suricata
DetectEngineThreadCtx_ Struct Reference

#include <detect.h>

Collaboration diagram for DetectEngineThreadCtx_:

Public Member Functions

 SC_ATOMIC_DECLARE (int, so_far_used_by_detect)
 

Data Fields

uint32_t tenant_id
 
uint64_t ticker
 
ThreadVarstv
 
SigIntIdnon_pf_id_array
 
uint32_t non_pf_id_cnt
 
uint32_t mt_det_ctxs_cnt
 
struct DetectEngineThreadCtx_ ** mt_det_ctxs
 
HashTablemt_det_ctxs_hash
 
struct DetectEngineTenantMapping_tenant_array
 
uint32_t tenant_array_size
 
uint32_t(* TenantGetId )(const void *, const Packet *p)
 
uint64_t raw_stream_progress
 
uint32_t buffer_offset
 
uint32_t pcre_match_start_offset
 
uint16_t filestore_cnt
 
uint16_t counter_alerts
 
uint16_t counter_mpm_list
 
uint16_t counter_nonmpm_list
 
uint16_t counter_fnonmpm_list
 
uint16_t counter_match_list
 
int inspect_list
 
struct {
   InspectionBuffer *   buffers
 
   uint32_t   buffers_size
 
   uint32_t   to_clear_idx
 
   uint32_t *   to_clear_queue
 
inspect
 
struct {
   InspectionBufferMultipleForList *   buffers
 
   uint32_t   buffers_size
 
   uint32_t   to_clear_idx
 
   uint32_t *   to_clear_queue
 
multi_inspect
 
uint16_t discontinue_matching
 
uint16_t flags
 
uint16_t tx_id_set
 
uint64_t tx_id
 
Packetp
 
int inspection_recursion_counter
 
Signature ** match_array
 
uint32_t match_array_len
 
SigIntId match_array_cnt
 
RuleMatchCandidateTxtx_candidates
 
uint32_t tx_candidates_size
 
SignatureNonPrefilterStorenon_pf_store_ptr
 
uint32_t non_pf_store_cnt
 
MpmThreadCtx mtc
 
MpmThreadCtx mtcu
 
MpmThreadCtx mtcs
 
PrefilterRuleStore pmq
 
SpmThreadCtxspm_thread_ctx
 
DetectEngineIPOnlyThreadCtx io_ctx
 
uint64_t * bj_values
 
DetectReplaceListreplist
 
DetectVarListvarlist
 
struct {
   uint32_t   file_id
 
   uint64_t   tx_id
 
filestore [DETECT_FILESTORE_MAX]
 
DetectEngineCtxde_ctx
 
void ** keyword_ctxs_array
 
int keyword_ctxs_size
 
int global_keyword_ctxs_size
 
void ** global_keyword_ctxs_array
 
uint8_t * base64_decoded
 
int base64_decoded_len
 
int base64_decoded_len_max
 
AppLayerDecoderEventsdecoder_events
 
uint16_t events
 
struct SCProfileData_rule_perf_data
 
int rule_perf_data_size
 
struct SCProfileKeywordData_keyword_perf_data
 
struct SCProfileKeywordData_ ** keyword_perf_data_per_list
 
int keyword_perf_list
 
struct SCProfileSghData_sgh_perf_data
 
struct SCProfilePrefilterData_prefilter_perf_data
 
int prefilter_perf_size
 

Detailed Description

Detection engine thread data.

Definition at line 965 of file detect.h.

Member Function Documentation

DetectEngineThreadCtx_::SC_ATOMIC_DECLARE ( int  ,
so_far_used_by_detect   
)

Field Documentation

uint8_t* DetectEngineThreadCtx_::base64_decoded
int DetectEngineThreadCtx_::base64_decoded_len
int DetectEngineThreadCtx_::base64_decoded_len_max

Definition at line 1099 of file detect.h.

Referenced by DetectEngineResetMaxSigId().

uint64_t* DetectEngineThreadCtx_::bj_values
InspectionBufferMultipleForList* DetectEngineThreadCtx_::buffers

inspection buffers for more complex case. As we can inspect multiple buffers in parallel, we need this extra wrapper struct

Definition at line 1022 of file detect.h.

uint32_t DetectEngineThreadCtx_::buffers_size

in number of elements

Definition at line 1014 of file detect.h.

Referenced by DetectEngineResetMaxSigId(), and DetectEngineThreadCtxInit().

uint16_t DetectEngineThreadCtx_::counter_alerts

id for alert counter

Definition at line 1002 of file detect.h.

Referenced by DetectEngineThreadCtxInit(), and SigMatchSignaturesGetSgh().

uint16_t DetectEngineThreadCtx_::counter_fnonmpm_list

Definition at line 1006 of file detect.h.

Referenced by DetectEngineThreadCtxInit(), and SigMatchSignaturesGetSgh().

uint16_t DetectEngineThreadCtx_::counter_match_list

Definition at line 1007 of file detect.h.

Referenced by DetectEngineThreadCtxInit(), and SigMatchSignaturesGetSgh().

uint16_t DetectEngineThreadCtx_::counter_mpm_list

Definition at line 1004 of file detect.h.

Referenced by DetectEngineThreadCtxInit(), and SigMatchSignaturesGetSgh().

uint16_t DetectEngineThreadCtx_::counter_nonmpm_list

Definition at line 1005 of file detect.h.

Referenced by DetectEngineThreadCtxInit(), and SigMatchSignaturesGetSgh().

AppLayerDecoderEvents* DetectEngineThreadCtx_::decoder_events
uint16_t DetectEngineThreadCtx_::discontinue_matching
uint16_t DetectEngineThreadCtx_::events

Definition at line 1102 of file detect.h.

Referenced by DetectEngineSetEvent().

uint32_t DetectEngineThreadCtx_::file_id

Definition at line 1085 of file detect.h.

Referenced by DetectFilestoreRegister().

struct { ... } DetectEngineThreadCtx_::filestore[DETECT_FILESTORE_MAX]

Referenced by DetectFilestoreRegister().

uint16_t DetectEngineThreadCtx_::filestore_cnt

Definition at line 999 of file detect.h.

Referenced by DetectFilestoreRegister(), and SigMatchSignaturesGetSgh().

uint16_t DetectEngineThreadCtx_::flags

Definition at line 1030 of file detect.h.

Referenced by DetectFlowFree(), DetectFlowMatch(), and SigMatchSignaturesGetSgh().

void** DetectEngineThreadCtx_::global_keyword_ctxs_array
int DetectEngineThreadCtx_::global_keyword_ctxs_size

store for keyword contexts that need a per thread storage. Global.

Definition at line 1094 of file detect.h.

Referenced by DetectEngineResetMaxSigId(), and DetectThreadCtxGetGlobalKeywordThreadCtx().

struct { ... } DetectEngineThreadCtx_::inspect
int DetectEngineThreadCtx_::inspect_list

list we're currently inspecting, DETECT_SM_LIST_*

Definition at line 1010 of file detect.h.

int DetectEngineThreadCtx_::inspection_recursion_counter
DetectEngineIPOnlyThreadCtx DetectEngineThreadCtx_::io_ctx

ip only rules ctx

Definition at line 1071 of file detect.h.

Referenced by DetectEngineResetMaxSigId(), DetectEngineThreadCtxInit(), and SigMatchSignaturesGetSgh().

void** DetectEngineThreadCtx_::keyword_ctxs_array

store for keyword contexts that need a per thread storage. Per de_ctx.

Definition at line 1091 of file detect.h.

Referenced by DetectEngineResetMaxSigId(), and DetectThreadCtxGetKeywordThreadCtx().

int DetectEngineThreadCtx_::keyword_ctxs_size

Definition at line 1092 of file detect.h.

Referenced by DetectEngineResetMaxSigId(), and DetectThreadCtxGetKeywordThreadCtx().

struct SCProfileKeywordData_* DetectEngineThreadCtx_::keyword_perf_data
struct SCProfileKeywordData_** DetectEngineThreadCtx_::keyword_perf_data_per_list
int DetectEngineThreadCtx_::keyword_perf_list

list we're currently inspecting, DETECT_SM_LIST_*

Definition at line 1120 of file detect.h.

Referenced by SCProfilingKeywordUpdateCounter().

Signature** DetectEngineThreadCtx_::match_array

array of signature pointers we're going to inspect in the detection loop.

Definition at line 1045 of file detect.h.

Referenced by DetectEngineResetMaxSigId(), DetectEngineThreadCtxInit(), and SigMatchSignaturesGetSgh().

SigIntId DetectEngineThreadCtx_::match_array_cnt

size in use

Definition at line 1050 of file detect.h.

Referenced by SCProfilingSghUpdateCounter(), and SigMatchSignaturesGetSgh().

uint32_t DetectEngineThreadCtx_::match_array_len

size of the array in items (mem size if * sizeof(Signature *) Only used during initialization.

Definition at line 1048 of file detect.h.

Referenced by DetectEngineResetMaxSigId().

struct DetectEngineThreadCtx_** DetectEngineThreadCtx_::mt_det_ctxs

Definition at line 980 of file detect.h.

uint32_t DetectEngineThreadCtx_::mt_det_ctxs_cnt

Definition at line 979 of file detect.h.

Referenced by Detect(), and DetectEngineResetMaxSigId().

HashTable* DetectEngineThreadCtx_::mt_det_ctxs_hash

Definition at line 981 of file detect.h.

Referenced by Detect(), DetectEngineResetMaxSigId(), and DetectEngineThreadCtxDeinit().

MpmThreadCtx DetectEngineThreadCtx_::mtc

pointer to the current mpm ctx that is stored in a rule group head – can be either a content or uricontent ctx. thread ctx for the mpm

Definition at line 1061 of file detect.h.

Referenced by DetectEngineResetMaxSigId(), DetectEngineThreadCtxInfo(), DetectEngineThreadCtxInit(), and PrefilterPktStreamRegister().

MpmThreadCtx DetectEngineThreadCtx_::mtcs

thread ctx for stream mpm

Definition at line 1063 of file detect.h.

Referenced by DetectEngineResetMaxSigId(), and DetectEngineThreadCtxInit().

MpmThreadCtx DetectEngineThreadCtx_::mtcu

thread ctx for uricontent mpm

Definition at line 1062 of file detect.h.

Referenced by DetectEngineResetMaxSigId(), DetectEngineThreadCtxInfo(), DetectEngineThreadCtxInit(), and DetectHttpResponseLineRegister().

struct { ... } DetectEngineThreadCtx_::multi_inspect
SigIntId* DetectEngineThreadCtx_::non_pf_id_array
uint32_t DetectEngineThreadCtx_::non_pf_id_cnt

Definition at line 977 of file detect.h.

Referenced by SigMatchSignaturesGetSgh().

uint32_t DetectEngineThreadCtx_::non_pf_store_cnt

Definition at line 1056 of file detect.h.

Referenced by SCProfilingSghUpdateCounter(), and SigMatchSignaturesGetSgh().

SignatureNonPrefilterStore* DetectEngineThreadCtx_::non_pf_store_ptr

Definition at line 1055 of file detect.h.

Referenced by SCProfilingSghUpdateCounter(), and SigMatchSignaturesGetSgh().

Packet* DetectEngineThreadCtx_::p

Definition at line 1036 of file detect.h.

Referenced by DetectEngineInspectStream().

uint32_t DetectEngineThreadCtx_::pcre_match_start_offset

Definition at line 996 of file detect.h.

Referenced by DetectEngineContentInspection(), and DetectPcrePayloadMatch().

struct SCProfilePrefilterData_* DetectEngineThreadCtx_::prefilter_perf_data
int DetectEngineThreadCtx_::prefilter_perf_size

Definition at line 1124 of file detect.h.

uint64_t DetectEngineThreadCtx_::raw_stream_progress

Definition at line 990 of file detect.h.

Referenced by DetectEngineInspectStream(), and SigMatchSignaturesGetSgh().

DetectReplaceList* DetectEngineThreadCtx_::replist
struct SCProfileData_* DetectEngineThreadCtx_::rule_perf_data
int DetectEngineThreadCtx_::rule_perf_data_size
struct SCProfileSghData_* DetectEngineThreadCtx_::sgh_perf_data
SpmThreadCtx* DetectEngineThreadCtx_::spm_thread_ctx

SPM thread context used for scanning. This has been cloned from the prototype held by DetectEngineCtx.

Definition at line 1068 of file detect.h.

Referenced by DetectEngineContentInspection(), DetectEngineResetMaxSigId(), and DetectEngineThreadCtxInit().

struct DetectEngineTenantMapping_* DetectEngineThreadCtx_::tenant_array
uint32_t DetectEngineThreadCtx_::tenant_array_size

Definition at line 984 of file detect.h.

Referenced by DetectEngineMultiTenantSetup(), and DetectEngineResetMaxSigId().

uint32_t DetectEngineThreadCtx_::tenant_id
Note
multi-tenant hash lookup code from Detect() depends on this beeing the first member

Definition at line 968 of file detect.h.

Referenced by DetectEngineReload(), and DetectEngineThreadCtxInit().

uint32_t(* DetectEngineThreadCtx_::TenantGetId) (const void *, const Packet *p)

Definition at line 986 of file detect.h.

Referenced by Detect(), and DetectEngineResetMaxSigId().

uint64_t DetectEngineThreadCtx_::ticker

ticker that is incremented once per packet.

Definition at line 971 of file detect.h.

Referenced by HttpHeaderGetBufferSpaceForTXID(), and SigMatchSignaturesGetSgh().

uint32_t DetectEngineThreadCtx_::to_clear_idx
uint32_t* DetectEngineThreadCtx_::to_clear_queue
ThreadVars* DetectEngineThreadCtx_::tv

Definition at line 974 of file detect.h.

Referenced by DetectEngineThreadCtxInit().

RuleMatchCandidateTx* DetectEngineThreadCtx_::tx_candidates

Definition at line 1052 of file detect.h.

Referenced by RuleMatchCandidateTxArrayFree(), and RuleMatchCandidateTxArrayInit().

uint32_t DetectEngineThreadCtx_::tx_candidates_size

Definition at line 1053 of file detect.h.

Referenced by RuleMatchCandidateTxArrayFree(), and RuleMatchCandidateTxArrayInit().

uint64_t DetectEngineThreadCtx_::tx_id

ID of the transaction currently being inspected.

Definition at line 1035 of file detect.h.

Referenced by DetectFilestoreRegister(), and DetectLuaRegister().

uint16_t DetectEngineThreadCtx_::tx_id_set

Definition at line 1033 of file detect.h.

DetectVarList* DetectEngineThreadCtx_::varlist

The documentation for this struct was generated from the following file: