suricata
AppLayerTxData Struct Reference

#include <app-layer-parser.h>

Collaboration diagram for AppLayerTxData:

Data Fields

AppLayerTxConfig config
 config: log flags More...
 
bool updated_tc
 
bool updated_ts
 
uint8_t flags
 
uint32_t logged
 logger flags for tx logging api More...
 
uint32_t files_opened
 track file open/logs so we can know how long to keep the tx More...
 
uint32_t files_logged
 
uint32_t files_stored
 
uint16_t file_flags
 
uint8_t file_tx
 
uint8_t guessed_applayer_logged
 
uint8_t detect_progress_ts
 
uint8_t detect_progress_tc
 
DetectEngineStatede_state
 
AppLayerDecoderEventsevents
 
GenericVartxbits
 

Detailed Description

Definition at line 177 of file app-layer-parser.h.

Field Documentation

◆ config

AppLayerTxConfig AppLayerTxData::config

config: log flags

Definition at line 179 of file app-layer-parser.h.

◆ de_state

DetectEngineState* AppLayerTxData::de_state

Definition at line 218 of file app-layer-parser.h.

Referenced by DetectRunStoreStateTx(), and SCAppLayerTxDataCleanup().

◆ detect_progress_tc

uint8_t AppLayerTxData::detect_progress_tc

Definition at line 216 of file app-layer-parser.h.

Referenced by AppLayerParserGetTxDetectProgress().

◆ detect_progress_ts

uint8_t AppLayerTxData::detect_progress_ts

detection engine progress tracking for use by detection engine Reflects the "progress" of prefilter engines into this TX, where the value is offset by 1. So if for progress state 0 the engines are done, the value here will be 1. So a value of 0 means, no progress tracked yet.

Definition at line 215 of file app-layer-parser.h.

Referenced by AppLayerParserGetTxDetectProgress().

◆ events

AppLayerDecoderEvents* AppLayerTxData::events

Definition at line 219 of file app-layer-parser.h.

Referenced by AppLayerParserGetEventsByTx(), and SCAppLayerTxDataCleanup().

◆ file_flags

uint16_t AppLayerTxData::file_flags

Definition at line 197 of file app-layer-parser.h.

Referenced by FileApplyTxFlags(), and HTPFileOpen().

◆ file_tx

uint8_t AppLayerTxData::file_tx

Indicated if a file tracking tx, and if so in which direction: 0: not a file tx STREAM_TOSERVER: file tx, files only in toserver dir STREAM_TOCLIENT: file tx , files only in toclient dir STREAM_TOSERVER|STREAM_TOCLIENT: files possible in both dirs

Definition at line 204 of file app-layer-parser.h.

◆ files_logged

uint32_t AppLayerTxData::files_logged

Definition at line 194 of file app-layer-parser.h.

◆ files_opened

uint32_t AppLayerTxData::files_opened

track file open/logs so we can know how long to keep the tx

Definition at line 193 of file app-layer-parser.h.

Referenced by HTPFileClose(), and HTPFileOpen().

◆ files_stored

uint32_t AppLayerTxData::files_stored

Definition at line 195 of file app-layer-parser.h.

◆ flags

uint8_t AppLayerTxData::flags

Definition at line 187 of file app-layer-parser.h.

Referenced by AppLayerParserSetTransactionInspectId().

◆ guessed_applayer_logged

uint8_t AppLayerTxData::guessed_applayer_logged

Number of times this tx data has already been logged for signatures not using application layer keywords

Definition at line 207 of file app-layer-parser.h.

◆ logged

uint32_t AppLayerTxData::logged

logger flags for tx logging api

Definition at line 190 of file app-layer-parser.h.

◆ txbits

GenericVar* AppLayerTxData::txbits

Definition at line 220 of file app-layer-parser.h.

Referenced by SCAppLayerTxDataCleanup().

◆ updated_tc

bool AppLayerTxData::updated_tc

The tx has been updated and needs to be processed : detection, logging, cleaning It can then be skipped until new data arrives. There is a boolean for both directions : to server and to client

Definition at line 184 of file app-layer-parser.h.

◆ updated_ts

bool AppLayerTxData::updated_ts

Definition at line 185 of file app-layer-parser.h.


The documentation for this struct was generated from the following file: