/* Copyright (C) 2007-2024 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef SURICATA_DETECT_ENGINE_REGISTER_H #define SURICATA_DETECT_ENGINE_REGISTER_H enum DetectKeywordId { DETECT_SID, DETECT_PRIORITY, DETECT_REV, DETECT_CLASSTYPE, /* sorted by prefilter priority. Higher in this list means it will be * picked over ones lower in the list */ DETECT_APP_LAYER_PROTOCOL, DETECT_ACK, DETECT_SEQ, DETECT_WINDOW, DETECT_IPOPTS, DETECT_IPADDR_SRC, DETECT_IPADDR_DST, DETECT_FLAGS, DETECT_FRAGBITS, DETECT_FRAGOFFSET, DETECT_TTL, DETECT_TOS, DETECT_ITYPE, DETECT_ICODE, DETECT_ICMP_ID, DETECT_ICMP_SEQ, DETECT_ICMPV4HDR, DETECT_DSIZE, DETECT_FLOW, /* end prefilter sort */ /* values used in util-var.c go here, to avoid int overflows */ DETECT_THRESHOLD, DETECT_FLOWBITS, DETECT_FLOWVAR, DETECT_FLOWVAR_POSTMATCH, DETECT_FLOWINT, DETECT_HOSTBITS, DETECT_XBITS, DETECT_PKTVAR, /* end util-var.c logic */ /* content inspection */ DETECT_CONTENT, DETECT_URICONTENT, DETECT_PCRE, DETECT_DEPTH, DETECT_STARTS_WITH, DETECT_ENDS_WITH, DETECT_DISTANCE, DETECT_WITHIN, DETECT_OFFSET, DETECT_REPLACE, DETECT_NOCASE, DETECT_FAST_PATTERN, DETECT_RAWBYTES, DETECT_BYTETEST, DETECT_BYTEJUMP, DETECT_BYTEMATH, DETECT_BYTE_EXTRACT, DETECT_DATASET, DETECT_DATAREP, DETECT_BASE64_DECODE, DETECT_BASE64_DATA, DETECT_BSIZE, DETECT_ASN1, DETECT_LUA, DETECT_ISDATAAT, DETECT_URILEN, DETECT_ABSENT, DETECT_ENTROPY, /* end of content inspection */ DETECT_METADATA, DETECT_REFERENCE, DETECT_TAG, DETECT_MSG, DETECT_SAMEIP, DETECT_GEOIP, DETECT_IPPROTO, DETECT_FTPBOUNCE, DETECT_FTP_DYNPORT, DETECT_ID, DETECT_RPC, DETECT_NOALERT, DETECT_ALERT, DETECT_IPV4_CSUM, DETECT_TCPV4_CSUM, DETECT_TCPV6_CSUM, DETECT_UDPV4_CSUM, DETECT_UDPV6_CSUM, DETECT_ICMPV4_CSUM, DETECT_ICMPV6_CSUM, DETECT_STREAM_SIZE, DETECT_DETECTION_FILTER, DETECT_DECODE_EVENT, DETECT_GID, DETECT_MARK, DETECT_FRAME, DETECT_FLOW_AGE, DETECT_FLOW_PKTS, DETECT_FLOW_PKTS_TO_SERVER, DETECT_FLOW_PKTS_TO_CLIENT, DETECT_FLOW_BYTES, DETECT_FLOW_BYTES_TO_SERVER, DETECT_FLOW_BYTES_TO_CLIENT, DETECT_REQUIRES, DETECT_TLS_VERSION, DETECT_TLS_SUBJECT, DETECT_TLS_ISSUERDN, DETECT_TLS_NOTBEFORE, DETECT_TLS_NOTAFTER, DETECT_TLS_EXPIRED, DETECT_TLS_VALID, DETECT_TLS_FINGERPRINT, DETECT_TLS_STORE, DETECT_TLS_CHAIN_LEN, DETECT_TLS_ALPN, DETECT_HTTP_COOKIE_CM, DETECT_HTTP_COOKIE, DETECT_HTTP_METHOD_CM, DETECT_HTTP_METHOD, DETECT_HTTP_PROTOCOL, DETECT_HTTP_START, DETECT_HTTP_CLIENT_BODY, DETECT_HTTP_REQUEST_BODY, DETECT_HTTP_SERVER_BODY, DETECT_HTTP_RESPONSE_BODY, DETECT_HTTP_HEADER_CM, DETECT_HTTP_HEADER, DETECT_HTTP_HEADER_NAMES, DETECT_HTTP_HEADER_ACCEPT, DETECT_HTTP_HEADER_ACCEPT_LANG, DETECT_HTTP_HEADER_ACCEPT_ENC, DETECT_HTTP_HEADER_CONNECTION, DETECT_HTTP_HEADER_CONTENT_LEN, DETECT_HTTP_HEADER_CONTENT_TYPE, DETECT_HTTP_HEADER_LOCATION, DETECT_HTTP_HEADER_SERVER, DETECT_HTTP_HEADER_REFERER, DETECT_HTTP_RAW_HEADER_CM, DETECT_HTTP_RAW_HEADER, DETECT_HTTP_URI_CM, DETECT_HTTP_URI, DETECT_HTTP_URI_RAW, DETECT_HTTP_RAW_URI, DETECT_HTTP_STAT_MSG_CM, DETECT_HTTP_STAT_MSG, DETECT_HTTP_STAT_CODE_CM, DETECT_HTTP_STAT_CODE, DETECT_HTTP_USER_AGENT, DETECT_HTTP_UA, DETECT_HTTP_HOST_CM, DETECT_HTTP_HOST, DETECT_HTTP_RAW_HOST, DETECT_HTTP_HOST_RAW, DETECT_HTTP_REQUEST_LINE, DETECT_HTTP_RESPONSE_LINE, DETECT_NFS_PROCEDURE, DETECT_NFS_VERSION, DETECT_SSH_PROTOCOL, DETECT_SSH_PROTOVERSION, DETECT_SSH_SOFTWARE, DETECT_SSH_SOFTWAREVERSION, DETECT_SSH_HASSH, DETECT_SSH_HASSH_SERVER, DETECT_SSH_HASSH_STRING, DETECT_SSH_HASSH_SERVER_STRING, DETECT_SSL_VERSION, DETECT_SSL_STATE, DETECT_FILE_DATA, DETECT_PKT_DATA, DETECT_APP_LAYER_EVENT, DETECT_APP_LAYER_STATE, DETECT_HTTP2_FRAMETYPE, DETECT_HTTP2_ERRORCODE, DETECT_HTTP2_PRIORITY, DETECT_HTTP2_WINDOW, DETECT_HTTP2_SIZEUPDATE, DETECT_HTTP2_SETTINGS, DETECT_HTTP2_HEADERNAME, DETECT_HTTP_REQUEST_HEADER, DETECT_HTTP_RESPONSE_HEADER, DETECT_DCE_IFACE, DETECT_DCE_OPNUM, DETECT_DCE_STUB_DATA, DETECT_SMB_NAMED_PIPE, DETECT_SMB_SHARE, DETECT_SMB_NTLMSSP_USER, DETECT_SMB_NTLMSSP_DOMAIN, DETECT_SMB_VERSION, DETECT_ENGINE_EVENT, DETECT_STREAM_EVENT, DETECT_CONFIG, DETECT_FILENAME, DETECT_FILE_NAME, DETECT_FILEEXT, DETECT_FILESTORE, DETECT_FILESTORE_POSTMATCH, DETECT_FILEMAGIC, DETECT_FILE_MAGIC, DETECT_FILEMD5, DETECT_FILESHA1, DETECT_FILESHA256, DETECT_FILESIZE, DETECT_L3PROTO, DETECT_IPREP, DETECT_DNS_RESPONSE, DETECT_TLS_SNI, DETECT_TLS_CERTS, DETECT_TLS_CERT_ISSUER, DETECT_TLS_CERT_SUBJECT, DETECT_TLS_CERT_SERIAL, DETECT_TLS_CERT_FINGERPRINT, DETECT_TLS_SUBJECTALTNAME, DETECT_TLS_RANDOM_TIME, DETECT_TLS_RANDOM_BYTES, DETECT_TLS_RANDOM, DETECT_TLS_JA3_HASH, DETECT_TLS_JA3_STRING, DETECT_TLS_JA3S_HASH, DETECT_TLS_JA3S_STRING, DETECT_MODBUS, DETECT_DNP3DATA, DETECT_DNP3FUNC, DETECT_DNP3IND, DETECT_DNP3OBJ, DETECT_KRB5_ERRCODE, DETECT_KRB5_MSGTYPE, DETECT_KRB5_CNAME, DETECT_KRB5_SNAME, DETECT_KRB5_TICKET_ENCRYPTION, DETECT_SIP_METHOD, DETECT_SIP_URI, DETECT_SIP_PROTOCOL, DETECT_SIP_STAT_CODE, DETECT_SIP_STAT_MSG, DETECT_SIP_REQUEST_LINE, DETECT_SIP_RESPONSE_LINE, DETECT_TEMPLATE, DETECT_TEMPLATE2, DETECT_IPV4HDR, DETECT_IPV6HDR, DETECT_ICMPV6HDR, DETECT_ICMPV6MTU, DETECT_TCPHDR, DETECT_UDPHDR, DETECT_TCPMSS, DETECT_FTPDATA, DETECT_TARGET, DETECT_QUIC_VERSION, DETECT_QUIC_SNI, DETECT_QUIC_UA, DETECT_QUIC_CYU_HASH, DETECT_QUIC_CYU_STRING, DETECT_BYPASS, DETECT_PREFILTER, DETECT_TRANSFORM_COMPRESS_WHITESPACE, DETECT_TRANSFORM_STRIP_WHITESPACE, DETECT_TRANSFORM_STRIP_PSEUDO_HEADERS, DETECT_TRANSFORM_MD5, DETECT_TRANSFORM_SHA1, DETECT_TRANSFORM_SHA256, DETECT_TRANSFORM_DOTPREFIX, DETECT_TRANSFORM_PCREXFORM, DETECT_TRANSFORM_URL_DECODE, DETECT_TRANSFORM_XOR, DETECT_TRANSFORM_TOLOWER, DETECT_TRANSFORM_TOUPPER, DETECT_TRANSFORM_HEADER_LOWERCASE, DETECT_TRANSFORM_FROM_BASE64, DETECT_IKE_EXCH_TYPE, DETECT_IKE_SPI_INITIATOR, DETECT_IKE_SPI_RESPONDER, DETECT_IKE_VENDOR, DETECT_IKE_CHOSEN_SA, DETECT_IKE_KEY_EXCHANGE_PAYLOAD_LENGTH, DETECT_IKE_NONCE_PAYLOAD_LENGTH, DETECT_IKE_NONCE, DETECT_IKE_KEY_EXCHANGE, DETECT_JA4_HASH, DETECT_FTP_COMMAND, DETECT_FTP_COMMAND_DATA, DETECT_FTP_REPLY, DETECT_FTP_MODE, DETECT_VLAN_ID, DETECT_VLAN_LAYERS, /* make sure this stays last */ DETECT_TBLSIZE_STATIC, }; extern int DETECT_TBLSIZE; extern int DETECT_TBLSIZE_IDX; // step for reallocating sigmatch_table #define DETECT_TBLSIZE_STEP 256 int SigTableList(const char *keyword); void SigTableCleanup(void); void SigTableInit(void); void SigTableSetup(void); int SCSigTablePreRegister(void (*KeywordsRegister)(void)); void SigTableRegisterTests(void); bool SigTableHasKeyword(const char *keyword); void SCDetectHelperKeywordSetCleanCString(int id); #endif /* SURICATA_DETECT_ENGINE_REGISTER_H */