suricata
DetectEngineCtx_ Struct Reference

main detection engine ctx More...

#include <detect.h>

Collaboration diagram for DetectEngineCtx_:

Data Fields

bool failure_fatal
 
uint8_t flags
 
uint8_t mpm_matcher
 
uint8_t spm_matcher
 
uint32_t tenant_id
 
Signaturesig_list
 
uint32_t sig_cnt
 
uint32_t srep_version
 
SRepCIDRTreesrepCIDR_ctx
 
Signature ** sig_array
 
uint32_t sig_array_len
 
uint32_t signum
 
uint32_t non_pf_store_cnt_max
 
struct SCSigOrderFunc_sc_sig_order_funcs
 
DetectEngineLookupFlow flow_gh [FLOW_STATES]
 
HashListTablesgh_hash_table
 
HashListTablempm_hash_table
 
HashListTablepattern_hash_table
 
HashListTabledup_sig_hash_table
 
DetectEngineIPOnlyCtx io_ctx
 
ThresholdCtx ths_ctx
 
int inspection_recursion_limit
 
int filemagic_thread_ctx_id
 
SpmGlobalThreadCtxspm_global_thread_ctx
 
uint16_t max_uniq_toclient_groups
 
uint16_t max_uniq_toserver_groups
 
uint32_t max_fb_id
 
MpmCtxFactoryContainermpm_ctx_factory_container
 
struct SigGroupHead_ ** sgh_array
 
uint32_t sgh_array_cnt
 
uint32_t sgh_array_size
 
int32_t sgh_mpm_context_proto_tcp_packet
 
int32_t sgh_mpm_context_proto_udp_packet
 
int32_t sgh_mpm_context_proto_other_packet
 
int32_t sgh_mpm_context_stream
 
int32_t byte_extract_max_local_id
 
uint32_t version
 
struct SigGroupHead_decoder_event_sgh
 
uint32_t base64_decode_max_len
 
int rule_line
 
char * rule_file
 
const char * sigerror
 
bool sigerror_silent
 
bool sigerror_ok
 
bool sigerror_requires
 
bool filedata_config_initialized
 
uint8_t sgh_mpm_ctx_cnf
 
int keyword_id
 
HashListTablekeyword_hash
 
struct {
   uint32_t   content_limit
 
   uint32_t   content_inspect_min_size
 
   uint32_t   content_inspect_window
 
filedata_config [ALPROTO_MAX]
 
struct SCProfileKeywordDetectCtx_profile_keyword_ctx
 
struct SCProfilePrefilterDetectCtx_profile_prefilter_ctx
 
struct SCProfileKeywordDetectCtx_ ** profile_keyword_ctx_per_list
 
struct SCProfileSghDetectCtx_profile_sgh_ctx
 
uint32_t profile_match_logging_threshold
 
char config_prefix [64]
 
enum DetectEngineType type
 
uint32_t ref_cnt
 
struct DetectEngineCtx_next
 
int loader_id
 
enum DetectEnginePrefilterSetting prefilter_setting
 
HashListTabledport_hash_table
 
DetectPorttcp_whitelist
 
DetectPortudp_whitelist
 
HashListTableaddress_table
 
HashTablemetadata_table
 
HashListTablebuffer_type_hash_name
 
HashListTablebuffer_type_hash_id
 
uint32_t buffer_type_id
 
uint32_t app_mpms_list_cnt
 
DetectBufferMpmRegistryapp_mpms_list
 
DetectEngineAppInspectionEngineapp_inspect_engines
 
DetectEnginePktInspectionEnginepkt_inspect_engines
 
DetectBufferMpmRegistrypkt_mpms_list
 
uint32_t pkt_mpms_list_cnt
 
DetectEngineFrameInspectionEngineframe_inspect_engines
 
DetectBufferMpmRegistryframe_mpms_list
 
uint32_t frame_mpms_list_cnt
 
uint32_t prefilter_id
 
HashListTableprefilter_hash_table
 
struct timeval last_reload
 
SigFileLoaderStat sig_stat
 
SCFPSupportSMListfp_support_smlist_list
 
bool sm_types_prefilter [DETECT_TBLSIZE]
 
bool sm_types_silent_error [DETECT_TBLSIZE]
 
HashTableclass_conf_ht
 
pcre2_code * class_conf_regex
 
pcre2_match_data * class_conf_regex_match
 
HashTablereference_conf_ht
 
pcre2_code * reference_conf_regex
 
pcre2_match_data * reference_conf_regex_match
 
struct EngineAnalysisCtx_ea
 
char * tenant_path
 
SCDetectRequiresStatusrequirements
 
uint16_t filestore_cnt
 

Detailed Description

main detection engine ctx

Definition at line 836 of file detect.h.

Field Documentation

◆ address_table

HashListTable* DetectEngineCtx_::address_table

table for storing the string representation with the parsers result

Definition at line 980 of file detect.h.

Referenced by DetectAddressMapFree(), and DetectAddressMapInit().

◆ app_inspect_engines

DetectEngineAppInspectionEngine* DetectEngineCtx_::app_inspect_engines

Definition at line 995 of file detect.h.

◆ app_mpms_list

DetectBufferMpmRegistry* DetectEngineCtx_::app_mpms_list

Definition at line 992 of file detect.h.

Referenced by DetectAppLayerMpmRegisterByParentId(), and DetectMpmPrepareAppMpms().

◆ app_mpms_list_cnt

uint32_t DetectEngineCtx_::app_mpms_list_cnt

Definition at line 991 of file detect.h.

Referenced by DetectAppLayerMpmRegisterByParentId().

◆ base64_decode_max_len

uint32_t DetectEngineCtx_::base64_decode_max_len

Definition at line 922 of file detect.h.

◆ buffer_type_hash_id

HashListTable* DetectEngineCtx_::buffer_type_hash_id

◆ buffer_type_hash_name

HashListTable* DetectEngineCtx_::buffer_type_hash_name

Definition at line 987 of file detect.h.

Referenced by DetectEngineBufferTypeGetByIdTransforms().

◆ buffer_type_id

uint32_t DetectEngineCtx_::buffer_type_id

◆ byte_extract_max_local_id

int32_t DetectEngineCtx_::byte_extract_max_local_id

Definition at line 912 of file detect.h.

◆ class_conf_ht

HashTable* DetectEngineCtx_::class_conf_ht

Definition at line 1025 of file detect.h.

Referenced by SCClassConfDeInitContext(), and SCClassConfGetClasstype().

◆ class_conf_regex

pcre2_code* DetectEngineCtx_::class_conf_regex

Definition at line 1026 of file detect.h.

Referenced by SCClassConfAddClasstype(), SCClassConfDeinit(), and SCClassConfInit().

◆ class_conf_regex_match

pcre2_match_data* DetectEngineCtx_::class_conf_regex_match

Definition at line 1027 of file detect.h.

Referenced by SCClassConfAddClasstype(), SCClassConfDeinit(), and SCClassConfInit().

◆ config_prefix

char DetectEngineCtx_::config_prefix[64]

◆ content_inspect_min_size

uint32_t DetectEngineCtx_::content_inspect_min_size

Definition at line 945 of file detect.h.

◆ content_inspect_window

uint32_t DetectEngineCtx_::content_inspect_window

Definition at line 946 of file detect.h.

◆ content_limit

uint32_t DetectEngineCtx_::content_limit

Definition at line 944 of file detect.h.

◆ decoder_event_sgh

struct SigGroupHead_* DetectEngineCtx_::decoder_event_sgh

sgh for signatures that match against invalid packets. In those cases we can't lookup by proto, address, port as we don't have these

Definition at line 919 of file detect.h.

Referenced by SigAddressCleanupStage1(), SigMatchSignaturesGetSgh(), and SigPrepareStage4().

◆ dport_hash_table

HashListTable* DetectEngineCtx_::dport_hash_table

◆ dup_sig_hash_table

HashListTable* DetectEngineCtx_::dup_sig_hash_table

Definition at line 875 of file detect.h.

Referenced by DetectParseDupSigHashFree(), and DetectParseDupSigHashInit().

◆ ea

◆ failure_fatal

bool DetectEngineCtx_::failure_fatal

Definition at line 837 of file detect.h.

◆ filedata_config

struct { ... } DetectEngineCtx_::filedata_config[ALPROTO_MAX]

◆ filedata_config_initialized

bool DetectEngineCtx_::filedata_config_initialized

Definition at line 934 of file detect.h.

◆ filemagic_thread_ctx_id

int DetectEngineCtx_::filemagic_thread_ctx_id

Definition at line 884 of file detect.h.

◆ filestore_cnt

uint16_t DetectEngineCtx_::filestore_cnt

Definition at line 1046 of file detect.h.

◆ flags

uint8_t DetectEngineCtx_::flags

◆ flow_gh

DetectEngineLookupFlow DetectEngineCtx_::flow_gh[FLOW_STATES]

Definition at line 866 of file detect.h.

Referenced by SigAddressCleanupStage1(), and SigPrepareStage2().

◆ fp_support_smlist_list

SCFPSupportSMList* DetectEngineCtx_::fp_support_smlist_list

◆ frame_inspect_engines

DetectEngineFrameInspectionEngine* DetectEngineCtx_::frame_inspect_engines

◆ frame_mpms_list

DetectBufferMpmRegistry* DetectEngineCtx_::frame_mpms_list

◆ frame_mpms_list_cnt

uint32_t DetectEngineCtx_::frame_mpms_list_cnt

Definition at line 1001 of file detect.h.

Referenced by DetectEngineFrameMpmRegister(), and DetectFrameMpmRegisterByParentId().

◆ inspection_recursion_limit

int DetectEngineCtx_::inspection_recursion_limit

Definition at line 881 of file detect.h.

Referenced by DetectEngineContentInspection(), and DetectEngineContentInspectionBuffer().

◆ io_ctx

DetectEngineIPOnlyCtx DetectEngineCtx_::io_ctx

Definition at line 877 of file detect.h.

Referenced by SigAddressCleanupStage1(), and SigPrepareStage2().

◆ keyword_hash

HashListTable* DetectEngineCtx_::keyword_hash

hash list of keywords that need thread local ctxs

Definition at line 941 of file detect.h.

Referenced by DetectRegisterThreadCtxFuncs(), and DetectUnregisterThreadCtxFuncs().

◆ keyword_id

int DetectEngineCtx_::keyword_id

Definition at line 939 of file detect.h.

◆ last_reload

struct timeval DetectEngineCtx_::last_reload

time of last ruleset reload

Definition at line 1004 of file detect.h.

◆ loader_id

int DetectEngineCtx_::loader_id

id of loader thread 'owning' this de_ctx

Definition at line 969 of file detect.h.

◆ max_fb_id

uint32_t DetectEngineCtx_::max_fb_id

Definition at line 896 of file detect.h.

Referenced by DetectFlowbitsAnalyze().

◆ max_uniq_toclient_groups

uint16_t DetectEngineCtx_::max_uniq_toclient_groups

Definition at line 892 of file detect.h.

◆ max_uniq_toserver_groups

uint16_t DetectEngineCtx_::max_uniq_toserver_groups

Definition at line 893 of file detect.h.

◆ metadata_table

HashTable* DetectEngineCtx_::metadata_table

table to store metadata keys and values

Definition at line 983 of file detect.h.

Referenced by DetectMetadataHashFree(), and DetectMetadataHashInit().

◆ mpm_ctx_factory_container

◆ mpm_hash_table

HashListTable* DetectEngineCtx_::mpm_hash_table

Definition at line 871 of file detect.h.

Referenced by MpmStoreFree(), MpmStoreInit(), and MpmStoreReportStats().

◆ mpm_matcher

uint8_t DetectEngineCtx_::mpm_matcher

◆ next

struct DetectEngineCtx_* DetectEngineCtx_::next

list in master: either active or freelist

Definition at line 966 of file detect.h.

◆ non_pf_store_cnt_max

uint32_t DetectEngineCtx_::non_pf_store_cnt_max

Maximum value of all our sgh's non_mpm_store_cnt setting, used to alloc det_ctx::non_mpm_id_array

Definition at line 860 of file detect.h.

Referenced by SigGroupHeadBuildNonPrefilterArray().

◆ pattern_hash_table

HashListTable* DetectEngineCtx_::pattern_hash_table

Definition at line 872 of file detect.h.

Referenced by DumpPatterns(), and EngineAnalysisAddAllRulePatterns().

◆ pkt_inspect_engines

DetectEnginePktInspectionEngine* DetectEngineCtx_::pkt_inspect_engines

Definition at line 996 of file detect.h.

◆ pkt_mpms_list

DetectBufferMpmRegistry* DetectEngineCtx_::pkt_mpms_list

Definition at line 997 of file detect.h.

Referenced by DetectMpmPreparePktMpms(), and DetectPktMpmRegisterByParentId().

◆ pkt_mpms_list_cnt

uint32_t DetectEngineCtx_::pkt_mpms_list_cnt

Definition at line 998 of file detect.h.

Referenced by DetectPktMpmRegisterByParentId().

◆ prefilter_hash_table

HashListTable* DetectEngineCtx_::prefilter_hash_table

Definition at line 1004 of file detect.h.

Referenced by PrefilterDeinit(), and PrefilterInit().

◆ prefilter_id

uint32_t DetectEngineCtx_::prefilter_id

◆ prefilter_setting

enum DetectEnginePrefilterSetting DetectEngineCtx_::prefilter_setting

are we using just mpm or also other prefilters

Definition at line 969 of file detect.h.

Referenced by PrefilterSetupRuleGroup().

◆ profile_keyword_ctx

struct SCProfileKeywordDetectCtx_* DetectEngineCtx_::profile_keyword_ctx

◆ profile_keyword_ctx_per_list

struct SCProfileKeywordDetectCtx_** DetectEngineCtx_::profile_keyword_ctx_per_list

Definition at line 955 of file detect.h.

◆ profile_match_logging_threshold

uint32_t DetectEngineCtx_::profile_match_logging_threshold

Definition at line 957 of file detect.h.

◆ profile_prefilter_ctx

struct SCProfilePrefilterDetectCtx_* DetectEngineCtx_::profile_prefilter_ctx

◆ profile_sgh_ctx

struct SCProfileSghDetectCtx_* DetectEngineCtx_::profile_sgh_ctx

◆ ref_cnt

uint32_t DetectEngineCtx_::ref_cnt

how many de_ctx' are referencing this

Definition at line 964 of file detect.h.

Referenced by DetectEngineReference().

◆ reference_conf_ht

HashTable* DetectEngineCtx_::reference_conf_ht

Definition at line 1032 of file detect.h.

Referenced by SCRConfAddReference(), SCRConfDeInitContext(), and SCRConfGetReference().

◆ reference_conf_regex

pcre2_code* DetectEngineCtx_::reference_conf_regex

Definition at line 1033 of file detect.h.

Referenced by SCRConfAddReference(), SCReferenceConfDeinit(), and SCReferenceConfInit().

◆ reference_conf_regex_match

pcre2_match_data* DetectEngineCtx_::reference_conf_regex_match

Definition at line 1034 of file detect.h.

Referenced by SCRConfAddReference(), SCReferenceConfDeinit(), and SCReferenceConfInit().

◆ requirements

SCDetectRequiresStatus* DetectEngineCtx_::requirements

Definition at line 1043 of file detect.h.

◆ rule_file

char* DetectEngineCtx_::rule_file

Definition at line 926 of file detect.h.

Referenced by LLVMFuzzerTestOneInput().

◆ rule_line

int DetectEngineCtx_::rule_line

Store rule file and line so that parsers can use them in errors.

Definition at line 925 of file detect.h.

◆ sc_sig_order_funcs

struct SCSigOrderFunc_* DetectEngineCtx_::sc_sig_order_funcs

Definition at line 863 of file detect.h.

Referenced by SCSigSignatureOrderingModuleCleanup().

◆ sgh_array

struct SigGroupHead_** DetectEngineCtx_::sgh_array

Definition at line 902 of file detect.h.

Referenced by SigAddressCleanupStage1(), SigGroupHeadStore(), and SigPrepareStage4().

◆ sgh_array_cnt

uint32_t DetectEngineCtx_::sgh_array_cnt

◆ sgh_array_size

uint32_t DetectEngineCtx_::sgh_array_size

Definition at line 904 of file detect.h.

Referenced by SigAddressCleanupStage1(), and SigGroupHeadStore().

◆ sgh_hash_table

◆ sgh_mpm_context_proto_other_packet

int32_t DetectEngineCtx_::sgh_mpm_context_proto_other_packet

Definition at line 908 of file detect.h.

Referenced by DetectMpmPrepareBuiltinMpms(), and MpmStorePrepareBuffer().

◆ sgh_mpm_context_proto_tcp_packet

int32_t DetectEngineCtx_::sgh_mpm_context_proto_tcp_packet

◆ sgh_mpm_context_proto_udp_packet

int32_t DetectEngineCtx_::sgh_mpm_context_proto_udp_packet

Definition at line 907 of file detect.h.

Referenced by DetectMpmPrepareBuiltinMpms(), and MpmStorePrepareBuffer().

◆ sgh_mpm_context_stream

int32_t DetectEngineCtx_::sgh_mpm_context_stream

Definition at line 909 of file detect.h.

Referenced by DetectMpmPrepareBuiltinMpms(), and MpmStorePrepareBuffer().

◆ sgh_mpm_ctx_cnf

uint8_t DetectEngineCtx_::sgh_mpm_ctx_cnf

Definition at line 937 of file detect.h.

Referenced by DetectEngineFrameMpmRegister().

◆ sig_array

◆ sig_array_len

uint32_t DetectEngineCtx_::sig_array_len

Definition at line 854 of file detect.h.

Referenced by DetectFlowbitsAnalyze(), and SigPrepareStage1().

◆ sig_cnt

uint32_t DetectEngineCtx_::sig_cnt

Definition at line 845 of file detect.h.

◆ sig_list

◆ sig_stat

SigFileLoaderStat DetectEngineCtx_::sig_stat

signatures stats

Definition at line 1010 of file detect.h.

Referenced by SigLoadSignatures().

◆ sigerror

const char* DetectEngineCtx_::sigerror

Definition at line 927 of file detect.h.

◆ sigerror_ok

bool DetectEngineCtx_::sigerror_ok

Definition at line 929 of file detect.h.

Referenced by SigInit().

◆ sigerror_requires

bool DetectEngineCtx_::sigerror_requires

The rule errored out due to missing requirements.

Definition at line 932 of file detect.h.

Referenced by SigInit().

◆ sigerror_silent

bool DetectEngineCtx_::sigerror_silent

Definition at line 928 of file detect.h.

Referenced by SigInit().

◆ signum

uint32_t DetectEngineCtx_::signum

Definition at line 856 of file detect.h.

Referenced by DetectEngineResetMaxSigId(), SigGroupBuild(), and SigInit().

◆ sm_types_prefilter

bool DetectEngineCtx_::sm_types_prefilter[DETECT_TBLSIZE]

per keyword flag indicating if a prefilter has been set for it. If true, the setup function will have to run.

Definition at line 1019 of file detect.h.

Referenced by PrefilterSetupRuleGroup().

◆ sm_types_silent_error

bool DetectEngineCtx_::sm_types_silent_error[DETECT_TBLSIZE]

Definition at line 1020 of file detect.h.

Referenced by SigMatchSilentErrorEnabled().

◆ spm_global_thread_ctx

SpmGlobalThreadCtx* DetectEngineCtx_::spm_global_thread_ctx

Definition at line 888 of file detect.h.

Referenced by DetectContentConvertToNocase(), DetectContentSetup(), and DetectEngineCtxFree().

◆ spm_matcher

uint8_t DetectEngineCtx_::spm_matcher

spm matcher this ctx uses

Definition at line 840 of file detect.h.

◆ srep_version

uint32_t DetectEngineCtx_::srep_version

Definition at line 848 of file detect.h.

◆ srepCIDR_ctx

SRepCIDRTree* DetectEngineCtx_::srepCIDR_ctx

Definition at line 851 of file detect.h.

Referenced by SRepDestroy(), and SRepInit().

◆ tcp_whitelist

DetectPort* DetectEngineCtx_::tcp_whitelist

Definition at line 976 of file detect.h.

◆ tenant_id

uint32_t DetectEngineCtx_::tenant_id

Definition at line 842 of file detect.h.

Referenced by DetectEngineThreadCtxInitForReload().

◆ tenant_path

char* DetectEngineCtx_::tenant_path

Definition at line 1040 of file detect.h.

◆ ths_ctx

ThresholdCtx DetectEngineCtx_::ths_ctx

Definition at line 878 of file detect.h.

Referenced by ThresholdContextDestroy(), ThresholdHashAllocate(), and ThresholdHashInit().

◆ type

enum DetectEngineType DetectEngineCtx_::type

Definition at line 959 of file detect.h.

Referenced by DetectEngineThreadCtxInit(), and DetectEngineThreadCtxInitForReload().

◆ udp_whitelist

DetectPort* DetectEngineCtx_::udp_whitelist

Definition at line 977 of file detect.h.

◆ version

uint32_t DetectEngineCtx_::version

version of the detect engine. The version is incremented on reloads

Definition at line 915 of file detect.h.


The documentation for this struct was generated from the following file: