-sni.h
detect-engine-payload.h
DetectMetadataRegister
void DetectMetadataRegister(void)
Definition: detect-metadata.c:40
detect-l3proto.h
DetectSipResponseLineRegister
void DetectSipResponseLineRegister(void)
Definition: detect-sip-response-line.c:95
SigTableElmt_
element in sigmatch type table.
Definition: detect.h:1169
DetectRfbSectypeRegister
void DetectRfbSectypeRegister(void)
Registration function for rfb.sectype keyword.
Definition: detect-rfb-sectype.c:72
detect-pcre.h
DetectHttpHeaderNamesRegister
void DetectHttpHeaderNamesRegister(void)
Registers the keyword handlers for the "http.header_names" keyword.
Definition: detect-http-header-names.c:391
detect-depth.h
detect-engine-prefilter.h
detect-icmpv6hdr.h
DetectFilemagicRegister
void DetectFilemagicRegister(void)
Registration function for keyword: filemagic.
Definition: detect-filemagic.c:70
util-unittest.h
DetectTlsSniRegister
void DetectTlsSniRegister(void)
Registration function for keyword: tls.sni.
Definition: detect-tls-sni.c:70
DetectTargetRegister
void DetectTargetRegister(void)
Registration function for target keyword.
Definition: detect-target.c:49
DetectBufferTypeCloseRegistration
void DetectBufferTypeCloseRegistration(void)
Definition: detect-engine.c:1229
SIGMATCH_NOT_BUILT
#define SIGMATCH_NOT_BUILT
Definition: detect.h:1376
detect-filename.h
util-unittest-helper.h
detect-stream_size.h
DetectSipStatMsgRegister
void DetectSipStatMsgRegister(void)
Definition: detect-sip-stat-msg.c:98
detect-http-ua.h
detect-asn1.h
detect-flowvar.h
detect-base64-data.h
detect-krb5-errcode.h
SigTableRegisterTests
void SigTableRegisterTests(void)
Definition: detect-engine-register.c:590
detect-udphdr.h
detect-http-protocol.h
detect-reference.h
detect-rpc.h
detect-sameip.h
detect-dce-stub-data.h
detect-dns-query.h
DetectTransformStripWhitespaceRegister
void DetectTransformStripWhitespaceRegister(void)
Definition: detect-transform-strip-whitespace.c:42
DetectSeqRegister
void DetectSeqRegister(void)
Registration function for ack: keyword.
Definition: detect-tcp-seq.c:51
DetectAsn1Register
void DetectAsn1Register(void)
Registration function for asn1.
Definition: detect-asn1.c:54
detect-krb5-msgtype.h
DetectBsizeRegister
void DetectBsizeRegister(void)
Registration function for bsize: keyword.
Definition: detect-bsize.c:50
DetectSmbShareRegister
void DetectSmbShareRegister(void)
Definition: detect-smb-share.c:141
app-layer-htp.h
detect-xbits.h
detect-app-layer-event.h
DetectBytejumpRegister
void DetectBytejumpRegister(void)
Definition: detect-bytejump.c:69
decode.h
DetectICMPv6mtuRegister
void DetectICMPv6mtuRegister(void)
Registration function for icmpv6.mtu: keyword.
Definition: detect-icmpv6-mtu.c:48
util-debug.h
detect-http-header-names.h
detect-transform-compress-whitespace.h
DetectTlsVersionRegister
void DetectTlsVersionRegister(void)
Registration function for keyword: tls.version.
Definition: detect-tls-version.c:74
DetectReplaceRegister
void DetectReplaceRegister(void)
Definition: detect-replace.c:68
detect-detection-filter.h
DetectICodeRegister
void DetectICodeRegister(void)
Registration function for icode: keyword.
Definition: detect-icode.c:60
detect-iprep.h
detect-rawbytes.h
DetectWindowRegister
void DetectWindowRegister(void)
Registration function for window: keyword.
Definition: detect-tcp-window.c:58
DetectL3ProtoRegister
void DetectL3ProtoRegister(void)
Registration function for ip_proto keyword.
Definition: detect-l3proto.c:53
detect-fragbits.h
DetectKrb5ErrCodeRegister
void DetectKrb5ErrCodeRegister(void)
Registration function for krb5_err_code: keyword.
Definition: detect-krb5-errcode.c:62
detect-ipv6hdr.h
DetectWithinRegister
void DetectWithinRegister(void)
Definition: detect-within.c:51
DetectContentRegister
void DetectContentRegister(void)
Definition: detect-content.c:55
detect-http-response-line.h
detect-tos.h
util-print.h
DetectSshProtocolRegister
void DetectSshProtocolRegister(void)
Definition: detect-ssh-proto.c:104
detect-filemagic.h
detect-transform-md5.h
detect-engine-mpm.h
DetectIcmpIdRegister
void DetectIcmpIdRegister(void)
Registration function for icode: icmp_id.
Definition: detect-icmp-id.c:56
detect.h
DetectSslStateRegister
void DetectSslStateRegister(void)
Registers the keyword handlers for the "ssl_state" keyword.
Definition: detect-ssl-state.c:80
detect-http-start.h
DetectLuaRegister
void DetectLuaRegister(void)
Registration function for keyword: lua.
Definition: detect-lua.c:74
pkt-var.h
DetectFiledataRegister
void DetectFiledataRegister(void)
Registration function for keyword: file_data.
Definition: detect-file-data.c:81
detect-prefilter.h
DetectIpv6hdrRegister
void DetectIpv6hdrRegister(void)
Registration function for ipv6.hdr: keyword.
Definition: detect-ipv6hdr.c:50
detect-http-uri.h
detect-tcp-window.h
detect-engine-port.h
DetectIcmpSeqRegister
void DetectIcmpSeqRegister(void)
Registration function for icmp_seq.
Definition: detect-icmp-seq.c:56
DetectIdRegister
void DetectIdRegister(void)
Registration function for keyword: id.
Definition: detect-id.c:63
DetectHttpUARegister
void DetectHttpUARegister(void)
Registers the keyword handlers for the "http_user_agent" keyword.
Definition: detect-http-ua.c:76
DetectRfbNameRegister
void DetectRfbNameRegister(void)
Definition: detect-rfb-name.c:92
detect-itype.h
detect-engine-profile.h
detect-sip-protocol.h
DetectPktDataRegister
void DetectPktDataRegister(void)
Registration function for keyword: file_data.
Definition: detect-pkt-data.c:52
util-profiling.h
util-rule-vars.h
DetectFlowbitsRegister
void DetectFlowbitsRegister(void)
Definition: detect-flowbits.c:57
DetectDatasetRegister
void DetectDatasetRegister(void)
Definition: detect-dataset.c:49
DetectUdphdrRegister
void DetectUdphdrRegister(void)
Registration function for udp.hdr: keyword.
Definition: detect-udphdr.c:49
conf-yaml-loader.h
DetectBytetestRegister
void DetectBytetestRegister(void)
Definition: detect-bytetest.c:76
detect-modbus.h
DetectDepthRegister
void DetectDepthRegister(void)
Definition: detect-depth.c:47
detect-bytejump.h
detect-id.h
conf.h
detect-engine-alert.h
DetectSipMethodRegister
void DetectSipMethodRegister(void)
Definition: detect-sip-method.c:125
detect-ipproto.h
detect-nfs-procedure.h
detect-engine-state.h
Data structures and function prototypes for keeping state for the detection engine.
detect-filestore.h
detect-http-stat-code.h
detect-replace.h
detect-krb5-cname.h
DetectMarkRegister
void DetectMarkRegister(void)
Registration function for nfq_set_mark: keyword.
Definition: detect-mark.c:53
DetectReferenceRegister
void DetectReferenceRegister(void)
Registration function for the reference: keyword.
Definition: detect-reference.c:58
detect-sip-method.h
DetectFileSha256Register
void DetectFileSha256Register(void)
Registration function for keyword: filesha256.
Definition: detect-filesha256.c:46
DetectPrefilterRegister
void DetectPrefilterRegister(void)
Definition: detect-prefilter.c:37
util-mpm-ac.h
detect-krb5-sname.h
DetectTlsCertsRegister
void DetectTlsCertsRegister(void)
Registration function for keyword: tls.certs.
Definition: detect-tls-certs.c:87
DetectFtpbounceRegister
void DetectFtpbounceRegister(void)
Registration function for ftpbounce: keyword.
Definition: detect-ftpbounce.c:68
detect-flowbits.h
runmodes.h
detect-ssl-version.h
detect-offset.h
DetectOffsetRegister
void DetectOffsetRegister(void)
Definition: detect-offset.c:45
detect-nocase.h
detect-http-host.h
detect-fragoffset.h
detect-ttl.h
detect-sip-stat-code.h
detect-transform-dotprefix.h
DetectSshSoftwareRegister
void DetectSshSoftwareRegister(void)
Definition: detect-ssh-software.c:105
DetectSipProtocolRegister
void DetectSipProtocolRegister(void)
Definition: detect-sip-protocol.c:95
detect-engine-analyzer.h
detect-rfb-secresult.h
DetectSipUriRegister
void DetectSipUriRegister(void)
Definition: detect-sip-uri.c:108
detect-engine-content-inspection.h
detect-http-server-body.h
detect-ssh-software-version.h
detect-bypass.h
DetectBypassRegister
void DetectBypassRegister(void)
Registration function for keyword: bypass.
Definition: detect-bypass.c:61
DetectAckRegister
void DetectAckRegister(void)
Registration function for ack: keyword.
Definition: detect-tcp-ack.c:54
DetectFilestoreRegister
void DetectFilestoreRegister(void)
Registration function for keyword: filestore.
Definition: detect-filestore.c:76
DetectTlsRegister
void DetectTlsRegister(void)
Registration function for keyword: tls.version.
Definition: detect-tls.c:113
DetectTagRegister
void DetectTagRegister(void)
Registration function for keyword tag.
Definition: detect-tag.c:68
DetectHttpResponseLineRegister
void DetectHttpResponseLineRegister(void)
Registers the keyword handlers for the "http_response_line" keyword.
Definition: detect-http-response-line.c:74
detect-fast-pattern.h
DetectTlsIssuerRegister
void DetectTlsIssuerRegister(void)
Registration function for keyword: tls.cert_issuer.
Definition: detect-tls-cert-issuer.c:70
detect-ssh-proto-version.h
DetectBase64DataRegister
void DetectBase64DataRegister(void)
Definition: detect-base64-data.c:30
flags
uint8_t flags
Definition: decode-gre.h:2
DetectHttpStatCodeRegister
void DetectHttpStatCodeRegister(void)
Registration function for keyword: http_stat_code.
Definition: detect-http-stat-code.c:79
DetectDceOpnumRegister
void DetectDceOpnumRegister(void)
Registers the keyword handlers for the "dce_opnum" keyword.
Definition: detect-dce-opnum.c:68
DetectKrb5CNameRegister
void DetectKrb5CNameRegister(void)
Definition: detect-krb5-cname.c:192
DetectHttpHeaderRegister
void DetectHttpHeaderRegister(void)
Registers the keyword handlers for the "http_header" keyword.
Definition: detect-http-header.c:406
detect-tls.h
suricata-common.h
DetectCipServiceRegister
void DetectCipServiceRegister(void)
Registration function for cip_service: keyword.
Definition: detect-cipservice.c:50
util-path.h
detect-byte-extract.h
detect-metadata.h
DetectKrb5SNameRegister
void DetectKrb5SNameRegister(void)
Definition: detect-krb5-sname.c:192
detect-sip-response-line.h
sigmatch_table
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
Definition: detect-parse.c:73
DetectHttpClientBodyRegister
void DetectHttpClientBodyRegister(void)
Registers the keyword handlers for the "http_client_body" keyword.
Definition: detect-http-client-body.c:79
detect-http-headers.h
DetectDnsOpcodeRegister
void DetectDnsOpcodeRegister(void)
Definition: detect-dns-opcode.c:87
DetectCsumRegister
void DetectCsumRegister(void)
Registers handlers for all the checksum keywords. The checksum keywords that are registered are ipv4-...
Definition: detect-csum.c:128
DetectTransformSha1Register
void DetectTransformSha1Register(void)
Definition: detect-transform-sha1.c:43
DetectUrilenRegister
void DetectUrilenRegister(void)
Registration function for urilen: keyword.
Definition: detect-urilen.c:64
detect-tls-cert-subject.h
detect-sip-stat-msg.h
detect-tls-version.h
detect-dataset.h
detect-template.h
util-classification-config.h
detect-rfb-name.h
DetectNfsProcedureRegister
void DetectNfsProcedureRegister(void)
Registration function for nfs_procedure keyword.
Definition: detect-nfs-procedure.c:89
DetectIpv4hdrRegister
void DetectIpv4hdrRegister(void)
Registration function for ipv4.hdr: keyword.
Definition: detect-ipv4hdr.c:50
DetectHttpRequestLineRegister
void DetectHttpRequestLineRegister(void)
Registers the keyword handlers for the "http_request_line" keyword.
Definition: detect-http-request-line.c:74
DetectFileSha1Register
void DetectFileSha1Register(void)
Registration function for keyword: filesha1.
Definition: detect-filesha1.c:46
DetectFlowRegister
void DetectFlowRegister(void)
Registration function for flow: keyword.
Definition: detect-flow.c:63
DetectDnsQueryRegister
void DetectDnsQueryRegister(void)
Registration function for keyword: dns_query.
Definition: detect-dns-query.c:206
DetectEnipCommandRegister
void DetectEnipCommandRegister(void)
Registration function for enip_command: keyword.
Definition: detect-cipservice.c:305
detect-hostbits.h
DetectRawbytesRegister
void DetectRawbytesRegister(void)
Definition: detect-rawbytes.c:43
detect-sip-uri.h
detect-snmp-version.h
DetectTosRegister
void DetectTosRegister(void)
Register Tos keyword.
Definition: detect-tos.c:62
util-optimize.h
detect-tls-certs.h
util-validate.h
detect-flow.h
detect-base64-decode.h
DetectEngineEventRegister
void DetectEngineEventRegister(void)
Registration function for decode-event: keyword.
Definition: detect-engine-event.c:61
DetectFlagsRegister
void DetectFlagsRegister(void)
Registration function for flags: keyword.
Definition: detect-tcp-flags.c:72
detect-http-raw-header.h
detect-engine-sigorder.h
DetectKrb5MsgTypeRegister
void DetectKrb5MsgTypeRegister(void)
Registration function for krb5_msg_type: keyword.
Definition: detect-krb5-msgtype.c:62
SigTableElmt_::Transform
void(* Transform)(InspectionBuffer *)
Definition: detect.h:1184
DetectFlowvarRegister
void DetectFlowvarRegister(void)
Definition: detect-flowvar.c:54
detect-tcp-ack.h
detect-http-method.h
detect-within.h
DetectNoalertRegister
void DetectNoalertRegister(void)
Definition: detect-noalert.c:33
detect-tls-cert-issuer.h
SCLogWarning
#define SCLogWarning(err_code,...)
Macro used to log WARNING messages.
Definition: util-debug.h:281
detect-datarep.h
detect-http-request-line.h
SigTableElmt_::SupportsPrefilter
bool(* SupportsPrefilter)(const Signature *s)
Definition: detect.h:1189
app-layer-template.h
detect-tcphdr.h
detect-tls-ja3s-hash.h
DetectSNMPCommunityRegister
void DetectSNMPCommunityRegister(void)
Definition: detect-snmp-community.c:50
DetectSmbNamedPipeRegister
void DetectSmbNamedPipeRegister(void)
Definition: detect-smb-share.c:78
DetectStreamSizeRegister
void DetectStreamSizeRegister(void)
Registration function for stream_size: keyword.
Definition: detect-stream_size.c:56
detect-engine-iponly.h
detect-parse.h
DetectSNMPVersionRegister
void DetectSNMPVersionRegister(void)
Registration function for snmp.procedure keyword.
Definition: detect-snmp-version.c:74
DetectDetectionFilterRegister
void DetectDetectionFilterRegister(void)
Registration function for detection_filter: keyword.
Definition: detect-detection-filter.c:62
detect-icode.h
detect-pkt-data.h
detect-threshold.h
DetectSipStatCodeRegister
void DetectSipStatCodeRegister(void)
Definition: detect-sip-stat-code.c:98
DetectDistanceRegister
void DetectDistanceRegister(void)
Definition: detect-distance.c:53
DetectTlsJa3SStringRegister
void DetectTlsJa3SStringRegister(void)
Registration function for keyword: ja3s.string.
Definition: detect-tls-ja3s-string.c:74
detect-geoip.h
detect-ssh-proto.h
DetectThresholdRegister
void DetectThresholdRegister(void)
Registration function for threshold: keyword.
Definition: detect-threshold.c:75
detect-tls-ja3-hash.h
DetectFlowintRegister
void DetectFlowintRegister(void)
Definition: detect-flowint.c:61
detect-filesize.h
DetectByteExtractRegister
void DetectByteExtractRegister(void)
Registers the keyword handlers for the "byte_extract" keyword.
Definition: detect-byte-extract.c:98
detect-icmp-id.h
DetectAppLayerProtocolRegister
void DetectAppLayerProtocolRegister(void)
Definition: detect-app-layer-protocol.c:258
app-layer-protos.h
detect-ssl-state.h
DetectSNMPPduTypeRegister
void DetectSNMPPduTypeRegister(void)
Definition: detect-snmp-pdu_type.c:62
detect-ipopts.h
detect-tls-ja3s-string.h
detect-urilen.h
suricata.h
detect-ipv4hdr.h
DetectFastPatternRegister
void DetectFastPatternRegister(void)
Registration function for fast_pattern keyword.
Definition: detect-fast-pattern.c:160
DetectHttpStatMsgRegister
void DetectHttpStatMsgRegister(void)
Registration function for keyword: http_stat_msg.
Definition: detect-http-stat-msg.c:79
DetectPktvarRegister
void DetectPktvarRegister(void)
Definition: detect-pktvar.c:46
detect-uricontent.h
DetectSslVersionRegister
void DetectSslVersionRegister(void)
Registration function for keyword: ssl_version.
Definition: detect-ssl-version.c:75
DetectModbusRegister
void DetectModbusRegister(void)
Registration function for Modbus keyword.
Definition: detect-modbus.c:509
SIGMATCH_NOOPT
#define SIGMATCH_NOOPT
Definition: detect.h:1370
detect-tls-cert-serial.h
DetectTransformCompressWhitespaceRegister
void DetectTransformCompressWhitespaceRegister(void)
Definition: detect-transform-compress-whitespace.c:42
detect-csum.h
detect-transform-sha1.h
app-layer-smtp.h
DetectNocaseRegister
void DetectNocaseRegister(void)
Definition: detect-nocase.c:38
coverage_unittests
int coverage_unittests
Definition: suricata.c:844
DetectTemplateRustBufferRegister
void DetectTemplateRustBufferRegister(void)
Definition: detect-template-rust-buffer.c:53
detect-distance.h
flow.h
DetectBase64DecodeRegister
void DetectBase64DecodeRegister(void)
Definition: detect-base64-decode.c:39
DetectFilenameRegister
void DetectFilenameRegister(void)
Registration function for keyword: filename.
Definition: detect-filename.c:78
DetectIPRepRegister
void DetectIPRepRegister(void)
Definition: detect-iprep.c:60
detect-engine-dcepayload.h
detect-cipservice.h
SC_WARN_NO_UNITTESTS
@ SC_WARN_NO_UNITTESTS
Definition: util-error.h:266
DetectTransformMd5Register
void DetectTransformMd5Register(void)
Definition: detect-transform-md5.c:43
DetectFtpdataRegister
void DetectFtpdataRegister(void)
Registration function for ftpcommand: keyword.
Definition: detect-ftpdata.c:62
DetectHttpMethodRegister
void DetectHttpMethodRegister(void)
Registration function for keyword: http_method.
Definition: detect-http-method.c:77
SIGMATCH_IPONLY_COMPAT
#define SIGMATCH_IPONLY_COMPAT
Definition: detect.h:1372
DetectTtlRegister
void DetectTtlRegister(void)
Registration function for ttl: keyword.
Definition: detect-ttl.c:59
DetectTemplate2Register
void DetectTemplate2Register(void)
Registration function for template2: keyword.
Definition: detect-template2.c:55
DetectTlsSubjectRegister
void DetectTlsSubjectRegister(void)
Registration function for keyword: tls.cert_subject.
Definition: detect-tls-cert-subject.c:70
detect-http-stat-msg.h
DetectPcreRegister
void DetectPcreRegister(void)
Definition: detect-pcre.c:113
SigTableList
void SigTableList(const char *keyword)
Definition: detect-engine-register.c:326
DetectClasstypeRegister
void DetectClasstypeRegister(void)
Registers the handler functions for the "Classtype" keyword.
Definition: detect-classtype.c:49
detect-engine-address.h
detect-dce-opnum.h
debug.h
util-threshold-config.h
detect-snmp-pdu_type.h
detect-snmp-community.h
SigTableElmt_::RegisterTests
void(* RegisterTests)(void)
Definition: detect.h:1193
detect-engine-threshold.h
DetectIsdataatRegister
void DetectIsdataatRegister(void)
Registration function for isdataat: keyword.
Definition: detect-isdataat.c:66
detect-icmp-seq.h
app-layer.h
detect-bytetest.h
detect-template-buffer.h
DetectFileMd5Register
void DetectFileMd5Register(void)
Registration function for keyword: filemd5.
Definition: detect-filemd5.c:45
DetectHttpRawHeaderRegister
void DetectHttpRawHeaderRegister(void)
Registers the keyword handlers for the "http_raw_header" keyword.
Definition: detect-http-raw-header.c:76
detect-filesha256.h
detect-msg.h