suricata
Public Member Functions | Data Fields
DetectEngineThreadCtx_ Struct Reference

#include <detect.h>

Collaboration diagram for DetectEngineThreadCtx_:
Collaboration graph
[legend]

Public Member Functions

 SC_ATOMIC_DECLARE (int, so_far_used_by_detect)
 

Data Fields

uint32_t tenant_id
 
ThreadVars * tv
 
uint32_t mt_det_ctxs_cnt
 
struct DetectEngineThreadCtx_ ** mt_det_ctxs
 
HashTable * mt_det_ctxs_hash
 
struct DetectEngineTenantMapping_ * tenant_array
 
uint32_t tenant_array_size
 
uint32_t(* TenantGetId )(const void *, const Packet *p)
 
uint64_t raw_stream_progress
 
uint32_t buffer_offset
 
uint32_t pcre_match_start_offset
 
SpmThreadCtx * spm_thread_ctx
 
uint64_t * byte_values
 
SigJsonContent * json_content
 
uint8_t json_content_capacity
 
uint8_t json_content_len
 
uint16_t filestore_cnt
 
uint16_t counter_alerts
 
uint16_t counter_alerts_overflow
 
uint16_t counter_alerts_suppressed
 
uint16_t counter_mpm_list
 
uint16_t counter_nonmpm_list
 
uint16_t counter_fnonmpm_list
 
uint16_t counter_match_list
 
struct {
   InspectionBuffer *   buffers
 
   uint32_t   buffers_size
 
   uint32_t   to_clear_idx
 
   uint32_t *   to_clear_queue
 
} inspect
 
struct {
   InspectionBufferMultipleForList *   buffers
 
   uint32_t   buffers_size
 
   uint32_t   to_clear_idx
 
   uint32_t *   to_clear_queue
 
} multi_inspect
 
bool tx_id_set
 
uint64_t tx_id
 
int64_t frame_id
 
uint64_t frame_inspect_progress
 
Packet * p
 
uint8_t * base64_decoded
 
int base64_decoded_len
 
uint16_t alert_queue_size
 
uint16_t alert_queue_capacity
 
PacketAlert * alert_queue
 
Signature ** match_array
 
uint32_t match_array_len
 
SigIntId match_array_cnt
 
RuleMatchCandidateTx * tx_candidates
 
uint32_t tx_candidates_size
 
MpmThreadCtx mtc
 
PostRuleMatchWorkQueue post_rule_work_queue
 
PrefilterRuleStore pmq
 
DetectReplaceList * replist
 
DetectVarList * varlist
 
struct {
   uint32_t   file_id
 
   uint64_t   tx_id
 
} filestore [DETECT_FILESTORE_MAX]
 
DetectEngineCtx * de_ctx
 
void ** keyword_ctxs_array
 
int keyword_ctxs_size
 
int global_keyword_ctxs_size
 
void ** global_keyword_ctxs_array
 
AppLayerDecoderEvents * decoder_events
 
uint16_t events
 
uint16_t lua_rule_errors
 
uint16_t lua_blocked_function_errors
 
uint16_t lua_instruction_limit_errors
 
uint16_t lua_memory_limit_errors
 
struct SCProfileKeywordData_ * keyword_perf_data
 
struct SCProfileKeywordData_ ** keyword_perf_data_per_list
 
int keyword_perf_list
 
struct SCProfileSghData_ * sgh_perf_data
 
struct SCProfilePrefilterData_ * prefilter_perf_data
 
uint64_t prefilter_bytes
 
uint64_t prefilter_bytes_called
 

Detailed Description

Detection engine thread data.

Definition at line 1244 of file detect.h.

Member Function Documentation

◆ SC_ATOMIC_DECLARE()

DetectEngineThreadCtx_::SC_ATOMIC_DECLARE ( int  ,
so_far_used_by_detect   
)

Field Documentation

◆ alert_queue

PacketAlert* DetectEngineThreadCtx_::alert_queue

Definition at line 1331 of file detect.h.

Referenced by AlertQueueFree(), and AlertQueueInit().

◆ alert_queue_capacity

uint16_t DetectEngineThreadCtx_::alert_queue_capacity

Definition at line 1330 of file detect.h.

Referenced by AlertQueueFree(), and AlertQueueInit().

◆ alert_queue_size

uint16_t DetectEngineThreadCtx_::alert_queue_size

Definition at line 1329 of file detect.h.

Referenced by AlertQueueInit(), and PacketAlertFinalize().

◆ base64_decoded

uint8_t* DetectEngineThreadCtx_::base64_decoded

Definition at line 1326 of file detect.h.

Referenced by DetectBase64DecodeDoMatch().

◆ base64_decoded_len

int DetectEngineThreadCtx_::base64_decoded_len

Definition at line 1327 of file detect.h.

Referenced by DetectBase64DecodeDoMatch().

◆ buffer_offset

uint32_t DetectEngineThreadCtx_::buffer_offset

offset into the payload of the end of the last match by: content, pcre, etc

Definition at line 1268 of file detect.h.

Referenced by DetectBase64DecodeDoMatch(), DetectByteExtractDoMatch(), DetectEngineContentInspection(), DetectEngineContentInspectionBuffer(), and DetectPcrePayloadMatch().

◆ buffers [1/2]

InspectionBuffer* DetectEngineThreadCtx_::buffers

Definition at line 1302 of file detect.h.

Referenced by InspectionBufferClean(), and InspectionBufferGet().

◆ buffers [2/2]

InspectionBufferMultipleForList* DetectEngineThreadCtx_::buffers

inspection buffers for more complex case. As we can inspect multiple buffers in parallel, we need this extra wrapper struct

Definition at line 1311 of file detect.h.

◆ buffers_size

uint32_t DetectEngineThreadCtx_::buffers_size

in number of elements

Definition at line 1303 of file detect.h.

◆ byte_values

uint64_t* DetectEngineThreadCtx_::byte_values

Definition at line 1279 of file detect.h.

◆ counter_alerts

uint16_t DetectEngineThreadCtx_::counter_alerts

id for alert counter

Definition at line 1289 of file detect.h.

◆ counter_alerts_overflow

uint16_t DetectEngineThreadCtx_::counter_alerts_overflow

id for discarded alerts counter

Definition at line 1291 of file detect.h.

◆ counter_alerts_suppressed

uint16_t DetectEngineThreadCtx_::counter_alerts_suppressed

id for suppressed alerts counter

Definition at line 1293 of file detect.h.

◆ counter_fnonmpm_list

uint16_t DetectEngineThreadCtx_::counter_fnonmpm_list

Definition at line 1297 of file detect.h.

◆ counter_match_list

uint16_t DetectEngineThreadCtx_::counter_match_list

Definition at line 1298 of file detect.h.

◆ counter_mpm_list

uint16_t DetectEngineThreadCtx_::counter_mpm_list

Definition at line 1295 of file detect.h.

◆ counter_nonmpm_list

uint16_t DetectEngineThreadCtx_::counter_nonmpm_list

Definition at line 1296 of file detect.h.

◆ de_ctx

DetectEngineCtx* DetectEngineThreadCtx_::de_ctx

Definition at line 1364 of file detect.h.

Referenced by DetectEngineInspectPktBufferGeneric(), DetectEngineThreadCtxInit(), DetectEngineThreadCtxInitForReload(), DetectPreFlow(), DetectPreStream(), RulesDumpTxMatchArray(), SCProfilingKeywordThreadCleanup(), SCProfilingKeywordThreadSetup(), SCProfilingPrefilterThreadCleanup(), SCProfilingPrefilterThreadSetup(), SCProfilingPrefilterUpdateCounter(), SCProfilingSghThreadCleanup(), SCProfilingSghThreadSetup(), and SCProfilingSghUpdateCounter().

◆ decoder_events

AppLayerDecoderEvents* DetectEngineThreadCtx_::decoder_events

Definition at line 1372 of file detect.h.

Referenced by DetectEngineSetEvent().

◆ events

uint16_t DetectEngineThreadCtx_::events

Definition at line 1373 of file detect.h.

Referenced by DetectEngineSetEvent().

◆ file_id

uint32_t DetectEngineThreadCtx_::file_id

Definition at line 1360 of file detect.h.

◆ filestore

struct { ... } DetectEngineThreadCtx_::filestore[DETECT_FILESTORE_MAX]

◆ filestore_cnt

uint16_t DetectEngineThreadCtx_::filestore_cnt

Definition at line 1286 of file detect.h.

◆ frame_id

int64_t DetectEngineThreadCtx_::frame_id

Definition at line 1321 of file detect.h.

◆ frame_inspect_progress

uint64_t DetectEngineThreadCtx_::frame_inspect_progress

used to set Frame::inspect_progress after all inspection on a frame is complete.

Definition at line 1322 of file detect.h.

◆ global_keyword_ctxs_array

void** DetectEngineThreadCtx_::global_keyword_ctxs_array

Definition at line 1370 of file detect.h.

Referenced by DetectThreadCtxGetGlobalKeywordThreadCtx().

◆ global_keyword_ctxs_size

int DetectEngineThreadCtx_::global_keyword_ctxs_size

store for keyword contexts that need a per thread storage. Global.

Definition at line 1369 of file detect.h.

Referenced by DetectThreadCtxGetGlobalKeywordThreadCtx().

◆ inspect

struct { ... } DetectEngineThreadCtx_::inspect

Referenced by InspectionBufferClean(), and InspectionBufferGet().

◆ json_content

SigJsonContent* DetectEngineThreadCtx_::json_content

Definition at line 1281 of file detect.h.

Referenced by DetectEngineThreadCtxGetJsonContext().

◆ json_content_capacity

uint8_t DetectEngineThreadCtx_::json_content_capacity

Definition at line 1282 of file detect.h.

Referenced by DetectEngineThreadCtxGetJsonContext().

◆ json_content_len

uint8_t DetectEngineThreadCtx_::json_content_len

Definition at line 1283 of file detect.h.

Referenced by DetectEngineThreadCtxGetJsonContext().

◆ keyword_ctxs_array

void** DetectEngineThreadCtx_::keyword_ctxs_array

store for keyword contexts that need a per thread storage. Per de_ctx.

Definition at line 1366 of file detect.h.

Referenced by DetectThreadCtxGetKeywordThreadCtx().

◆ keyword_ctxs_size

int DetectEngineThreadCtx_::keyword_ctxs_size

Definition at line 1367 of file detect.h.

Referenced by DetectThreadCtxGetKeywordThreadCtx().

◆ keyword_perf_data

struct SCProfileKeywordData_* DetectEngineThreadCtx_::keyword_perf_data

Definition at line 1404 of file detect.h.

Referenced by SCProfilingKeywordThreadCleanup(), SCProfilingKeywordThreadSetup(), and SCProfilingKeywordUpdateCounter().

◆ keyword_perf_data_per_list

struct SCProfileKeywordData_** DetectEngineThreadCtx_::keyword_perf_data_per_list

Definition at line 1405 of file detect.h.

Referenced by SCProfilingKeywordThreadSetup(), and SCProfilingKeywordUpdateCounter().

◆ keyword_perf_list

int DetectEngineThreadCtx_::keyword_perf_list

list we're currently inspecting, DETECT_SM_LIST_*

Definition at line 1406 of file detect.h.

Referenced by SCProfilingKeywordUpdateCounter().

◆ lua_blocked_function_errors

uint16_t DetectEngineThreadCtx_::lua_blocked_function_errors

stats id for lua blocked function counts

Definition at line 1379 of file detect.h.

◆ lua_instruction_limit_errors

uint16_t DetectEngineThreadCtx_::lua_instruction_limit_errors

stats if for lua instruction limit errors

Definition at line 1382 of file detect.h.

◆ lua_memory_limit_errors

uint16_t DetectEngineThreadCtx_::lua_memory_limit_errors

stat of lua memory limit errors.

Definition at line 1385 of file detect.h.

◆ lua_rule_errors

uint16_t DetectEngineThreadCtx_::lua_rule_errors

stats id for lua rule errors

Definition at line 1376 of file detect.h.

◆ match_array

Signature** DetectEngineThreadCtx_::match_array

array of signature pointers we're going to inspect in the detection loop.

Definition at line 1335 of file detect.h.

Referenced by RulesDumpMatchArray().

◆ match_array_cnt

SigIntId DetectEngineThreadCtx_::match_array_cnt

size in use

Definition at line 1340 of file detect.h.

Referenced by RulesDumpMatchArray(), and SCProfilingSghUpdateCounter().

◆ match_array_len

uint32_t DetectEngineThreadCtx_::match_array_len

size of the array in items (mem size if * sizeof(Signature *) Only used during initialization.

Definition at line 1338 of file detect.h.

◆ mt_det_ctxs

struct DetectEngineThreadCtx_** DetectEngineThreadCtx_::mt_det_ctxs

Definition at line 1255 of file detect.h.

◆ mt_det_ctxs_cnt

uint32_t DetectEngineThreadCtx_::mt_det_ctxs_cnt

Definition at line 1254 of file detect.h.

Referenced by Detect().

◆ mt_det_ctxs_hash

HashTable* DetectEngineThreadCtx_::mt_det_ctxs_hash

Definition at line 1256 of file detect.h.

Referenced by DetectEngineThreadCtxDeinit().

◆ mtc

MpmThreadCtx DetectEngineThreadCtx_::mtc

thread ctx for the mpm

Definition at line 1345 of file detect.h.

◆ multi_inspect

struct { ... } DetectEngineThreadCtx_::multi_inspect

Referenced by InspectionBufferClean().

◆ p

Packet* DetectEngineThreadCtx_::p

Definition at line 1324 of file detect.h.

Referenced by DetectEngineInspectStream(), and DetectEntropyDoMatch().

◆ pcre_match_start_offset

uint32_t DetectEngineThreadCtx_::pcre_match_start_offset

used by pcre match function alone: normally in sync with buffer_offset, but points to 1 byte after the start of the last pcre match if a pcre match happened.

Definition at line 1272 of file detect.h.

Referenced by DetectPcrePayloadMatch().

◆ pmq

PrefilterRuleStore DetectEngineThreadCtx_::pmq

Definition at line 1349 of file detect.h.

Referenced by DetectRunPrefilterTx(), Prefilter(), PrefilterPostRuleMatch(), and SCProfilingSghUpdateCounter().

◆ post_rule_work_queue

PostRuleMatchWorkQueue DetectEngineThreadCtx_::post_rule_work_queue

Definition at line 1347 of file detect.h.

Referenced by PostRuleMatchWorkQueueAppend().

◆ prefilter_bytes

uint64_t DetectEngineThreadCtx_::prefilter_bytes

bytes inspected by current prefilter callback call

Definition at line 1411 of file detect.h.

◆ prefilter_bytes_called

uint64_t DetectEngineThreadCtx_::prefilter_bytes_called

number of times we inspected a buffer

Definition at line 1413 of file detect.h.

◆ prefilter_perf_data

struct SCProfilePrefilterData_* DetectEngineThreadCtx_::prefilter_perf_data

Definition at line 1409 of file detect.h.

Referenced by SCProfilingPrefilterThreadCleanup(), SCProfilingPrefilterThreadSetup(), and SCProfilingPrefilterUpdateCounter().

◆ raw_stream_progress

uint64_t DetectEngineThreadCtx_::raw_stream_progress

Definition at line 1265 of file detect.h.

◆ replist

DetectReplaceList* DetectEngineThreadCtx_::replist

Definition at line 1352 of file detect.h.

◆ sgh_perf_data

struct SCProfileSghData_* DetectEngineThreadCtx_::sgh_perf_data

Definition at line 1407 of file detect.h.

Referenced by SCProfilingSghThreadCleanup(), SCProfilingSghThreadSetup(), and SCProfilingSghUpdateCounter().

◆ spm_thread_ctx

SpmThreadCtx* DetectEngineThreadCtx_::spm_thread_ctx

SPM thread context used for scanning. This has been cloned from the prototype held by DetectEngineCtx.

Definition at line 1276 of file detect.h.

◆ tenant_array

struct DetectEngineTenantMapping_* DetectEngineThreadCtx_::tenant_array

Definition at line 1258 of file detect.h.

◆ tenant_array_size

uint32_t DetectEngineThreadCtx_::tenant_array_size

Definition at line 1259 of file detect.h.

◆ tenant_id

uint32_t DetectEngineThreadCtx_::tenant_id
Note
multi-tenant hash lookup code from Detect() depends on this being the first member

Definition at line 1247 of file detect.h.

Referenced by DetectEngineThreadCtxInitForReload().

◆ TenantGetId

uint32_t(* DetectEngineThreadCtx_::TenantGetId) (const void *, const Packet *p)

Definition at line 1261 of file detect.h.

Referenced by Detect().

◆ to_clear_idx

uint32_t DetectEngineThreadCtx_::to_clear_idx

Definition at line 1304 of file detect.h.

Referenced by InspectionBufferClean().

◆ to_clear_queue

uint32_t* DetectEngineThreadCtx_::to_clear_queue

Definition at line 1305 of file detect.h.

Referenced by InspectionBufferClean().

◆ tv

ThreadVars* DetectEngineThreadCtx_::tv

Definition at line 1252 of file detect.h.

Referenced by DetectEngineThreadCtxInit(), and DetectEngineThreadCtxInitForReload().

◆ tx_candidates

RuleMatchCandidateTx* DetectEngineThreadCtx_::tx_candidates

Definition at line 1342 of file detect.h.

Referenced by RuleMatchCandidateTxArrayFree(), RuleMatchCandidateTxArrayInit(), and RulesDumpTxMatchArray().

◆ tx_candidates_size

uint32_t DetectEngineThreadCtx_::tx_candidates_size

Definition at line 1343 of file detect.h.

Referenced by RuleMatchCandidateTxArrayFree(), and RuleMatchCandidateTxArrayInit().

◆ tx_id

uint64_t DetectEngineThreadCtx_::tx_id

ID of the transaction currently being inspected.

Definition at line 1320 of file detect.h.

Referenced by LuaExtensionsMatchSetup().

◆ tx_id_set

bool DetectEngineThreadCtx_::tx_id_set

Definition at line 1318 of file detect.h.

Referenced by LuaExtensionsMatchSetup().

◆ varlist

DetectVarList* DetectEngineThreadCtx_::varlist

Definition at line 1354 of file detect.h.

Referenced by DetectVarStoreMatch(), and DetectVarStoreMatchKeyValue().

The documentation for this struct was generated from the following file: