|
|
|
@ -334,7 +334,7 @@ struct DetectEngineThreadCtx_;// DetectEngineThreadCtx;
|
|
|
|
|
|
|
|
|
|
|
|
/* inspection buffer is a simple structure that is passed between prefilter,
|
|
|
|
/* inspection buffer is a simple structure that is passed between prefilter,
|
|
|
|
* transformation functions and inspection functions.
|
|
|
|
* transformation functions and inspection functions.
|
|
|
|
* Initialy setup with 'orig' ptr and len, transformations can then take
|
|
|
|
* Initially setup with 'orig' ptr and len, transformations can then take
|
|
|
|
* then and fill the 'buf'. Multiple transformations can update the buffer,
|
|
|
|
* then and fill the 'buf'. Multiple transformations can update the buffer,
|
|
|
|
* both growing and shrinking it.
|
|
|
|
* both growing and shrinking it.
|
|
|
|
* Prefilter and inspection will only deal with 'inspect'. */
|
|
|
|
* Prefilter and inspection will only deal with 'inspect'. */
|
|
|
|
@ -502,7 +502,7 @@ typedef struct SignatureInitData_ {
|
|
|
|
int transform_cnt;
|
|
|
|
int transform_cnt;
|
|
|
|
|
|
|
|
|
|
|
|
/** score to influence rule grouping. A higher value leads to a higher
|
|
|
|
/** score to influence rule grouping. A higher value leads to a higher
|
|
|
|
* likelyhood of a rulegroup with this sig ending up as a contained
|
|
|
|
* likelihood of a rulegroup with this sig ending up as a contained
|
|
|
|
* group. */
|
|
|
|
* group. */
|
|
|
|
int whitelist;
|
|
|
|
int whitelist;
|
|
|
|
|
|
|
|
|
|
|
|
@ -900,7 +900,7 @@ typedef struct DetectEngineCtx_ {
|
|
|
|
/** id of loader thread 'owning' this de_ctx */
|
|
|
|
/** id of loader thread 'owning' this de_ctx */
|
|
|
|
int loader_id;
|
|
|
|
int loader_id;
|
|
|
|
|
|
|
|
|
|
|
|
/** are we useing just mpm or also other prefilters */
|
|
|
|
/** are we using just mpm or also other prefilters */
|
|
|
|
enum DetectEnginePrefilterSetting prefilter_setting;
|
|
|
|
enum DetectEnginePrefilterSetting prefilter_setting;
|
|
|
|
|
|
|
|
|
|
|
|
HashListTable *dport_hash_table;
|
|
|
|
HashListTable *dport_hash_table;
|
|
|
|
@ -1002,7 +1002,7 @@ typedef struct RuleMatchCandidateTx {
|
|
|
|
*/
|
|
|
|
*/
|
|
|
|
typedef struct DetectEngineThreadCtx_ {
|
|
|
|
typedef struct DetectEngineThreadCtx_ {
|
|
|
|
/** \note multi-tenant hash lookup code from Detect() *depends*
|
|
|
|
/** \note multi-tenant hash lookup code from Detect() *depends*
|
|
|
|
* on this beeing the first member */
|
|
|
|
* on this being the first member */
|
|
|
|
uint32_t tenant_id;
|
|
|
|
uint32_t tenant_id;
|
|
|
|
|
|
|
|
|
|
|
|
/** ticker that is incremented once per packet. */
|
|
|
|
/** ticker that is incremented once per packet. */
|
|
|
|
|