|
suricata
|
|
suricata
|
Signature container. More...
#include <detect.h>
Data Fields | |
| uint32_t | flags |
| AppProto | alproto |
| uint16_t | dsize_low |
| uint16_t | dsize_high |
| SignatureMask | mask |
| SigIntId | num |
| uint8_t | action |
| uint8_t | file_flags |
| DetectProto | proto |
| uint8_t | class |
| uint16_t | addr_dst_match4_cnt |
| uint16_t | addr_src_match4_cnt |
| uint16_t | addr_dst_match6_cnt |
| uint16_t | addr_src_match6_cnt |
| DetectMatchAddressIPv4 * | addr_dst_match4 |
| DetectMatchAddressIPv4 * | addr_src_match4 |
| DetectMatchAddressIPv6 * | addr_dst_match6 |
| DetectMatchAddressIPv6 * | addr_src_match6 |
| uint32_t | id |
| uint32_t | gid |
| uint32_t | rev |
| int | prio |
| DetectPort * | sp |
| DetectPort * | dp |
| uint16_t | profiling_id |
| IPOnlyCIDRItem * | CidrSrc |
| IPOnlyCIDRItem * | CidrDst |
| DetectEngineAppInspectionEngine * | app_inspect |
| SigMatchData * | sm_arrays [DETECT_SM_LIST_MAX] |
| const struct DetectFilestoreData_ * | filestore_ctx |
| char * | msg |
| char * | class_msg |
| DetectReference * | references |
| DetectMetadata * | metadata |
| char * | sig_str |
| SignatureInitData * | init_data |
| struct Signature_ * | next |
| uint8_t Signature_::action |
inline – action
Definition at line 505 of file detect.h.
Referenced by DetectSignatureApplyActions(), IPOnlyMatchPacket(), PacketAlertAppend(), PacketAlertFinalize(), SigMatchListSMBelongsTo(), and SigMatchSignaturesGetSgh().
| DetectMatchAddressIPv4* Signature_::addr_dst_match4 |
Definition at line 519 of file detect.h.
Referenced by DetectSignatureSetAppProto(), SigFree(), and SigMatchSignaturesGetSgh().
| uint16_t Signature_::addr_dst_match4_cnt |
ipv4 match arrays
Definition at line 515 of file detect.h.
Referenced by DetectSignatureSetAppProto(), and SigMatchSignaturesGetSgh().
| DetectMatchAddressIPv6* Signature_::addr_dst_match6 |
ipv6 match arrays
Definition at line 522 of file detect.h.
Referenced by DetectSignatureSetAppProto(), SigFree(), and SigMatchSignaturesGetSgh().
| uint16_t Signature_::addr_dst_match6_cnt |
Definition at line 517 of file detect.h.
Referenced by DetectSignatureSetAppProto(), and SigMatchSignaturesGetSgh().
| DetectMatchAddressIPv4* Signature_::addr_src_match4 |
Definition at line 520 of file detect.h.
Referenced by DetectSignatureSetAppProto(), SigFree(), and SigMatchSignaturesGetSgh().
| uint16_t Signature_::addr_src_match4_cnt |
Definition at line 516 of file detect.h.
Referenced by DetectSignatureSetAppProto(), and SigMatchSignaturesGetSgh().
| DetectMatchAddressIPv6* Signature_::addr_src_match6 |
Definition at line 523 of file detect.h.
Referenced by DetectSignatureSetAppProto(), SigFree(), and SigMatchSignaturesGetSgh().
| uint16_t Signature_::addr_src_match6_cnt |
Definition at line 518 of file detect.h.
Referenced by DetectSignatureSetAppProto(), and SigMatchSignaturesGetSgh().
| AppProto Signature_::alproto |
Definition at line 496 of file detect.h.
Referenced by DetectAppLayerProtocolRegister(), DetectByteExtractDoMatch(), DetectBytejumpDoMatch(), DetectBytetestDoMatch(), DetectDnsQueryRegister(), DetectEngineAppInspectionEngine2Signature(), DetectEngineContentModifierBufferSetup(), DetectFilestorePostMatch(), DetectHttpCookieRegister(), DetectHttpHHRegister(), DetectHttpMethodRegister(), DetectHttpRequestLineRegister(), DetectHttpResponseLineRegister(), DetectHttpStatCodeRegister(), DetectHttpStatMsgRegister(), DetectHttpUriSetup(), DetectIsdataatFree(), DetectLuaRegister(), DetectPcrePayloadMatch(), DetectSetupParseRegexes(), DetectSignatureSetAppProto(), DetectSmbNamedPipeRegister(), DetectTlsIssuerRegister(), DetectTlsJa3HashRegister(), DetectTlsJa3StringRegister(), DetectTlsSniRegister(), DetectTlsSubjectRegister(), EngineAnalysisRules(), EngineAnalysisRulesFailure(), PacketCreateMask(), SigGroupHeadBuildNonPrefilterArray(), SigMatchList2DataArray(), SigMatchListSMBelongsTo(), SigMatchSignaturesGetSgh(), and SignatureIsIPOnly().
| DetectEngineAppInspectionEngine* Signature_::app_inspect |
Definition at line 540 of file detect.h.
Referenced by DetectAppLayerInspectEngineRegister2(), DetectEngineAppInspectionEngine2Signature(), DetectEngineAppInspectionEngineSignatureFree(), EngineAnalysisRulesFailure(), and SigMatchSignaturesGetSgh().
| IPOnlyCIDRItem * Signature_::CidrDst |
Definition at line 538 of file detect.h.
Referenced by IPOnlyAddSignature(), IPOnlySigParseAddress(), SigFree(), and SignatureIsIPOnly().
| IPOnlyCIDRItem* Signature_::CidrSrc |
netblocks and hosts specified at the sid, in CIDR format
Definition at line 538 of file detect.h.
Referenced by IPOnlyAddSignature(), IPOnlySigParseAddress(), SigFree(), and SignatureIsIPOnly().
| uint8_t Signature_::class |
| char* Signature_::class_msg |
classification message
Definition at line 552 of file detect.h.
Referenced by AlertFastLogger(), AlertFastLogInitCtx(), and DetectClasstypeRegister().
| DetectPort * Signature_::dp |
Definition at line 531 of file detect.h.
Referenced by IPOnlyMatchPacket(), PacketCreateMask(), SigFree(), SigMatchList2DataArray(), SigMatchListSMBelongsTo(), and SigMatchSignaturesGetSgh().
| uint16_t Signature_::dsize_high |
Definition at line 499 of file detect.h.
Referenced by SigMatchSignaturesGetSgh(), and SigParseSetDsizePair().
| uint16_t Signature_::dsize_low |
Definition at line 498 of file detect.h.
Referenced by SigMatchSignaturesGetSgh(), and SigParseSetDsizePair().
| uint8_t Signature_::file_flags |
Definition at line 506 of file detect.h.
Referenced by DetectFileextRegister(), DetectFilemagicRegister(), DetectFilenameRegister(), DetectFilesizeRegister(), SigMatchList2DataArray(), SignatureIsFilemagicInspecting(), SignatureIsFileMd5Inspecting(), SignatureIsFileSha1Inspecting(), SignatureIsFileSha256Inspecting(), and SignatureIsFilesizeInspecting().
| const struct DetectFilestoreData_* Signature_::filestore_ctx |
Definition at line 547 of file detect.h.
Referenced by DetectFilestorePostMatch().
| uint32_t Signature_::flags |
Definition at line 493 of file detect.h.
Referenced by DetectAckRegister(), DetectAppLayerEventRegister(), DetectAppLayerProtocolRegister(), DetectBypassRegister(), DetectByteExtractDoMatch(), DetectContentPMATCHValidateCallback(), DetectDsizeRegister(), DetectEngineAppInspectionEngine2Signature(), DetectEngineContentModifierBufferSetup(), DetectEngineInspectStream(), DetectEngineInspectStreamPayload(), DetectFilestorePostMatch(), DetectFlagsRegister(), DetectFlowbitMatch(), DetectFlowbitsAnalyze(), DetectFlowSetupImplicit(), DetectFragBitsRegister(), DetectFragOffsetRegister(), DetectGeoipRegister(), DetectHostbitFree(), DetectHttpRawHeaderRegister(), DetectIcmpIdRegister(), DetectIdRegister(), DetectIPProtoRegister(), DetectNoalertRegister(), DetectPcrePayloadMatch(), DetectPrefilterRegister(), DetectReplaceRegister(), DetectRpcRegister(), DetectSameipRegister(), DetectSeqRegister(), DetectSetFastPatternAndItsId(), DetectSetupParseRegexes(), DetectSignatureSetAppProto(), DetectTargetRegister(), DetectTemplate2Register(), DetectTemplateRegister(), DetectThresholdRegister(), DetectTlsRegister(), DetectTosRegister(), DetectTtlRegister(), DetectWindowRegister(), DetectXbitMatchHost(), DetectXbitsRegister(), EngineAnalysisRules(), EngineAnalysisRulesFailure(), IPOnlyAddSignature(), IPOnlyMatchPacket(), IPOnlySigParseAddress(), MpmStoreFree(), MpmStorePrepareBuffer(), PacketAlertFinalize(), PacketCreateMask(), SCThresholdConfInitContext(), SigAddressPrepareStage1(), SigAddressPrepareStage2(), SigGroupHeadBuildNonPrefilterArray(), SigMatchList2DataArray(), SigMatchListSMBelongsTo(), SigMatchSignaturesGetSgh(), SignatureHasPacketContent(), SignatureHasStreamContent(), SignatureIsFilestoring(), SignatureIsIPOnly(), SigParseApplyDsizeToContent(), SigParseGetMaxDsize(), and SigParseSetDsizePair().
| uint32_t Signature_::gid |
generator id
Definition at line 526 of file detect.h.
Referenced by AlertFastLogger(), DetectGidRegister(), DetectLuaRegister(), DetectTagRegister(), EngineAnalysisRulesFailure(), PacketAlertTagInit(), PacketAlertThreshold(), SCProfilingRuleInitCounters(), SCThresholdConfInitContext(), SigInit(), SigMatchList2DataArray(), ThresholdIPPairTimeoutCheck(), and Unified2AlertInitCtx().
| uint32_t Signature_::id |
sid, set by the 'sid' rule keyword
Definition at line 525 of file detect.h.
Referenced by AlertFastLogger(), CreateGroupedPortList(), DetectAppLayerInspectEngineRegister2(), DetectEngineAppInspectionEngine2Signature(), DetectEngineInspectStream(), DetectFileInspectGeneric(), DetectFilestorePostMatch(), DetectFlowbitsAnalyze(), DetectHttpClientBodyRegister(), DetectHttpHHRegister(), DetectHttpRequestLineRegister(), DetectHttpUriSetup(), DetectLoadCompleteSigPath(), DetectLuaRegister(), DetectSetupParseRegexes(), DetectSidRegister(), DetectTagRegister(), DetectTlsFingerprintRegister(), DetectTlsJa3HashRegister(), DetectTlsSerialRegister(), DetectUrilenApplyToContent(), EngineAnalysisFP(), EngineAnalysisRules(), EngineAnalysisRulesFailure(), IPOnlyMatchPacket(), MpmStoreFree(), PacketAlertAppend(), PacketAlertCheck(), PacketAlertTagInit(), PacketAlertThreshold(), PacketCreateMask(), SCProfilingRuleInitCounters(), SCSigSignatureOrderingModuleCleanup(), SCThresholdConfInitContext(), SigAddressCleanupStage1(), SigAddressPrepareStage1(), SigAddressPrepareStage2(), SigGroupHeadContainsSigId(), SigInit(), SigMatchList2DataArray(), SigMatchSignaturesGetSgh(), SignatureIsIPOnly(), SigParseApplyDsizeToContent(), ThresholdIPPairTimeoutCheck(), Unified2AlertInitCtx(), UTHPacketMatchSig(), and UTHPacketMatchSigMpm().
| SignatureInitData* Signature_::init_data |
Definition at line 560 of file detect.h.
Referenced by DetectAckRegister(), DetectAppLayerEventPrepare(), DetectAppLayerInspectEngineRegister2(), DetectBase64DataRegister(), DetectBase64DecodeDoMatch(), DetectBufferGetActiveList(), DetectBufferSetActiveList(), DetectByteExtractDoMatch(), DetectByteExtractRetrieveSMVar(), DetectBytejumpDoMatch(), DetectBytetestDoMatch(), DetectContentPMATCHValidateCallback(), DetectContentPropagateLimits(), DetectContentSetup(), DetectDceStubDataRegister(), DetectDnsQueryRegister(), DetectDsizeRegister(), DetectEngineAppendSig(), DetectEngineAppInspectionEngine2Signature(), DetectEngineContentModifierBufferSetup(), DetectFastPatternRegister(), DetectFileextRegister(), DetectFilemagicRegister(), DetectFilenameRegister(), DetectFlagsSignatureNeedsSynOnlyPackets(), DetectFlagsSignatureNeedsSynPackets(), DetectFlowbitsAnalyze(), DetectFlowFree(), DetectFlowSetupImplicit(), DetectFlowvarMatch(), DetectFragBitsRegister(), DetectFragOffsetFree(), DetectGetLastSM(), DetectGetLastSMByListId(), DetectGetLastSMFromLists(), DetectGetLastSMFromMpmLists(), DetectHttpClientBodyRegister(), DetectHttpHHRegister(), DetectHttpMethodRegister(), DetectHttpResponseLineRegister(), DetectIcmpIdFree(), DetectIcmpSeqFree(), DetectICodeFree(), DetectIdFree(), DetectIPProtoRegister(), DetectIPProtoRemoveAllSMs(), DetectIsdataatSetup(), DetectITypeFree(), DetectLuaRegister(), DetectParseDupSigHashFree(), DetectPcrePayloadMatch(), DetectPktDataRegister(), DetectPrefilterRegister(), DetectRawbytesRegister(), DetectReplaceRegister(), DetectSeqRegister(), DetectSetFastPatternAndItsId(), DetectSetupParseRegexes(), DetectSignatureAddTransform(), DetectSignatureSetAppProto(), DetectTemplate2Free(), DetectTemplateBufferRegister(), DetectTemplateRustBufferRegister(), DetectTlsFingerprintRegister(), DetectTlsJa3HashRegister(), DetectTlsRegister(), DetectTlsSerialRegister(), DetectTosRegister(), DetectTtlFree(), DetectUricontentRegister(), DetectUrilenApplyToContent(), DetectUrilenValidateContent(), EngineAnalysisFP(), EngineAnalysisRules(), EngineAnalysisRulesFailure(), MpmStoreFree(), MpmStorePrepareBuffer(), PacketCreateMask(), PerCentEncodingMatch(), RetrieveFPForSig(), SigAddressPrepareStage1(), SigAddressPrepareStage2(), SigAddressPrepareStage4(), SigAlloc(), SigFree(), SigInit(), SigMatchAppendSMToList(), SigMatchList2DataArray(), SigMatchListSMBelongsTo(), SigMatchRemoveSMFromList(), SignatureHasPacketContent(), SignatureHasStreamContent(), SignatureIsIPOnly(), SigParseApplyDsizeToContent(), SigParseGetMaxDsize(), and SigParseSetDsizePair().
| SignatureMask Signature_::mask |
Definition at line 501 of file detect.h.
Referenced by EngineAnalysisRulesFailure(), PacketCreateMask(), SigGroupHeadBuildNonPrefilterArray(), and SigMatchSignaturesGetSgh().
| DetectMetadata* Signature_::metadata |
Metadata
Definition at line 556 of file detect.h.
Referenced by DetectMetadataHashFree(), and SigAlloc().
| char* Signature_::msg |
Definition at line 549 of file detect.h.
Referenced by AlertFastLogger(), DetectMsgRegister(), EngineAnalysisRulesFailure(), IPOnlyMatchPacket(), and SigFree().
| struct Signature_* Signature_::next |
ptr to the next sig in the list
Definition at line 563 of file detect.h.
Referenced by DetectAckRegister(), DetectAppLayerProtocolRegister(), DetectBytejumpDoMatch(), DetectBytetestDoMatch(), DetectClasstypeRegister(), DetectDceStubDataRegister(), DetectEngineAppendSig(), DetectFastPatternRegister(), DetectFlowbitsAnalyze(), DetectFragOffsetFree(), DetectHostbitFree(), DetectIcmpIdFree(), DetectIcmpSeqFree(), DetectICodeFree(), DetectIsdataatFree(), DetectITypeFree(), DetectL3ProtoRegister(), DetectParseDupSigHashFree(), DetectPcrePayloadMatch(), DetectPriorityRegister(), DetectProtoContainsProto(), DetectReplaceFreeInternal(), DetectRpcFree(), DetectSetFastPatternAndItsId(), DetectSetupParseRegexes(), DetectThresholdRegister(), DetectUricontentRegister(), DetectUrilenValidateContent(), MpmACRegister(), MpmACTileRegister(), PacketCreateMask(), SCACBSPrintInfo(), SCProfilingRuleInitCounters(), SCSigOrderSignatures(), SCSigSignatureOrderingModuleCleanup(), SCThresholdConfInitContext(), SCThresholdConfParseFile(), SigAddressPrepareStage1(), SigAddressPrepareStage2(), SigAddressPrepareStage4(), SigCleanSignatures(), SigFindSignatureBySidGid(), SigGroupBuild(), SigGroupHeadContainsSigId(), SigInit(), and SigParseApplyDsizeToContent().
| SigIntId Signature_::num |
signature number, internal id
Definition at line 502 of file detect.h.
Referenced by DetectEngineStateResetTxs(), DetectFlowbitsAnalyze(), DetectPortHashFree(), DetectSignatureApplyActions(), IPOnlyAddSignature(), MpmStorePrepareBuffer(), PacketAlertAppend(), PacketAlertTagInit(), PacketCreateMask(), PatternStrength(), SCThresholdConfParseFile(), SigAddressPrepareStage1(), SigGroupBuild(), SigGroupHeadAppendSig(), SigGroupHeadBuildNonPrefilterArray(), SigMatchList2DataArray(), and ThresholdIPPairTimeoutCheck().
| int Signature_::prio |
Definition at line 528 of file detect.h.
Referenced by AlertFastLogger(), DetectClasstypeRegister(), DetectPriorityRegister(), PacketAlertTagInit(), SigAlloc(), and SigMatchList2DataArray().
| uint16_t Signature_::profiling_id |
Definition at line 534 of file detect.h.
Referenced by SCProfilingRuleInitCounters().
| DetectProto Signature_::proto |
addresses, ports and proto this sig matches on
Definition at line 509 of file detect.h.
Referenced by DetectAppLayerEventRegister(), DetectIPProtoRegister(), DetectIPProtoRemoveAllSMs(), DetectL3ProtoRegister(), DetectProtoContainsProto(), EngineAnalysisRules(), IPOnlyMatchPacket(), PacketCreateMask(), SigAddressPrepareStage1(), SigMatchList2DataArray(), SigMatchListSMBelongsTo(), SigMatchSignaturesGetSgh(), SignatureHasPacketContent(), and SignatureHasStreamContent().
| DetectReference* Signature_::references |
Reference
Definition at line 554 of file detect.h.
Referenced by DetectReferenceFree(), and SigAlloc().
| uint32_t Signature_::rev |
Definition at line 527 of file detect.h.
Referenced by AlertFastLogger(), DetectLuaRegister(), DetectParseDupSigHashFree(), DetectRevRegister(), DetectSetupParseRegexes(), EngineAnalysisRulesFailure(), PacketAlertTagInit(), SCProfilingRuleInitCounters(), and Unified2AlertInitCtx().
| char* Signature_::sig_str |
Definition at line 558 of file detect.h.
Referenced by DetectReplaceRegister(), EngineAnalysisRulesFailure(), SigFree(), and SigParse().
| SigMatchData* Signature_::sm_arrays[DETECT_SM_LIST_MAX] |
Definition at line 544 of file detect.h.
Referenced by DetectBase64DataDoMatch(), DetectEngineInspectPacketPayload(), DetectEngineIPOnlyThreadDeinit(), DetectFastPatternRegister(), EngineAnalysisRulesFailure(), IPOnlyMatchPacket(), PacketAlertFinalize(), PacketAlertGetTag(), PacketCreateMask(), SCThresholdConfParseFile(), SigAddressPrepareStage4(), SigAlloc(), SigGetThresholdTypeIter(), SigMatchSignaturesGetSgh(), SignatureHasPacketContent(), and SignatureHasStreamContent().
| DetectPort* Signature_::sp |
port settings for this signature
Definition at line 531 of file detect.h.
Referenced by DetectSetupParseRegexes(), IPOnlyMatchPacket(), PacketCreateMask(), SigFree(), SigMatchList2DataArray(), SigMatchListSMBelongsTo(), and SigMatchSignaturesGetSgh().
1.8.11 
