detect-engine-register.h

Go to the documentation of this file.

/* Copyright (C) 2007-2024 Open Information Security Foundation
 *
 * You can copy, redistribute or modify this Program under the terms of
 * the GNU General Public License version 2 as published by the Free
 * Software Foundation.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * version 2 along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
 * 02110-1301, USA.
 */
 
/**
 * \file
 *
 * \author Victor Julien <victor@inliniac.net>
 */
 
#ifndef SURICATA_DETECT_ENGINE_REGISTER_H
#define SURICATA_DETECT_ENGINE_REGISTER_H
 
enum DetectKeywordId {
    DETECT_SID,
    DETECT_PRIORITY,
    DETECT_REV,
    DETECT_CLASSTYPE,
 
    /* sorted by prefilter priority. Higher in this list means it will be
     * picked over ones lower in the list */
    DETECT_APP_LAYER_PROTOCOL,
    DETECT_ACK,
    DETECT_SEQ,
    DETECT_WINDOW,
    DETECT_IPOPTS,
    DETECT_IPADDR_SRC,
    DETECT_IPADDR_DST,
    DETECT_FLAGS,
    DETECT_FRAGBITS,
    DETECT_FRAGOFFSET,
    DETECT_TTL,
    DETECT_TOS,
    DETECT_ITYPE,
    DETECT_ICODE,
    DETECT_ICMP_ID,
    DETECT_ICMP_SEQ,
    DETECT_ICMPV4HDR,
    DETECT_IGMPHDR,
    DETECT_IGMP_TYPE,
    DETECT_SCTPHDR,
    DETECT_SCTP_CHUNK_TYPE,
    DETECT_SCTP_CHUNK_CNT,
    DETECT_SCTP_VTAG,
    DETECT_SCTP_CHUNK_DATA,
    DETECT_DSIZE,
 
    DETECT_FLOW,
    /* end prefilter sort */
 
    DETECT_TCP_SESSION,
 
    /* values used in util-var.c go here, to avoid int overflows */
    DETECT_THRESHOLD,
    DETECT_FLOWBITS,
    DETECT_FLOWVAR,
    DETECT_FLOWVAR_POSTMATCH,
    DETECT_FLOWINT,
    DETECT_HOSTBITS,
    DETECT_XBITS,
    DETECT_PKTVAR,
    /* end util-var.c logic */
 
    /* content inspection */
    DETECT_CONTENT,
    DETECT_URICONTENT,
    DETECT_PCRE,
    DETECT_DEPTH,
    DETECT_STARTS_WITH,
    DETECT_ENDS_WITH,
    DETECT_DISTANCE,
    DETECT_WITHIN,
    DETECT_OFFSET,
    DETECT_REPLACE,
    DETECT_NOCASE,
    DETECT_FAST_PATTERN,
    DETECT_RAWBYTES,
    DETECT_BYTETEST,
    DETECT_BYTEJUMP,
    DETECT_BYTEMATH,
    DETECT_BYTE_EXTRACT,
    DETECT_DATASET,
    DETECT_DATAREP,
    DETECT_BASE64_DECODE,
    DETECT_BASE64_DATA,
    DETECT_BSIZE,
    DETECT_ASN1,
    DETECT_LUA,
    DETECT_ISDATAAT,
    DETECT_URILEN,
    DETECT_ABSENT,
    DETECT_ENTROPY,
    /* end of content inspection */
 
    DETECT_METADATA,
    DETECT_REFERENCE,
    DETECT_TAG,
    DETECT_MSG,
    DETECT_SAMEIP,
    DETECT_GEOIP,
    DETECT_IPPROTO,
    DETECT_FTPBOUNCE,
    DETECT_FTP_DYNPORT,
    DETECT_ID,
    DETECT_RPC,
    DETECT_NOALERT,
    DETECT_ALERT,
    DETECT_IPV4_CSUM,
    DETECT_TCPV4_CSUM,
    DETECT_TCPV6_CSUM,
    DETECT_UDPV4_CSUM,
    DETECT_UDPV6_CSUM,
    DETECT_ICMPV4_CSUM,
    DETECT_ICMPV6_CSUM,
    DETECT_IGMP_CSUM,
    DETECT_STREAM_SIZE,
    DETECT_DETECTION_FILTER,
 
    DETECT_DECODE_EVENT,
    DETECT_GID,
    DETECT_MARK,
 
    DETECT_FRAME,
 
    DETECT_FLOW_AGE,
    DETECT_FLOW_PKTS,
    DETECT_FLOW_PKTS_TO_SERVER,
    DETECT_FLOW_PKTS_TO_CLIENT,
    DETECT_FLOW_BYTES,
    DETECT_FLOW_BYTES_TO_SERVER,
    DETECT_FLOW_BYTES_TO_CLIENT,
    DETECT_FLOW_ELEPHANT,
 
    DETECT_REQUIRES,
 
    DETECT_TLS_VERSION,
    DETECT_TLS_SUBJECT,
    DETECT_TLS_ISSUERDN,
    DETECT_TLS_NOTBEFORE,
    DETECT_TLS_NOTAFTER,
    DETECT_TLS_EXPIRED,
    DETECT_TLS_VALID,
    DETECT_TLS_FINGERPRINT,
    DETECT_TLS_STORE,
    DETECT_TLS_CHAIN_LEN,
    DETECT_TLS_ALPN,
 
    DETECT_HTTP_COOKIE_CM,
    DETECT_HTTP_COOKIE,
    DETECT_HTTP_METHOD_CM,
    DETECT_HTTP_METHOD,
    DETECT_HTTP_PROTOCOL,
    DETECT_HTTP_START,
    DETECT_HTTP_CLIENT_BODY,
    DETECT_HTTP_REQUEST_BODY,
    DETECT_HTTP_SERVER_BODY,
    DETECT_HTTP_RESPONSE_BODY,
    DETECT_HTTP_HEADER_CM,
    DETECT_HTTP_HEADER,
    DETECT_HTTP_HEADER_NAMES,
    DETECT_HTTP_HEADER_ACCEPT,
    DETECT_HTTP_HEADER_ACCEPT_LANG,
    DETECT_HTTP_HEADER_ACCEPT_ENC,
    DETECT_HTTP_HEADER_CONNECTION,
    DETECT_HTTP_HEADER_CONTENT_LEN,
    DETECT_HTTP_HEADER_CONTENT_TYPE,
    DETECT_HTTP_HEADER_LOCATION,
    DETECT_HTTP_HEADER_SERVER,
    DETECT_HTTP_HEADER_REFERER,
    DETECT_HTTP_RAW_HEADER_CM,
    DETECT_HTTP_RAW_HEADER,
    DETECT_HTTP_URI_CM,
    DETECT_HTTP_URI,
    DETECT_HTTP_URI_RAW,
    DETECT_HTTP_RAW_URI,
    DETECT_HTTP_STAT_MSG_CM,
    DETECT_HTTP_STAT_MSG,
    DETECT_HTTP_STAT_CODE_CM,
    DETECT_HTTP_STAT_CODE,
    DETECT_HTTP_USER_AGENT,
    DETECT_HTTP_UA,
    DETECT_HTTP_HOST_CM,
    DETECT_HTTP_HOST,
    DETECT_HTTP_RAW_HOST,
    DETECT_HTTP_HOST_RAW,
    DETECT_HTTP_REQUEST_LINE,
    DETECT_HTTP_RESPONSE_LINE,
    DETECT_NFS_VERSION,
    DETECT_SSL_VERSION,
    DETECT_SSL_STATE,
    DETECT_FILE_DATA,
    DETECT_PKT_DATA,
    DETECT_APP_LAYER_EVENT,
    DETECT_APP_LAYER_STATE,
 
    DETECT_HTTP2_FRAMETYPE,
    DETECT_HTTP2_ERRORCODE,
    DETECT_HTTP2_PRIORITY,
    DETECT_HTTP2_WINDOW,
    DETECT_HTTP2_SIZEUPDATE,
    DETECT_HTTP2_SETTINGS,
    DETECT_HTTP2_HEADERNAME,
    DETECT_HTTP_REQUEST_HEADER,
    DETECT_HTTP_RESPONSE_HEADER,
 
    DETECT_ENGINE_EVENT,
    DETECT_STREAM_EVENT,
 
    DETECT_CONFIG,
 
    DETECT_FILENAME,
    DETECT_FILE_NAME,
    DETECT_FILEEXT,
    DETECT_FILESTORE,
    DETECT_FILESTORE_POSTMATCH,
    DETECT_FILEMAGIC,
    DETECT_FILE_MAGIC,
    DETECT_FILEMD5,
    DETECT_FILESHA1,
    DETECT_FILESHA256,
    DETECT_FILESIZE,
 
    DETECT_L3PROTO,
    DETECT_IPREP,
 
    DETECT_DNS_RESPONSE,
    DETECT_TLS_SNI,
    DETECT_TLS_CERTS,
    DETECT_TLS_CERT_ISSUER,
    DETECT_TLS_CERT_SUBJECT,
    DETECT_TLS_CERT_SERIAL,
    DETECT_TLS_CERT_FINGERPRINT,
    DETECT_TLS_SUBJECTALTNAME,
    DETECT_TLS_RANDOM_TIME,
    DETECT_TLS_RANDOM_BYTES,
    DETECT_TLS_RANDOM,
 
    DETECT_TLS_JA3_HASH,
    DETECT_TLS_JA3_STRING,
    DETECT_TLS_JA3S_HASH,
    DETECT_TLS_JA3S_STRING,
 
    DETECT_MODBUS,
 
    DETECT_DNP3DATA,
    DETECT_DNP3FUNC,
    DETECT_DNP3IND,
    DETECT_DNP3OBJ,
 
    DETECT_SIP_METHOD,
    DETECT_SIP_URI,
    DETECT_TEMPLATE,
    DETECT_ETHERHDR,
    DETECT_IPV4HDR,
    DETECT_IPV6HDR,
    DETECT_ICMPV6HDR,
    DETECT_ICMPV6MTU,
    DETECT_TCPHDR,
    DETECT_UDPHDR,
    DETECT_TCPMSS,
    DETECT_TCP_WSCALE,
    DETECT_FTPDATA,
    DETECT_TARGET,
 
    DETECT_BYPASS,
 
    DETECT_PREFILTER,
 
    DETECT_TRANSFORM_PCREXFORM,
    DETECT_TRANSFORM_LUAXFORM,
 
    DETECT_JA4_HASH,
 
    DETECT_FTP_COMMAND,
    DETECT_FTP_COMMAND_DATA,
    DETECT_FTP_REPLY,
    DETECT_FTP_MODE,
    DETECT_FTP_REPLY_RECEIVED,
    DETECT_FTP_COMPLETION_CODE,
 
    DETECT_VLAN_ID,
    DETECT_VLAN_LAYERS,
 
    /* make sure this stays last */
    DETECT_TBLSIZE_STATIC,
};
 
/* holds the values for different possible lists in struct Signature.
 * These codes are access points to particular lists in the array
 * Signature->init_data->smlists[DETECT_SM_LIST_MAX]. */
enum DetectSigmatchListEnum {
    /* list for non-payload per packet matches, e.g. ttl, flow keyword */
    DETECT_SM_LIST_MATCH = 0,
    /* list for payload and stream match */
    DETECT_SM_LIST_PMATCH,
 
    /* base64_data keyword uses some hardcoded logic so consider
     * built-in
     * TODO convert to inspect engine */
    DETECT_SM_LIST_BASE64_DATA,
 
    /* list for post match actions: flowbit set, flowint increment, etc */
    DETECT_SM_LIST_POSTMATCH,
 
    DETECT_SM_LIST_TMATCH, /**< post-detection tagging */
 
    /* lists for alert thresholding and suppression */
    DETECT_SM_LIST_SUPPRESS,
    DETECT_SM_LIST_THRESHOLD,
 
    DETECT_SM_LIST_MAX,
 
    /* start of dynamically registered lists */
    DETECT_SM_LIST_DYNAMIC_START = DETECT_SM_LIST_MAX,
};
 
extern int DETECT_TBLSIZE;
extern int DETECT_TBLSIZE_IDX;
// step for reallocating sigmatch_table
#define DETECT_TBLSIZE_STEP 256
 
// no macro for bindgen
/** sigmatch has no options, so the parser shouldn't expect any */
#define SIGMATCH_NOOPT (1UL << (0))
/** sigmatch is compatible with a ip only rule */
#define SIGMATCH_IPONLY_COMPAT (1UL << (1))
/** sigmatch is compatible with a decode event only rule */
#define SIGMATCH_DEONLY_COMPAT (1UL << (2))
/** sigmatch may have options, so the parser should be ready to
 *  deal with both cases */
#define SIGMATCH_OPTIONAL_OPT (1UL << (3))
/** input may be wrapped in double quotes. They will be stripped before
 *  input data is passed to keyword parser */
#define SIGMATCH_QUOTES_OPTIONAL (1UL << (4))
/** input MUST be wrapped in double quotes. They will be stripped before
 *  input data is passed to keyword parser. Missing double quotes lead to
 *  error and signature invalidation. */
#define SIGMATCH_QUOTES_MANDATORY (1UL << (5))
/** negation parsing is handled by the rule parser. Signature::init_data::negated
 *  will be set to true or false prior to calling the keyword parser. Exclamation
 *  mark is stripped from the input to the keyword parser. */
#define SIGMATCH_HANDLE_NEGATION (1UL << (6))
/** keyword is a content modifier */
#define SIGMATCH_INFO_CONTENT_MODIFIER (1UL << (7))
/** keyword is a sticky buffer */
#define SIGMATCH_INFO_STICKY_BUFFER (1UL << (8))
/** keyword is deprecated: used to suggest an alternative */
#define SIGMATCH_INFO_DEPRECATED (1UL << (9))
/** strict parsing is enabled */
#define SIGMATCH_STRICT_PARSING (1UL << (10))
/** keyword supported by firewall rules */
#define SIGMATCH_SUPPORT_FIREWALL (1UL << (11))
/** keyword supporting setting an optional direction */
#define SIGMATCH_SUPPORT_DIR (1UL << (12))
/** keyword is a multi buffer */
#define SIGMATCH_INFO_MULTI_BUFFER (1UL << (13))
/** keyword is a unsigned 8-bit integer */
#define SIGMATCH_INFO_UINT8 (1UL << (14))
/** keyword is a unsigned 16-bit integer */
#define SIGMATCH_INFO_UINT16 (1UL << (15))
/** keyword is a unsigned 32-bit integer */
#define SIGMATCH_INFO_UINT32 (1UL << (16))
/** keyword is a unsigned 64-bit integer */
#define SIGMATCH_INFO_UINT64 (1UL << (17))
/** keyword is a multi uint */
#define SIGMATCH_INFO_MULTI_UINT (1UL << (18))
/** keyword is an uint with enumeration stringer */
#define SIGMATCH_INFO_ENUM_UINT (1UL << (19))
/** keyword matches mutable state that can change as the transaction advances
 *  (e.g. ssl_state): a no match must stay revisitable instead of becoming
 *  final at P + 1. */
#define SIGMATCH_STATEFUL (1UL << (23))
/** keyword is an uint with bitflags */
#define SIGMATCH_INFO_BITFLAGS_UINT (1UL << (20))
/** keyword cannot be used in firewall rules */
#define SIGMATCH_BAN_FIREWALL_RULE (1UL << (21))
/** keyword cannot be used in firewall mode */
#define SIGMATCH_BAN_FIREWALL_MODE (1UL << (22))
/** keyword cannot be used in td rules with firewall mode */
#define SIGMATCH_BAN_TD_FIREWALL_MODE (1UL << (24))
 
int SigTableList(const char *keyword);
void SigTableCleanup(void);
void SigTableInit(void);
void SigTableSetup(void);
int SCSigTablePreRegister(void (*KeywordsRegister)(void));
void SigTableRegisterTests(void);
bool SCSigTableHasKeyword(const char *keyword);
void SCDetectHelperKeywordSetCleanCString(uint16_t id);
 
#endif /* SURICATA_DETECT_ENGINE_REGISTER_H */