suricata
detect-engine-register.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2017 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  */
23 
24 #ifndef __DETECT_ENGINE_REGISTER_H__
25 #define __DETECT_ENGINE_REGISTER_H__
26 
27 enum {
28  DETECT_SID,
29  DETECT_PRIORITY,
30  DETECT_REV,
31  DETECT_CLASSTYPE,
32 
33  /* sorted by prefilter priority. Higher in this list means it will be
34  * picked over ones lower in the list */
35  DETECT_AL_APP_LAYER_PROTOCOL,
36  DETECT_ACK,
37  DETECT_SEQ,
38  DETECT_WINDOW,
39  DETECT_IPOPTS,
40  DETECT_FLAGS,
41  DETECT_FRAGBITS,
42  DETECT_FRAGOFFSET,
43  DETECT_TTL,
44  DETECT_TOS,
45  DETECT_ITYPE,
46  DETECT_ICODE,
47  DETECT_ICMP_ID,
48  DETECT_ICMP_SEQ,
49  DETECT_DSIZE,
50 
51  DETECT_FLOW,
52  /* end prefilter sort */
53 
54  DETECT_THRESHOLD,
55  DETECT_METADATA,
56  DETECT_REFERENCE,
57  DETECT_TAG,
58  DETECT_MSG,
59  DETECT_CONTENT,
60  DETECT_URICONTENT,
61  DETECT_PCRE,
62  DETECT_DEPTH,
63  DETECT_STARTS_WITH,
64  DETECT_ENDS_WITH,
65  DETECT_DISTANCE,
66  DETECT_WITHIN,
67  DETECT_OFFSET,
68  DETECT_REPLACE,
69  DETECT_NOCASE,
70  DETECT_FAST_PATTERN,
71  DETECT_RAWBYTES,
72  DETECT_BYTETEST,
73  DETECT_BYTEJUMP,
74  DETECT_SAMEIP,
75  DETECT_GEOIP,
76  DETECT_IPPROTO,
77  DETECT_FTPBOUNCE,
78  DETECT_ISDATAAT,
79  DETECT_ID,
80  DETECT_RPC,
81  DETECT_FLOWVAR,
82  DETECT_FLOWVAR_POSTMATCH,
83  DETECT_FLOWINT,
84  DETECT_PKTVAR,
85  DETECT_NOALERT,
86  DETECT_FLOWBITS,
87  DETECT_HOSTBITS,
88  DETECT_IPV4_CSUM,
89  DETECT_TCPV4_CSUM,
90  DETECT_TCPV6_CSUM,
91  DETECT_UDPV4_CSUM,
92  DETECT_UDPV6_CSUM,
93  DETECT_ICMPV4_CSUM,
94  DETECT_ICMPV6_CSUM,
95  DETECT_STREAM_SIZE,
96  DETECT_DETECTION_FILTER,
97 
98  DETECT_DECODE_EVENT,
99  DETECT_GID,
100  DETECT_MARK,
101 
102  DETECT_BSIZE,
103 
104  DETECT_AL_TLS_VERSION,
105  DETECT_AL_TLS_SUBJECT,
106  DETECT_AL_TLS_ISSUERDN,
107  DETECT_AL_TLS_NOTBEFORE,
108  DETECT_AL_TLS_NOTAFTER,
109  DETECT_AL_TLS_EXPIRED,
110  DETECT_AL_TLS_VALID,
111  DETECT_AL_TLS_FINGERPRINT,
112  DETECT_AL_TLS_STORE,
113 
114  DETECT_AL_HTTP_COOKIE,
115  DETECT_HTTP_COOKIE,
116  DETECT_AL_HTTP_METHOD,
117  DETECT_HTTP_METHOD,
118  DETECT_AL_HTTP_PROTOCOL,
119  DETECT_AL_HTTP_START,
120  DETECT_AL_URILEN,
121  DETECT_AL_HTTP_CLIENT_BODY,
122  DETECT_HTTP_REQUEST_BODY,
123  DETECT_AL_HTTP_SERVER_BODY,
124  DETECT_HTTP_RESPONSE_BODY,
125  DETECT_AL_HTTP_HEADER,
126  DETECT_HTTP_HEADER,
127  DETECT_AL_HTTP_HEADER_NAMES,
128  DETECT_AL_HTTP_HEADER_ACCEPT,
129  DETECT_AL_HTTP_HEADER_ACCEPT_LANG,
130  DETECT_AL_HTTP_HEADER_ACCEPT_ENC,
131  DETECT_AL_HTTP_HEADER_CONNECTION,
132  DETECT_AL_HTTP_HEADER_CONTENT_LEN,
133  DETECT_AL_HTTP_HEADER_CONTENT_TYPE,
134  DETECT_AL_HTTP_HEADER_LOCATION,
135  DETECT_AL_HTTP_HEADER_SERVER,
136  DETECT_AL_HTTP_HEADER_REFERER,
137  DETECT_AL_HTTP_RAW_HEADER,
138  DETECT_HTTP_RAW_HEADER,
139  DETECT_AL_HTTP_URI,
140  DETECT_HTTP_URI,
141  DETECT_HTTP_URI_RAW,
142  DETECT_AL_HTTP_RAW_URI,
143  DETECT_AL_HTTP_STAT_MSG,
144  DETECT_HTTP_STAT_MSG,
145  DETECT_AL_HTTP_STAT_CODE,
146  DETECT_HTTP_STAT_CODE,
147  DETECT_AL_HTTP_USER_AGENT,
148  DETECT_HTTP_UA,
149  DETECT_AL_HTTP_HOST,
150  DETECT_HTTP_HOST,
151  DETECT_AL_HTTP_RAW_HOST,
152  DETECT_HTTP_HOST_RAW,
153  DETECT_AL_HTTP_REQUEST_LINE,
154  DETECT_AL_HTTP_RESPONSE_LINE,
155  DETECT_AL_NFS_PROCEDURE,
156  DETECT_AL_NFS_VERSION,
157  DETECT_AL_SSH_PROTOCOL,
158  DETECT_AL_SSH_PROTOVERSION,
159  DETECT_AL_SSH_SOFTWARE,
160  DETECT_AL_SSH_SOFTWAREVERSION,
161  DETECT_AL_SSL_VERSION,
162  DETECT_AL_SSL_STATE,
163  DETECT_BYTE_EXTRACT,
164  DETECT_FILE_DATA,
165  DETECT_PKT_DATA,
166  DETECT_AL_APP_LAYER_EVENT,
167 
168  DETECT_DCE_IFACE,
169  DETECT_DCE_OPNUM,
170  DETECT_DCE_STUB_DATA,
171  DETECT_SMB_NAMED_PIPE,
172  DETECT_SMB_SHARE,
173 
174  DETECT_ASN1,
175 
176  DETECT_ENGINE_EVENT,
177  DETECT_STREAM_EVENT,
178 
179  DETECT_FILENAME,
180  DETECT_FILE_NAME,
181  DETECT_FILEEXT,
182  DETECT_FILESTORE,
183  DETECT_FILESTORE_POSTMATCH,
184  DETECT_FILEMAGIC,
185  DETECT_FILE_MAGIC,
186  DETECT_FILEMD5,
187  DETECT_FILESHA1,
188  DETECT_FILESHA256,
189  DETECT_FILESIZE,
190 
191  DETECT_L3PROTO,
192  DETECT_LUA,
193  DETECT_IPREP,
194 
195  DETECT_AL_DNS_QUERY,
196  DETECT_AL_TLS_SNI,
197  DETECT_AL_TLS_CERTS,
198  DETECT_AL_TLS_CERT_ISSUER,
199  DETECT_AL_TLS_CERT_SUBJECT,
200  DETECT_AL_TLS_CERT_SERIAL,
201  DETECT_AL_TLS_CERT_FINGERPRINT,
202 
203  DETECT_AL_TLS_JA3_HASH,
204  DETECT_AL_TLS_JA3_STRING,
205  DETECT_AL_TLS_JA3S_HASH,
206  DETECT_AL_TLS_JA3S_STRING,
207 
208  DETECT_AL_MODBUS,
209  DETECT_CIPSERVICE,
210  DETECT_ENIPCOMMAND,
211 
212  DETECT_AL_DNP3DATA,
213  DETECT_AL_DNP3FUNC,
214  DETECT_AL_DNP3IND,
215  DETECT_AL_DNP3OBJ,
216 
217  DETECT_XBITS,
218  DETECT_BASE64_DECODE,
219  DETECT_BASE64_DATA,
220 
221  DETECT_AL_KRB5_ERRCODE,
222  DETECT_AL_KRB5_MSGTYPE,
223  DETECT_AL_KRB5_CNAME,
224  DETECT_AL_KRB5_SNAME,
225 
226  DETECT_TEMPLATE,
227  DETECT_TEMPLATE2,
228  DETECT_FTPDATA,
229  DETECT_TARGET,
230  DETECT_AL_TEMPLATE_RUST_BUFFER,
231  DETECT_AL_SNMP_VERSION,
232  DETECT_AL_SNMP_COMMUNITY,
233  DETECT_AL_SNMP_PDU_TYPE,
234  DETECT_AL_TEMPLATE_BUFFER,
235 
236  DETECT_BYPASS,
237 
238  DETECT_PREFILTER,
239 
240  DETECT_TRANSFORM_COMPRESS_WHITESPACE,
241  DETECT_TRANSFORM_STRIP_WHITESPACE,
242  DETECT_TRANSFORM_MD5,
243  DETECT_TRANSFORM_SHA1,
244  DETECT_TRANSFORM_SHA256,
245 
246  /* make sure this stays last */
247  DETECT_TBLSIZE,
248 };
249 
250 void SigTableList(const char *keyword);
251 void SigTableSetup(void);
252 void SigTableRegisterTests(void);
253 
254 #endif /* __DETECT_ENGINE_REGISTER_H__ */
SigTableRegisterTests
void SigTableRegisterTests(void)
Definition: detect-engine-register.c:548
SigTableList
void SigTableList(const char *keyword)
Definition: detect-engine-register.c:305
SigTableSetup
void SigTableSetup(void)
Definition: detect-engine-register.c:378