suricata
State support

State is stored in the DetectEngineState structure. This is basically a container for storage item of type DeStateStore. They contains an array of DeStateStoreItem which store the state of match for an individual signature identified by DeStateStoreItem::sid. More...

Files

file  detect-engine-state.c
 State based signature handling.
 
file  detect-engine-state.h
 Data structures and function prototypes for keeping state for the detection engine.
 

Macros

#define CASE_CODE(E)   case E: return #E
 

Functions

DetectEngineStateDetectEngineStateAlloc (void)
 Alloc a DetectEngineState object. More...
 
void DetectEngineStateFree (DetectEngineState *state)
 Frees a DetectEngineState object. More...
 
void DetectRunStoreStateTx (const SigGroupHead *sgh, Flow *f, void *tx, uint64_t tx_id, const Signature *s, uint32_t inspect_flags, uint8_t flow_flags, const uint16_t file_no_match)
 
void DetectEngineStateResetTxs (Flow *f)
 Reset de state for active tx' To be used on detect engine reload. More...
 
void DeStateRegisterTests (void)
 

Detailed Description

State is stored in the DetectEngineState structure. This is basically a container for storage item of type DeStateStore. They contains an array of DeStateStoreItem which store the state of match for an individual signature identified by DeStateStoreItem::sid.

Macro Definition Documentation

◆ CASE_CODE

#define CASE_CODE (   E)    case E: return #E

convert enum to string

Definition at line 69 of file detect-engine-state.c.

Function Documentation

◆ DeStateRegisterTests()

void DeStateRegisterTests ( void  )

Definition at line 1447 of file detect-engine-state.c.

References UtRegisterTest().

Here is the call graph for this function:

◆ DetectEngineStateAlloc()

DetectEngineState* DetectEngineStateAlloc ( void  )

Alloc a DetectEngineState object.

Return values
Alloc'dinstance of DetectEngineState.

Definition at line 163 of file detect-engine-state.c.

References SCCalloc, and unlikely.

Referenced by DetectRunStoreStateTx().

Here is the caller graph for this function:

◆ DetectEngineStateFree()

void DetectEngineStateFree ( DetectEngineState state)

Frees a DetectEngineState object.

Parameters
stateDetectEngineState instance to free.

Definition at line 172 of file detect-engine-state.c.

References DetectEngineState_::dir_state, DetectEngineStateDirection_::head, DeStateStore_::next, and SCFree.

◆ DetectEngineStateResetTxs()

void DetectEngineStateResetTxs ( Flow f)

Reset de state for active tx' To be used on detect engine reload.

Parameters
fwrite LOCKED flow

Definition at line 267 of file detect-engine-state.c.

◆ DetectRunStoreStateTx()

void DetectRunStoreStateTx ( const SigGroupHead sgh,
Flow f,
void *  tx,
uint64_t  tx_id,
const Signature s,
uint32_t  inspect_flags,
uint8_t  flow_flags,
const uint16_t  file_no_match 
)

Definition at line 221 of file detect-engine-state.c.

References Flow_::alproto, AppLayerParserGetTxData(), BUG_ON, DetectEngineStateAlloc(), Flow_::proto, and SCLogDebug.

Here is the call graph for this function: