Go to the documentation of this file.
35 #ifndef __DETECT_ENGINE_STATE_H__
36 #define __DETECT_ENGINE_STATE_H__
38 #define DETECT_ENGINE_INSPECT_SIG_NO_MATCH 0
39 #define DETECT_ENGINE_INSPECT_SIG_MATCH 1
40 #define DETECT_ENGINE_INSPECT_SIG_CANT_MATCH 2
44 #define DETECT_ENGINE_INSPECT_SIG_CANT_MATCH_FILES 3
50 #define DETECT_ENGINE_INSPECT_SIG_MATCH_MORE_FILES 4
53 #define DE_STATE_CHUNK_SIZE 15
56 #define DE_STATE_FLAG_FULL_INSPECT BIT_U32(0)
57 #define DE_STATE_FLAG_SIG_CANT_MATCH BIT_U32(1)
60 #define DE_STATE_ID_FILE_INSPECT 2UL
61 #define DE_STATE_FLAG_FILE_INSPECT BIT_U32(DE_STATE_ID_FILE_INSPECT)
64 #define DE_STATE_FLAG_BASE 3UL
71 #define DETECT_ENGINE_STATE_FLAG_FILE_NEW BIT_U8(0)
131 const bool tag_txs_as_inspected);
140 Flow *f,
void *tx, uint64_t tx_id,
142 uint32_t inspect_flags, uint8_t flow_flags,
143 const uint16_t file_no_match);
147 Flow *f,
void *tx, uint64_t tx_id,
148 const uint8_t flow_flags,
149 const uint16_t file_no_match);
struct AppLayerTxData * tx_data_ptr
#define DE_STATE_CHUNK_SIZE
Container for matching data for a signature group.
struct DetectEngineStateDirection_ DetectEngineStateDirection
struct DetectEngineState_ DetectEngineState
DetectEngineStateDirection dir_state[2]
const uint64_t prefilter_flags_orig
struct DetectTransaction_ DetectTransaction
void DetectRunStoreStateTx(const SigGroupHead *sgh, Flow *f, void *tx, uint64_t tx_id, const Signature *s, uint32_t inspect_flags, uint8_t flow_flags, const uint16_t file_no_match)
void DeStateUpdateInspectTransactionId(Flow *f, const uint8_t flags, const bool tag_txs_as_inspected)
Update the inspect id.
struct DeStateStore_ * next
DetectEngineState * DetectEngineStateAlloc(void)
Alloc a DetectEngineState object.
void DetectRunStoreStateTxFileOnly(const SigGroupHead *sgh, Flow *f, void *tx, uint64_t tx_id, const uint8_t flow_flags, const uint16_t file_no_match)
DetectEngineStateDirection * de_state
void DetectEngineStateFree(DetectEngineState *state)
Frees a DetectEngineState object.
void DetectEngineStateResetTxs(Flow *f)
Reset de state for active tx' To be used on detect engine reload.
struct DeStateStore_ DeStateStore
struct DeStateStoreItem_ DeStateStoreItem
DeStateStoreItem store[DE_STATE_CHUNK_SIZE]
void DeStateRegisterTests(void)
const uint64_t detect_flags