suricata
DetectEngineCtx_ Struct Reference

main detection engine ctx More...

#include <detect.h>

Collaboration diagram for DetectEngineCtx_:

Data Fields

uint8_t flags
 
int failure_fatal
 
int tenant_id
 
Signaturesig_list
 
uint32_t sig_cnt
 
uint32_t srep_version
 
SRepCIDRTreesrepCIDR_ctx
 
Signature ** sig_array
 
uint32_t sig_array_size
 
uint32_t sig_array_len
 
uint32_t signum
 
uint32_t non_pf_store_cnt_max
 
struct SCSigOrderFunc_sc_sig_order_funcs
 
HashTableclass_conf_ht
 
HashTablereference_conf_ht
 
DetectEngineLookupFlow flow_gh [FLOW_STATES]
 
uint32_t gh_unique
 
uint32_t gh_reuse
 
HashListTablesgh_hash_table
 
HashListTablempm_hash_table
 
HashListTabledup_sig_hash_table
 
DetectEngineIPOnlyCtx io_ctx
 
ThresholdCtx ths_ctx
 
uint16_t mpm_matcher
 
uint16_t spm_matcher
 
SpmGlobalThreadCtxspm_global_thread_ctx
 
uint16_t max_uniq_toclient_groups
 
uint16_t max_uniq_toserver_groups
 
uint8_t sgh_mpm_context
 
uint32_t max_fb_id
 
uint32_t max_fp_id
 
MpmCtxFactoryContainermpm_ctx_factory_container
 
int inspection_recursion_limit
 
int hcbd_buffer_limit
 
int hsbd_buffer_limit
 
struct SigGroupHead_ ** sgh_array
 
uint32_t sgh_array_cnt
 
uint32_t sgh_array_size
 
int32_t sgh_mpm_context_proto_tcp_packet
 
int32_t sgh_mpm_context_proto_udp_packet
 
int32_t sgh_mpm_context_proto_other_packet
 
int32_t sgh_mpm_context_stream
 
int32_t byte_extract_max_local_id
 
uint32_t version
 
struct SigGroupHead_decoder_event_sgh
 
uint32_t base64_decode_max_len
 
char * rule_file
 
int rule_line
 
bool sigerror_silent
 
bool sigerror_ok
 
const char * sigerror
 
DetectEngineThreadKeywordCtxItemkeyword_list
 
int keyword_id
 
struct {
   uint32_t   content_limit
 
   uint32_t   content_inspect_min_size
 
   uint32_t   content_inspect_window
 
filedata_config [ALPROTO_MAX]
 
bool filedata_config_initialized
 
struct SCProfileDetectCtx_profile_ctx
 
struct SCProfileKeywordDetectCtx_profile_keyword_ctx
 
struct SCProfilePrefilterDetectCtx_profile_prefilter_ctx
 
struct SCProfileKeywordDetectCtx_ ** profile_keyword_ctx_per_list
 
struct SCProfileSghDetectCtx_profile_sgh_ctx
 
uint32_t profile_match_logging_threshold
 
uint32_t prefilter_maxid
 
char config_prefix [64]
 
enum DetectEngineType type
 
uint32_t ref_cnt
 
struct DetectEngineCtx_next
 
int loader_id
 
enum DetectEnginePrefilterSetting prefilter_setting
 
HashListTabledport_hash_table
 
DetectPorttcp_whitelist
 
DetectPortudp_whitelist
 
HashListTableaddress_table
 
HashTablemetadata_table
 
DetectBufferType ** buffer_type_map
 
uint32_t buffer_type_map_elements
 
HashListTablebuffer_type_hash
 
int buffer_type_id
 
DetectEngineAppInspectionEngineapp_inspect_engines
 
DetectBufferMpmRegisteryapp_mpms_list
 
uint32_t app_mpms_list_cnt
 
DetectEnginePktInspectionEnginepkt_inspect_engines
 
DetectBufferMpmRegisterypkt_mpms_list
 
uint32_t pkt_mpms_list_cnt
 
uint32_t prefilter_id
 
HashListTableprefilter_hash_table
 
struct timeval last_reload
 
SigFileLoaderStat sig_stat
 
bool sm_types_prefilter [DETECT_TBLSIZE]
 
bool sm_types_silent_error [DETECT_TBLSIZE]
 

Detailed Description

main detection engine ctx

Definition at line 766 of file detect.h.

Field Documentation

◆ address_table

HashListTable* DetectEngineCtx_::address_table

table for storing the string representation with the parsers result

Definition at line 918 of file detect.h.

Referenced by DetectAddressMapFree(), and DetectAddressMapInit().

◆ app_inspect_engines

DetectEngineAppInspectionEngine* DetectEngineCtx_::app_inspect_engines

Definition at line 933 of file detect.h.

Referenced by DetectEngineAppInspectionEngine2Signature().

◆ app_mpms_list

DetectBufferMpmRegistery* DetectEngineCtx_::app_mpms_list

Definition at line 934 of file detect.h.

Referenced by DetectAppLayerMpmRegisterByParentId(), and DetectMpmPrepareAppMpms().

◆ app_mpms_list_cnt

uint32_t DetectEngineCtx_::app_mpms_list_cnt

Definition at line 935 of file detect.h.

Referenced by DetectAppLayerMpmRegisterByParentId().

◆ base64_decode_max_len

uint32_t DetectEngineCtx_::base64_decode_max_len

Definition at line 867 of file detect.h.

◆ buffer_type_hash

HashListTable* DetectEngineCtx_::buffer_type_hash

Definition at line 928 of file detect.h.

◆ buffer_type_id

int DetectEngineCtx_::buffer_type_id

Definition at line 929 of file detect.h.

Referenced by SCProfilingKeywordInitCounters(), and SCProfilingKeywordThreadSetup().

◆ buffer_type_map

DetectBufferType** DetectEngineCtx_::buffer_type_map

Definition at line 923 of file detect.h.

Referenced by DetectBufferTypeGetNameById().

◆ buffer_type_map_elements

uint32_t DetectEngineCtx_::buffer_type_map_elements

Definition at line 924 of file detect.h.

Referenced by DetectBufferTypeGetNameById(), and MpmStoreReportStats().

◆ byte_extract_max_local_id

int32_t DetectEngineCtx_::byte_extract_max_local_id

Definition at line 857 of file detect.h.

◆ class_conf_ht

HashTable* DetectEngineCtx_::class_conf_ht

Definition at line 795 of file detect.h.

Referenced by SCClassConfDeInitContext(), and SCClassConfGetClasstype().

◆ config_prefix

char DetectEngineCtx_::config_prefix[64]

Definition at line 897 of file detect.h.

Referenced by DetectLoadCompleteSigPath(), SCRuleVarsGetConfVar(), and SigLoadSignatures().

◆ content_inspect_min_size

uint32_t DetectEngineCtx_::content_inspect_min_size

Definition at line 882 of file detect.h.

◆ content_inspect_window

uint32_t DetectEngineCtx_::content_inspect_window

Definition at line 883 of file detect.h.

◆ content_limit

uint32_t DetectEngineCtx_::content_limit

Definition at line 881 of file detect.h.

◆ decoder_event_sgh

struct SigGroupHead_* DetectEngineCtx_::decoder_event_sgh

sgh for signatures that match against invalid packets. In those cases we can't lookup by proto, address, port as we don't have these

Definition at line 864 of file detect.h.

Referenced by SigAddressCleanupStage1(), and SigMatchSignaturesGetSgh().

◆ dport_hash_table

HashListTable* DetectEngineCtx_::dport_hash_table

◆ dup_sig_hash_table

HashListTable* DetectEngineCtx_::dup_sig_hash_table

Definition at line 810 of file detect.h.

Referenced by DetectParseDupSigHashFree(), and DetectParseDupSigHashInit().

◆ failure_fatal

int DetectEngineCtx_::failure_fatal

Definition at line 768 of file detect.h.

◆ filedata_config

struct { ... } DetectEngineCtx_::filedata_config[ALPROTO_MAX]

◆ filedata_config_initialized

bool DetectEngineCtx_::filedata_config_initialized

Definition at line 885 of file detect.h.

◆ flags

◆ flow_gh

DetectEngineLookupFlow DetectEngineCtx_::flow_gh[FLOW_STATES]

Definition at line 800 of file detect.h.

Referenced by SigAddressCleanupStage1(), and SigAddressPrepareStage2().

◆ gh_reuse

uint32_t DetectEngineCtx_::gh_reuse

Definition at line 802 of file detect.h.

◆ gh_unique

uint32_t DetectEngineCtx_::gh_unique

Definition at line 802 of file detect.h.

◆ hcbd_buffer_limit

int DetectEngineCtx_::hcbd_buffer_limit

Definition at line 841 of file detect.h.

◆ hsbd_buffer_limit

int DetectEngineCtx_::hsbd_buffer_limit

Definition at line 843 of file detect.h.

◆ inspection_recursion_limit

int DetectEngineCtx_::inspection_recursion_limit

Definition at line 838 of file detect.h.

Referenced by DetectEngineContentInspection().

◆ io_ctx

◆ keyword_id

int DetectEngineCtx_::keyword_id

Definition at line 878 of file detect.h.

Referenced by DetectRegisterThreadCtxFuncs().

◆ keyword_list

DetectEngineThreadKeywordCtxItem* DetectEngineCtx_::keyword_list

list of keywords that need thread local ctxs

Definition at line 877 of file detect.h.

Referenced by DetectRegisterThreadCtxFuncs(), and DetectUnregisterThreadCtxFuncs().

◆ last_reload

struct timeval DetectEngineCtx_::last_reload

time of last ruleset reload

Definition at line 941 of file detect.h.

◆ loader_id

int DetectEngineCtx_::loader_id

id of loader thread 'owning' this de_ctx

Definition at line 907 of file detect.h.

◆ max_fb_id

uint32_t DetectEngineCtx_::max_fb_id

Definition at line 831 of file detect.h.

Referenced by DetectFlowbitsAnalyze().

◆ max_fp_id

uint32_t DetectEngineCtx_::max_fp_id

Definition at line 833 of file detect.h.

◆ max_uniq_toclient_groups

uint16_t DetectEngineCtx_::max_uniq_toclient_groups

Definition at line 824 of file detect.h.

◆ max_uniq_toserver_groups

uint16_t DetectEngineCtx_::max_uniq_toserver_groups

Definition at line 825 of file detect.h.

◆ metadata_table

HashTable* DetectEngineCtx_::metadata_table

table to store metadata keys and values

Definition at line 921 of file detect.h.

Referenced by DetectMetadataHashFree(), and DetectMetadataHashInit().

◆ mpm_ctx_factory_container

◆ mpm_hash_table

HashListTable* DetectEngineCtx_::mpm_hash_table

Definition at line 807 of file detect.h.

Referenced by MpmStoreFree(), MpmStoreInit(), and MpmStoreReportStats().

◆ mpm_matcher

uint16_t DetectEngineCtx_::mpm_matcher

◆ next

struct DetectEngineCtx_* DetectEngineCtx_::next

list in master: either active or freelist

Definition at line 904 of file detect.h.

◆ non_pf_store_cnt_max

uint32_t DetectEngineCtx_::non_pf_store_cnt_max

Maximum value of all our sgh's non_mpm_store_cnt setting, used to alloc det_ctx::non_mpm_id_array

Definition at line 789 of file detect.h.

Referenced by SigGroupHeadBuildNonPrefilterArray().

◆ pkt_inspect_engines

DetectEnginePktInspectionEngine* DetectEngineCtx_::pkt_inspect_engines

Definition at line 936 of file detect.h.

Referenced by DetectEngineAppInspectionEngine2Signature().

◆ pkt_mpms_list

DetectBufferMpmRegistery* DetectEngineCtx_::pkt_mpms_list

Definition at line 937 of file detect.h.

Referenced by DetectMpmPreparePktMpms(), and DetectPktMpmRegisterByParentId().

◆ pkt_mpms_list_cnt

uint32_t DetectEngineCtx_::pkt_mpms_list_cnt

Definition at line 938 of file detect.h.

Referenced by DetectPktMpmRegisterByParentId().

◆ prefilter_hash_table

HashListTable* DetectEngineCtx_::prefilter_hash_table

Definition at line 941 of file detect.h.

Referenced by PrefilterDeinit(), and PrefilterInit().

◆ prefilter_id

uint32_t DetectEngineCtx_::prefilter_id

◆ prefilter_maxid

uint32_t DetectEngineCtx_::prefilter_maxid

Definition at line 895 of file detect.h.

◆ prefilter_setting

enum DetectEnginePrefilterSetting DetectEngineCtx_::prefilter_setting

are we using just mpm or also other prefilters

Definition at line 907 of file detect.h.

Referenced by PrefilterSetupRuleGroup().

◆ profile_ctx

struct SCProfileDetectCtx_* DetectEngineCtx_::profile_ctx

◆ profile_keyword_ctx

struct SCProfileKeywordDetectCtx_* DetectEngineCtx_::profile_keyword_ctx

◆ profile_keyword_ctx_per_list

struct SCProfileKeywordDetectCtx_** DetectEngineCtx_::profile_keyword_ctx_per_list

Definition at line 891 of file detect.h.

◆ profile_match_logging_threshold

uint32_t DetectEngineCtx_::profile_match_logging_threshold

Definition at line 893 of file detect.h.

◆ profile_prefilter_ctx

struct SCProfilePrefilterDetectCtx_* DetectEngineCtx_::profile_prefilter_ctx

◆ profile_sgh_ctx

struct SCProfileSghDetectCtx_* DetectEngineCtx_::profile_sgh_ctx

◆ ref_cnt

uint32_t DetectEngineCtx_::ref_cnt

how many de_ctx' are referencing this

Definition at line 902 of file detect.h.

Referenced by DetectEngineReference().

◆ reference_conf_ht

HashTable* DetectEngineCtx_::reference_conf_ht

Definition at line 797 of file detect.h.

Referenced by SCRConfDeInitContext(), and SCRConfGetReference().

◆ rule_file

char* DetectEngineCtx_::rule_file

Store rule file and line so that parsers can use them in errors.

Definition at line 870 of file detect.h.

◆ rule_line

int DetectEngineCtx_::rule_line

Definition at line 871 of file detect.h.

◆ sc_sig_order_funcs

struct SCSigOrderFunc_* DetectEngineCtx_::sc_sig_order_funcs

Definition at line 792 of file detect.h.

Referenced by SCSigSignatureOrderingModuleCleanup().

◆ sgh_array

struct SigGroupHead_** DetectEngineCtx_::sgh_array

Definition at line 847 of file detect.h.

Referenced by SigAddressCleanupStage1(), and SigGroupHeadStore().

◆ sgh_array_cnt

uint32_t DetectEngineCtx_::sgh_array_cnt

◆ sgh_array_size

uint32_t DetectEngineCtx_::sgh_array_size

Definition at line 849 of file detect.h.

Referenced by SigAddressCleanupStage1(), and SigGroupHeadStore().

◆ sgh_hash_table

◆ sgh_mpm_context

uint8_t DetectEngineCtx_::sgh_mpm_context

Definition at line 828 of file detect.h.

◆ sgh_mpm_context_proto_other_packet

int32_t DetectEngineCtx_::sgh_mpm_context_proto_other_packet

Definition at line 853 of file detect.h.

Referenced by DetectMpmPrepareBuiltinMpms().

◆ sgh_mpm_context_proto_tcp_packet

int32_t DetectEngineCtx_::sgh_mpm_context_proto_tcp_packet

Definition at line 851 of file detect.h.

Referenced by DetectMpmInitializeBuiltinMpms(), and DetectMpmPrepareBuiltinMpms().

◆ sgh_mpm_context_proto_udp_packet

int32_t DetectEngineCtx_::sgh_mpm_context_proto_udp_packet

Definition at line 852 of file detect.h.

Referenced by DetectMpmPrepareBuiltinMpms().

◆ sgh_mpm_context_stream

int32_t DetectEngineCtx_::sgh_mpm_context_stream

Definition at line 854 of file detect.h.

Referenced by DetectMpmPrepareBuiltinMpms().

◆ sig_array

◆ sig_array_len

uint32_t DetectEngineCtx_::sig_array_len

Definition at line 783 of file detect.h.

Referenced by DetectFlowbitsAnalyze(), and SigAddressPrepareStage1().

◆ sig_array_size

uint32_t DetectEngineCtx_::sig_array_size

Definition at line 782 of file detect.h.

Referenced by SigAddressPrepareStage1().

◆ sig_cnt

uint32_t DetectEngineCtx_::sig_cnt

Definition at line 773 of file detect.h.

◆ sig_list

◆ sig_stat

SigFileLoaderStat DetectEngineCtx_::sig_stat

signatures stats

Definition at line 947 of file detect.h.

Referenced by SigLoadSignatures().

◆ sigerror

const char* DetectEngineCtx_::sigerror

Definition at line 874 of file detect.h.

◆ sigerror_ok

bool DetectEngineCtx_::sigerror_ok

Definition at line 873 of file detect.h.

◆ sigerror_silent

bool DetectEngineCtx_::sigerror_silent

Definition at line 872 of file detect.h.

Referenced by SigInit().

◆ signum

uint32_t DetectEngineCtx_::signum

Definition at line 785 of file detect.h.

Referenced by DetectEngineResetMaxSigId(), SigGroupBuild(), SigInit(), and ThresholdHashRealloc().

◆ sm_types_prefilter

bool DetectEngineCtx_::sm_types_prefilter[DETECT_TBLSIZE]

per keyword flag indicating if a prefilter has been set for it. If true, the setup function will have to run.

Definition at line 952 of file detect.h.

Referenced by PrefilterSetupRuleGroup().

◆ sm_types_silent_error

bool DetectEngineCtx_::sm_types_silent_error[DETECT_TBLSIZE]

Definition at line 953 of file detect.h.

Referenced by SigMatchSilentErrorEnabled().

◆ spm_global_thread_ctx

SpmGlobalThreadCtx* DetectEngineCtx_::spm_global_thread_ctx

Definition at line 820 of file detect.h.

Referenced by DetectContentSetup(), and DetectEngineCtxFree().

◆ spm_matcher

uint16_t DetectEngineCtx_::spm_matcher

spm matcher this ctx uses

Definition at line 816 of file detect.h.

◆ srep_version

uint32_t DetectEngineCtx_::srep_version

Definition at line 776 of file detect.h.

◆ srepCIDR_ctx

SRepCIDRTree* DetectEngineCtx_::srepCIDR_ctx

Definition at line 779 of file detect.h.

Referenced by SRepDestroy(), and SRepInit().

◆ tcp_whitelist

DetectPort* DetectEngineCtx_::tcp_whitelist

Definition at line 914 of file detect.h.

◆ tenant_id

int DetectEngineCtx_::tenant_id

Definition at line 770 of file detect.h.

◆ ths_ctx

ThresholdCtx DetectEngineCtx_::ths_ctx

Definition at line 813 of file detect.h.

Referenced by ThresholdContextDestroy(), ThresholdHashInit(), and ThresholdHashRealloc().

◆ type

enum DetectEngineType DetectEngineCtx_::type

Definition at line 897 of file detect.h.

Referenced by DetectEngineThreadCtxInit().

◆ udp_whitelist

DetectPort* DetectEngineCtx_::udp_whitelist

Definition at line 915 of file detect.h.

◆ version

uint32_t DetectEngineCtx_::version

version of the detect engine. The version is incremented on reloads

Definition at line 860 of file detect.h.


The documentation for this struct was generated from the following file: