suricata
DetectEngineCtx_ Struct Reference

main detection engine ctx More...

#include <detect.h>

Collaboration diagram for DetectEngineCtx_:

Data Fields

uint8_t flags
 
int failure_fatal
 
int tenant_id
 
Signaturesig_list
 
uint32_t sig_cnt
 
uint32_t srep_version
 
SRepCIDRTreesrepCIDR_ctx
 
Signature ** sig_array
 
uint32_t sig_array_size
 
uint32_t sig_array_len
 
uint32_t signum
 
uint32_t non_pf_store_cnt_max
 
struct SCSigOrderFunc_sc_sig_order_funcs
 
HashTableclass_conf_ht
 
HashTablereference_conf_ht
 
DetectEngineLookupFlow flow_gh [FLOW_STATES]
 
uint32_t gh_unique
 
uint32_t gh_reuse
 
HashListTablesgh_hash_table
 
HashListTablempm_hash_table
 
HashListTabledup_sig_hash_table
 
DetectEngineIPOnlyCtx io_ctx
 
ThresholdCtx ths_ctx
 
uint16_t mpm_matcher
 
uint16_t spm_matcher
 
SpmGlobalThreadCtxspm_global_thread_ctx
 
uint16_t max_uniq_toclient_groups
 
uint16_t max_uniq_toserver_groups
 
uint8_t sgh_mpm_context
 
uint32_t max_fb_id
 
uint32_t max_fp_id
 
MpmCtxFactoryContainermpm_ctx_factory_container
 
int inspection_recursion_limit
 
int hcbd_buffer_limit
 
int hsbd_buffer_limit
 
struct SigGroupHead_ ** sgh_array
 
uint32_t sgh_array_cnt
 
uint32_t sgh_array_size
 
int32_t sgh_mpm_context_proto_tcp_packet
 
int32_t sgh_mpm_context_proto_udp_packet
 
int32_t sgh_mpm_context_proto_other_packet
 
int32_t sgh_mpm_context_stream
 
int32_t byte_extract_max_local_id
 
uint32_t version
 
struct SigGroupHead_decoder_event_sgh
 
uint32_t base64_decode_max_len
 
char * rule_file
 
int rule_line
 
const char * sigerror
 
DetectEngineThreadKeywordCtxItemkeyword_list
 
int keyword_id
 
struct {
   uint32_t   content_limit
 
   uint32_t   content_inspect_min_size
 
   uint32_t   content_inspect_window
 
filedata_config [ALPROTO_MAX]
 
bool filedata_config_initialized
 
struct SCProfileDetectCtx_profile_ctx
 
struct SCProfileKeywordDetectCtx_profile_keyword_ctx
 
struct SCProfilePrefilterDetectCtx_profile_prefilter_ctx
 
struct SCProfileKeywordDetectCtx_ ** profile_keyword_ctx_per_list
 
struct SCProfileSghDetectCtx_profile_sgh_ctx
 
uint32_t profile_match_logging_threshold
 
uint32_t prefilter_maxid
 
char config_prefix [64]
 
enum DetectEngineType type
 
uint32_t ref_cnt
 
struct DetectEngineCtx_next
 
int loader_id
 
enum DetectEnginePrefilterSetting prefilter_setting
 
HashListTabledport_hash_table
 
DetectPorttcp_whitelist
 
DetectPortudp_whitelist
 
HashListTableaddress_table
 
HashTablemetadata_table
 
DetectBufferType ** buffer_type_map
 
uint32_t buffer_type_map_elements
 
HashListTablebuffer_type_hash
 
int buffer_type_id
 
DetectEngineAppInspectionEngineapp_inspect_engines
 
DetectMpmAppLayerRegisteryapp_mpms_list
 
uint32_t app_mpms_list_cnt
 
uint32_t prefilter_id
 
HashListTableprefilter_hash_table
 
DetectMpmAppLayerKeywordapp_mpms
 
struct timeval last_reload
 
SigFileLoaderStat sig_stat
 
bool sm_types_prefilter [DETECT_TBLSIZE]
 

Detailed Description

main detection engine ctx

Definition at line 723 of file detect.h.

Field Documentation

HashListTable* DetectEngineCtx_::address_table

table for storing the string representation with the parsers result

Definition at line 873 of file detect.h.

Referenced by DetectAddressMapFree(), and DetectAddressMapInit().

DetectMpmAppLayerKeyword* DetectEngineCtx_::app_mpms

table with mpms and their registration function

Todo:
we only need this at init, so perhaps this can move to a DetectEngineCtx 'init' struct

Definition at line 898 of file detect.h.

Referenced by DetectEngineCtxFree(), DetectMpmPrepareAppMpms(), DetectMpmSetupAppMpms(), MpmStoreReportStats(), PatternMatchPrepareGroup(), and SigGroupBuild().

uint32_t DetectEngineCtx_::app_mpms_list_cnt
uint32_t DetectEngineCtx_::base64_decode_max_len

Definition at line 824 of file detect.h.

Referenced by DetectBase64DecodeDoMatch(), and DetectEngineResetMaxSigId().

HashListTable* DetectEngineCtx_::buffer_type_hash

Definition at line 883 of file detect.h.

Referenced by DetectBufferTypeGetByIdTransforms(), and InspectionBufferApplyTransforms().

DetectBufferType** DetectEngineCtx_::buffer_type_map
uint32_t DetectEngineCtx_::buffer_type_map_elements
int32_t DetectEngineCtx_::byte_extract_max_local_id

Definition at line 814 of file detect.h.

Referenced by DetectByteExtractDoMatch(), and DetectEngineResetMaxSigId().

uint32_t DetectEngineCtx_::content_inspect_min_size

Definition at line 837 of file detect.h.

uint32_t DetectEngineCtx_::content_inspect_window

Definition at line 838 of file detect.h.

uint32_t DetectEngineCtx_::content_limit

Definition at line 836 of file detect.h.

struct SigGroupHead_* DetectEngineCtx_::decoder_event_sgh

sgh for signatures that match against invalid packets. In those cases we can't lookup by proto, address, port as we don't have these

Definition at line 821 of file detect.h.

Referenced by CreateGroupedPortList(), SigAddressCleanupStage1(), SigAddressPrepareStage2(), SigAddressPrepareStage4(), and SigMatchSignaturesGetSgh().

HashListTable* DetectEngineCtx_::dport_hash_table
HashListTable* DetectEngineCtx_::dup_sig_hash_table

Definition at line 767 of file detect.h.

Referenced by DetectParseDupSigHashFree(), and DetectParseDupSigHashInit().

int DetectEngineCtx_::failure_fatal
struct { ... } DetectEngineCtx_::filedata_config[ALPROTO_MAX]
bool DetectEngineCtx_::filedata_config_initialized

Definition at line 840 of file detect.h.

uint8_t DetectEngineCtx_::flags

Definition at line 724 of file detect.h.

Referenced by ActionInitConfig(), AlertFastLogInitCtx(), DetectAckRegister(), DetectAppLayerProtocolRegister(), DetectBase64DataDoMatch(), DetectBypassRegister(), DetectByteExtractRetrieveSMVar(), DetectBytejumpDoMatch(), DetectBytetestDoMatch(), DetectDceIfaceRegister(), DetectDceOpnumRegister(), DetectDceStubDataRegister(), DetectDetectionFilterRegister(), DetectDistanceRegister(), DetectDnsQueryRegister(), DetectEngineInspectENIP(), DetectEngineInspectModbus(), DetectEngineInspectStream(), DetectEngineStateResetTxs(), DetectFastPatternRegister(), DetectFilestoreRegister(), DetectFlowbitsAnalyze(), DetectFlowFree(), DetectFlowintFree(), DetectFragOffsetFree(), DetectFtpbounceRegister(), DetectGeoipRegister(), DetectHostbitFree(), DetectHttpRequestLineRegister(), DetectHttpResponseLineRegister(), DetectIcmpIdFree(), DetectIcmpSeqFree(), DetectICodeFree(), DetectIPProtoRemoveAllSMs(), DetectIPRepFree(), DetectIsdataatFree(), DetectITypeFree(), DetectL3ProtoRegister(), DetectLuaRegister(), DetectModbusRegister(), DetectMpmSetupAppMpms(), DetectPcrePayloadMatch(), DetectPktDataRegister(), DetectProtoContainsProto(), DetectReferenceFree(), DetectReplaceFreeInternal(), DetectRpcFree(), DetectSameipRegister(), DetectSetupParseRegexes(), DetectSshSoftwareVersionRegister(), DetectSshVersionRegister(), DetectSslStateRegister(), DetectSslVersionRegister(), DetectThresholdRegister(), DetectTlsFingerprintRegister(), DetectTlsIssuerRegister(), DetectTlsJa3HashRegister(), DetectTlsJa3StringRegister(), DetectTlsSerialRegister(), DetectTlsSniRegister(), DetectTlsSubjectRegister(), DetectTlsValidityRegister(), DetectTlsVersionRegister(), DetectUricontentRegister(), DetectUrilenValidateContent(), DetectXbitFree(), IPOnlyAddSignature(), MpmACRegister(), MpmACTileRegister(), MpmStoreReportStats(), RegisterModbusParsers(), SCACBSPrintInfo(), SCRuleVarsGetConfVar(), SCSigSignatureOrderingModuleCleanup(), SCThresholdConfParseFile(), SigAddressCleanupStage1(), SigAddressPrepareStage1(), SigAddressPrepareStage2(), SignatureIsIPOnly(), SigParseApplyDsizeToContent(), SMTPParserCleanup(), TagTimeoutCheck(), UTHGenericTest(), UTHPacketMatchSig(), UTHPacketMatchSigMpm(), and UTHParseSignature().

uint32_t DetectEngineCtx_::gh_reuse

Definition at line 759 of file detect.h.

Referenced by PacketCreateMask().

uint32_t DetectEngineCtx_::gh_unique

Definition at line 759 of file detect.h.

Referenced by PacketCreateMask().

int DetectEngineCtx_::hcbd_buffer_limit

Definition at line 798 of file detect.h.

int DetectEngineCtx_::hsbd_buffer_limit

Definition at line 800 of file detect.h.

int DetectEngineCtx_::inspection_recursion_limit
int DetectEngineCtx_::keyword_id

Definition at line 833 of file detect.h.

Referenced by DetectEngineResetMaxSigId(), and DetectRegisterThreadCtxFuncs().

DetectEngineThreadKeywordCtxItem* DetectEngineCtx_::keyword_list

list of keywords that need thread local ctxs

Definition at line 832 of file detect.h.

Referenced by DetectEngineCtxInitWithPrefix(), DetectEngineResetMaxSigId(), and DetectRegisterThreadCtxFuncs().

struct timeval DetectEngineCtx_::last_reload

time of last ruleset reload

Definition at line 901 of file detect.h.

Referenced by PostRunDeinit(), and SigLoadSignatures().

int DetectEngineCtx_::loader_id

id of loader thread 'owning' this de_ctx

Definition at line 862 of file detect.h.

Referenced by DetectEngineMultiTenantEnabled().

uint32_t DetectEngineCtx_::max_fb_id

Definition at line 788 of file detect.h.

Referenced by DetectFlowbitMatch(), and DetectFlowbitsAnalyze().

uint32_t DetectEngineCtx_::max_fp_id

Definition at line 790 of file detect.h.

Referenced by DetectSetFastPatternAndItsId().

uint16_t DetectEngineCtx_::max_uniq_toclient_groups

Definition at line 781 of file detect.h.

Referenced by DetectEngineCtxFree(), DetectEngineGetEventInfo(), and PacketCreateMask().

uint16_t DetectEngineCtx_::max_uniq_toserver_groups

Definition at line 782 of file detect.h.

Referenced by DetectEngineCtxFree(), DetectEngineGetEventInfo(), and PacketCreateMask().

HashTable* DetectEngineCtx_::metadata_table

table to store metadata keys and values

Definition at line 876 of file detect.h.

Referenced by DetectMetadataHashFree(), and DetectMetadataHashInit().

HashListTable* DetectEngineCtx_::mpm_hash_table

Definition at line 764 of file detect.h.

Referenced by MpmStoreFree(), MpmStoreInit(), and MpmStoreReportStats().

uint32_t DetectEngineCtx_::non_pf_store_cnt_max

Maximum value of all our sgh's non_mpm_store_cnt setting, used to alloc det_ctx::non_mpm_id_array

Definition at line 746 of file detect.h.

Referenced by DetectEngineResetMaxSigId(), and SigGroupHeadBuildNonPrefilterArray().

HashListTable* DetectEngineCtx_::prefilter_hash_table

Definition at line 893 of file detect.h.

Referenced by PrefilterDeinit(), PrefilterInit(), and SCProfilingPrefilterInitCounters().

uint32_t DetectEngineCtx_::prefilter_id
uint32_t DetectEngineCtx_::prefilter_maxid

Definition at line 850 of file detect.h.

Referenced by PrefilterSetupRuleGroup().

enum DetectEnginePrefilterSetting DetectEngineCtx_::prefilter_setting

are we useing just mpm or also other prefilters

Definition at line 865 of file detect.h.

Referenced by DetectEngineCtxFree(), PrefilterSetupRuleGroup(), and SigAddressPrepareStage1().

struct SCProfileKeywordDetectCtx_** DetectEngineCtx_::profile_keyword_ctx_per_list
uint32_t DetectEngineCtx_::profile_match_logging_threshold

Definition at line 848 of file detect.h.

Referenced by SigGroupBuild(), and SigMatchSignaturesGetSgh().

uint32_t DetectEngineCtx_::ref_cnt
HashTable* DetectEngineCtx_::reference_conf_ht
char* DetectEngineCtx_::rule_file

Store rule file and line so that parsers can use them in errors.

Definition at line 827 of file detect.h.

Referenced by DetectLoadCompleteSigPath(), and DetectPcrePayloadMatch().

int DetectEngineCtx_::rule_line

Definition at line 828 of file detect.h.

Referenced by DetectLoadCompleteSigPath(), and DetectPcrePayloadMatch().

struct SCSigOrderFunc_* DetectEngineCtx_::sc_sig_order_funcs

Definition at line 749 of file detect.h.

Referenced by SCSigOrderSignatures(), and SCSigSignatureOrderingModuleCleanup().

struct SigGroupHead_** DetectEngineCtx_::sgh_array

Definition at line 804 of file detect.h.

Referenced by SigAddressCleanupStage1(), SigAddressPrepareStage4(), and SigGroupHeadStore().

uint32_t DetectEngineCtx_::sgh_array_size

Definition at line 806 of file detect.h.

Referenced by SigAddressCleanupStage1(), and SigGroupHeadStore().

uint8_t DetectEngineCtx_::sgh_mpm_context

Definition at line 785 of file detect.h.

Referenced by DetectEngineCtxFree(), DetectMpmPrepareAppMpms(), and DetectMpmSetupAppMpms().

int32_t DetectEngineCtx_::sgh_mpm_context_proto_other_packet
int32_t DetectEngineCtx_::sgh_mpm_context_proto_tcp_packet
int32_t DetectEngineCtx_::sgh_mpm_context_proto_udp_packet
int32_t DetectEngineCtx_::sgh_mpm_context_stream
uint32_t DetectEngineCtx_::sig_array_len
uint32_t DetectEngineCtx_::sig_array_size

Definition at line 739 of file detect.h.

Referenced by SigAddressPrepareStage1().

uint32_t DetectEngineCtx_::sig_cnt

Definition at line 730 of file detect.h.

Referenced by SigAddressPrepareStage1().

Signature* DetectEngineCtx_::sig_list

Definition at line 729 of file detect.h.

Referenced by AlertFastLogInitCtx(), DetectAckRegister(), DetectBase64DataDoMatch(), DetectBase64DecodeDoMatch(), DetectByteExtractRetrieveSMVar(), DetectBytejumpDoMatch(), DetectBytetestDoMatch(), DetectClasstypeRegister(), DetectDceOpnumRegister(), DetectDceStubDataRegister(), DetectDetectionFilterRegister(), DetectDistanceRegister(), DetectDNP3Register(), DetectEngineAppendSig(), DetectEngineInspectENIP(), DetectEngineInspectModbus(), DetectEngineInspectStream(), DetectEngineStateResetTxs(), DetectFastPatternRegister(), DetectFilestoreRegister(), DetectFlowbitsAnalyze(), DetectFlowFree(), DetectFragOffsetFree(), DetectFtpbounceRegister(), DetectGeoipRegister(), DetectHostbitFree(), DetectHttpRequestLineRegister(), DetectHttpResponseLineRegister(), DetectIcmpIdFree(), DetectIcmpSeqFree(), DetectICodeFree(), DetectIPProtoRemoveAllSMs(), DetectIPRepFree(), DetectIsdataatFree(), DetectITypeFree(), DetectL3ProtoRegister(), DetectModbusRegister(), DetectParseDupSigHashFree(), DetectPcrePayloadMatch(), DetectPktDataRegister(), DetectPriorityRegister(), DetectProtoContainsProto(), DetectReferenceFree(), DetectReplaceFreeInternal(), DetectRpcFree(), DetectSameipRegister(), DetectSetFastPatternAndItsId(), DetectSetupParseRegexes(), DetectSshSoftwareVersionRegister(), DetectSshVersionRegister(), DetectSslVersionRegister(), DetectThresholdRegister(), DetectTlsFingerprintRegister(), DetectTlsIssuerRegister(), DetectTlsSerialRegister(), DetectTlsSubjectRegister(), DetectTlsVersionRegister(), DetectUricontentRegister(), DetectUrilenValidateContent(), MpmACRegister(), MpmACTileRegister(), PacketCreateMask(), SCACBSPrintInfo(), SCProfilingRuleInitCounters(), SCSigOrderSignatures(), SCSigSignatureOrderingModuleCleanup(), SCThresholdConfInitContext(), SCThresholdConfParseFile(), SigAddressPrepareStage1(), SigAddressPrepareStage2(), SigAddressPrepareStage4(), SigCleanSignatures(), SigFindSignatureBySidGid(), SigGroupBuild(), SigGroupHeadContainsSigId(), SigParseApplyDsizeToContent(), UTHPacketMatchSig(), and UTHPacketMatchSigMpm().

SigFileLoaderStat DetectEngineCtx_::sig_stat
const char* DetectEngineCtx_::sigerror
bool DetectEngineCtx_::sm_types_prefilter[DETECT_TBLSIZE]

per keyword flag indicating if a prefilter has been set for it. If true, the setup function will have to run.

Definition at line 909 of file detect.h.

Referenced by DetectPrefilterRegister(), and PrefilterSetupRuleGroup().

uint16_t DetectEngineCtx_::spm_matcher

spm matcher this ctx uses

Definition at line 773 of file detect.h.

Referenced by DetectEngineInspectBufferGeneric().

uint32_t DetectEngineCtx_::srep_version

Definition at line 733 of file detect.h.

Referenced by DetectIPRepRegister(), and SRepInit().

SRepCIDRTree* DetectEngineCtx_::srepCIDR_ctx

Definition at line 736 of file detect.h.

Referenced by DetectIPRepFree(), DetectIPRepRegister(), SRepDestroy(), and SRepInit().

DetectPort* DetectEngineCtx_::tcp_whitelist

Definition at line 869 of file detect.h.

Referenced by DetectEngineCtxFree(), and PacketCreateMask().

DetectPort* DetectEngineCtx_::udp_whitelist

Definition at line 870 of file detect.h.

Referenced by DetectEngineCtxFree(), and PacketCreateMask().

uint32_t DetectEngineCtx_::version

version of the detect engine

Definition at line 817 of file detect.h.

Referenced by DetectEngineCtxFree(), DetectEngineInspectBufferGeneric(), and SigMatchSignaturesGetSgh().


The documentation for this struct was generated from the following file: