suricata
detect-engine-register.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2017 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  */
23 
24 #ifndef __DETECT_ENGINE_REGISTER_H__
25 #define __DETECT_ENGINE_REGISTER_H__
26 
27 enum DetectKeywordId {
28  DETECT_SID,
29  DETECT_PRIORITY,
30  DETECT_REV,
31  DETECT_CLASSTYPE,
32 
33  /* sorted by prefilter priority. Higher in this list means it will be
34  * picked over ones lower in the list */
35  DETECT_AL_APP_LAYER_PROTOCOL,
36  DETECT_ACK,
37  DETECT_SEQ,
38  DETECT_WINDOW,
39  DETECT_IPOPTS,
40  DETECT_FLAGS,
41  DETECT_FRAGBITS,
42  DETECT_FRAGOFFSET,
43  DETECT_TTL,
44  DETECT_TOS,
45  DETECT_ITYPE,
46  DETECT_ICODE,
47  DETECT_ICMP_ID,
48  DETECT_ICMP_SEQ,
49  DETECT_DSIZE,
50 
51  DETECT_FLOW,
52  /* end prefilter sort */
53 
54  DETECT_THRESHOLD,
55  DETECT_METADATA,
56  DETECT_REFERENCE,
57  DETECT_TAG,
58  DETECT_MSG,
59  DETECT_CONTENT,
60  DETECT_URICONTENT,
61  DETECT_PCRE,
62  DETECT_DEPTH,
63  DETECT_STARTS_WITH,
64  DETECT_ENDS_WITH,
65  DETECT_DISTANCE,
66  DETECT_WITHIN,
67  DETECT_OFFSET,
68  DETECT_REPLACE,
69  DETECT_NOCASE,
70  DETECT_FAST_PATTERN,
71  DETECT_RAWBYTES,
72  DETECT_BYTETEST,
73  DETECT_BYTEJUMP,
74  DETECT_SAMEIP,
75  DETECT_GEOIP,
76  DETECT_IPPROTO,
77  DETECT_FTPBOUNCE,
78  DETECT_ISDATAAT,
79  DETECT_ID,
80  DETECT_RPC,
81  DETECT_FLOWVAR,
82  DETECT_FLOWVAR_POSTMATCH,
83  DETECT_FLOWINT,
84  DETECT_PKTVAR,
85  DETECT_NOALERT,
86  DETECT_FLOWBITS,
87  DETECT_HOSTBITS,
88  DETECT_IPV4_CSUM,
89  DETECT_TCPV4_CSUM,
90  DETECT_TCPV6_CSUM,
91  DETECT_UDPV4_CSUM,
92  DETECT_UDPV6_CSUM,
93  DETECT_ICMPV4_CSUM,
94  DETECT_ICMPV6_CSUM,
95  DETECT_STREAM_SIZE,
96  DETECT_DETECTION_FILTER,
97  DETECT_DATASET,
98  DETECT_DATAREP,
99 
100  DETECT_DECODE_EVENT,
101  DETECT_GID,
102  DETECT_MARK,
103 
104  DETECT_BSIZE,
105 
106  DETECT_AL_TLS_VERSION,
107  DETECT_AL_TLS_SUBJECT,
108  DETECT_AL_TLS_ISSUERDN,
109  DETECT_AL_TLS_NOTBEFORE,
110  DETECT_AL_TLS_NOTAFTER,
111  DETECT_AL_TLS_EXPIRED,
112  DETECT_AL_TLS_VALID,
113  DETECT_AL_TLS_FINGERPRINT,
114  DETECT_AL_TLS_STORE,
115 
116  DETECT_AL_HTTP_COOKIE,
117  DETECT_HTTP_COOKIE,
118  DETECT_AL_HTTP_METHOD,
119  DETECT_HTTP_METHOD,
120  DETECT_AL_HTTP_PROTOCOL,
121  DETECT_AL_HTTP_START,
122  DETECT_AL_URILEN,
123  DETECT_AL_HTTP_CLIENT_BODY,
124  DETECT_HTTP_REQUEST_BODY,
125  DETECT_AL_HTTP_SERVER_BODY,
126  DETECT_HTTP_RESPONSE_BODY,
127  DETECT_AL_HTTP_HEADER,
128  DETECT_HTTP_HEADER,
129  DETECT_AL_HTTP_HEADER_NAMES,
130  DETECT_AL_HTTP_HEADER_ACCEPT,
131  DETECT_AL_HTTP_HEADER_ACCEPT_LANG,
132  DETECT_AL_HTTP_HEADER_ACCEPT_ENC,
133  DETECT_AL_HTTP_HEADER_CONNECTION,
134  DETECT_AL_HTTP_HEADER_CONTENT_LEN,
135  DETECT_AL_HTTP_HEADER_CONTENT_TYPE,
136  DETECT_AL_HTTP_HEADER_LOCATION,
137  DETECT_AL_HTTP_HEADER_SERVER,
138  DETECT_AL_HTTP_HEADER_REFERER,
139  DETECT_AL_HTTP_RAW_HEADER,
140  DETECT_HTTP_RAW_HEADER,
141  DETECT_AL_HTTP_URI,
142  DETECT_HTTP_URI,
143  DETECT_HTTP_URI_RAW,
144  DETECT_AL_HTTP_RAW_URI,
145  DETECT_AL_HTTP_STAT_MSG,
146  DETECT_HTTP_STAT_MSG,
147  DETECT_AL_HTTP_STAT_CODE,
148  DETECT_HTTP_STAT_CODE,
149  DETECT_AL_HTTP_USER_AGENT,
150  DETECT_HTTP_UA,
151  DETECT_AL_HTTP_HOST,
152  DETECT_HTTP_HOST,
153  DETECT_AL_HTTP_RAW_HOST,
154  DETECT_HTTP_HOST_RAW,
155  DETECT_AL_HTTP_REQUEST_LINE,
156  DETECT_AL_HTTP_RESPONSE_LINE,
157  DETECT_AL_NFS_PROCEDURE,
158  DETECT_AL_NFS_VERSION,
159  DETECT_AL_SSH_PROTOCOL,
160  DETECT_AL_SSH_PROTOVERSION,
161  DETECT_AL_SSH_SOFTWARE,
162  DETECT_AL_SSH_SOFTWAREVERSION,
163  DETECT_AL_SSL_VERSION,
164  DETECT_AL_SSL_STATE,
165  DETECT_BYTE_EXTRACT,
166  DETECT_FILE_DATA,
167  DETECT_PKT_DATA,
168  DETECT_AL_APP_LAYER_EVENT,
169 
170  DETECT_DCE_IFACE,
171  DETECT_DCE_OPNUM,
172  DETECT_DCE_STUB_DATA,
173  DETECT_SMB_NAMED_PIPE,
174  DETECT_SMB_SHARE,
175 
176  DETECT_ASN1,
177 
178  DETECT_ENGINE_EVENT,
179  DETECT_STREAM_EVENT,
180 
181  DETECT_FILENAME,
182  DETECT_FILE_NAME,
183  DETECT_FILEEXT,
184  DETECT_FILESTORE,
185  DETECT_FILESTORE_POSTMATCH,
186  DETECT_FILEMAGIC,
187  DETECT_FILE_MAGIC,
188  DETECT_FILEMD5,
189  DETECT_FILESHA1,
190  DETECT_FILESHA256,
191  DETECT_FILESIZE,
192 
193  DETECT_L3PROTO,
194  DETECT_LUA,
195  DETECT_IPREP,
196 
197  DETECT_AL_DNS_QUERY,
198  DETECT_AL_DNS_OPCODE,
199  DETECT_AL_TLS_SNI,
200  DETECT_AL_TLS_CERTS,
201  DETECT_AL_TLS_CERT_ISSUER,
202  DETECT_AL_TLS_CERT_SUBJECT,
203  DETECT_AL_TLS_CERT_SERIAL,
204  DETECT_AL_TLS_CERT_FINGERPRINT,
205 
206  DETECT_AL_TLS_JA3_HASH,
207  DETECT_AL_TLS_JA3_STRING,
208  DETECT_AL_TLS_JA3S_HASH,
209  DETECT_AL_TLS_JA3S_STRING,
210 
211  DETECT_AL_MODBUS,
212  DETECT_CIPSERVICE,
213  DETECT_ENIPCOMMAND,
214 
215  DETECT_AL_DNP3DATA,
216  DETECT_AL_DNP3FUNC,
217  DETECT_AL_DNP3IND,
218  DETECT_AL_DNP3OBJ,
219 
220  DETECT_XBITS,
221  DETECT_BASE64_DECODE,
222  DETECT_BASE64_DATA,
223 
224  DETECT_AL_KRB5_ERRCODE,
225  DETECT_AL_KRB5_MSGTYPE,
226  DETECT_AL_KRB5_CNAME,
227  DETECT_AL_KRB5_SNAME,
228 
229  DETECT_AL_SIP_METHOD,
230  DETECT_AL_SIP_URI,
231  DETECT_AL_SIP_PROTOCOL,
232  DETECT_AL_SIP_STAT_CODE,
233  DETECT_AL_SIP_STAT_MSG,
234  DETECT_AL_SIP_REQUEST_LINE,
235  DETECT_AL_SIP_RESPONSE_LINE,
236 
237  DETECT_TEMPLATE,
238  DETECT_TEMPLATE2,
239  DETECT_IPV4HDR,
240  DETECT_IPV6HDR,
241  DETECT_TCPHDR,
242  DETECT_UDPHDR,
243  DETECT_TCPMSS,
244  DETECT_FTPDATA,
245  DETECT_TARGET,
246  DETECT_AL_TEMPLATE_RUST_BUFFER,
247  DETECT_AL_SNMP_VERSION,
248  DETECT_AL_SNMP_COMMUNITY,
249  DETECT_AL_SNMP_PDU_TYPE,
250  DETECT_AL_TEMPLATE_BUFFER,
251 
252  DETECT_BYPASS,
253 
254  DETECT_PREFILTER,
255 
256  DETECT_TRANSFORM_COMPRESS_WHITESPACE,
257  DETECT_TRANSFORM_STRIP_WHITESPACE,
258  DETECT_TRANSFORM_MD5,
259  DETECT_TRANSFORM_SHA1,
260  DETECT_TRANSFORM_SHA256,
261  DETECT_TRANSFORM_DOTPREFIX,
262 
263  /* make sure this stays last */
264  DETECT_TBLSIZE,
265 };
266 
267 void SigTableList(const char *keyword);
268 void SigTableSetup(void);
269 void SigTableRegisterTests(void);
270 
271 #endif /* __DETECT_ENGINE_REGISTER_H__ */
SigTableRegisterTests
void SigTableRegisterTests(void)
Definition: detect-engine-register.c:580
SigTableList
void SigTableList(const char *keyword)
Definition: detect-engine-register.c:321
SigTableSetup
void SigTableSetup(void)
Definition: detect-engine-register.c:394