suricata
DetectEngineCtx_ Struct Reference

main detection engine ctx More...

#include <detect.h>

Collaboration diagram for DetectEngineCtx_:

Data Fields

bool failure_fatal
 
uint8_t flags
 
uint8_t mpm_matcher
 
uint8_t spm_matcher
 
uint32_t tenant_id
 
Signaturesig_list
 
uint32_t sig_cnt
 
uint32_t srep_version
 
SRepCIDRTreesrepCIDR_ctx
 
Signature ** sig_array
 
uint32_t sig_array_len
 
uint32_t signum
 
uint32_t non_pf_store_cnt_max
 
struct SCSigOrderFunc_sc_sig_order_funcs
 
DetectEngineLookupFlow flow_gh [FLOW_STATES]
 
HashListTablesgh_hash_table
 
HashListTablempm_hash_table
 
HashListTablepattern_hash_table
 
HashListTabledup_sig_hash_table
 
DetectEngineIPOnlyCtx io_ctx
 
int inspection_recursion_limit
 
uint8_t guess_applayer_log_limit
 
bool guess_applayer
 
int filemagic_thread_ctx_id
 
SpmGlobalThreadCtxspm_global_thread_ctx
 
uint16_t max_uniq_toclient_groups
 
uint16_t max_uniq_toserver_groups
 
uint32_t max_fb_id
 
MpmCtxFactoryContainermpm_ctx_factory_container
 
struct SigGroupHead_ ** sgh_array
 
uint32_t sgh_array_cnt
 
uint32_t sgh_array_size
 
int32_t sgh_mpm_context_proto_tcp_packet
 
int32_t sgh_mpm_context_proto_udp_packet
 
int32_t sgh_mpm_context_proto_other_packet
 
int32_t sgh_mpm_context_stream
 
int32_t byte_extract_max_local_id
 
uint32_t version
 
struct SigGroupHead_decoder_event_sgh
 
uint32_t base64_decode_max_len
 
int rule_line
 
char * rule_file
 
const char * sigerror
 
bool sigerror_silent
 
bool sigerror_ok
 
bool sigerror_requires
 
uint8_t sgh_mpm_ctx_cnf
 
int keyword_id
 
HashListTablekeyword_hash
 
DetectFileDataCfgfiledata_config
 
struct SCProfileKeywordDetectCtx_profile_keyword_ctx
 
struct SCProfilePrefilterDetectCtx_profile_prefilter_ctx
 
struct SCProfileKeywordDetectCtx_ ** profile_keyword_ctx_per_list
 
struct SCProfileSghDetectCtx_profile_sgh_ctx
 
uint32_t profile_match_logging_threshold
 
char config_prefix [64]
 
enum DetectEngineType type
 
uint32_t ref_cnt
 
struct DetectEngineCtx_next
 
int loader_id
 
enum DetectEnginePrefilterSetting prefilter_setting
 
HashListTabledport_hash_table
 
DetectPorttcp_priorityports
 
DetectPortudp_priorityports
 
HashListTableaddress_table
 
HashTablemetadata_table
 
HashListTablebuffer_type_hash_name
 
HashListTablebuffer_type_hash_id
 
uint32_t buffer_type_id
 
uint32_t app_mpms_list_cnt
 
DetectBufferMpmRegistryapp_mpms_list
 
DetectEngineAppInspectionEngineapp_inspect_engines
 
DetectEnginePktInspectionEnginepkt_inspect_engines
 
DetectBufferMpmRegistrypkt_mpms_list
 
uint32_t pkt_mpms_list_cnt
 
DetectEngineFrameInspectionEngineframe_inspect_engines
 
DetectBufferMpmRegistryframe_mpms_list
 
uint32_t frame_mpms_list_cnt
 
uint32_t prefilter_id
 
HashListTableprefilter_hash_table
 
struct timeval last_reload
 
SigFileLoaderStat sig_stat
 
SCFPSupportSMListfp_support_smlist_list
 
bool * sm_types_prefilter
 
bool * sm_types_silent_error
 
HashTableclass_conf_ht
 
pcre2_code * class_conf_regex
 
pcre2_match_data * class_conf_regex_match
 
HashTablereference_conf_ht
 
pcre2_code * reference_conf_regex
 
pcre2_match_data * reference_conf_regex_match
 
struct EngineAnalysisCtx_ea
 
char * tenant_path
 
SCDetectRequiresStatusrequirements
 
uint16_t filestore_cnt
 

Detailed Description

main detection engine ctx

Definition at line 843 of file detect.h.

Field Documentation

◆ address_table

HashListTable* DetectEngineCtx_::address_table

table for storing the string representation with the parsers result

Definition at line 986 of file detect.h.

Referenced by DetectAddressMapFree(), and DetectAddressMapInit().

◆ app_inspect_engines

DetectEngineAppInspectionEngine* DetectEngineCtx_::app_inspect_engines

Definition at line 1001 of file detect.h.

◆ app_mpms_list

DetectBufferMpmRegistry* DetectEngineCtx_::app_mpms_list

Definition at line 998 of file detect.h.

Referenced by DetectAppLayerMpmRegisterByParentId(), and DetectMpmPrepareAppMpms().

◆ app_mpms_list_cnt

uint32_t DetectEngineCtx_::app_mpms_list_cnt

Definition at line 997 of file detect.h.

Referenced by DetectAppLayerMpmRegisterByParentId().

◆ base64_decode_max_len

uint32_t DetectEngineCtx_::base64_decode_max_len

Definition at line 934 of file detect.h.

◆ buffer_type_hash_id

HashListTable* DetectEngineCtx_::buffer_type_hash_id

◆ buffer_type_hash_name

HashListTable* DetectEngineCtx_::buffer_type_hash_name

Definition at line 993 of file detect.h.

Referenced by DetectEngineBufferTypeGetByIdTransforms().

◆ buffer_type_id

uint32_t DetectEngineCtx_::buffer_type_id

◆ byte_extract_max_local_id

int32_t DetectEngineCtx_::byte_extract_max_local_id

Definition at line 924 of file detect.h.

◆ class_conf_ht

HashTable* DetectEngineCtx_::class_conf_ht

Definition at line 1031 of file detect.h.

Referenced by SCClassConfDeInitContext(), and SCClassConfGetClasstype().

◆ class_conf_regex

pcre2_code* DetectEngineCtx_::class_conf_regex

Definition at line 1032 of file detect.h.

Referenced by SCClassConfAddClasstype(), SCClassConfDeinit(), and SCClassConfInit().

◆ class_conf_regex_match

pcre2_match_data* DetectEngineCtx_::class_conf_regex_match

Definition at line 1033 of file detect.h.

Referenced by SCClassConfAddClasstype(), SCClassConfDeinit(), and SCClassConfInit().

◆ config_prefix

char DetectEngineCtx_::config_prefix[64]

◆ decoder_event_sgh

struct SigGroupHead_* DetectEngineCtx_::decoder_event_sgh

sgh for signatures that match against invalid packets. In those cases we can't lookup by proto, address, port as we don't have these

Definition at line 931 of file detect.h.

Referenced by SigAddressCleanupStage1(), SigMatchSignaturesGetSgh(), and SigPrepareStage4().

◆ dport_hash_table

HashListTable* DetectEngineCtx_::dport_hash_table

◆ dup_sig_hash_table

HashListTable* DetectEngineCtx_::dup_sig_hash_table

Definition at line 882 of file detect.h.

Referenced by DetectParseDupSigHashFree(), and DetectParseDupSigHashInit().

◆ ea

◆ failure_fatal

bool DetectEngineCtx_::failure_fatal

Definition at line 844 of file detect.h.

◆ filedata_config

DetectFileDataCfg* DetectEngineCtx_::filedata_config

Definition at line 953 of file detect.h.

Referenced by DetectEngineCtxFree().

◆ filemagic_thread_ctx_id

int DetectEngineCtx_::filemagic_thread_ctx_id

Definition at line 896 of file detect.h.

◆ filestore_cnt

uint16_t DetectEngineCtx_::filestore_cnt

Definition at line 1052 of file detect.h.

◆ flags

uint8_t DetectEngineCtx_::flags

◆ flow_gh

DetectEngineLookupFlow DetectEngineCtx_::flow_gh[FLOW_STATES]

Definition at line 873 of file detect.h.

Referenced by SigAddressCleanupStage1(), and SigPrepareStage2().

◆ fp_support_smlist_list

SCFPSupportSMList* DetectEngineCtx_::fp_support_smlist_list

◆ frame_inspect_engines

DetectEngineFrameInspectionEngine* DetectEngineCtx_::frame_inspect_engines

◆ frame_mpms_list

DetectBufferMpmRegistry* DetectEngineCtx_::frame_mpms_list

◆ frame_mpms_list_cnt

uint32_t DetectEngineCtx_::frame_mpms_list_cnt

Definition at line 1007 of file detect.h.

Referenced by DetectEngineFrameMpmRegister(), and DetectFrameMpmRegisterByParentId().

◆ guess_applayer

bool DetectEngineCtx_::guess_applayer

Definition at line 893 of file detect.h.

◆ guess_applayer_log_limit

uint8_t DetectEngineCtx_::guess_applayer_log_limit

Definition at line 890 of file detect.h.

◆ inspection_recursion_limit

int DetectEngineCtx_::inspection_recursion_limit

Definition at line 887 of file detect.h.

Referenced by DetectEngineContentInspection(), and DetectEngineContentInspectionBuffer().

◆ io_ctx

DetectEngineIPOnlyCtx DetectEngineCtx_::io_ctx

Definition at line 884 of file detect.h.

Referenced by SigAddressCleanupStage1(), and SigPrepareStage2().

◆ keyword_hash

HashListTable* DetectEngineCtx_::keyword_hash

hash list of keywords that need thread local ctxs

Definition at line 951 of file detect.h.

Referenced by DetectRegisterThreadCtxFuncs(), and DetectUnregisterThreadCtxFuncs().

◆ keyword_id

int DetectEngineCtx_::keyword_id

Definition at line 949 of file detect.h.

◆ last_reload

struct timeval DetectEngineCtx_::last_reload

time of last ruleset reload

Definition at line 1010 of file detect.h.

◆ loader_id

int DetectEngineCtx_::loader_id

id of loader thread 'owning' this de_ctx

Definition at line 975 of file detect.h.

◆ max_fb_id

uint32_t DetectEngineCtx_::max_fb_id

Definition at line 908 of file detect.h.

Referenced by DetectFlowbitsAnalyze().

◆ max_uniq_toclient_groups

uint16_t DetectEngineCtx_::max_uniq_toclient_groups

Definition at line 904 of file detect.h.

◆ max_uniq_toserver_groups

uint16_t DetectEngineCtx_::max_uniq_toserver_groups

Definition at line 905 of file detect.h.

◆ metadata_table

HashTable* DetectEngineCtx_::metadata_table

table to store metadata keys and values

Definition at line 989 of file detect.h.

Referenced by DetectMetadataHashFree(), and DetectMetadataHashInit().

◆ mpm_ctx_factory_container

◆ mpm_hash_table

HashListTable* DetectEngineCtx_::mpm_hash_table

Definition at line 878 of file detect.h.

Referenced by MpmStoreFree(), MpmStoreInit(), and MpmStoreReportStats().

◆ mpm_matcher

uint8_t DetectEngineCtx_::mpm_matcher

◆ next

struct DetectEngineCtx_* DetectEngineCtx_::next

list in master: either active or freelist

Definition at line 972 of file detect.h.

◆ non_pf_store_cnt_max

uint32_t DetectEngineCtx_::non_pf_store_cnt_max

Maximum value of all our sgh's non_mpm_store_cnt setting, used to alloc det_ctx::non_mpm_id_array

Definition at line 867 of file detect.h.

Referenced by SigGroupHeadBuildNonPrefilterArray().

◆ pattern_hash_table

HashListTable* DetectEngineCtx_::pattern_hash_table

Definition at line 879 of file detect.h.

Referenced by DumpPatterns(), and EngineAnalysisAddAllRulePatterns().

◆ pkt_inspect_engines

DetectEnginePktInspectionEngine* DetectEngineCtx_::pkt_inspect_engines

Definition at line 1002 of file detect.h.

◆ pkt_mpms_list

DetectBufferMpmRegistry* DetectEngineCtx_::pkt_mpms_list

Definition at line 1003 of file detect.h.

Referenced by DetectMpmPreparePktMpms(), and DetectPktMpmRegisterByParentId().

◆ pkt_mpms_list_cnt

uint32_t DetectEngineCtx_::pkt_mpms_list_cnt

Definition at line 1004 of file detect.h.

Referenced by DetectPktMpmRegisterByParentId().

◆ prefilter_hash_table

HashListTable* DetectEngineCtx_::prefilter_hash_table

Definition at line 1010 of file detect.h.

Referenced by PrefilterDeinit(), and PrefilterInit().

◆ prefilter_id

uint32_t DetectEngineCtx_::prefilter_id

◆ prefilter_setting

enum DetectEnginePrefilterSetting DetectEngineCtx_::prefilter_setting

are we using just mpm or also other prefilters

Definition at line 975 of file detect.h.

Referenced by PrefilterSetupRuleGroup().

◆ profile_keyword_ctx

struct SCProfileKeywordDetectCtx_* DetectEngineCtx_::profile_keyword_ctx

◆ profile_keyword_ctx_per_list

struct SCProfileKeywordDetectCtx_** DetectEngineCtx_::profile_keyword_ctx_per_list

Definition at line 961 of file detect.h.

◆ profile_match_logging_threshold

uint32_t DetectEngineCtx_::profile_match_logging_threshold

Definition at line 963 of file detect.h.

◆ profile_prefilter_ctx

struct SCProfilePrefilterDetectCtx_* DetectEngineCtx_::profile_prefilter_ctx

◆ profile_sgh_ctx

struct SCProfileSghDetectCtx_* DetectEngineCtx_::profile_sgh_ctx

◆ ref_cnt

uint32_t DetectEngineCtx_::ref_cnt

how many de_ctx' are referencing this

Definition at line 970 of file detect.h.

Referenced by DetectEngineReference().

◆ reference_conf_ht

HashTable* DetectEngineCtx_::reference_conf_ht

Definition at line 1038 of file detect.h.

Referenced by SCRConfAddReference(), SCRConfDeInitContext(), and SCRConfGetReference().

◆ reference_conf_regex

pcre2_code* DetectEngineCtx_::reference_conf_regex

Definition at line 1039 of file detect.h.

Referenced by SCRConfAddReference(), SCReferenceConfDeinit(), and SCReferenceConfInit().

◆ reference_conf_regex_match

pcre2_match_data* DetectEngineCtx_::reference_conf_regex_match

Definition at line 1040 of file detect.h.

Referenced by SCRConfAddReference(), SCReferenceConfDeinit(), and SCReferenceConfInit().

◆ requirements

SCDetectRequiresStatus* DetectEngineCtx_::requirements

Definition at line 1049 of file detect.h.

◆ rule_file

char* DetectEngineCtx_::rule_file

Definition at line 938 of file detect.h.

Referenced by LLVMFuzzerTestOneInput().

◆ rule_line

int DetectEngineCtx_::rule_line

Store rule file and line so that parsers can use them in errors.

Definition at line 937 of file detect.h.

◆ sc_sig_order_funcs

struct SCSigOrderFunc_* DetectEngineCtx_::sc_sig_order_funcs

Definition at line 870 of file detect.h.

Referenced by SCSigSignatureOrderingModuleCleanup().

◆ sgh_array

struct SigGroupHead_** DetectEngineCtx_::sgh_array

Definition at line 914 of file detect.h.

Referenced by SigAddressCleanupStage1(), SigGroupHeadStore(), and SigPrepareStage4().

◆ sgh_array_cnt

uint32_t DetectEngineCtx_::sgh_array_cnt

◆ sgh_array_size

uint32_t DetectEngineCtx_::sgh_array_size

Definition at line 916 of file detect.h.

Referenced by SigAddressCleanupStage1(), and SigGroupHeadStore().

◆ sgh_hash_table

HashListTable* DetectEngineCtx_::sgh_hash_table

◆ sgh_mpm_context_proto_other_packet

int32_t DetectEngineCtx_::sgh_mpm_context_proto_other_packet

Definition at line 920 of file detect.h.

Referenced by DetectMpmPrepareBuiltinMpms(), and MpmStorePrepareBuffer().

◆ sgh_mpm_context_proto_tcp_packet

int32_t DetectEngineCtx_::sgh_mpm_context_proto_tcp_packet

◆ sgh_mpm_context_proto_udp_packet

int32_t DetectEngineCtx_::sgh_mpm_context_proto_udp_packet

Definition at line 919 of file detect.h.

Referenced by DetectMpmPrepareBuiltinMpms(), and MpmStorePrepareBuffer().

◆ sgh_mpm_context_stream

int32_t DetectEngineCtx_::sgh_mpm_context_stream

Definition at line 921 of file detect.h.

Referenced by DetectMpmPrepareBuiltinMpms(), and MpmStorePrepareBuffer().

◆ sgh_mpm_ctx_cnf

uint8_t DetectEngineCtx_::sgh_mpm_ctx_cnf

Definition at line 947 of file detect.h.

Referenced by DetectEngineFrameMpmRegister().

◆ sig_array

◆ sig_array_len

uint32_t DetectEngineCtx_::sig_array_len

Definition at line 861 of file detect.h.

Referenced by DetectFlowbitsAnalyze(), IPOnlyInit(), and SigPrepareStage1().

◆ sig_cnt

uint32_t DetectEngineCtx_::sig_cnt

Definition at line 852 of file detect.h.

◆ sig_list

◆ sig_stat

SigFileLoaderStat DetectEngineCtx_::sig_stat

signatures stats

Definition at line 1016 of file detect.h.

Referenced by SigLoadSignatures().

◆ sigerror

const char* DetectEngineCtx_::sigerror

Definition at line 939 of file detect.h.

◆ sigerror_ok

bool DetectEngineCtx_::sigerror_ok

Definition at line 941 of file detect.h.

Referenced by SigInit().

◆ sigerror_requires

bool DetectEngineCtx_::sigerror_requires

The rule errored out due to missing requirements.

Definition at line 944 of file detect.h.

Referenced by SigInit().

◆ sigerror_silent

bool DetectEngineCtx_::sigerror_silent

Definition at line 940 of file detect.h.

Referenced by SigInit().

◆ signum

uint32_t DetectEngineCtx_::signum

Definition at line 863 of file detect.h.

Referenced by DetectEngineResetMaxSigId(), SigGroupBuild(), and SigInit().

◆ sm_types_prefilter

bool* DetectEngineCtx_::sm_types_prefilter

per keyword flag indicating if a prefilter has been set for it. If true, the setup function will have to run.

Definition at line 1025 of file detect.h.

Referenced by DetectEngineCtxFree(), and PrefilterSetupRuleGroup().

◆ sm_types_silent_error

bool* DetectEngineCtx_::sm_types_silent_error

Definition at line 1026 of file detect.h.

Referenced by DetectEngineCtxFree(), and SigMatchSilentErrorEnabled().

◆ spm_global_thread_ctx

SpmGlobalThreadCtx* DetectEngineCtx_::spm_global_thread_ctx

Definition at line 900 of file detect.h.

Referenced by DetectContentConvertToNocase(), DetectContentSetup(), and DetectEngineCtxFree().

◆ spm_matcher

uint8_t DetectEngineCtx_::spm_matcher

spm matcher this ctx uses

Definition at line 847 of file detect.h.

◆ srep_version

uint32_t DetectEngineCtx_::srep_version

Definition at line 855 of file detect.h.

◆ srepCIDR_ctx

SRepCIDRTree* DetectEngineCtx_::srepCIDR_ctx

Definition at line 858 of file detect.h.

Referenced by SRepDestroy(), and SRepInit().

◆ tcp_priorityports

DetectPort* DetectEngineCtx_::tcp_priorityports

Definition at line 982 of file detect.h.

◆ tenant_id

uint32_t DetectEngineCtx_::tenant_id

Definition at line 849 of file detect.h.

Referenced by DetectEngineThreadCtxInitForReload().

◆ tenant_path

char* DetectEngineCtx_::tenant_path

Definition at line 1046 of file detect.h.

◆ type

enum DetectEngineType DetectEngineCtx_::type

Definition at line 965 of file detect.h.

Referenced by DetectEngineThreadCtxInit(), and DetectEngineThreadCtxInitForReload().

◆ udp_priorityports

DetectPort* DetectEngineCtx_::udp_priorityports

Definition at line 983 of file detect.h.

◆ version

uint32_t DetectEngineCtx_::version

version of the detect engine. The version is incremented on reloads

Definition at line 927 of file detect.h.


The documentation for this struct was generated from the following file: