/** * \brief Registration function for keyword: tls_cert_issuer */ void DetectTlsIssuerRegister(void) { sigmatch_table[DETECT_AL_TLS_CERT_ISSUER].name = "tls_cert_issuer"; sigmatch_table[DETECT_AL_TLS_CERT_ISSUER].desc = "content modifier to match specifically and only on the TLS cert issuer buffer"; sigmatch_table[DETECT_AL_TLS_CERT_ISSUER].url = DOC_URL DOC_VERSION "/rules/tls-keywords.html#tls-cert-issuer"; sigmatch_table[DETECT_AL_TLS_CERT_ISSUER].Match = NULL; sigmatch_table[DETECT_AL_TLS_CERT_ISSUER].Setup = DetectTlsIssuerSetup; sigmatch_table[DETECT_AL_TLS_CERT_ISSUER].Free = NULL; sigmatch_table[DETECT_AL_TLS_CERT_ISSUER].RegisterTests = DetectTlsIssuerRegisterTests; sigmatch_table[DETECT_AL_TLS_CERT_ISSUER].flags |= SIGMATCH_NOOPT; DetectAppLayerInspectEngineRegister2("tls_cert_issuer", ALPROTO_TLS, SIG_FLAG_TOCLIENT, TLS_STATE_CERT_READY, DetectEngineInspectBufferGeneric, GetData); DetectAppLayerMpmRegister2("tls_cert_issuer", SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister, GetData, ALPROTO_TLS, TLS_STATE_CERT_READY); DetectBufferTypeSetDescriptionByName("tls_cert_issuer", "TLS certificate issuer"); g_tls_cert_issuer_buffer_id = DetectBufferTypeGetByName("tls_cert_issuer"); }
/** * \brief Registers the keyword handlers for the "http_request_line" keyword. */ void DetectHttpRequestLineRegister(void) { sigmatch_table[DETECT_AL_HTTP_REQUEST_LINE].name = "http.request_line"; sigmatch_table[DETECT_AL_HTTP_REQUEST_LINE].alias = "http_request_line"; sigmatch_table[DETECT_AL_HTTP_REQUEST_LINE].desc = "sticky buffer to match on the HTTP request line"; sigmatch_table[DETECT_AL_HTTP_REQUEST_LINE].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-request-line"; sigmatch_table[DETECT_AL_HTTP_REQUEST_LINE].Match = NULL; sigmatch_table[DETECT_AL_HTTP_REQUEST_LINE].Setup = DetectHttpRequestLineSetup; sigmatch_table[DETECT_AL_HTTP_REQUEST_LINE].RegisterTests = DetectHttpRequestLineRegisterTests; sigmatch_table[DETECT_AL_HTTP_REQUEST_LINE].flags |= SIGMATCH_NOOPT|SIGMATCH_INFO_STICKY_BUFFER; DetectAppLayerInspectEngineRegister2("http_request_line", ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_LINE, DetectEngineInspectBufferGeneric, GetData); DetectAppLayerMpmRegister2("http_request_line", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, GetData, ALPROTO_HTTP, HTP_REQUEST_LINE); DetectBufferTypeSetDescriptionByName("http_request_line", "http request line"); g_http_request_line_buffer_id = DetectBufferTypeGetByName("http_request_line"); }
/** * \brief Registers the keyword handlers for the "http_raw_header" keyword. */ void DetectHttpRawHeaderRegister(void) { /* http_raw_header content modifier */ sigmatch_table[DETECT_AL_HTTP_RAW_HEADER].name = "http_raw_header"; sigmatch_table[DETECT_AL_HTTP_RAW_HEADER].Setup = DetectHttpRawHeaderSetup; #ifdef UNITTESTS sigmatch_table[DETECT_AL_HTTP_RAW_HEADER].RegisterTests = DetectHttpRawHeaderRegisterTests; #endif sigmatch_table[DETECT_AL_HTTP_RAW_HEADER].flags |= SIGMATCH_NOOPT; sigmatch_table[DETECT_AL_HTTP_RAW_HEADER].alternative = DETECT_HTTP_RAW_HEADER; /* http.header.raw sticky buffer */ sigmatch_table[DETECT_HTTP_RAW_HEADER].name = "http.header.raw"; sigmatch_table[DETECT_HTTP_RAW_HEADER].desc = "sticky buffer to match the raw HTTP header buffer"; sigmatch_table[DETECT_HTTP_RAW_HEADER].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-raw-header"; sigmatch_table[DETECT_HTTP_RAW_HEADER].Setup = DetectHttpRawHeaderSetupSticky; sigmatch_table[DETECT_HTTP_RAW_HEADER].flags |= SIGMATCH_NOOPT; sigmatch_table[DETECT_HTTP_RAW_HEADER].flags |= SIGMATCH_INFO_STICKY_BUFFER; DetectAppLayerInspectEngineRegister2("http_raw_header", ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_HEADERS+1, DetectEngineInspectBufferGeneric, GetData); DetectAppLayerInspectEngineRegister2("http_raw_header", ALPROTO_HTTP, SIG_FLAG_TOCLIENT, HTP_RESPONSE_HEADERS+1, DetectEngineInspectBufferGeneric, GetData); DetectAppLayerMpmRegister2("http_raw_header", SIG_FLAG_TOSERVER, 2, PrefilterMpmHttpHeaderRawRequestRegister, NULL, ALPROTO_HTTP, 0); /* progress handled in register */ DetectAppLayerMpmRegister2("http_raw_header", SIG_FLAG_TOCLIENT, 2, PrefilterMpmHttpHeaderRawResponseRegister, NULL, ALPROTO_HTTP, 0); /* progress handled in register */ DetectBufferTypeSetDescriptionByName("http_raw_header", "raw http headers"); DetectBufferTypeRegisterValidateCallback("http_raw_header", DetectHttpRawHeaderValidateCallback); g_http_raw_header_buffer_id = DetectBufferTypeGetByName("http_raw_header"); }
/** * \brief Registers the keyword handlers for the "http_header" keyword. */ void DetectHttpStartRegister(void) { sigmatch_table[DETECT_AL_HTTP_START].name = KEYWORD_NAME; sigmatch_table[DETECT_AL_HTTP_START].alias = KEYWORD_NAME_LEGACY; sigmatch_table[DETECT_AL_HTTP_START].desc = BUFFER_NAME " sticky buffer"; sigmatch_table[DETECT_AL_HTTP_START].url = DOC_URL DOC_VERSION "/rules/" KEYWORD_DOC; sigmatch_table[DETECT_AL_HTTP_START].Setup = DetectHttpStartSetup; sigmatch_table[DETECT_AL_HTTP_START].flags |= SIGMATCH_NOOPT|SIGMATCH_INFO_STICKY_BUFFER; DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterTxHttpRequestStartRegister, NULL, ALPROTO_HTTP, HTP_REQUEST_HEADERS); DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2, PrefilterTxHttpResponseStartRegister, NULL, ALPROTO_HTTP, HTP_RESPONSE_HEADERS); DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_HEADERS, InspectEngineHttpStart, NULL); DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP, SIG_FLAG_TOCLIENT, HTP_RESPONSE_HEADERS, InspectEngineHttpStart, NULL); DetectBufferTypeSetDescriptionByName(BUFFER_NAME, BUFFER_DESC); g_buffer_id = DetectBufferTypeGetByName(BUFFER_NAME); g_keyword_thread_id = DetectRegisterThreadCtxGlobalFuncs(KEYWORD_NAME, HttpHeaderThreadDataInit, &g_td_config, HttpHeaderThreadDataFree); SCLogDebug("keyword %s registered. Thread id %d. " "Buffer %s registered. Buffer id %d", KEYWORD_NAME, g_keyword_thread_id, BUFFER_NAME, g_buffer_id); }
void DetectSmbNamedPipeRegister(void) { sigmatch_table[KEYWORD_ID].name = KEYWORD_NAME; sigmatch_table[KEYWORD_ID].alias = KEYWORD_NAME_LEGACY; sigmatch_table[KEYWORD_ID].Setup = DetectSmbNamedPipeSetup; sigmatch_table[KEYWORD_ID].flags |= SIGMATCH_NOOPT|SIGMATCH_INFO_STICKY_BUFFER; sigmatch_table[KEYWORD_ID].desc = "sticky buffer to match on SMB named pipe in tree connect"; DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, GetNamedPipeData, ALPROTO_SMB, 1); DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_SMB, SIG_FLAG_TOSERVER, 0, DetectEngineInspectBufferGeneric, GetNamedPipeData); g_smb_named_pipe_buffer_id = DetectBufferTypeGetByName(BUFFER_NAME); }
/** * \brief Registration function for keyword: http_method */ void DetectHttpMethodRegister(void) { /* http_method content modifier */ sigmatch_table[DETECT_AL_HTTP_METHOD].name = "http_method"; sigmatch_table[DETECT_AL_HTTP_METHOD].desc = "content modifier to match only on the HTTP method-buffer"; sigmatch_table[DETECT_AL_HTTP_METHOD].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-method"; sigmatch_table[DETECT_AL_HTTP_METHOD].Match = NULL; sigmatch_table[DETECT_AL_HTTP_METHOD].Setup = DetectHttpMethodSetup; #ifdef UNITTESTS sigmatch_table[DETECT_AL_HTTP_METHOD].RegisterTests = DetectHttpMethodRegisterTests; #endif sigmatch_table[DETECT_AL_HTTP_METHOD].flags |= SIGMATCH_NOOPT|SIGMATCH_INFO_CONTENT_MODIFIER; sigmatch_table[DETECT_AL_HTTP_METHOD].alternative = DETECT_HTTP_METHOD; /* http.method sticky buffer */ sigmatch_table[DETECT_HTTP_METHOD].name = "http.method"; sigmatch_table[DETECT_HTTP_METHOD].desc = "sticky buffer to match specifically and only on the HTTP method buffer"; sigmatch_table[DETECT_HTTP_METHOD].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-method"; sigmatch_table[DETECT_HTTP_METHOD].Setup = DetectHttpMethodSetupSticky; sigmatch_table[DETECT_HTTP_METHOD].flags |= SIGMATCH_NOOPT|SIGMATCH_INFO_STICKY_BUFFER; DetectAppLayerInspectEngineRegister2("http_method", ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_LINE, DetectEngineInspectBufferGeneric, GetData); DetectAppLayerMpmRegister2("http_method", SIG_FLAG_TOSERVER, 4, PrefilterGenericMpmRegister, GetData, ALPROTO_HTTP, HTP_REQUEST_LINE); DetectBufferTypeSetDescriptionByName("http_method", "http request method"); DetectBufferTypeRegisterValidateCallback("http_method", DetectHttpMethodValidateCallback); g_http_method_buffer_id = DetectBufferTypeGetByName("http_method"); SCLogDebug("registering http_method rule option"); }
/** * \brief Registration function for keyword: dns_query */ void DetectDnsQueryRegister (void) { sigmatch_table[DETECT_AL_DNS_QUERY].name = "dns.query"; sigmatch_table[DETECT_AL_DNS_QUERY].alias = "dns_query"; sigmatch_table[DETECT_AL_DNS_QUERY].desc = "sticky buffer to match DNS query-buffer"; sigmatch_table[DETECT_AL_DNS_QUERY].Setup = DetectDnsQuerySetup; sigmatch_table[DETECT_AL_DNS_QUERY].RegisterTests = DetectDnsQueryRegisterTests; sigmatch_table[DETECT_AL_DNS_QUERY].flags |= SIGMATCH_NOOPT; sigmatch_table[DETECT_AL_DNS_QUERY].flags |= SIGMATCH_INFO_STICKY_BUFFER; DetectAppLayerMpmRegister2("dns_query", SIG_FLAG_TOSERVER, 2, PrefilterMpmDnsQueryRegister, NULL, ALPROTO_DNS, 1); DetectAppLayerInspectEngineRegister2("dns_query", ALPROTO_DNS, SIG_FLAG_TOSERVER, 1, DetectEngineInspectDnsQuery, NULL); DetectBufferTypeSetDescriptionByName("dns_query", "dns request query"); g_dns_query_buffer_id = DetectBufferTypeGetByName("dns_query"); /* register these generic engines from here for now */ DetectAppLayerInspectEngineRegister("dns_request", ALPROTO_DNS, SIG_FLAG_TOSERVER, 1, DetectEngineInspectDnsRequest); DetectAppLayerInspectEngineRegister("dns_response", ALPROTO_DNS, SIG_FLAG_TOCLIENT, 1, DetectEngineInspectDnsResponse); DetectBufferTypeSetDescriptionByName("dns_request", "dns requests"); DetectBufferTypeSetDescriptionByName("dns_response", "dns responses"); }
/** * \brief Registration function for keywords: http_uri and http.uri */ void DetectHttpUriRegister (void) { /* http_uri content modifier */ sigmatch_table[DETECT_AL_HTTP_URI].name = "http_uri"; sigmatch_table[DETECT_AL_HTTP_URI].desc = "content modifier to match specifically and only on the HTTP uri-buffer"; sigmatch_table[DETECT_AL_HTTP_URI].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-uri-and-http-raw-uri"; sigmatch_table[DETECT_AL_HTTP_URI].Setup = DetectHttpUriSetup; #ifdef UNITTESTS sigmatch_table[DETECT_AL_HTTP_URI].RegisterTests = DetectHttpUriRegisterTests; #endif sigmatch_table[DETECT_AL_HTTP_URI].flags |= SIGMATCH_NOOPT; /* http.uri sticky buffer */ sigmatch_table[DETECT_HTTP_URI].name = "http.uri"; sigmatch_table[DETECT_HTTP_URI].alias = "http.uri.normalized"; sigmatch_table[DETECT_HTTP_URI].desc = "sticky buffer to match specifically and only on the normalized HTTP URI buffer"; sigmatch_table[DETECT_HTTP_URI].url = DOC_URL DOC_VERSION "/rules/tls-keywords.html#http-uri"; sigmatch_table[DETECT_HTTP_URI].Setup = DetectHttpUriSetupSticky; sigmatch_table[DETECT_HTTP_URI].flags |= SIGMATCH_NOOPT; DetectAppLayerInspectEngineRegister2("http_uri", ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_LINE, DetectEngineInspectBufferGeneric, GetData); DetectAppLayerMpmRegister2("http_uri", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, GetData, ALPROTO_HTTP, HTP_REQUEST_LINE); DetectBufferTypeSetDescriptionByName("http_uri", "http request uri"); DetectBufferTypeRegisterSetupCallback("http_uri", DetectHttpUriSetupCallback); DetectBufferTypeRegisterValidateCallback("http_uri", DetectHttpUriValidateCallback); g_http_uri_buffer_id = DetectBufferTypeGetByName("http_uri"); /* http_raw_uri content modifier */ sigmatch_table[DETECT_AL_HTTP_RAW_URI].name = "http_raw_uri"; sigmatch_table[DETECT_AL_HTTP_RAW_URI].desc = "content modifier to match on the raw HTTP uri"; sigmatch_table[DETECT_AL_HTTP_RAW_URI].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http_uri-and-http_raw-uri"; sigmatch_table[DETECT_AL_HTTP_RAW_URI].Setup = DetectHttpRawUriSetup; sigmatch_table[DETECT_AL_HTTP_RAW_URI].flags |= SIGMATCH_NOOPT; /* http.uri.raw sticky buffer */ sigmatch_table[DETECT_HTTP_URI_RAW].name = "http.uri.raw"; sigmatch_table[DETECT_HTTP_URI_RAW].desc = "sticky buffer to match specifically and only on the raw HTTP URI buffer"; sigmatch_table[DETECT_HTTP_URI_RAW].url = DOC_URL DOC_VERSION "/rules/tls-keywords.html#http-uri"; sigmatch_table[DETECT_HTTP_URI_RAW].Setup = DetectHttpRawUriSetupSticky; sigmatch_table[DETECT_HTTP_URI_RAW].flags |= SIGMATCH_NOOPT; DetectAppLayerInspectEngineRegister2("http_raw_uri", ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_LINE, DetectEngineInspectBufferGeneric, GetRawData); DetectAppLayerMpmRegister2("http_raw_uri", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, GetRawData, ALPROTO_HTTP, HTP_REQUEST_LINE); DetectBufferTypeSetDescriptionByName("http_raw_uri", "raw http uri"); DetectBufferTypeRegisterSetupCallback("http_raw_uri", DetectHttpRawUriSetupCallback); DetectBufferTypeRegisterValidateCallback("http_raw_uri", DetectHttpRawUriValidateCallback); g_http_raw_uri_buffer_id = DetectBufferTypeGetByName("http_raw_uri"); }