suricata
detect-engine-register.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2017 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  */
23 
24 #ifndef __DETECT_ENGINE_REGISTER_H__
25 #define __DETECT_ENGINE_REGISTER_H__
26 
27 enum {
28  DETECT_SID,
29  DETECT_PRIORITY,
30  DETECT_REV,
31  DETECT_CLASSTYPE,
32 
33  /* sorted by prefilter priority. Higher in this list means it will be
34  * picked over ones lower in the list */
35  DETECT_AL_APP_LAYER_PROTOCOL,
36  DETECT_ACK,
37  DETECT_SEQ,
38  DETECT_WINDOW,
39  DETECT_IPOPTS,
40  DETECT_FLAGS,
41  DETECT_FRAGBITS,
42  DETECT_FRAGOFFSET,
43  DETECT_TTL,
44  DETECT_TOS,
45  DETECT_ITYPE,
46  DETECT_ICODE,
47  DETECT_ICMP_ID,
48  DETECT_ICMP_SEQ,
49  DETECT_DSIZE,
50 
51  DETECT_FLOW,
52  /* end prefilter sort */
53 
54  DETECT_THRESHOLD,
55  DETECT_METADATA,
56  DETECT_REFERENCE,
57  DETECT_TAG,
58  DETECT_MSG,
59  DETECT_CONTENT,
60  DETECT_URICONTENT,
61  DETECT_PCRE,
62  DETECT_DEPTH,
63  DETECT_STARTS_WITH,
64  DETECT_ENDS_WITH,
65  DETECT_DISTANCE,
66  DETECT_WITHIN,
67  DETECT_OFFSET,
68  DETECT_REPLACE,
69  DETECT_NOCASE,
70  DETECT_FAST_PATTERN,
71  DETECT_RAWBYTES,
72  DETECT_BYTETEST,
73  DETECT_BYTEJUMP,
74  DETECT_SAMEIP,
75  DETECT_GEOIP,
76  DETECT_IPPROTO,
77  DETECT_FTPBOUNCE,
78  DETECT_ISDATAAT,
79  DETECT_ID,
80  DETECT_RPC,
81  DETECT_FLOWVAR,
82  DETECT_FLOWVAR_POSTMATCH,
83  DETECT_FLOWINT,
84  DETECT_PKTVAR,
85  DETECT_NOALERT,
86  DETECT_FLOWBITS,
87  DETECT_HOSTBITS,
88  DETECT_IPV4_CSUM,
89  DETECT_TCPV4_CSUM,
90  DETECT_TCPV6_CSUM,
91  DETECT_UDPV4_CSUM,
92  DETECT_UDPV6_CSUM,
93  DETECT_ICMPV4_CSUM,
94  DETECT_ICMPV6_CSUM,
95  DETECT_STREAM_SIZE,
96  DETECT_DETECTION_FILTER,
97 
98  DETECT_DECODE_EVENT,
99  DETECT_GID,
100  DETECT_MARK,
101 
102  DETECT_BSIZE,
103 
104  DETECT_AL_TLS_VERSION,
105  DETECT_AL_TLS_SUBJECT,
106  DETECT_AL_TLS_ISSUERDN,
107  DETECT_AL_TLS_NOTBEFORE,
108  DETECT_AL_TLS_NOTAFTER,
109  DETECT_AL_TLS_EXPIRED,
110  DETECT_AL_TLS_VALID,
111  DETECT_AL_TLS_FINGERPRINT,
112  DETECT_AL_TLS_STORE,
113 
114  DETECT_AL_HTTP_COOKIE,
115  DETECT_HTTP_COOKIE,
116  DETECT_AL_HTTP_METHOD,
117  DETECT_HTTP_METHOD,
118  DETECT_AL_HTTP_PROTOCOL,
119  DETECT_AL_HTTP_START,
120  DETECT_AL_URILEN,
121  DETECT_AL_HTTP_CLIENT_BODY,
122  DETECT_HTTP_REQUEST_BODY,
123  DETECT_AL_HTTP_SERVER_BODY,
124  DETECT_HTTP_RESPONSE_BODY,
125  DETECT_AL_HTTP_HEADER,
126  DETECT_HTTP_HEADER,
127  DETECT_AL_HTTP_HEADER_NAMES,
128  DETECT_AL_HTTP_HEADER_ACCEPT,
129  DETECT_AL_HTTP_HEADER_ACCEPT_LANG,
130  DETECT_AL_HTTP_HEADER_ACCEPT_ENC,
131  DETECT_AL_HTTP_HEADER_CONNECTION,
132  DETECT_AL_HTTP_HEADER_CONTENT_LEN,
133  DETECT_AL_HTTP_HEADER_CONTENT_TYPE,
134  DETECT_AL_HTTP_HEADER_REFERER,
135  DETECT_AL_HTTP_RAW_HEADER,
136  DETECT_HTTP_RAW_HEADER,
137  DETECT_AL_HTTP_URI,
138  DETECT_HTTP_URI,
139  DETECT_HTTP_URI_RAW,
140  DETECT_AL_HTTP_RAW_URI,
141  DETECT_AL_HTTP_STAT_MSG,
142  DETECT_HTTP_STAT_MSG,
143  DETECT_AL_HTTP_STAT_CODE,
144  DETECT_HTTP_STAT_CODE,
145  DETECT_AL_HTTP_USER_AGENT,
146  DETECT_HTTP_UA,
147  DETECT_AL_HTTP_HOST,
148  DETECT_HTTP_HOST,
149  DETECT_AL_HTTP_RAW_HOST,
150  DETECT_HTTP_HOST_RAW,
151  DETECT_AL_HTTP_REQUEST_LINE,
152  DETECT_AL_HTTP_RESPONSE_LINE,
153  DETECT_AL_NFS_PROCEDURE,
154  DETECT_AL_NFS_VERSION,
155  DETECT_AL_SSH_PROTOCOL,
156  DETECT_AL_SSH_PROTOVERSION,
157  DETECT_AL_SSH_SOFTWARE,
158  DETECT_AL_SSH_SOFTWAREVERSION,
159  DETECT_AL_SSL_VERSION,
160  DETECT_AL_SSL_STATE,
161  DETECT_BYTE_EXTRACT,
162  DETECT_FILE_DATA,
163  DETECT_PKT_DATA,
164  DETECT_AL_APP_LAYER_EVENT,
165 
166  DETECT_DCE_IFACE,
167  DETECT_DCE_OPNUM,
168  DETECT_DCE_STUB_DATA,
169  DETECT_SMB_NAMED_PIPE,
170  DETECT_SMB_SHARE,
171 
172  DETECT_ASN1,
173 
174  DETECT_ENGINE_EVENT,
175  DETECT_STREAM_EVENT,
176 
177  DETECT_FILENAME,
178  DETECT_FILE_NAME,
179  DETECT_FILEEXT,
180  DETECT_FILESTORE,
181  DETECT_FILEMAGIC,
182  DETECT_FILEMD5,
183  DETECT_FILESHA1,
184  DETECT_FILESHA256,
185  DETECT_FILESIZE,
186 
187  DETECT_L3PROTO,
188  DETECT_LUA,
189  DETECT_IPREP,
190 
191  DETECT_AL_DNS_QUERY,
192  DETECT_AL_TLS_SNI,
193  DETECT_AL_TLS_CERT_ISSUER,
194  DETECT_AL_TLS_CERT_SUBJECT,
195  DETECT_AL_TLS_CERT_SERIAL,
196  DETECT_AL_TLS_CERT_FINGERPRINT,
197 
198  DETECT_AL_TLS_JA3_HASH,
199  DETECT_AL_TLS_JA3_STRING,
200 
201  DETECT_AL_MODBUS,
202  DETECT_CIPSERVICE,
203  DETECT_ENIPCOMMAND,
204 
205  DETECT_AL_DNP3DATA,
206  DETECT_AL_DNP3FUNC,
207  DETECT_AL_DNP3IND,
208  DETECT_AL_DNP3OBJ,
209 
210  DETECT_XBITS,
211  DETECT_BASE64_DECODE,
212  DETECT_BASE64_DATA,
213 
214  DETECT_AL_KRB5_ERRCODE,
215  DETECT_AL_KRB5_MSGTYPE,
216  DETECT_AL_KRB5_CNAME,
217  DETECT_AL_KRB5_SNAME,
218 
219  DETECT_TEMPLATE,
220  DETECT_TEMPLATE2,
221  DETECT_FTPDATA,
222  DETECT_TARGET,
223  DETECT_AL_TEMPLATE_RUST_BUFFER,
224  DETECT_AL_TEMPLATE_BUFFER,
225 
226  DETECT_BYPASS,
227 
228  DETECT_PREFILTER,
229 
230  DETECT_TRANSFORM_COMPRESS_WHITESPACE,
231  DETECT_TRANSFORM_STRIP_WHITESPACE,
232  DETECT_TRANSFORM_MD5,
233  DETECT_TRANSFORM_SHA1,
234  DETECT_TRANSFORM_SHA256,
235 
236  /* make sure this stays last */
237  DETECT_TBLSIZE,
238 };
239 
240 void SigTableList(const char *keyword);
241 void SigTableSetup(void);
242 void SigTableRegisterTests(void);
243 
244 #endif /* __DETECT_ENGINE_REGISTER_H__ */
SigTableRegisterTests
void SigTableRegisterTests(void)
Definition: detect-engine-register.c:536
SigTableList
void SigTableList(const char *keyword)
Definition: detect-engine-register.c:299
SigTableSetup
void SigTableSetup(void)
Definition: detect-engine-register.c:372