suricata
detect-engine-analyzer.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2025 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Eileen Donlon <emdonlo@gmail.com>
22  * \author Victor Julien <victor@inliniac.net>
23  *
24  * Rule analyzers for the detection engine
25  */
26 
27 #include "suricata-common.h"
28 #include "suricata.h"
29 #include "rust.h"
30 #include "action-globals.h"
31 #include "detect.h"
32 #include "detect-parse.h"
33 #include "detect-engine.h"
34 #include "detect-engine-analyzer.h"
35 #include "detect-engine-mpm.h"
36 #include "detect-engine-uint.h"
37 #include "conf.h"
38 #include "detect-content.h"
39 #include "detect-pcre.h"
40 #include "detect-bytejump.h"
41 #include "detect-bytetest.h"
42 #include "detect-isdataat.h"
43 #include "detect-flow.h"
44 #include "detect-ttl.h"
45 #include "detect-tcp-flags.h"
46 #include "detect-tcp-ack.h"
47 #include "detect-ipopts.h"
48 #include "detect-tcp-seq.h"
49 #include "feature.h"
50 #include "util-print.h"
51 #include "util-time.h"
52 #include "util-validate.h"
53 #include "util-conf.h"
54 #include "detect-flowbits.h"
55 #include "detect-flowint.h"
56 #include "detect-xbits.h"
57 #include "util-var-name.h"
58 #include "detect-icmp-id.h"
59 #include "detect-tcp-window.h"
60 
61 static int rule_warnings_only = 0;
62 
63 /* Details for each buffer being tracked */
64 typedef struct DetectEngineAnalyzerItems {
65  int16_t item_id;
66  bool item_seen;
67  bool export_item_seen;
68  bool check_encoding_match;
69  const char *item_name;
70  const char *display_name;
71 } DetectEngineAnalyzerItems;
72 
73 typedef struct FpPatternStats_ {
74  uint16_t min;
75  uint16_t max;
76  uint32_t cnt;
77  uint64_t tot;
78 } FpPatternStats;
79 
80 /* Track which items require the item_seen value to be exposed */
81 struct ExposedItemSeen {
82  const char *bufname;
83  bool *item_seen_ptr;
84 };
85 
86 typedef struct EngineAnalysisCtx_ {
87 
88  FILE *rule_engine_analysis_fp;
89  FILE *fp_engine_analysis_fp;
90 
91  DetectEngineAnalyzerItems *analyzer_items;
92  char *file_prefix;
93  pcre2_code *percent_re;
94 
95  /*
96  * This array contains the map between the `analyzer_items` array listed above and
97  * the item ids returned by DetectBufferTypeGetByName. Iterating signature's sigmatch
98  * array provides list_ids. The map converts those ids into elements of the
99  * analyzer items array.
100  *
101  * Ultimately, the g_buffer_type_hash is searched for each buffer name. The size of that
102  * hashlist is 256, so that's the value we use here.
103  */
104  int16_t analyzer_item_map[256];
105  FpPatternStats fp_pattern_stats[DETECT_SM_LIST_MAX];
106  /*
107  * Certain values must be directly accessible. This array contains items that are directly
108  * accessed when checking if they've been seen or not.
109  */
110  struct ExposedItemSeen exposed_item_seen_list[2];
111 
112  bool analyzer_initialized;
113 } EngineAnalysisCtx;
114 
115 const DetectEngineAnalyzerItems analyzer_items[] = {
116  /* request keywords */
117  { 0, false, false, true, "http_uri", "http uri" },
118  { 0, false, false, false, "http_raw_uri", "http raw uri" },
119  { 0, false, true, false, "http_method", "http method" },
120  { 0, false, false, false, "http_request_line", "http request line" },
121  { 0, false, false, false, "http_client_body", "http client body" },
122  { 0, false, false, true, "http_header", "http header" },
123  { 0, false, false, false, "http_raw_header", "http raw header" },
124  { 0, false, false, true, "http_cookie", "http cookie" },
125  { 0, false, false, false, "http_user_agent", "http user agent" },
126  { 0, false, false, false, "http_host", "http host" },
127  { 0, false, false, false, "http_raw_host", "http raw host" },
128  { 0, false, false, false, "http_accept_enc", "http accept enc" },
129  { 0, false, false, false, "http_referer", "http referer" },
130  { 0, false, false, false, "http_content_type", "http content type" },
131  { 0, false, false, false, "http_header_names", "http header names" },
132 
133  /* response keywords not listed above */
134  { 0, false, false, false, "http_stat_msg", "http stat msg" },
135  { 0, false, false, false, "http_stat_code", "http stat code" },
136  { 0, false, true, false, "file_data", "http server body" },
137 
138  /* missing request keywords */
139  { 0, false, false, false, "http_request_line", "http request line" },
140  { 0, false, false, false, "http_accept", "http accept" },
141  { 0, false, false, false, "http_accept_lang", "http accept lang" },
142  { 0, false, false, false, "http_connection", "http connection" },
143  { 0, false, false, false, "http_content_len", "http content len" },
144  { 0, false, false, false, "http_protocol", "http protocol" },
145  { 0, false, false, false, "http_start", "http start" },
146 
147  /* missing response keywords; some of the missing are listed above*/
148  { 0, false, false, false, "http_response_line", "http response line" },
149  { 0, false, false, false, "http.server", "http server" },
150  { 0, false, false, false, "http.location", "http location" },
151 };
152 
153 static void FpPatternStatsAdd(FpPatternStats *fp, int list, uint16_t patlen)
154 {
155  if (list < 0 || list >= DETECT_SM_LIST_MAX)
156  return;
157 
158  FpPatternStats *f = &fp[list];
159 
160  if (f->min == 0)
161  f->min = patlen;
162  else if (patlen < f->min)
163  f->min = patlen;
164 
165  if (patlen > f->max)
166  f->max = patlen;
167 
168  f->cnt++;
169  f->tot += patlen;
170 }
171 
172 void EngineAnalysisFP(const DetectEngineCtx *de_ctx, const Signature *s, const char *line)
173 {
174  int fast_pattern_set = 0;
175  int fast_pattern_only_set = 0;
176  int fast_pattern_chop_set = 0;
177  const DetectContentData *fp_cd = NULL;
178  const SigMatch *mpm_sm = s->init_data->mpm_sm;
179  const int mpm_sm_list = s->init_data->mpm_sm_list;
180 
181  if (mpm_sm != NULL) {
182  fp_cd = (DetectContentData *)mpm_sm->ctx;
183  if (fp_cd->flags & DETECT_CONTENT_FAST_PATTERN) {
184  fast_pattern_set = 1;
185  if (fp_cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) {
186  fast_pattern_only_set = 1;
187  } else if (fp_cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) {
188  fast_pattern_chop_set = 1;
189  }
190  }
191  }
192 
193  FILE *fp = de_ctx->ea->rule_engine_analysis_fp;
194  fprintf(fp, "== Sid: %u ==\n", s->id);
195  fprintf(fp, "%s\n", line);
196 
197  fprintf(fp, " Fast Pattern analysis:\n");
198  if (s->init_data->prefilter_sm != NULL) {
199  fprintf(fp, " Prefilter on: %s\n",
200  sigmatch_table[s->init_data->prefilter_sm->type].name);
201  fprintf(fp, "\n");
202  return;
203  }
204 
205  if (fp_cd == NULL) {
206  fprintf(fp, " No content present\n");
207  fprintf(fp, "\n");
208  return;
209  }
210 
211  fprintf(fp, " Fast pattern matcher: ");
212  int list_type = mpm_sm_list;
213  if (list_type == DETECT_SM_LIST_PMATCH)
214  fprintf(fp, "content\n");
215  else {
216  const char *desc = DetectEngineBufferTypeGetDescriptionById(de_ctx, list_type);
217  const char *name = DetectEngineBufferTypeGetNameById(de_ctx, list_type);
218  if (desc && name) {
219  fprintf(fp, "%s (%s)\n", desc, name);
220  }
221  }
222 
223  int flags_set = 0;
224  fprintf(fp, " Flags:");
225  if (fp_cd->flags & DETECT_CONTENT_OFFSET) {
226  fprintf(fp, " Offset");
227  flags_set = 1;
228  } if (fp_cd->flags & DETECT_CONTENT_DEPTH) {
229  fprintf(fp, " Depth");
230  flags_set = 1;
231  }
232  if (fp_cd->flags & DETECT_CONTENT_WITHIN) {
233  fprintf(fp, " Within");
234  flags_set = 1;
235  }
236  if (fp_cd->flags & DETECT_CONTENT_DISTANCE) {
237  fprintf(fp, " Distance");
238  flags_set = 1;
239  }
240  if (fp_cd->flags & DETECT_CONTENT_NOCASE) {
241  fprintf(fp, " Nocase");
242  flags_set = 1;
243  }
244  if (fp_cd->flags & DETECT_CONTENT_NEGATED) {
245  fprintf(fp, " Negated");
246  flags_set = 1;
247  }
248  if (flags_set == 0)
249  fprintf(fp, " None");
250  fprintf(fp, "\n");
251 
252  fprintf(fp, " Fast pattern set: %s\n", fast_pattern_set ? "yes" : "no");
253  fprintf(fp, " Fast pattern only set: %s\n", fast_pattern_only_set ? "yes" : "no");
254  fprintf(fp, " Fast pattern chop set: %s\n", fast_pattern_chop_set ? "yes" : "no");
255  if (fast_pattern_chop_set) {
256  fprintf(fp, " Fast pattern offset, length: %u, %u\n", fp_cd->fp_chop_offset,
257  fp_cd->fp_chop_len);
258  }
259 
260  uint16_t patlen = fp_cd->content_len;
261  uint8_t *pat = SCMalloc(fp_cd->content_len + 1);
262  if (unlikely(pat == NULL)) {
263  FatalError("Error allocating memory");
264  }
265  memcpy(pat, fp_cd->content, fp_cd->content_len);
266  pat[fp_cd->content_len] = '\0';
267  fprintf(fp, " Original content: ");
268  PrintRawUriFp(fp, pat, patlen);
269  fprintf(fp, "\n");
270 
271  if (fast_pattern_chop_set) {
272  SCFree(pat);
273  patlen = fp_cd->fp_chop_len;
274  pat = SCMalloc(fp_cd->fp_chop_len + 1);
275  if (unlikely(pat == NULL)) {
276  exit(EXIT_FAILURE);
277  }
278  memcpy(pat, fp_cd->content + fp_cd->fp_chop_offset, fp_cd->fp_chop_len);
279  pat[fp_cd->fp_chop_len] = '\0';
280  fprintf(fp, " Final content: ");
281  PrintRawUriFp(fp, pat, patlen);
282  fprintf(fp, "\n");
283 
284  FpPatternStatsAdd(&de_ctx->ea->fp_pattern_stats[0], list_type, patlen);
285  } else {
286  fprintf(fp, " Final content: ");
287  PrintRawUriFp(fp, pat, patlen);
288  fprintf(fp, "\n");
289 
290  FpPatternStatsAdd(&de_ctx->ea->fp_pattern_stats[0], list_type, patlen);
291  }
292  SCFree(pat);
293 
294  fprintf(fp, "\n");
295 }
296 
297 /**
298  * \brief Sets up the fast pattern analyzer according to the config.
299  *
300  * \retval 1 If rule analyzer successfully enabled.
301  * \retval 0 If not enabled.
302  */
303 static int SetupFPAnalyzer(DetectEngineCtx *de_ctx)
304 {
305  int fp_engine_analysis_set = 0;
306 
307  if ((SCConfGetBool("engine-analysis.rules-fast-pattern", &fp_engine_analysis_set)) == 0) {
308  return false;
309  }
310 
311  if (fp_engine_analysis_set == 0)
312  return false;
313 
314  const char *log_dir = SCConfigGetLogDirectory();
315  char *log_path = SCMalloc(PATH_MAX);
316  if (log_path == NULL) {
317  FatalError("Unable to allocate scratch memory for rule filename");
318  }
319  snprintf(log_path, PATH_MAX, "%s/%s%s", log_dir,
320  de_ctx->ea->file_prefix ? de_ctx->ea->file_prefix : "", "rules_fast_pattern.txt");
321 
322  FILE *fp = fopen(log_path, "w");
323  if (fp == NULL) {
324  SCLogError("failed to open %s: %s", log_path, strerror(errno));
325  SCFree(log_path);
326  return false;
327  }
328 
329  de_ctx->ea->fp_engine_analysis_fp = fp;
330 
331  SCLogInfo("Engine-Analysis for fast_pattern printed to file - %s",
332  log_path);
333  SCFree(log_path);
334 
335  struct timeval tval;
336  gettimeofday(&tval, NULL);
337  struct tm local_tm;
338  struct tm *tms = SCLocalTime(tval.tv_sec, &local_tm);
339  fprintf(fp, "----------------------------------------------"
340  "---------------------\n");
341  fprintf(fp,
342  "Date: %" PRId32 "/%" PRId32 "/%04d -- "
343  "%02d:%02d:%02d\n",
344  tms->tm_mday, tms->tm_mon + 1, tms->tm_year + 1900, tms->tm_hour, tms->tm_min,
345  tms->tm_sec);
346  fprintf(fp, "----------------------------------------------"
347  "---------------------\n");
348 
349  memset(&de_ctx->ea->fp_pattern_stats[0], 0, sizeof(de_ctx->ea->fp_pattern_stats));
350  return true;
351 }
352 
353 /**
354  * \brief Compiles regex for rule analysis
355  * \retval 1 if successful
356  * \retval 0 if on error
357  */
358 static bool PerCentEncodingSetup(EngineAnalysisCtx *ea_ctx)
359 {
360 #define DETECT_PERCENT_ENCODING_REGEX "%[0-9|a-f|A-F]{2}"
361  int en;
362  PCRE2_SIZE eo = 0;
363  int opts = 0; // PCRE2_NEWLINE_ANY??
364 
365  ea_ctx->percent_re = pcre2_compile((PCRE2_SPTR8)DETECT_PERCENT_ENCODING_REGEX,
366  PCRE2_ZERO_TERMINATED, opts, &en, &eo, NULL);
367  if (ea_ctx->percent_re == NULL) {
368  PCRE2_UCHAR errbuffer[256];
369  pcre2_get_error_message(en, errbuffer, sizeof(errbuffer));
370  SCLogError("Compile of \"%s\" failed at offset %d: %s", DETECT_PERCENT_ENCODING_REGEX,
371  (int)eo, errbuffer);
372  return false;
373  }
374 
375  return true;
376 }
377 /**
378  * \brief Sets up the rule analyzer according to the config
379  * \retval 1 if rule analyzer successfully enabled
380  * \retval 0 if not enabled
381  */
382 static int SetupRuleAnalyzer(DetectEngineCtx *de_ctx)
383 {
384  SCConfNode *conf = SCConfGetNode("engine-analysis");
385  int enabled = 0;
386  if (conf != NULL) {
387  const char *value = SCConfNodeLookupChildValue(conf, "rules");
388  if (value && SCConfValIsTrue(value)) {
389  enabled = 1;
390  } else if (value && strcasecmp(value, "warnings-only") == 0) {
391  enabled = 1;
392  rule_warnings_only = 1;
393  }
394  if (enabled) {
395  const char *log_dir;
396  log_dir = SCConfigGetLogDirectory();
397  char log_path[PATH_MAX];
398  snprintf(log_path, sizeof(log_path), "%s/%s%s", log_dir,
399  de_ctx->ea->file_prefix ? de_ctx->ea->file_prefix : "", "rules_analysis.txt");
400  de_ctx->ea->rule_engine_analysis_fp = fopen(log_path, "w");
401  if (de_ctx->ea->rule_engine_analysis_fp == NULL) {
402  SCLogError("failed to open %s: %s", log_path, strerror(errno));
403  return 0;
404  }
405 
406  SCLogInfo("Engine-Analysis for rules printed to file - %s",
407  log_path);
408 
409  struct timeval tval;
410  gettimeofday(&tval, NULL);
411  struct tm local_tm;
412  struct tm *tms = SCLocalTime(tval.tv_sec, &local_tm);
413  fprintf(de_ctx->ea->rule_engine_analysis_fp,
414  "----------------------------------------------"
415  "---------------------\n");
416  fprintf(de_ctx->ea->rule_engine_analysis_fp,
417  "Date: %" PRId32 "/%" PRId32 "/%04d -- "
418  "%02d:%02d:%02d\n",
419  tms->tm_mday, tms->tm_mon + 1, tms->tm_year + 1900, tms->tm_hour, tms->tm_min,
420  tms->tm_sec);
421  fprintf(de_ctx->ea->rule_engine_analysis_fp,
422  "----------------------------------------------"
423  "---------------------\n");
424 
425  /*compile regex's for rule analysis*/
426  if (!PerCentEncodingSetup(de_ctx->ea)) {
427  fprintf(de_ctx->ea->rule_engine_analysis_fp,
428  "Error compiling regex; can't check for percent encoding in normalized "
429  "http content.\n");
430  }
431  }
432  }
433  else {
434  SCLogInfo("Conf parameter \"engine-analysis.rules\" not found. "
435  "Defaulting to not printing the rules analysis report.");
436  }
437  if (!enabled) {
438  SCLogInfo("Engine-Analysis for rules disabled in conf file.");
439  return 0;
440  }
441  return 1;
442 }
443 
444 static void CleanupFPAnalyzer(DetectEngineCtx *de_ctx)
445 {
446  FILE *fp = de_ctx->ea->rule_engine_analysis_fp;
447  fprintf(fp, "============\n"
448  "Summary:\n============\n");
449 
450  for (int i = 0; i < DETECT_SM_LIST_MAX; i++) {
451  FpPatternStats *f = &de_ctx->ea->fp_pattern_stats[i];
452  if (f->cnt == 0)
453  continue;
454 
455  fprintf(fp,
456  "%s, smallest pattern %u byte(s), longest pattern %u byte(s), number of patterns "
457  "%u, avg pattern len %.2f byte(s)\n",
458  DetectSigmatchListEnumToString(i), f->min, f->max, f->cnt,
459  (float)((double)f->tot / (float)f->cnt));
460  }
461 
462  fclose(de_ctx->ea->rule_engine_analysis_fp);
463  de_ctx->ea->rule_engine_analysis_fp = NULL;
464 }
465 
466 static void CleanupRuleAnalyzer(DetectEngineCtx *de_ctx)
467 {
468  if (de_ctx->ea->fp_engine_analysis_fp != NULL) {
469  fclose(de_ctx->ea->fp_engine_analysis_fp);
470  de_ctx->ea->fp_engine_analysis_fp = NULL;
471  }
472  if (de_ctx->ea->percent_re != NULL) {
473  pcre2_code_free(de_ctx->ea->percent_re);
474  }
475 }
476 
477 void SetupEngineAnalysis(DetectEngineCtx *de_ctx, bool *fp_analysis, bool *rule_analysis)
478 {
479  *fp_analysis = false;
480  *rule_analysis = false;
481 
482  EngineAnalysisCtx *ea = SCCalloc(1, sizeof(EngineAnalysisCtx));
483  if (ea == NULL) {
484  FatalError("Unable to allocate per-engine analysis context");
485  }
486 
487  ea->file_prefix = NULL;
488  size_t cfg_prefix_len = strlen(de_ctx->config_prefix);
489  if (cfg_prefix_len > 0) {
490  char prefix[sizeof(de_ctx->config_prefix) + 1];
491  snprintf(prefix, sizeof(prefix), "%s.", de_ctx->config_prefix);
492  ea->file_prefix = SCStrdup(prefix);
493  if (ea->file_prefix == NULL) {
494  FatalError("Unable to allocate per-engine analysis context name buffer");
495  }
496  }
497 
498  de_ctx->ea = ea;
499 
500  *fp_analysis = SetupFPAnalyzer(de_ctx);
501  *rule_analysis = SetupRuleAnalyzer(de_ctx);
502 
503  if (!(*fp_analysis || *rule_analysis)) {
504  if (ea->file_prefix)
505  SCFree(ea->file_prefix);
506  if (ea->analyzer_items)
507  SCFree(ea->analyzer_items);
508  SCFree(ea);
509  de_ctx->ea = NULL;
510  }
511 }
512 
513 void CleanupEngineAnalysis(DetectEngineCtx *de_ctx)
514 {
515  if (de_ctx->ea) {
516  CleanupRuleAnalyzer(de_ctx);
517  CleanupFPAnalyzer(de_ctx);
518  if (de_ctx->ea->file_prefix)
519  SCFree(de_ctx->ea->file_prefix);
520  if (de_ctx->ea->analyzer_items)
521  SCFree(de_ctx->ea->analyzer_items);
522  SCFree(de_ctx->ea);
523  de_ctx->ea = NULL;
524  }
525 }
526 
527 /**
528  * \brief Checks for % encoding in content.
529  * \param Pointer to content
530  * \retval number of matches if content has % encoding
531  * \retval 0 if it doesn't have % encoding
532  * \retval -1 on error
533  */
534 static int PerCentEncodingMatch(EngineAnalysisCtx *ea_ctx, uint8_t *content, uint16_t content_len)
535 {
536  int ret = 0;
537 
538  pcre2_match_data *match = pcre2_match_data_create_from_pattern(ea_ctx->percent_re, NULL);
539  ret = pcre2_match(ea_ctx->percent_re, (PCRE2_SPTR8)content, content_len, 0, 0, match, NULL);
540  if (ret == -1) {
541  return 0;
542  } else if (ret < -1) {
543  SCLogError("Error parsing content - %s; error code is %d", content, ret);
544  ret = -1;
545  }
546  pcre2_match_data_free(match);
547  return ret;
548 }
549 
550 static void EngineAnalysisRulesPrintFP(const DetectEngineCtx *de_ctx, const Signature *s)
551 {
552  const DetectContentData *fp_cd = NULL;
553  const SigMatch *mpm_sm = s->init_data->mpm_sm;
554  const int mpm_sm_list = s->init_data->mpm_sm_list;
555 
556  if (mpm_sm != NULL) {
557  fp_cd = (DetectContentData *)mpm_sm->ctx;
558  }
559 
560  if (fp_cd == NULL) {
561  return;
562  }
563 
564  uint16_t patlen = fp_cd->content_len;
565  uint8_t *pat = SCMalloc(fp_cd->content_len + 1);
566  if (unlikely(pat == NULL)) {
567  FatalError("Error allocating memory");
568  }
569 
570  EngineAnalysisCtx *ea_ctx = de_ctx->ea;
571 
572  memcpy(pat, fp_cd->content, fp_cd->content_len);
573  pat[fp_cd->content_len] = '\0';
574 
575  if (fp_cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) {
576  SCFree(pat);
577  patlen = fp_cd->fp_chop_len;
578  pat = SCMalloc(fp_cd->fp_chop_len + 1);
579  if (unlikely(pat == NULL)) {
580  exit(EXIT_FAILURE);
581  }
582  memcpy(pat, fp_cd->content + fp_cd->fp_chop_offset, fp_cd->fp_chop_len);
583  pat[fp_cd->fp_chop_len] = '\0';
584  fprintf(ea_ctx->rule_engine_analysis_fp, " Fast Pattern \"");
585  PrintRawUriFp(ea_ctx->rule_engine_analysis_fp, pat, patlen);
586  } else {
587  fprintf(ea_ctx->rule_engine_analysis_fp, " Fast Pattern \"");
588  PrintRawUriFp(ea_ctx->rule_engine_analysis_fp, pat, patlen);
589  }
590  SCFree(pat);
591 
592  fprintf(ea_ctx->rule_engine_analysis_fp, "\" on \"");
593 
594  const int list_type = mpm_sm_list;
595  if (list_type == DETECT_SM_LIST_PMATCH) {
596  int payload = 0;
597  int stream = 0;
598  if (SignatureHasPacketContent(s))
599  payload = 1;
600  if (SignatureHasStreamContent(s))
601  stream = 1;
602  fprintf(ea_ctx->rule_engine_analysis_fp, "%s",
603  payload ? (stream ? "payload and reassembled stream" : "payload")
604  : "reassembled stream");
605  }
606  else {
607  const char *desc = DetectEngineBufferTypeGetDescriptionById(de_ctx, list_type);
608  const char *name = DetectEngineBufferTypeGetNameById(de_ctx, list_type);
609  if (desc && name) {
610  fprintf(ea_ctx->rule_engine_analysis_fp, "%s (%s)", desc, name);
611  } else if (desc || name) {
612  fprintf(ea_ctx->rule_engine_analysis_fp, "%s", desc ? desc : name);
613  }
614 
615  }
616 
617  fprintf(ea_ctx->rule_engine_analysis_fp, "\" ");
618  const DetectBufferType *bt = DetectEngineBufferTypeGetById(de_ctx, list_type);
619  if (bt && bt->transforms.cnt) {
620  fprintf(ea_ctx->rule_engine_analysis_fp, "(with %d transform(s)) ", bt->transforms.cnt);
621  }
622  fprintf(ea_ctx->rule_engine_analysis_fp, "buffer.\n");
623 }
624 
625 void EngineAnalysisRulesFailure(
626  const DetectEngineCtx *de_ctx, const char *line, const char *file, int lineno)
627 {
628  FILE *tmp_fp = de_ctx->ea->fp_engine_analysis_fp ? de_ctx->ea->fp_engine_analysis_fp
629  : de_ctx->ea->rule_engine_analysis_fp;
630  if (tmp_fp) {
631  fprintf(tmp_fp, "== Sid: UNKNOWN ==\n");
632  fprintf(tmp_fp, "%s\n", line);
633  fprintf(tmp_fp, " FAILURE: invalid rule.\n");
634  fprintf(tmp_fp, " File: %s.\n", file);
635  fprintf(tmp_fp, " Line: %d.\n", lineno);
636  fprintf(tmp_fp, "\n");
637  }
638 }
639 
640 typedef struct RuleAnalyzer {
641  SCJsonBuilder *js; /* document root */
642 
643  SCJsonBuilder *js_warnings;
644  SCJsonBuilder *js_notes;
645 } RuleAnalyzer;
646 
647 static void ATTR_FMT_PRINTF(2, 3) AnalyzerNote(RuleAnalyzer *ctx, char *fmt, ...)
648 {
649  va_list ap;
650  char str[1024];
651 
652  va_start(ap, fmt);
653  vsnprintf(str, sizeof(str), fmt, ap);
654  va_end(ap);
655 
656  if (!ctx->js_notes)
657  ctx->js_notes = SCJbNewArray();
658  if (ctx->js_notes)
659  SCJbAppendString(ctx->js_notes, str);
660 }
661 
662 static void ATTR_FMT_PRINTF(2, 3) AnalyzerWarning(RuleAnalyzer *ctx, char *fmt, ...)
663 {
664  va_list ap;
665  char str[1024];
666 
667  va_start(ap, fmt);
668  vsnprintf(str, sizeof(str), fmt, ap);
669  va_end(ap);
670 
671  if (!ctx->js_warnings)
672  ctx->js_warnings = SCJbNewArray();
673  if (ctx->js_warnings)
674  SCJbAppendString(ctx->js_warnings, str);
675 }
676 
677 #define CHECK(pat) if (strlen((pat)) <= len && memcmp((pat), buf, MIN(len, strlen((pat)))) == 0) return true;
678 
679 static bool LooksLikeHTTPMethod(const uint8_t *buf, uint16_t len)
680 {
681  CHECK("GET /");
682  CHECK("POST /");
683  CHECK("HEAD /");
684  CHECK("PUT /");
685  return false;
686 }
687 
688 static bool LooksLikeHTTPUA(const uint8_t *buf, uint16_t len)
689 {
690  CHECK("User-Agent: ");
691  CHECK("\nUser-Agent: ");
692  return false;
693 }
694 
695 static void DumpContent(SCJsonBuilder *js, const DetectContentData *cd)
696 {
697  char pattern_str[1024] = "";
698  DetectContentPatternPrettyPrint(cd->content, cd->content_len, pattern_str, sizeof(pattern_str));
699 
700  SCJbSetString(js, "pattern", pattern_str);
701  SCJbSetUint(js, "length", cd->content_len);
702  SCJbSetBool(js, "nocase", cd->flags & DETECT_CONTENT_NOCASE);
703  SCJbSetBool(js, "negated", cd->flags & DETECT_CONTENT_NEGATED);
704  SCJbSetBool(js, "starts_with", cd->flags & DETECT_CONTENT_STARTS_WITH);
705  SCJbSetBool(js, "ends_with", cd->flags & DETECT_CONTENT_ENDS_WITH);
706  SCJbSetBool(js, "is_mpm", cd->flags & DETECT_CONTENT_MPM);
707  SCJbSetBool(js, "no_double_inspect", cd->flags & DETECT_CONTENT_NO_DOUBLE_INSPECTION_REQUIRED);
708  if (cd->flags & DETECT_CONTENT_OFFSET) {
709  SCJbSetUint(js, "offset", cd->offset);
710  }
711  if (cd->flags & DETECT_CONTENT_DEPTH) {
712  SCJbSetUint(js, "depth", cd->depth);
713  }
714  if (cd->flags & DETECT_CONTENT_DISTANCE) {
715  SCJbSetInt(js, "distance", cd->distance);
716  }
717  if (cd->flags & DETECT_CONTENT_WITHIN) {
718  SCJbSetInt(js, "within", cd->within);
719  }
720  SCJbSetBool(js, "fast_pattern", cd->flags & DETECT_CONTENT_FAST_PATTERN);
721  SCJbSetBool(js, "relative_next", cd->flags & DETECT_CONTENT_RELATIVE_NEXT);
722 }
723 
724 static void DumpPcre(SCJsonBuilder *js, const DetectPcreData *cd)
725 {
726  SCJbSetBool(js, "relative", cd->flags & DETECT_PCRE_RELATIVE);
727  SCJbSetBool(js, "relative_next", cd->flags & DETECT_PCRE_RELATIVE_NEXT);
728  SCJbSetBool(js, "nocase", cd->flags & DETECT_PCRE_CASELESS);
729  SCJbSetBool(js, "negated", cd->flags & DETECT_PCRE_NEGATE);
730 }
731 
732 static void DumpMatches(RuleAnalyzer *ctx, SCJsonBuilder *js, const SigMatchData *smd)
733 {
734  if (smd == NULL)
735  return;
736 
737  SCJbOpenArray(js, "matches");
738  do {
739  SCJbStartObject(js);
740  const char *mname = sigmatch_table[smd->type].name;
741  SCJbSetString(js, "name", mname);
742 
743  switch (smd->type) {
744  case DETECT_CONTENT: {
745  const DetectContentData *cd = (const DetectContentData *)smd->ctx;
746 
747  SCJbOpenObject(js, "content");
748  DumpContent(js, cd);
749  if (cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) {
750  AnalyzerNote(ctx, (char *)"'fast_pattern:only' option is silently ignored and "
751  "is interpreted as regular 'fast_pattern'");
752  }
753  if (LooksLikeHTTPMethod(cd->content, cd->content_len)) {
754  AnalyzerNote(ctx,
755  (char *)"pattern looks like it inspects HTTP, use http.request_line or "
756  "http.method and http.uri instead for improved performance");
757  }
758  if (LooksLikeHTTPUA(cd->content, cd->content_len)) {
759  AnalyzerNote(ctx,
760  (char *)"pattern looks like it inspects HTTP, use http.user_agent "
761  "or http.header for improved performance");
762  }
763  if (cd->flags & DETECT_CONTENT_WITHIN2DEPTH) {
764  AnalyzerNote(ctx, (char *)"'within' option for pattern w/o previous content "
765  "was converted to 'depth'");
766  }
767  if (cd->flags & DETECT_CONTENT_DISTANCE2OFFSET) {
768  AnalyzerNote(ctx, (char *)"'distance' option for pattern w/o previous content "
769  "was converted to 'offset'");
770  }
771  SCJbClose(js);
772  break;
773  }
774  case DETECT_PCRE: {
775  const DetectPcreData *cd = (const DetectPcreData *)smd->ctx;
776 
777  SCJbOpenObject(js, "pcre");
778  DumpPcre(js, cd);
779  SCJbClose(js);
780  if (cd->flags & DETECT_PCRE_RAWBYTES) {
781  AnalyzerNote(ctx,
782  (char *)"'/B' (rawbytes) option is a no-op and is silently ignored");
783  }
784  break;
785  }
786  case DETECT_BYTEJUMP: {
787  const DetectBytejumpData *cd = (const DetectBytejumpData *)smd->ctx;
788 
789  SCJbOpenObject(js, "byte_jump");
790  SCJbSetUint(js, "nbytes", cd->nbytes);
791  SCJbSetInt(js, "offset", cd->offset);
792  SCJbSetUint(js, "multiplier", cd->multiplier);
793  SCJbSetInt(js, "post_offset", cd->post_offset);
794  switch (cd->base) {
795  case DETECT_BYTEJUMP_BASE_UNSET:
796  SCJbSetString(js, "base", "unset");
797  break;
798  case DETECT_BYTEJUMP_BASE_OCT:
799  SCJbSetString(js, "base", "oct");
800  break;
801  case DETECT_BYTEJUMP_BASE_DEC:
802  SCJbSetString(js, "base", "dec");
803  break;
804  case DETECT_BYTEJUMP_BASE_HEX:
805  SCJbSetString(js, "base", "hex");
806  break;
807  }
808  SCJbOpenArray(js, "flags");
809  if (cd->flags & DETECT_BYTEJUMP_BEGIN)
810  SCJbAppendString(js, "from_beginning");
811  if (cd->flags & DETECT_BYTEJUMP_LITTLE)
812  SCJbAppendString(js, "little_endian");
813  if (cd->flags & DETECT_BYTEJUMP_BIG)
814  SCJbAppendString(js, "big_endian");
815  if (cd->flags & DETECT_BYTEJUMP_STRING)
816  SCJbAppendString(js, "string");
817  if (cd->flags & DETECT_BYTEJUMP_RELATIVE)
818  SCJbAppendString(js, "relative");
819  if (cd->flags & DETECT_BYTEJUMP_ALIGN)
820  SCJbAppendString(js, "align");
821  if (cd->flags & DETECT_BYTEJUMP_DCE)
822  SCJbAppendString(js, "dce");
823  if (cd->flags & DETECT_BYTEJUMP_OFFSET_BE)
824  SCJbAppendString(js, "offset_be");
825  if (cd->flags & DETECT_BYTEJUMP_END)
826  SCJbAppendString(js, "from_end");
827  SCJbClose(js);
828  SCJbClose(js);
829  break;
830  }
831  case DETECT_BYTETEST: {
832  const DetectBytetestData *cd = (const DetectBytetestData *)smd->ctx;
833 
834  SCJbOpenObject(js, "byte_test");
835  SCJbSetUint(js, "nbytes", cd->nbytes);
836  SCJbSetInt(js, "offset", cd->offset);
837  switch (cd->base) {
838  case DETECT_BYTETEST_BASE_UNSET:
839  SCJbSetString(js, "base", "unset");
840  break;
841  case DETECT_BYTETEST_BASE_OCT:
842  SCJbSetString(js, "base", "oct");
843  break;
844  case DETECT_BYTETEST_BASE_DEC:
845  SCJbSetString(js, "base", "dec");
846  break;
847  case DETECT_BYTETEST_BASE_HEX:
848  SCJbSetString(js, "base", "hex");
849  break;
850  }
851  SCJbOpenArray(js, "flags");
852  if (cd->flags & DETECT_BYTETEST_LITTLE)
853  SCJbAppendString(js, "little_endian");
854  if (cd->flags & DETECT_BYTETEST_BIG)
855  SCJbAppendString(js, "big_endian");
856  if (cd->flags & DETECT_BYTETEST_STRING)
857  SCJbAppendString(js, "string");
858  if (cd->flags & DETECT_BYTETEST_RELATIVE)
859  SCJbAppendString(js, "relative");
860  if (cd->flags & DETECT_BYTETEST_DCE)
861  SCJbAppendString(js, "dce");
862  SCJbClose(js);
863  SCJbClose(js);
864  break;
865  }
866  case DETECT_ABSENT: {
867  const DetectAbsentData *dad = (const DetectAbsentData *)smd->ctx;
868  SCJbOpenObject(js, "absent");
869  SCJbSetBool(js, "or_else", dad->or_else);
870  SCJbClose(js);
871  break;
872  }
873 
874  case DETECT_IPOPTS: {
875  const DetectIpOptsData *cd = (const DetectIpOptsData *)smd->ctx;
876 
877  SCJbOpenObject(js, "ipopts");
878  const char *flag = IpOptsFlagToString(cd->ipopt);
879  SCJbSetString(js, "option", flag);
880  SCJbClose(js);
881  break;
882  }
883  case DETECT_FLOWBITS: {
884  const DetectFlowbitsData *cd = (const DetectFlowbitsData *)smd->ctx;
885 
886  SCJbOpenObject(js, "flowbits");
887  switch (cd->cmd) {
888  case DETECT_FLOWBITS_CMD_ISSET:
889  SCJbSetString(js, "cmd", "isset");
890  break;
891  case DETECT_FLOWBITS_CMD_ISNOTSET:
892  SCJbSetString(js, "cmd", "isnotset");
893  break;
894  case DETECT_FLOWBITS_CMD_SET:
895  SCJbSetString(js, "cmd", "set");
896  break;
897  case DETECT_FLOWBITS_CMD_UNSET:
898  SCJbSetString(js, "cmd", "unset");
899  break;
900  case DETECT_FLOWBITS_CMD_TOGGLE:
901  SCJbSetString(js, "cmd", "toggle");
902  break;
903  }
904  bool is_or = false;
905  SCJbOpenArray(js, "names");
906  if (cd->or_list_size == 0) {
907  SCJbAppendString(js, VarNameStoreSetupLookup(cd->idx, VAR_TYPE_FLOW_BIT));
908  } else if (cd->or_list_size > 0) {
909  is_or = true;
910  for (uint8_t i = 0; i < cd->or_list_size; i++) {
911  const char *varname =
912  VarNameStoreSetupLookup(cd->or_list[i], VAR_TYPE_FLOW_BIT);
913  SCJbAppendString(js, varname);
914  }
915  }
916  SCJbClose(js); // array
917  if (is_or) {
918  SCJbSetString(js, "operator", "or");
919  }
920  SCJbClose(js); // object
921  break;
922  }
923  case DETECT_XBITS: {
924  const DetectXbitsData *xd = (const DetectXbitsData *)smd->ctx;
925 
926  SCJbOpenObject(js, "xbits");
927  switch (xd->cmd) {
928  case DETECT_XBITS_CMD_ISSET:
929  SCJbSetString(js, "cmd", "isset");
930  break;
931  case DETECT_XBITS_CMD_ISNOTSET:
932  SCJbSetString(js, "cmd", "isnotset");
933  break;
934  case DETECT_XBITS_CMD_SET:
935  SCJbSetString(js, "cmd", "set");
936  break;
937  case DETECT_XBITS_CMD_UNSET:
938  SCJbSetString(js, "cmd", "unset");
939  break;
940  case DETECT_XBITS_CMD_TOGGLE:
941  SCJbSetString(js, "cmd", "toggle");
942  break;
943  }
944  SCJbSetString(js, "name", VarNameStoreSetupLookup(xd->idx, xd->type));
945  switch (xd->tracker) {
946  case DETECT_XBITS_TRACK_IPSRC:
947  SCJbSetString(js, "track", "ip_src");
948  break;
949  case DETECT_XBITS_TRACK_IPDST:
950  SCJbSetString(js, "track", "ip_dst");
951  break;
952  case DETECT_XBITS_TRACK_IPPAIR:
953  SCJbSetString(js, "track", "ip_pair");
954  break;
955  case DETECT_XBITS_TRACK_TX:
956  SCJbSetString(js, "track", "tx");
957  break;
958  }
959  // always log expire value
960  SCJbSetUint(js, "expire", xd->expire);
961  SCJbClose(js); // object
962  break;
963  }
964  case DETECT_FLOWINT: {
965  const DetectFlowintData *cd = (const DetectFlowintData *)smd->ctx;
966 
967  SCJbOpenObject(js, "flowint");
968  switch (cd->modifier) {
969  case FLOWINT_MODIFIER_SET:
970  SCJbSetString(js, "cmd", "set");
971  break;
972  case FLOWINT_MODIFIER_ADD:
973  SCJbSetString(js, "cmd", "add");
974  break;
975  case FLOWINT_MODIFIER_SUB:
976  SCJbSetString(js, "cmd", "sub");
977  break;
978  case FLOWINT_MODIFIER_LT:
979  SCJbSetString(js, "cmd", "lt");
980  break;
981  case FLOWINT_MODIFIER_LE:
982  SCJbSetString(js, "cmd", "lte");
983  break;
984  case FLOWINT_MODIFIER_EQ:
985  SCJbSetString(js, "cmd", "eq");
986  break;
987  case FLOWINT_MODIFIER_NE:
988  SCJbSetString(js, "cmd", "ne");
989  break;
990  case FLOWINT_MODIFIER_GE:
991  SCJbSetString(js, "cmd", "gte");
992  break;
993  case FLOWINT_MODIFIER_GT:
994  SCJbSetString(js, "cmd", "gt");
995  break;
996  case FLOWINT_MODIFIER_ISSET:
997  SCJbSetString(js, "cmd", "isset");
998  break;
999  case FLOWINT_MODIFIER_ISNOTSET:
1000  SCJbSetString(js, "cmd", "isnotset");
1001  break;
1002  }
1003  const char *varname = VarNameStoreSetupLookup(cd->idx, VAR_TYPE_FLOW_INT);
1004  if (varname != NULL) {
1005  SCJbSetString(js, "var", varname);
1006  }
1007  if (cd->targettype == FLOWINT_TARGET_VAL) {
1008  SCJbSetUint(js, "value", cd->target.value);
1009  } else if (cd->targettype == FLOWINT_TARGET_VAR) {
1010  if (cd->target.tvar.name != NULL) {
1011  SCJbSetString(js, "target", cd->target.tvar.name);
1012  }
1013  }
1014  SCJbClose(js);
1015  break;
1016  }
1017  case DETECT_ACK: {
1018  const DetectU32Data *cd = (const DetectU32Data *)smd->ctx;
1019  SCJbOpenObject(js, "ack");
1020  SCDetectU32ToJson(js, cd);
1021  SCJbClose(js);
1022  break;
1023  }
1024  case DETECT_SEQ: {
1025  const DetectU32Data *cd = (const DetectU32Data *)smd->ctx;
1026  SCJbOpenObject(js, "seq");
1027  SCDetectU32ToJson(js, cd);
1028  SCJbClose(js);
1029  break;
1030  }
1031  case DETECT_TCPMSS: {
1032  const DetectU16Data *cd = (const DetectU16Data *)smd->ctx;
1033  SCJbOpenObject(js, "tcp_mss");
1034  SCDetectU16ToJson(js, cd);
1035  SCJbClose(js);
1036  break;
1037  }
1038  case DETECT_DSIZE: {
1039  const DetectU16Data *cd = (const DetectU16Data *)smd->ctx;
1040  SCJbOpenObject(js, "dsize");
1041  SCDetectU16ToJson(js, cd);
1042  SCJbClose(js);
1043  break;
1044  }
1045  case DETECT_ICODE: {
1046  const DetectU8Data *cd = (const DetectU8Data *)smd->ctx;
1047  SCJbOpenObject(js, "code");
1048  SCDetectU8ToJson(js, cd);
1049  SCJbClose(js);
1050  break;
1051  }
1052  case DETECT_TTL: {
1053  const DetectU8Data *cd = (const DetectU8Data *)smd->ctx;
1054  SCJbOpenObject(js, "ttl");
1055  SCDetectU8ToJson(js, cd);
1056  SCJbClose(js);
1057  break;
1058  }
1059  case DETECT_ICMP_ID: {
1060  const DetectU16Data *cd = (const DetectU16Data *)smd->ctx;
1061  SCJbOpenObject(js, "id");
1062  SCDetectU16ToJson(js, cd);
1063  SCJbClose(js);
1064  break;
1065  }
1066  case DETECT_WINDOW: {
1067  const DetectU16Data *cd = (const DetectU16Data *)smd->ctx;
1068  SCJbOpenObject(js, "window");
1069  SCDetectU16ToJson(js, cd);
1070  SCJbClose(js);
1071  break;
1072  }
1073  case DETECT_FLOW_AGE: {
1074  const DetectU32Data *cd = (const DetectU32Data *)smd->ctx;
1075  SCJbOpenObject(js, "flow_age");
1076  SCDetectU32ToJson(js, cd);
1077  SCJbClose(js);
1078  break;
1079  }
1080  case DETECT_FLOW_ELEPHANT: {
1081  const uint8_t *dfd = (const uint8_t *)smd->ctx;
1082  SCJbOpenObject(js, "flow_elephant");
1083  switch (*dfd) {
1084  case DETECT_FLOW_TOSERVER:
1085  SCJbSetString(js, "dir", "toserver");
1086  break;
1087  case DETECT_FLOW_TOCLIENT:
1088  SCJbSetString(js, "dir", "toclient");
1089  break;
1090  case DETECT_FLOW_TOEITHER:
1091  SCJbSetString(js, "dir", "either");
1092  break;
1093  case DETECT_FLOW_TOBOTH:
1094  SCJbSetString(js, "dir", "both");
1095  break;
1096  }
1097  SCJbClose(js);
1098  break;
1099  }
1100  }
1101  SCJbClose(js);
1102 
1103  if (smd->is_last)
1104  break;
1105  smd++;
1106  } while (1);
1107  SCJbClose(js);
1108 }
1109 
1110 SCMutex g_rules_analyzer_write_m = SCMUTEX_INITIALIZER;
1111 void EngineAnalysisRules2(const DetectEngineCtx *de_ctx, const Signature *s)
1112 {
1113  SCEnter();
1114 
1115  RuleAnalyzer ctx = { NULL, NULL, NULL };
1116 
1117  ctx.js = SCJbNewObject();
1118  if (ctx.js == NULL)
1119  SCReturn;
1120 
1121  if (s->init_data->firewall_rule) {
1122  JB_SET_STRING(ctx.js, "class", "firewall");
1123  } else {
1124  JB_SET_STRING(ctx.js, "class", "threat detection");
1125  }
1126 
1127  SCJbSetString(ctx.js, "raw", s->sig_str);
1128  SCJbSetUint(ctx.js, "id", s->id);
1129  SCJbSetUint(ctx.js, "gid", s->gid);
1130  SCJbSetUint(ctx.js, "rev", s->rev);
1131  SCJbSetString(ctx.js, "msg", s->msg);
1132 
1133  const char *alproto = AppProtoToString(s->alproto);
1134  SCJbSetString(ctx.js, "app_proto", alproto);
1135 
1136  SCJbOpenArray(ctx.js, "requirements");
1137  if (s->mask & SIG_MASK_REQUIRE_PAYLOAD) {
1138  SCJbAppendString(ctx.js, "payload");
1139  }
1140  if (s->mask & SIG_MASK_REQUIRE_NO_PAYLOAD) {
1141  SCJbAppendString(ctx.js, "no_payload");
1142  }
1143  if (s->mask & SIG_MASK_REQUIRE_FLOW) {
1144  SCJbAppendString(ctx.js, "flow");
1145  }
1146  if (s->mask & SIG_MASK_REQUIRE_FLAGS_INITDEINIT) {
1147  SCJbAppendString(ctx.js, "tcp_flags_init_deinit");
1148  }
1149  if (s->mask & SIG_MASK_REQUIRE_FLAGS_UNUSUAL) {
1150  SCJbAppendString(ctx.js, "tcp_flags_unusual");
1151  }
1152  if (s->mask & SIG_MASK_REQUIRE_ENGINE_EVENT) {
1153  SCJbAppendString(ctx.js, "engine_event");
1154  }
1155  if (s->mask & SIG_MASK_REQUIRE_REAL_PKT) {
1156  SCJbAppendString(ctx.js, "real_pkt");
1157  }
1158  SCJbClose(ctx.js);
1159 
1160  SCJbOpenObject(ctx.js, "match_policy");
1161  SCJbOpenArray(ctx.js, "actions");
1162  if (s->action & ACTION_ALERT) {
1163  SCJbAppendString(ctx.js, "alert");
1164  }
1165  if (s->action & ACTION_DROP) {
1166  SCJbAppendString(ctx.js, "drop");
1167  }
1168  if (s->action & ACTION_REJECT) {
1169  SCJbAppendString(ctx.js, "reject");
1170  }
1171  if (s->action & ACTION_REJECT_DST) {
1172  SCJbAppendString(ctx.js, "reject_dst");
1173  }
1174  if (s->action & ACTION_REJECT_BOTH) {
1175  SCJbAppendString(ctx.js, "reject_both");
1176  }
1177  if (s->action & ACTION_CONFIG) {
1178  SCJbAppendString(ctx.js, "config");
1179  }
1180  if (s->action & ACTION_PASS) {
1181  SCJbAppendString(ctx.js, "pass");
1182  }
1183  if (s->action & ACTION_ACCEPT) {
1184  SCJbAppendString(ctx.js, "accept");
1185  }
1186  SCJbClose(ctx.js);
1187 
1188  if (s->action_scope == ACTION_SCOPE_AUTO) {
1189  enum SignaturePropertyFlowAction flow_action = signature_properties[s->type].flow_action;
1190  switch (flow_action) {
1191  case SIG_PROP_FLOW_ACTION_PACKET:
1192  SCJbSetString(ctx.js, "scope", "packet");
1193  break;
1194  case SIG_PROP_FLOW_ACTION_FLOW:
1195  SCJbSetString(ctx.js, "scope", "flow");
1196  break;
1197  case SIG_PROP_FLOW_ACTION_FLOW_IF_STATEFUL:
1198  SCJbSetString(ctx.js, "scope", "flow_if_stateful");
1199  break;
1200  }
1201  } else {
1202  enum ActionScope as = s->action_scope;
1203  switch (as) {
1204  case ACTION_SCOPE_PACKET:
1205  SCJbSetString(ctx.js, "scope", "packet");
1206  break;
1207  case ACTION_SCOPE_FLOW:
1208  SCJbSetString(ctx.js, "scope", "flow");
1209  break;
1210  case ACTION_SCOPE_HOOK:
1211  SCJbSetString(ctx.js, "scope", "hook");
1212  break;
1213  case ACTION_SCOPE_TX:
1214  SCJbSetString(ctx.js, "scope", "tx");
1215  break;
1216  case ACTION_SCOPE_AUTO: /* should be unreachable */
1217  break;
1218  }
1219  }
1220  SCJbClose(ctx.js);
1221 
1222  switch (s->type) {
1223  case SIG_TYPE_NOT_SET:
1224  SCJbSetString(ctx.js, "type", "unset");
1225  break;
1226  case SIG_TYPE_IPONLY:
1227  SCJbSetString(ctx.js, "type", "ip_only");
1228  break;
1229  case SIG_TYPE_LIKE_IPONLY:
1230  SCJbSetString(ctx.js, "type", "like_ip_only");
1231  break;
1232  case SIG_TYPE_PDONLY:
1233  SCJbSetString(ctx.js, "type", "pd_only");
1234  break;
1235  case SIG_TYPE_DEONLY:
1236  SCJbSetString(ctx.js, "type", "de_only");
1237  break;
1238  case SIG_TYPE_PKT:
1239  SCJbSetString(ctx.js, "type", "pkt");
1240  break;
1241  case SIG_TYPE_PKT_STREAM:
1242  SCJbSetString(ctx.js, "type", "pkt_stream");
1243  break;
1244  case SIG_TYPE_STREAM:
1245  SCJbSetString(ctx.js, "type", "stream");
1246  break;
1247  case SIG_TYPE_APPLAYER:
1248  SCJbSetString(ctx.js, "type", "app_layer");
1249  break;
1250  case SIG_TYPE_APP_TX:
1251  SCJbSetString(ctx.js, "type", "app_tx");
1252  break;
1253  case SIG_TYPE_MAX:
1254  SCJbSetString(ctx.js, "type", "error");
1255  break;
1256  }
1257 
1258  // dependencies object and its subfields only logged if we have values
1259  if (s->init_data->is_rule_state_dependant) {
1260  SCJbOpenObject(ctx.js, "dependencies");
1261  SCJbOpenObject(ctx.js, "flowbits");
1262  SCJbOpenObject(ctx.js, "upstream");
1263  if (s->init_data->rule_state_dependant_sids_size > 0) {
1264  SCJbOpenObject(ctx.js, "state_modifying_rules");
1265  SCJbOpenArray(ctx.js, "sids");
1266  for (uint32_t i = 0; i < s->init_data->rule_state_dependant_sids_idx; i++) {
1267  SCJbAppendUint(ctx.js, s->init_data->rule_state_dependant_sids_array[i]);
1268  }
1269  SCJbClose(ctx.js); // sids
1270  SCJbOpenArray(ctx.js, "names");
1271  for (uint32_t i = 0; i < s->init_data->rule_state_flowbits_ids_size - 1; i++) {
1272  if (s->init_data->rule_state_flowbits_ids_array[i] != 0) {
1273  SCJbAppendString(ctx.js,
1274  VarNameStoreSetupLookup(s->init_data->rule_state_flowbits_ids_array[i],
1275  VAR_TYPE_FLOW_BIT));
1276  }
1277  }
1278  SCJbClose(ctx.js); // names
1279  SCJbClose(ctx.js); // state_modifying_rules
1280  }
1281  SCJbClose(ctx.js); // upstream
1282  SCJbClose(ctx.js); // flowbits
1283  SCJbClose(ctx.js); // dependencies
1284  }
1285 
1286  SCJbOpenArray(ctx.js, "flags");
1287  if (s->flags & SIG_FLAG_SRC_ANY) {
1288  SCJbAppendString(ctx.js, "src_any");
1289  }
1290  if (s->flags & SIG_FLAG_DST_ANY) {
1291  SCJbAppendString(ctx.js, "dst_any");
1292  }
1293  if (s->flags & SIG_FLAG_SP_ANY) {
1294  SCJbAppendString(ctx.js, "sp_any");
1295  }
1296  if (s->flags & SIG_FLAG_DP_ANY) {
1297  SCJbAppendString(ctx.js, "dp_any");
1298  }
1299  if ((s->action & ACTION_ALERT) == 0) {
1300  SCJbAppendString(ctx.js, "noalert");
1301  }
1302  if (s->flags & SIG_FLAG_DSIZE) {
1303  SCJbAppendString(ctx.js, "dsize");
1304  }
1305  if (s->flags & SIG_FLAG_APPLAYER) {
1306  SCJbAppendString(ctx.js, "applayer");
1307  }
1308  if (s->flags & SIG_FLAG_REQUIRE_PACKET) {
1309  SCJbAppendString(ctx.js, "need_packet");
1310  }
1311  if (s->flags & SIG_FLAG_REQUIRE_STREAM) {
1312  SCJbAppendString(ctx.js, "need_stream");
1313  }
1314  if (s->flags & SIG_FLAG_MPM_NEG) {
1315  SCJbAppendString(ctx.js, "negated_mpm");
1316  }
1317  if (s->flags & SIG_FLAG_FLUSH) {
1318  SCJbAppendString(ctx.js, "flush");
1319  }
1320  if (s->flags & SIG_FLAG_REQUIRE_FLOWVAR) {
1321  SCJbAppendString(ctx.js, "need_flowvar");
1322  }
1323  if (s->flags & SIG_FLAG_FILESTORE) {
1324  SCJbAppendString(ctx.js, "filestore");
1325  }
1326  if (s->flags & SIG_FLAG_TOSERVER) {
1327  SCJbAppendString(ctx.js, "toserver");
1328  }
1329  if (s->flags & SIG_FLAG_TOCLIENT) {
1330  SCJbAppendString(ctx.js, "toclient");
1331  }
1332  if (s->flags & SIG_FLAG_TLSSTORE) {
1333  SCJbAppendString(ctx.js, "tlsstore");
1334  }
1335  if (s->flags & SIG_FLAG_BYPASS) {
1336  SCJbAppendString(ctx.js, "bypass");
1337  }
1338  if (s->flags & SIG_FLAG_PREFILTER) {
1339  SCJbAppendString(ctx.js, "prefilter");
1340  }
1341  if (s->flags & SIG_FLAG_SRC_IS_TARGET) {
1342  SCJbAppendString(ctx.js, "src_is_target");
1343  }
1344  if (s->flags & SIG_FLAG_DEST_IS_TARGET) {
1345  SCJbAppendString(ctx.js, "dst_is_target");
1346  }
1347  SCJbClose(ctx.js);
1348 
1349  const DetectEnginePktInspectionEngine *pkt_mpm = NULL;
1350  const DetectEngineAppInspectionEngine *app_mpm = NULL;
1351 
1352  SCJbOpenArray(ctx.js, "pkt_engines");
1353  const DetectEnginePktInspectionEngine *pkt = s->pkt_inspect;
1354  for ( ; pkt != NULL; pkt = pkt->next) {
1355  const char *name = DetectEngineBufferTypeGetNameById(de_ctx, pkt->sm_list);
1356  if (name == NULL) {
1357  switch (pkt->sm_list) {
1358  case DETECT_SM_LIST_PMATCH:
1359  name = "payload";
1360  break;
1361  case DETECT_SM_LIST_MATCH:
1362  name = "packet";
1363  break;
1364  default:
1365  name = "unknown";
1366  break;
1367  }
1368  }
1369  SCJbStartObject(ctx.js);
1370  SCJbSetString(ctx.js, "name", name);
1371  SCJbSetBool(ctx.js, "is_mpm", pkt->mpm);
1372  if (pkt->v1.transforms != NULL) {
1373  SCJbOpenArray(ctx.js, "transforms");
1374  for (int t = 0; t < pkt->v1.transforms->cnt; t++) {
1375  SCJbStartObject(ctx.js);
1376  SCJbSetString(ctx.js, "name",
1377  sigmatch_table[pkt->v1.transforms->transforms[t].transform].name);
1378  SCJbClose(ctx.js);
1379  }
1380  SCJbClose(ctx.js);
1381  }
1382  DumpMatches(&ctx, ctx.js, pkt->smd);
1383  SCJbClose(ctx.js);
1384  if (pkt->mpm) {
1385  pkt_mpm = pkt;
1386  }
1387  }
1388  SCJbClose(ctx.js);
1389  SCJbOpenArray(ctx.js, "frame_engines");
1390  const DetectEngineFrameInspectionEngine *frame = s->frame_inspect;
1391  for (; frame != NULL; frame = frame->next) {
1392  const char *name = DetectEngineBufferTypeGetNameById(de_ctx, frame->sm_list);
1393  SCJbStartObject(ctx.js);
1394  SCJbSetString(ctx.js, "name", name);
1395  SCJbSetBool(ctx.js, "is_mpm", frame->mpm);
1396  if (frame->v1.transforms != NULL) {
1397  SCJbOpenArray(ctx.js, "transforms");
1398  for (int t = 0; t < frame->v1.transforms->cnt; t++) {
1399  SCJbStartObject(ctx.js);
1400  SCJbSetString(ctx.js, "name",
1401  sigmatch_table[frame->v1.transforms->transforms[t].transform].name);
1402  SCJbClose(ctx.js);
1403  }
1404  SCJbClose(ctx.js);
1405  }
1406  DumpMatches(&ctx, ctx.js, frame->smd);
1407  SCJbClose(ctx.js);
1408  }
1409  SCJbClose(ctx.js);
1410 
1411  if (s->init_data->init_flags & SIG_FLAG_INIT_STATE_MATCH) {
1412  bool has_stream = false;
1413  bool has_client_body_mpm = false;
1414  bool has_file_data_mpm = false;
1415 
1416  SCJbOpenArray(ctx.js, "engines");
1417  const DetectEngineAppInspectionEngine *app = s->app_inspect;
1418  for ( ; app != NULL; app = app->next) {
1419  const char *name = DetectEngineBufferTypeGetNameById(de_ctx, app->sm_list);
1420  if (name == NULL) {
1421  switch (app->sm_list) {
1422  case DETECT_SM_LIST_PMATCH:
1423  name = "stream";
1424  break;
1425  default:
1426  name = "unknown";
1427  break;
1428  }
1429  }
1430 
1431  if (app->sm_list == DETECT_SM_LIST_PMATCH && !app->mpm) {
1432  has_stream = true;
1433  } else if (app->mpm && strcmp(name, "http_client_body") == 0) {
1434  has_client_body_mpm = true;
1435  } else if (app->mpm && strcmp(name, "file_data") == 0) {
1436  has_file_data_mpm = true;
1437  }
1438 
1439  SCJbStartObject(ctx.js);
1440  SCJbSetString(ctx.js, "name", name);
1441  const char *direction = app->dir == 0 ? "toserver" : "toclient";
1442  SCJbSetString(ctx.js, "direction", direction);
1443  SCJbSetBool(ctx.js, "is_mpm", app->mpm);
1444  SCJbSetString(ctx.js, "app_proto", AppProtoToString(app->alproto));
1445  SCJbSetUint(ctx.js, "progress", app->progress);
1446 
1447  if (app->v2.transforms != NULL) {
1448  SCJbOpenArray(ctx.js, "transforms");
1449  for (int t = 0; t < app->v2.transforms->cnt; t++) {
1450  SCJbStartObject(ctx.js);
1451  SCJbSetString(ctx.js, "name",
1452  sigmatch_table[app->v2.transforms->transforms[t].transform].name);
1453  SCJbClose(ctx.js);
1454  }
1455  SCJbClose(ctx.js);
1456  }
1457  DumpMatches(&ctx, ctx.js, app->smd);
1458  SCJbClose(ctx.js);
1459  if (app->mpm) {
1460  app_mpm = app;
1461  }
1462  }
1463  SCJbClose(ctx.js);
1464 
1465  if (has_stream && has_client_body_mpm)
1466  AnalyzerNote(&ctx, (char *)"mpm in http_client_body combined with stream match leads to stream buffering");
1467  if (has_stream && has_file_data_mpm)
1468  AnalyzerNote(&ctx, (char *)"mpm in file_data combined with stream match leads to stream buffering");
1469  }
1470 
1471  SCJbOpenObject(ctx.js, "lists");
1472  for (int i = 0; i < DETECT_SM_LIST_MAX; i++) {
1473  if (s->sm_arrays[i] != NULL) {
1474  SCJbOpenObject(ctx.js, DetectListToHumanString(i));
1475  DumpMatches(&ctx, ctx.js, s->sm_arrays[i]);
1476  SCJbClose(ctx.js);
1477  }
1478  }
1479  SCJbClose(ctx.js);
1480 
1481  if (pkt_mpm || app_mpm) {
1482  SCJbOpenObject(ctx.js, "mpm");
1483 
1484  int mpm_list = pkt_mpm ? DETECT_SM_LIST_PMATCH : app_mpm->sm_list;
1485  const char *name;
1486  if (mpm_list < DETECT_SM_LIST_DYNAMIC_START)
1487  name = DetectListToHumanString(mpm_list);
1488  else
1489  name = DetectEngineBufferTypeGetNameById(de_ctx, mpm_list);
1490  SCJbSetString(ctx.js, "buffer", name);
1491 
1492  SigMatchData *smd = pkt_mpm ? pkt_mpm->smd : app_mpm->smd;
1493  if (smd == NULL && mpm_list == DETECT_SM_LIST_PMATCH) {
1494  smd = s->sm_arrays[mpm_list];
1495  }
1496  do {
1497  switch (smd->type) {
1498  case DETECT_CONTENT: {
1499  const DetectContentData *cd = (const DetectContentData *)smd->ctx;
1500  if (cd->flags & DETECT_CONTENT_MPM) {
1501  DumpContent(ctx.js, cd);
1502  }
1503  break;
1504  }
1505  }
1506 
1507  if (smd->is_last)
1508  break;
1509  smd++;
1510  } while (1);
1511  SCJbClose(ctx.js);
1512  } else if (s->init_data->prefilter_sm) {
1513  SCJbOpenObject(ctx.js, "prefilter");
1514  int prefilter_list = SigMatchListSMBelongsTo(s, s->init_data->prefilter_sm);
1515  const char *name;
1516  if (prefilter_list < DETECT_SM_LIST_DYNAMIC_START)
1517  name = DetectListToHumanString(prefilter_list);
1518  else
1519  name = DetectEngineBufferTypeGetNameById(de_ctx, prefilter_list);
1520  SCJbSetString(ctx.js, "buffer", name);
1521  const char *mname = sigmatch_table[s->init_data->prefilter_sm->type].name;
1522  SCJbSetString(ctx.js, "name", mname);
1523  SCJbClose(ctx.js);
1524  }
1525 
1526  if (ctx.js_warnings) {
1527  SCJbClose(ctx.js_warnings);
1528  SCJbSetObject(ctx.js, "warnings", ctx.js_warnings);
1529  SCJbFree(ctx.js_warnings);
1530  ctx.js_warnings = NULL;
1531  }
1532  if (ctx.js_notes) {
1533  SCJbClose(ctx.js_notes);
1534  SCJbSetObject(ctx.js, "notes", ctx.js_notes);
1535  SCJbFree(ctx.js_notes);
1536  ctx.js_notes = NULL;
1537  }
1538  SCJbClose(ctx.js);
1539 
1540  const char *filename = "rules.json";
1541  const char *log_dir = SCConfigGetLogDirectory();
1542  char json_path[PATH_MAX] = "";
1543  snprintf(json_path, sizeof(json_path), "%s/%s%s", log_dir,
1544  de_ctx->ea->file_prefix ? de_ctx->ea->file_prefix : "", filename);
1545 
1546  SCMutexLock(&g_rules_analyzer_write_m);
1547  FILE *fp = fopen(json_path, "a");
1548  if (fp != NULL) {
1549  fwrite(SCJbPtr(ctx.js), SCJbLen(ctx.js), 1, fp);
1550  fprintf(fp, "\n");
1551  fclose(fp);
1552  }
1553  SCMutexUnlock(&g_rules_analyzer_write_m);
1554  SCJbFree(ctx.js);
1555  SCReturn;
1556 }
1557 
1558 void DumpPatterns(DetectEngineCtx *de_ctx)
1559 {
1560  if (de_ctx->pattern_hash_table == NULL)
1561  return;
1562 
1563  SCJsonBuilder *root_jb = SCJbNewObject();
1564  SCJsonBuilder *arrays[de_ctx->buffer_type_id];
1565  memset(&arrays, 0, sizeof(SCJsonBuilder *) * de_ctx->buffer_type_id);
1566 
1567  SCJbOpenArray(root_jb, "buffers");
1568 
1569  for (HashListTableBucket *htb = HashListTableGetListHead(de_ctx->pattern_hash_table);
1570  htb != NULL; htb = HashListTableGetListNext(htb)) {
1571  char str[1024] = "";
1572  DetectPatternTracker *p = HashListTableGetListData(htb);
1573  DetectContentPatternPrettyPrint(p->cd->content, p->cd->content_len, str, sizeof(str));
1574 
1575  SCJsonBuilder *jb = arrays[p->sm_list];
1576  if (arrays[p->sm_list] == NULL) {
1577  jb = arrays[p->sm_list] = SCJbNewObject();
1578  const char *name;
1579  if (p->sm_list < DETECT_SM_LIST_DYNAMIC_START)
1580  name = DetectListToHumanString(p->sm_list);
1581  else
1582  name = DetectEngineBufferTypeGetNameById(de_ctx, p->sm_list);
1583  SCJbSetString(jb, "name", name);
1584  SCJbSetUint(jb, "list_id", p->sm_list);
1585 
1586  SCJbOpenArray(jb, "patterns");
1587  }
1588 
1589  SCJbStartObject(jb);
1590  SCJbSetString(jb, "pattern", str);
1591  SCJbSetUint(jb, "patlen", p->cd->content_len);
1592  SCJbSetUint(jb, "cnt", p->cnt);
1593  SCJbSetUint(jb, "mpm", p->mpm);
1594  SCJbOpenObject(jb, "flags");
1595  SCJbSetBool(jb, "nocase", p->cd->flags & DETECT_CONTENT_NOCASE);
1596  SCJbSetBool(jb, "negated", p->cd->flags & DETECT_CONTENT_NEGATED);
1597  SCJbSetBool(jb, "depth", p->cd->flags & DETECT_CONTENT_DEPTH);
1598  SCJbSetBool(jb, "offset", p->cd->flags & DETECT_CONTENT_OFFSET);
1599  SCJbSetBool(jb, "endswith", p->cd->flags & DETECT_CONTENT_ENDS_WITH);
1600  SCJbClose(jb);
1601  SCJbClose(jb);
1602  }
1603 
1604  for (uint32_t i = 0; i < de_ctx->buffer_type_id; i++) {
1605  SCJsonBuilder *jb = arrays[i];
1606  if (jb == NULL)
1607  continue;
1608 
1609  SCJbClose(jb); // array
1610  SCJbClose(jb); // object
1611 
1612  SCJbAppendObject(root_jb, jb);
1613  SCJbFree(jb);
1614  }
1615  SCJbClose(root_jb);
1616  SCJbClose(root_jb);
1617 
1618  const char *filename = "patterns.json";
1619  const char *log_dir = SCConfigGetLogDirectory();
1620  char json_path[PATH_MAX] = "";
1621  snprintf(json_path, sizeof(json_path), "%s/%s%s", log_dir,
1622  de_ctx->ea->file_prefix ? de_ctx->ea->file_prefix : "", filename);
1623 
1624  SCMutexLock(&g_rules_analyzer_write_m);
1625  FILE *fp = fopen(json_path, "a");
1626  if (fp != NULL) {
1627  fwrite(SCJbPtr(root_jb), SCJbLen(root_jb), 1, fp);
1628  fprintf(fp, "\n");
1629  fclose(fp);
1630  }
1631  SCMutexUnlock(&g_rules_analyzer_write_m);
1632  SCJbFree(root_jb);
1633 
1634  HashListTableFree(de_ctx->pattern_hash_table);
1635  de_ctx->pattern_hash_table = NULL;
1636 }
1637 
1638 static void EngineAnalysisItemsReset(EngineAnalysisCtx *ea_ctx)
1639 {
1640  for (size_t i = 0; i < ARRAY_SIZE(analyzer_items); i++) {
1641  ea_ctx->analyzer_items[i].item_seen = false;
1642  }
1643 }
1644 
1645 static void EngineAnalysisItemsInit(EngineAnalysisCtx *ea_ctx)
1646 {
1647  if (ea_ctx->analyzer_initialized) {
1648  EngineAnalysisItemsReset(ea_ctx);
1649  return;
1650  }
1651 
1652  ea_ctx->exposed_item_seen_list[0].bufname = "http_method";
1653  ea_ctx->exposed_item_seen_list[1].bufname = "file_data";
1654  ea_ctx->analyzer_items = SCCalloc(1, sizeof(analyzer_items));
1655  if (!ea_ctx->analyzer_items) {
1656  FatalError("Unable to allocate analysis scratch pad");
1657  }
1658  memset(ea_ctx->analyzer_item_map, -1, sizeof(ea_ctx->analyzer_item_map));
1659 
1660  for (size_t i = 0; i < ARRAY_SIZE(analyzer_items); i++) {
1661  ea_ctx->analyzer_items[i] = analyzer_items[i];
1662  DetectEngineAnalyzerItems *analyzer_item = &ea_ctx->analyzer_items[i];
1663 
1664  int item_id = DetectBufferTypeGetByName(analyzer_item->item_name);
1665  DEBUG_VALIDATE_BUG_ON(item_id < 0 || item_id > UINT16_MAX);
1666  analyzer_item->item_id = (uint16_t)item_id;
1667  if (analyzer_item->item_id == -1) {
1668  /* Mismatch between the analyzer_items array and what's supported */
1669  FatalError("unable to initialize engine-analysis table: detect buffer \"%s\" not "
1670  "recognized.",
1671  analyzer_item->item_name);
1672  }
1673  analyzer_item->item_seen = false;
1674 
1675  if (analyzer_item->export_item_seen) {
1676  for (size_t k = 0; k < ARRAY_SIZE(ea_ctx->exposed_item_seen_list); k++) {
1677  if (0 ==
1678  strcmp(ea_ctx->exposed_item_seen_list[k].bufname, analyzer_item->item_name))
1679  ea_ctx->exposed_item_seen_list[k].item_seen_ptr = &analyzer_item->item_seen;
1680  }
1681  }
1682  ea_ctx->analyzer_item_map[analyzer_item->item_id] = (int16_t)i;
1683  }
1684 
1685  ea_ctx->analyzer_initialized = true;
1686 }
1687 
1688 /**
1689  * \brief Prints analysis of loaded rules.
1690  *
1691  * Warns if potential rule issues are detected. For example,
1692  * warns if a rule uses a construct that may perform poorly,
1693  * e.g. pcre without content or with http_method content only;
1694  * warns if a rule uses a construct that may not be consistent with intent,
1695  * e.g. client side ports only, http and content without any http_* modifiers, etc.
1696  *
1697  * \param s Pointer to the signature.
1698  */
1699 void EngineAnalysisRules(const DetectEngineCtx *de_ctx,
1700  const Signature *s, const char *line)
1701 {
1702  uint32_t rule_bidirectional = 0;
1703  uint32_t rule_pcre = 0;
1704  uint32_t rule_pcre_http = 0;
1705  uint32_t rule_content = 0;
1706  uint32_t rule_flow = 0;
1707  uint32_t rule_flags = 0;
1708  uint32_t rule_flow_toserver = 0;
1709  uint32_t rule_flow_toclient = 0;
1710  uint32_t rule_flow_nostream = 0;
1711  uint32_t rule_ipv4_only = 0;
1712  uint32_t rule_ipv6_only = 0;
1713  uint32_t rule_flowbits = 0;
1714  uint32_t rule_flowint = 0;
1715  uint32_t rule_content_http = 0;
1716  uint32_t rule_content_offset_depth = 0;
1717  int32_t list_id = 0;
1718  uint32_t rule_warning = 0;
1719  uint32_t stream_buf = 0;
1720  uint32_t packet_buf = 0;
1721  uint32_t file_store = 0;
1722  uint32_t warn_pcre_no_content = 0;
1723  uint32_t warn_pcre_http_content = 0;
1724  uint32_t warn_pcre_http = 0;
1725  uint32_t warn_content_http_content = 0;
1726  uint32_t warn_content_http = 0;
1727  uint32_t warn_tcp_no_flow = 0;
1728  uint32_t warn_client_ports = 0;
1729  uint32_t warn_direction = 0;
1730  uint32_t warn_method_toclient = 0;
1731  uint32_t warn_method_serverbody = 0;
1732  uint32_t warn_pcre_method = 0;
1733  uint32_t warn_encoding_norm_http_buf = 0;
1734  uint32_t warn_file_store_not_present = 0;
1735  uint32_t warn_offset_depth_pkt_stream = 0;
1736  uint32_t warn_offset_depth_alproto = 0;
1737  uint32_t warn_non_alproto_fp_for_alproto_sig = 0;
1738  uint32_t warn_no_direction = 0;
1739  uint32_t warn_both_direction = 0;
1740 
1741  EngineAnalysisItemsInit(de_ctx->ea);
1742 
1743  bool *http_method_item_seen_ptr = de_ctx->ea->exposed_item_seen_list[0].item_seen_ptr;
1744  bool *http_server_body_item_seen_ptr = de_ctx->ea->exposed_item_seen_list[1].item_seen_ptr;
1745 
1746  if (s->init_data->init_flags & SIG_FLAG_INIT_BIDIREC) {
1747  rule_bidirectional = 1;
1748  }
1749 
1750  if (s->flags & SIG_FLAG_REQUIRE_PACKET) {
1751  packet_buf += 1;
1752  }
1753  if (s->flags & SIG_FLAG_FILESTORE) {
1754  file_store += 1;
1755  }
1756  if (s->flags & SIG_FLAG_REQUIRE_STREAM) {
1757  stream_buf += 1;
1758  }
1759 
1760  if (s->proto && s->proto->flags & DETECT_PROTO_IPV4) {
1761  rule_ipv4_only += 1;
1762  }
1763  if (s->proto && s->proto->flags & DETECT_PROTO_IPV6) {
1764  rule_ipv6_only += 1;
1765  }
1766 
1767  for (list_id = 0; list_id < DETECT_SM_LIST_MAX; list_id++) {
1768  SigMatch *sm = NULL;
1769  for (sm = s->init_data->smlists[list_id]; sm != NULL; sm = sm->next) {
1770  int16_t item_slot = de_ctx->ea->analyzer_item_map[list_id];
1771  if (sm->type == DETECT_PCRE) {
1772  if (item_slot == -1) {
1773  rule_pcre++;
1774  continue;
1775  }
1776 
1777  rule_pcre_http++;
1778  de_ctx->ea->analyzer_items[item_slot].item_seen = true;
1779  } else if (sm->type == DETECT_CONTENT) {
1780  if (item_slot == -1) {
1781  rule_content++;
1782  if (list_id == DETECT_SM_LIST_PMATCH) {
1783  DetectContentData *cd = (DetectContentData *)sm->ctx;
1784  if (cd->flags & (DETECT_CONTENT_OFFSET | DETECT_CONTENT_DEPTH)) {
1785  rule_content_offset_depth++;
1786  }
1787  }
1788  continue;
1789  }
1790 
1791  rule_content_http++;
1792  de_ctx->ea->analyzer_items[item_slot].item_seen = true;
1793 
1794  if (de_ctx->ea->analyzer_items[item_slot].check_encoding_match) {
1795  DetectContentData *cd = (DetectContentData *)sm->ctx;
1796  if (cd != NULL &&
1797  PerCentEncodingMatch(de_ctx->ea, cd->content, cd->content_len) > 0) {
1798  warn_encoding_norm_http_buf += 1;
1799  }
1800  }
1801  }
1802  else if (sm->type == DETECT_FLOW) {
1803  rule_flow += 1;
1804  if ((s->flags & SIG_FLAG_TOSERVER) && !(s->flags & SIG_FLAG_TOCLIENT)) {
1805  rule_flow_toserver = 1;
1806  }
1807  else if ((s->flags & SIG_FLAG_TOCLIENT) && !(s->flags & SIG_FLAG_TOSERVER)) {
1808  rule_flow_toclient = 1;
1809  }
1810  DetectFlowData *fd = (DetectFlowData *)sm->ctx;
1811  if (fd != NULL) {
1812  if (fd->flags & DETECT_FLOW_FLAG_NOSTREAM)
1813  rule_flow_nostream = 1;
1814  }
1815  }
1816  else if (sm->type == DETECT_FLOWBITS) {
1817  if (list_id == DETECT_SM_LIST_MATCH) {
1818  rule_flowbits += 1;
1819  }
1820  }
1821  else if (sm->type == DETECT_FLOWINT) {
1822  if (list_id == DETECT_SM_LIST_MATCH) {
1823  rule_flowint += 1;
1824  }
1825  }
1826  else if (sm->type == DETECT_FLAGS) {
1827  if (sm->ctx != NULL) {
1828  rule_flags = 1;
1829  }
1830  }
1831  } /* for (sm = s->init_data->smlists[list_id]; sm != NULL; sm = sm->next) */
1832 
1833  } /* for ( ; list_id < DETECT_SM_LIST_MAX; list_id++) */
1834 
1835  if (file_store && !SCRequiresFeature("output::file-store")) {
1836  rule_warning += 1;
1837  warn_file_store_not_present = 1;
1838  }
1839 
1840  if (rule_pcre > 0 && rule_content == 0 && rule_content_http == 0) {
1841  rule_warning += 1;
1842  warn_pcre_no_content = 1;
1843  }
1844 
1845  if (rule_content_http > 0 && rule_pcre > 0 && rule_pcre_http == 0) {
1846  rule_warning += 1;
1847  warn_pcre_http_content = 1;
1848  } else if (s->alproto == ALPROTO_HTTP1 && rule_pcre > 0 && rule_pcre_http == 0) {
1849  rule_warning += 1;
1850  warn_pcre_http = 1;
1851  }
1852 
1853  if (rule_content > 0 && rule_content_http > 0) {
1854  rule_warning += 1;
1855  warn_content_http_content = 1;
1856  }
1857  if (s->alproto == ALPROTO_HTTP1 && rule_content > 0 && rule_content_http == 0) {
1858  rule_warning += 1;
1859  warn_content_http = 1;
1860  }
1861  if (rule_content == 1) {
1862  //todo: warning if content is weak, separate warning for pcre + weak content
1863  }
1864  if (rule_flow == 0 && rule_flags == 0 && !(s->init_data->proto.flags & DETECT_PROTO_ANY) &&
1865  DetectProtoContainsProto(&s->init_data->proto, IPPROTO_TCP) &&
1866  (rule_content || rule_content_http || rule_pcre || rule_pcre_http || rule_flowbits ||
1867  rule_flowint)) {
1868  rule_warning += 1;
1869  warn_tcp_no_flow = 1;
1870  }
1871  if (rule_flow && !rule_bidirectional && (rule_flow_toserver || rule_flow_toclient)
1872  && !((s->flags & SIG_FLAG_SP_ANY) && (s->flags & SIG_FLAG_DP_ANY))) {
1873  if (((s->flags & SIG_FLAG_TOSERVER) && !(s->flags & SIG_FLAG_SP_ANY) && (s->flags & SIG_FLAG_DP_ANY))
1874  || ((s->flags & SIG_FLAG_TOCLIENT) && !(s->flags & SIG_FLAG_DP_ANY) && (s->flags & SIG_FLAG_SP_ANY))) {
1875  rule_warning += 1;
1876  warn_client_ports = 1;
1877  }
1878  }
1879  if (rule_flow && rule_bidirectional && (rule_flow_toserver || rule_flow_toclient)) {
1880  rule_warning += 1;
1881  warn_direction = 1;
1882  }
1883 
1884  if (*http_method_item_seen_ptr) {
1885  if (rule_flow && rule_flow_toclient) {
1886  rule_warning += 1;
1887  warn_method_toclient = 1;
1888  }
1889  if (*http_server_body_item_seen_ptr) {
1890  rule_warning += 1;
1891  warn_method_serverbody = 1;
1892  }
1893  if (rule_content == 0 && rule_content_http == 0 && (rule_pcre > 0 || rule_pcre_http > 0)) {
1894  rule_warning += 1;
1895  warn_pcre_method = 1;
1896  }
1897  }
1898  if (rule_content_offset_depth > 0 && stream_buf && packet_buf) {
1899  rule_warning += 1;
1900  warn_offset_depth_pkt_stream = 1;
1901  }
1902  if (rule_content_offset_depth > 0 && !stream_buf && packet_buf && s->alproto != ALPROTO_UNKNOWN) {
1903  rule_warning += 1;
1904  warn_offset_depth_alproto = 1;
1905  }
1906  if (s->init_data->mpm_sm != NULL && s->alproto == ALPROTO_HTTP1 &&
1907  s->init_data->mpm_sm_list == DETECT_SM_LIST_PMATCH) {
1908  rule_warning += 1;
1909  warn_non_alproto_fp_for_alproto_sig = 1;
1910  }
1911 
1912  if ((s->flags & (SIG_FLAG_TOSERVER|SIG_FLAG_TOCLIENT)) == 0) {
1913  warn_no_direction += 1;
1914  rule_warning += 1;
1915  }
1916 
1917  /* No warning about direction for ICMP protos */
1918  if (!(DetectProtoContainsProto(&s->init_data->proto, IPPROTO_ICMPV6) &&
1919  DetectProtoContainsProto(&s->init_data->proto, IPPROTO_ICMP))) {
1920  if ((s->flags & (SIG_FLAG_TOSERVER|SIG_FLAG_TOCLIENT)) == (SIG_FLAG_TOSERVER|SIG_FLAG_TOCLIENT)) {
1921  warn_both_direction += 1;
1922  rule_warning += 1;
1923  }
1924  }
1925 
1926  if (!rule_warnings_only || (rule_warnings_only && rule_warning > 0)) {
1927  FILE *fp = de_ctx->ea->rule_engine_analysis_fp;
1928  fprintf(fp, "== Sid: %u ==\n", s->id);
1929  fprintf(fp, "%s\n", line);
1930 
1931  switch (s->type) {
1932  case SIG_TYPE_NOT_SET:
1933  break;
1934  case SIG_TYPE_IPONLY:
1935  fprintf(fp, " Rule is ip only.\n");
1936  break;
1937  case SIG_TYPE_LIKE_IPONLY:
1938  fprintf(fp, " Rule is like ip only.\n");
1939  break;
1940  case SIG_TYPE_PDONLY:
1941  fprintf(fp, " Rule is PD only.\n");
1942  break;
1943  case SIG_TYPE_DEONLY:
1944  fprintf(fp, " Rule is DE only.\n");
1945  break;
1946  case SIG_TYPE_PKT:
1947  fprintf(fp, " Rule is packet inspecting.\n");
1948  break;
1949  case SIG_TYPE_PKT_STREAM:
1950  fprintf(fp, " Rule is packet and stream inspecting.\n");
1951  break;
1952  case SIG_TYPE_STREAM:
1953  fprintf(fp, " Rule is stream inspecting.\n");
1954  break;
1955  case SIG_TYPE_APPLAYER:
1956  fprintf(fp, " Rule is app-layer inspecting.\n");
1957  break;
1958  case SIG_TYPE_APP_TX:
1959  fprintf(fp, " Rule is App-layer TX inspecting.\n");
1960  break;
1961  case SIG_TYPE_MAX:
1962  break;
1963  }
1964  if (rule_ipv6_only)
1965  fprintf(fp, " Rule is IPv6 only.\n");
1966  if (rule_ipv4_only)
1967  fprintf(fp, " Rule is IPv4 only.\n");
1968  if (packet_buf)
1969  fprintf(fp, " Rule matches on packets.\n");
1970  if (!rule_flow_nostream && stream_buf &&
1971  (rule_flow || rule_flowbits || rule_flowint || rule_content || rule_pcre)) {
1972  fprintf(fp, " Rule matches on reassembled stream.\n");
1973  }
1974  for(size_t i = 0; i < ARRAY_SIZE(analyzer_items); i++) {
1975  DetectEngineAnalyzerItems *ai = &de_ctx->ea->analyzer_items[i];
1976  if (ai->item_seen) {
1977  fprintf(fp, " Rule matches on %s buffer.\n", ai->display_name);
1978  }
1979  }
1980  if (s->alproto != ALPROTO_UNKNOWN) {
1981  fprintf(fp, " App layer protocol is %s.\n", AppProtoToString(s->alproto));
1982  }
1983  if (rule_content || rule_content_http || rule_pcre || rule_pcre_http) {
1984  fprintf(fp,
1985  " Rule contains %u content options, %u http content options, %u pcre "
1986  "options, and %u pcre options with http modifiers.\n",
1987  rule_content, rule_content_http, rule_pcre, rule_pcre_http);
1988  }
1989 
1990  /* print fast pattern info */
1991  if (s->init_data->prefilter_sm) {
1992  fprintf(fp, " Prefilter on: %s.\n",
1993  sigmatch_table[s->init_data->prefilter_sm->type].name);
1994  } else {
1995  EngineAnalysisRulesPrintFP(de_ctx, s);
1996  }
1997 
1998  /* this is where the warnings start */
1999  if (warn_pcre_no_content /*rule_pcre > 0 && rule_content == 0 && rule_content_http == 0*/) {
2000  fprintf(fp, " Warning: Rule uses pcre without a content option present.\n"
2001  " -Consider adding a content to improve performance of this "
2002  "rule.\n");
2003  }
2004  if (warn_pcre_http_content /*rule_content_http > 0 && rule_pcre > 0 && rule_pcre_http == 0*/) {
2005  fprintf(fp, " Warning: Rule uses content options with http_* and pcre options "
2006  "without http modifiers.\n"
2007  " -Consider adding http pcre modifier.\n");
2008  }
2009  else if (warn_pcre_http /*s->alproto == ALPROTO_HTTP1 && rule_pcre > 0 && rule_pcre_http == 0*/) {
2010  fprintf(fp, " Warning: Rule app layer protocol is http, but pcre options do not "
2011  "have http modifiers.\n"
2012  " -Consider adding http pcre modifiers.\n");
2013  }
2014  if (warn_content_http_content /*rule_content > 0 && rule_content_http > 0*/) {
2015  fprintf(fp,
2016  " Warning: Rule contains content with http_* and content without http_*.\n"
2017  " -Consider adding http content modifiers.\n");
2018  }
2019  if (warn_content_http /*s->alproto == ALPROTO_HTTP1 && rule_content > 0 && rule_content_http == 0*/) {
2020  fprintf(fp, " Warning: Rule app layer protocol is http, but content options do not "
2021  "have http_* modifiers.\n"
2022  " -Consider adding http content modifiers.\n");
2023  }
2024  if (rule_content == 1) {
2025  //todo: warning if content is weak, separate warning for pcre + weak content
2026  }
2027  if (warn_encoding_norm_http_buf) {
2028  fprintf(fp, " Warning: Rule may contain percent encoded content for a normalized "
2029  "http buffer match.\n");
2030  }
2031  if (warn_tcp_no_flow /*rule_flow == 0 && rule_flags == 0
2032  && !(s->proto.flags & DETECT_PROTO_ANY) && DetectProtoContainsProto(&s->proto, IPPROTO_TCP)*/) {
2033  fprintf(fp, " Warning: TCP rule without a flow or flags option.\n"
2034  " -Consider adding flow or flags to improve performance of "
2035  "this rule.\n");
2036  }
2037  if (warn_client_ports /*rule_flow && !rule_bidirectional && (rule_flow_toserver || rule_flow_toclient)
2038  && !((s->flags & SIG_FLAG_SP_ANY) && (s->flags & SIG_FLAG_DP_ANY)))
2039  if (((s->flags & SIG_FLAG_TOSERVER) && !(s->flags & SIG_FLAG_SP_ANY) && (s->flags & SIG_FLAG_DP_ANY))
2040  || ((s->flags & SIG_FLAG_TOCLIENT) && !(s->flags & SIG_FLAG_DP_ANY) && (s->flags & SIG_FLAG_SP_ANY))*/) {
2041  fprintf(fp,
2042  " Warning: Rule contains ports or port variables only on the client side.\n"
2043  " -Flow direction possibly inconsistent with rule.\n");
2044  }
2045  if (warn_direction /*rule_flow && rule_bidirectional && (rule_flow_toserver || rule_flow_toclient)*/) {
2046  fprintf(fp, " Warning: Rule is bidirectional and has a flow option with a specific "
2047  "direction.\n");
2048  }
2049  if (warn_method_toclient /*http_method_buf && rule_flow && rule_flow_toclient*/) {
2050  fprintf(fp, " Warning: Rule uses content or pcre for http_method with "
2051  "flow:to_client or from_server\n");
2052  }
2053  if (warn_method_serverbody /*http_method_buf && http_server_body_buf*/) {
2054  fprintf(fp, " Warning: Rule uses content or pcre for http_method with content or "
2055  "pcre for http_server_body.\n");
2056  }
2057  if (warn_pcre_method /*http_method_buf && rule_content == 0 && rule_content_http == 0
2058  && (rule_pcre > 0 || rule_pcre_http > 0)*/) {
2059  fprintf(fp, " Warning: Rule uses pcre with only a http_method content; possible "
2060  "performance issue.\n");
2061  }
2062  if (warn_offset_depth_pkt_stream) {
2063  fprintf(fp, " Warning: Rule has depth"
2064  "/offset with raw content keywords. Please note the "
2065  "offset/depth will be checked against both packet "
2066  "payloads and stream. If you meant to have the offset/"
2067  "depth checked against just the payload, you can update "
2068  "the signature as \"alert tcp-pkt...\"\n");
2069  }
2070  if (warn_offset_depth_alproto) {
2071  fprintf(fp,
2072  " Warning: Rule has "
2073  "offset/depth set along with a match on a specific "
2074  "app layer protocol - %d. This can lead to FNs if we "
2075  "have a offset/depth content match on a packet payload "
2076  "before we can detect the app layer protocol for the "
2077  "flow.\n",
2078  s->alproto);
2079  }
2080  if (warn_non_alproto_fp_for_alproto_sig) {
2081  fprintf(fp, " Warning: Rule app layer "
2082  "protocol is http, but the fast_pattern is set on the raw "
2083  "stream. Consider adding fast_pattern over a http "
2084  "buffer for increased performance.");
2085  }
2086  if (warn_no_direction) {
2087  fprintf(fp, " Warning: Rule has no direction indicator.\n");
2088  }
2089  if (warn_both_direction) {
2090  fprintf(fp, " Warning: Rule is inspecting both the request and the response.\n");
2091  }
2092  if (warn_file_store_not_present) {
2093  fprintf(fp, " Warning: Rule requires file-store but the output file-store is not "
2094  "enabled.\n");
2095  }
2096  if (rule_warning == 0) {
2097  fprintf(fp, " No warnings for this rule.\n");
2098  }
2099  fprintf(fp, "\n");
2100  }
2101 }
2102 
2103 #include "app-layer-parser.h"
2104 
2105 static void FirewallAddRulesForState(const DetectEngineCtx *de_ctx, const AppProto a,
2106  const uint8_t state, const uint8_t direction, RuleAnalyzer *ctx)
2107 {
2108  uint32_t accept_rules = 0;
2109  SCJbSetString(ctx->js, "policy", "drop:flow");
2110  SCJbOpenArray(ctx->js, "rules");
2111  for (Signature *s = de_ctx->sig_list; s != NULL; s = s->next) {
2112  if ((s->flags & SIG_FLAG_FIREWALL) == 0)
2113  break;
2114  if (s->type != SIG_TYPE_APP_TX)
2115  continue;
2116  if (s->alproto != a)
2117  continue;
2118 
2119  if (direction == STREAM_TOSERVER) {
2120  if (s->flags & SIG_FLAG_TOCLIENT) {
2121  continue;
2122  }
2123  } else {
2124  if (s->flags & SIG_FLAG_TOSERVER) {
2125  continue;
2126  }
2127  }
2128 
2129  if (s->app_progress_hook == state) {
2130  SCJbAppendString(ctx->js, s->sig_str);
2131  accept_rules += ((s->action & ACTION_ACCEPT) != 0);
2132  }
2133  }
2134  SCJbClose(ctx->js);
2135 
2136  if (accept_rules == 0) {
2137  AnalyzerWarning(ctx, (char *)"no accept rules for state, default policy will be applied");
2138  }
2139 }
2140 
2141 int FirewallAnalyzer(const DetectEngineCtx *de_ctx)
2142 {
2143  RuleAnalyzer ctx = { NULL, NULL, NULL };
2144  ctx.js = SCJbNewObject();
2145  if (ctx.js == NULL)
2146  return -1;
2147 
2148  SCJbOpenObject(ctx.js, "tables");
2149  SCJbOpenObject(ctx.js, "packet:filter");
2150  SCJbSetString(ctx.js, "policy", "drop:packet");
2151  SCJbOpenArray(ctx.js, "rules");
2152  uint32_t accept_rules = 0;
2153  uint32_t last_sid = 0;
2154  for (Signature *s = de_ctx->sig_list; s != NULL; s = s->next) {
2155  if ((s->flags & SIG_FLAG_FIREWALL) == 0)
2156  break;
2157  if (s->type != SIG_TYPE_PKT)
2158  continue;
2159  /* don't double list <> sigs */
2160  if (last_sid == s->id)
2161  continue;
2162  last_sid = s->id;
2163  SCJbAppendString(ctx.js, s->sig_str);
2164  accept_rules += ((s->action & ACTION_ACCEPT) != 0);
2165  }
2166  SCJbClose(ctx.js);
2167  if (accept_rules == 0) {
2168  AnalyzerWarning(&ctx,
2169  (char *)"no accept rules for \'packet:filter\', default policy will be applied");
2170  }
2171  if (ctx.js_warnings) {
2172  SCJbClose(ctx.js_warnings);
2173  SCJbSetObject(ctx.js, "warnings", ctx.js_warnings);
2174  SCJbFree(ctx.js_warnings);
2175  ctx.js_warnings = NULL;
2176  }
2177  SCJbClose(ctx.js); // packet_filter
2178 
2179  for (AppProto a = 0; a < g_alproto_max; a++) {
2180  if (!AppProtoIsValid(a))
2181  continue;
2182 
2183  // HACK not all protocols have named states yet
2184  const char *hack = AppLayerParserGetStateNameById(IPPROTO_TCP, a, 0, STREAM_TOSERVER);
2185  if (!hack)
2186  continue;
2187 
2188  SCJbOpenObject(ctx.js, AppProtoToString(a));
2189  const uint8_t complete_state_ts =
2190  (const uint8_t)AppLayerParserGetStateProgressCompletionStatus(a, STREAM_TOSERVER);
2191  for (uint8_t state = 0; state < complete_state_ts; state++) {
2192  const char *name =
2193  AppLayerParserGetStateNameById(IPPROTO_TCP, a, state, STREAM_TOSERVER);
2194  char table_name[128];
2195  snprintf(table_name, sizeof(table_name), "app:%s:%s", AppProtoToString(a), name);
2196  SCJbOpenObject(ctx.js, table_name);
2197  FirewallAddRulesForState(de_ctx, a, state, STREAM_TOSERVER, &ctx);
2198  if (ctx.js_warnings) {
2199  SCJbClose(ctx.js_warnings);
2200  SCJbSetObject(ctx.js, "warnings", ctx.js_warnings);
2201  SCJbFree(ctx.js_warnings);
2202  ctx.js_warnings = NULL;
2203  }
2204  SCJbClose(ctx.js);
2205  }
2206  const uint8_t complete_state_tc =
2207  (const uint8_t)AppLayerParserGetStateProgressCompletionStatus(a, STREAM_TOCLIENT);
2208  for (uint8_t state = 0; state < complete_state_tc; state++) {
2209  const char *name =
2210  AppLayerParserGetStateNameById(IPPROTO_TCP, a, state, STREAM_TOCLIENT);
2211  char table_name[128];
2212  snprintf(table_name, sizeof(table_name), "app:%s:%s", AppProtoToString(a), name);
2213  SCJbOpenObject(ctx.js, table_name);
2214  FirewallAddRulesForState(de_ctx, a, state, STREAM_TOCLIENT, &ctx);
2215  if (ctx.js_warnings) {
2216  SCJbClose(ctx.js_warnings);
2217  SCJbSetObject(ctx.js, "warnings", ctx.js_warnings);
2218  SCJbFree(ctx.js_warnings);
2219  ctx.js_warnings = NULL;
2220  }
2221  SCJbClose(ctx.js);
2222  }
2223  SCJbClose(ctx.js); // app layer
2224  }
2225  SCJbOpenObject(ctx.js, "packet:td");
2226  SCJbSetString(ctx.js, "policy", "accept:hook");
2227  last_sid = 0;
2228  SCJbOpenArray(ctx.js, "rules");
2229  for (Signature *s = de_ctx->sig_list; s != NULL; s = s->next) {
2230  if ((s->flags & SIG_FLAG_FIREWALL) != 0)
2231  continue;
2232  if (s->type == SIG_TYPE_APP_TX)
2233  continue;
2234  if (last_sid == s->id)
2235  continue;
2236  last_sid = s->id;
2237  SCJbAppendString(ctx.js, s->sig_str);
2238  }
2239  SCJbClose(ctx.js); // rules
2240  SCJbClose(ctx.js); // packet:td
2241  SCJbOpenObject(ctx.js, "app:td");
2242  SCJbSetString(ctx.js, "policy", "accept:hook");
2243  last_sid = 0;
2244  SCJbOpenArray(ctx.js, "rules");
2245  for (Signature *s = de_ctx->sig_list; s != NULL; s = s->next) {
2246  if ((s->flags & SIG_FLAG_FIREWALL) != 0)
2247  continue;
2248  if (s->type != SIG_TYPE_APP_TX)
2249  continue;
2250  if (last_sid == s->id)
2251  continue;
2252  last_sid = s->id;
2253  SCJbAppendString(ctx.js, s->sig_str);
2254  }
2255  SCJbClose(ctx.js); // rules
2256  SCJbClose(ctx.js); // app:td
2257  SCJbClose(ctx.js); // tables
2258 
2259  SCJbOpenObject(ctx.js, "lists");
2260  SCJbOpenObject(ctx.js, "firewall");
2261  last_sid = 0;
2262  SCJbOpenArray(ctx.js, "rules");
2263  for (Signature *s = de_ctx->sig_list; s != NULL; s = s->next) {
2264  if ((s->flags & SIG_FLAG_FIREWALL) == 0)
2265  continue;
2266  if (last_sid == s->id)
2267  continue;
2268  last_sid = s->id;
2269  SCJbAppendString(ctx.js, s->sig_str);
2270  }
2271  SCJbClose(ctx.js); // rules
2272  SCJbClose(ctx.js); // firewall
2273 
2274  SCJbOpenObject(ctx.js, "td");
2275  last_sid = 0;
2276  SCJbOpenArray(ctx.js, "rules");
2277  for (Signature *s = de_ctx->sig_list; s != NULL; s = s->next) {
2278  if ((s->flags & SIG_FLAG_FIREWALL) != 0)
2279  continue;
2280  if (last_sid == s->id)
2281  continue;
2282  last_sid = s->id;
2283  SCJbAppendString(ctx.js, s->sig_str);
2284  }
2285  SCJbClose(ctx.js); // rules
2286  SCJbClose(ctx.js); // td
2287 
2288  SCJbOpenObject(ctx.js, "all");
2289  last_sid = 0;
2290  SCJbOpenArray(ctx.js, "rules");
2291  for (Signature *s = de_ctx->sig_list; s != NULL; s = s->next) {
2292  if (last_sid == s->id)
2293  continue;
2294  last_sid = s->id;
2295  SCJbAppendString(ctx.js, s->sig_str);
2296  }
2297  SCJbClose(ctx.js); // rules
2298  SCJbClose(ctx.js); // all
2299 
2300  SCJbClose(ctx.js); // lists
2301 
2302  SCJbClose(ctx.js); // top level object
2303 
2304  const char *filename = "firewall.json";
2305  const char *log_dir = SCConfigGetLogDirectory();
2306  char json_path[PATH_MAX] = "";
2307  snprintf(json_path, sizeof(json_path), "%s/%s", log_dir, filename);
2308 
2309  SCMutexLock(&g_rules_analyzer_write_m);
2310  FILE *fp = fopen(json_path, "w");
2311  if (fp != NULL) {
2312  fwrite(SCJbPtr(ctx.js), SCJbLen(ctx.js), 1, fp);
2313  fprintf(fp, "\n");
2314  fclose(fp);
2315  }
2316  SCMutexUnlock(&g_rules_analyzer_write_m);
2317  SCJbFree(ctx.js);
2318  return 0;
2319 }
detect-tcp-flags.h
DETECT_PCRE_CASELESS
#define DETECT_PCRE_CASELESS
Definition: detect-pcre.h:32
DETECT_CONTENT_NOCASE
#define DETECT_CONTENT_NOCASE
Definition: detect-content.h:29
SignatureHasPacketContent
int SignatureHasPacketContent(const Signature *s)
check if a signature has patterns that are to be inspected against a packets payload (as opposed to t...
Definition: detect-engine-mpm.c:853
DetectBytejumpData_::post_offset
int32_t post_offset
Definition: detect-bytejump.h:52
HashListTableGetListData
#define HashListTableGetListData(hb)
Definition: util-hashlist.h:56
SIG_TYPE_STREAM
@ SIG_TYPE_STREAM
Definition: detect.h:74
DetectContentData_::offset
uint16_t offset
Definition: detect-content.h:107
DetectBytetestData_::flags
uint16_t flags
Definition: detect-bytetest.h:58
detect-engine-uint.h
DetectPatternTracker
Definition: detect.h:813
SignatureInitData_::rule_state_dependant_sids_idx
uint32_t rule_state_dependant_sids_idx
Definition: detect.h:663
DetectEngineAppInspectionEngine_
Definition: detect.h:416
DETECT_CONTENT_RELATIVE_NEXT
#define DETECT_CONTENT_RELATIVE_NEXT
Definition: detect-content.h:66
DetectEngineAppInspectionEngine_::mpm
bool mpm
Definition: detect.h:420
DETECT_TTL
@ DETECT_TTL
Definition: detect-engine-register.h:45
detect-content.h
DetectFlowbitsData_::or_list_size
uint8_t or_list_size
Definition: detect-flowbits.h:38
len
uint8_t len
Definition: app-layer-dnp3.h:2
DetectEngineAppInspectionEngine_::v2
struct DetectEngineAppInspectionEngine_::@82 v2
SCConfValIsTrue
int SCConfValIsTrue(const char *val)
Check if a value is true.
Definition: conf.c:552
detect-engine.h
DETECT_SM_LIST_PMATCH
@ DETECT_SM_LIST_PMATCH
Definition: detect.h:119
SIG_MASK_REQUIRE_REAL_PKT
#define SIG_MASK_REQUIRE_REAL_PKT
Definition: detect.h:316
DETECT_CONTENT_FAST_PATTERN_CHOP
#define DETECT_CONTENT_FAST_PATTERN_CHOP
Definition: detect-content.h:36
SignatureInitData_::smlists
struct SigMatch_ * smlists[DETECT_SM_LIST_MAX]
Definition: detect.h:646
DetectContentData_::fp_chop_len
uint16_t fp_chop_len
Definition: detect-content.h:98
sigmatch_table
SigTableElmt * sigmatch_table
Definition: detect-parse.c:79
DetectXbitsData_::expire
uint32_t expire
Definition: detect-xbits.h:45
Signature_::sig_str
char * sig_str
Definition: detect.h:749
SIG_TYPE_APP_TX
@ SIG_TYPE_APP_TX
Definition: detect.h:77
AppLayerParserGetStateNameById
const char * AppLayerParserGetStateNameById(uint8_t ipproto, AppProto alproto, const int id, const uint8_t direction)
Definition: app-layer-parser.c:1641
DetectEnginePktInspectionEngine
Definition: detect.h:484
DetectEngineAppInspectionEngine_::next
struct DetectEngineAppInspectionEngine_ * next
Definition: detect.h:441
DETECT_PROTO_IPV6
#define DETECT_PROTO_IPV6
Definition: detect-engine-proto.h:32
DetectFlowData_
Definition: detect-flow.h:37
DETECT_FLOW_FLAG_NOSTREAM
#define DETECT_FLOW_FLAG_NOSTREAM
Definition: detect-flow.h:33
SigTableElmt_::name
const char * name
Definition: detect.h:1468
DETECT_BYTEJUMP
@ DETECT_BYTEJUMP
Definition: detect-engine-register.h:85
DetectPatternTracker::mpm
uint32_t mpm
Definition: detect.h:817
DETECT_ABSENT
@ DETECT_ABSENT
Definition: detect-engine-register.h:97
DetectListToHumanString
const char * DetectListToHumanString(int list)
Definition: detect-parse.c:112
DetectEngineCtx_::pattern_hash_table
HashListTable * pattern_hash_table
Definition: detect.h:970
DumpPatterns
void DumpPatterns(DetectEngineCtx *de_ctx)
Definition: detect-engine-analyzer.c:1558
FLOWINT_MODIFIER_ADD
@ FLOWINT_MODIFIER_ADD
Definition: detect-flowint.h:31
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
DetectContentData_::within
int32_t within
Definition: detect-content.h:109
ACTION_PASS
#define ACTION_PASS
Definition: action-globals.h:34
ACTION_REJECT
#define ACTION_REJECT
Definition: action-globals.h:31
DETECT_BYTEJUMP_LITTLE
#define DETECT_BYTEJUMP_LITTLE
Definition: detect-bytejump.h:35
SetupEngineAnalysis
void SetupEngineAnalysis(DetectEngineCtx *de_ctx, bool *fp_analysis, bool *rule_analysis)
Definition: detect-engine-analyzer.c:477
Signature_::app_progress_hook
uint8_t app_progress_hook
Definition: detect.h:709
DETECT_CONTENT
@ DETECT_CONTENT
Definition: detect-engine-register.h:71
SignatureInitData_::prefilter_sm
SigMatch * prefilter_sm
Definition: detect.h:626
EngineAnalysisCtx_::rule_engine_analysis_fp
FILE * rule_engine_analysis_fp
Definition: detect-engine-analyzer.c:88
DETECT_FLOW
@ DETECT_FLOW
Definition: detect-engine-register.h:56
Signature_::alproto
AppProto alproto
Definition: detect.h:677
SignatureInitData_::is_rule_state_dependant
bool is_rule_state_dependant
Definition: detect.h:660
detect-isdataat.h
FLOWINT_MODIFIER_NE
@ FLOWINT_MODIFIER_NE
Definition: detect-flowint.h:38
DETECT_BYTETEST_BASE_HEX
#define DETECT_BYTETEST_BASE_HEX
Definition: detect-bytetest.h:40
SigMatchData_::is_last
bool is_last
Definition: detect.h:367
name
const char * name
Definition: detect-engine-proto.c:48
DetectContentPatternPrettyPrint
void DetectContentPatternPrettyPrint(const uint8_t *pat, const uint16_t pat_len, char *str, size_t str_len)
Definition: detect-content.c:743
g_rules_analyzer_write_m
SCMutex g_rules_analyzer_write_m
Definition: detect-engine-analyzer.c:1110
DetectEngineAnalyzerItems::display_name
const char * display_name
Definition: detect-engine-analyzer.c:70
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:86
DETECT_CONTENT_WITHIN2DEPTH
#define DETECT_CONTENT_WITHIN2DEPTH
Definition: detect-content.h:62
EngineAnalysisCtx_::percent_re
pcre2_code * percent_re
Definition: detect-engine-analyzer.c:93
DETECT_SM_LIST_DYNAMIC_START
@ DETECT_SM_LIST_DYNAMIC_START
Definition: detect.h:138
DETECT_FLOWBITS_CMD_ISNOTSET
#define DETECT_FLOWBITS_CMD_ISNOTSET
Definition: detect-flowbits.h:31
SIG_FLAG_DEST_IS_TARGET
#define SIG_FLAG_DEST_IS_TARGET
Definition: detect.h:284
SigMatchData_::ctx
SigMatchCtx * ctx
Definition: detect.h:368
DETECT_CONTENT_NO_DOUBLE_INSPECTION_REQUIRED
#define DETECT_CONTENT_NO_DOUBLE_INSPECTION_REQUIRED
Definition: detect-content.h:55
DetectFlowintData_::targettype
uint8_t targettype
Definition: detect-flowint.h:71
action-globals.h
EngineAnalysisCtx_
Definition: detect-engine-analyzer.c:86
DETECT_IPOPTS
@ DETECT_IPOPTS
Definition: detect-engine-register.h:39
AppProtoToString
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
Definition: app-layer-protos.c:41
ctx
struct Thresholds ctx
DETECT_BYTEJUMP_BASE_OCT
#define DETECT_BYTEJUMP_BASE_OCT
Definition: detect-bytejump.h:29
DetectEngineFrameInspectionEngine::transforms
const DetectEngineTransforms * transforms
Definition: detect.h:519
DetectFlowData_::flags
uint16_t flags
Definition: detect-flow.h:38
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:937
DETECT_PROTO_ANY
#define DETECT_PROTO_ANY
Definition: detect-engine-proto.h:28
DetectFlowintData_
Definition: detect-flowint.h:61
DetectXbitsData_::cmd
uint8_t cmd
Definition: detect-xbits.h:43
DetectEnginePktInspectionEngine::smd
SigMatchData * smd
Definition: detect.h:485
AppLayerParserGetStateProgressCompletionStatus
int AppLayerParserGetStateProgressCompletionStatus(AppProto alproto, uint8_t direction)
Definition: app-layer-parser.c:1140
SIG_TYPE_PKT_STREAM
@ SIG_TYPE_PKT_STREAM
Definition: detect.h:73
DetectFlowbitsData_::cmd
uint8_t cmd
Definition: detect-flowbits.h:37
DetectEngineFrameInspectionEngine::mpm
bool mpm
Definition: detect.h:513
DETECT_BYTETEST_DCE
#define DETECT_BYTETEST_DCE
Definition: detect-bytetest.h:47
HashListTableGetListHead
HashListTableBucket * HashListTableGetListHead(HashListTable *ht)
Definition: util-hashlist.c:287
detect-tcp-seq.h
EngineAnalysisCtx_::fp_pattern_stats
FpPatternStats fp_pattern_stats[DETECT_SM_LIST_MAX]
Definition: detect-engine-analyzer.c:105
detect-flowint.h
DetectEngineBufferTypeGetNameById
const char * DetectEngineBufferTypeGetNameById(const DetectEngineCtx *de_ctx, const int id)
Definition: detect-engine.c:1308
SIG_FLAG_DST_ANY
#define SIG_FLAG_DST_ANY
Definition: detect.h:241
ACTION_SCOPE_FLOW
@ ACTION_SCOPE_FLOW
Definition: action-globals.h:45
SCMutexLock
#define SCMutexLock(mut)
Definition: threads-debug.h:117
util-var-name.h
SIG_FLAG_REQUIRE_STREAM
#define SIG_FLAG_REQUIRE_STREAM
Definition: detect.h:254
DETECT_XBITS_TRACK_IPDST
#define DETECT_XBITS_TRACK_IPDST
Definition: detect-xbits.h:35
DetectPatternTracker::cnt
uint32_t cnt
Definition: detect.h:816
rust.h
EngineAnalysisCtx_::fp_engine_analysis_fp
FILE * fp_engine_analysis_fp
Definition: detect-engine-analyzer.c:89
SCConfGetBool
int SCConfGetBool(const char *name, int *val)
Retrieve a configuration value as a boolean.
Definition: conf.c:498
EngineAnalysisCtx_::analyzer_initialized
bool analyzer_initialized
Definition: detect-engine-analyzer.c:112
DetectEngineAnalyzerItems
Definition: detect-engine-analyzer.c:64
DETECT_BYTEJUMP_DCE
#define DETECT_BYTEJUMP_DCE
Definition: detect-bytejump.h:40
DetectPatternTracker::cd
const struct DetectContentData_ * cd
Definition: detect.h:814
VarNameStoreSetupLookup
const char * VarNameStoreSetupLookup(const uint32_t id, const enum VarTypes type)
Definition: util-var-name.c:191
SCMUTEX_INITIALIZER
#define SCMUTEX_INITIALIZER
Definition: threads-debug.h:122
Signature_::sm_arrays
SigMatchData * sm_arrays[DETECT_SM_LIST_MAX]
Definition: detect.h:735
FpPatternStats_::max
uint16_t max
Definition: detect-engine-analyzer.c:75
SignatureInitData_::init_flags
uint32_t init_flags
Definition: detect.h:609
DetectBufferType_
Definition: detect.h:449
DETECT_FLOWBITS_CMD_TOGGLE
#define DETECT_FLOWBITS_CMD_TOGGLE
Definition: detect-flowbits.h:29
DetectContentData_
Definition: detect-content.h:93
DETECT_FLOWBITS_CMD_ISSET
#define DETECT_FLOWBITS_CMD_ISSET
Definition: detect-flowbits.h:32
DetectPcreData_::flags
uint16_t flags
Definition: detect-pcre.h:51
SCConfNodeLookupChildValue
const char * SCConfNodeLookupChildValue(const SCConfNode *node, const char *name)
Lookup the value of a child configuration node by name.
Definition: conf.c:852
DetectContentData_::fp_chop_offset
uint16_t fp_chop_offset
Definition: detect-content.h:100
DetectBytetestData_::nbytes
uint8_t nbytes
Definition: detect-bytetest.h:54
DetectBytetestData_
Definition: detect-bytetest.h:53
EngineAnalysisCtx_::analyzer_item_map
int16_t analyzer_item_map[256]
Definition: detect-engine-analyzer.c:104
SIG_FLAG_TOCLIENT
#define SIG_FLAG_TOCLIENT
Definition: detect.h:271
DETECT_BYTEJUMP_BIG
#define DETECT_BYTEJUMP_BIG
Definition: detect-bytejump.h:36
SIG_FLAG_SRC_ANY
#define SIG_FLAG_SRC_ANY
Definition: detect.h:240
EngineAnalysisRulesFailure
void EngineAnalysisRulesFailure(const DetectEngineCtx *de_ctx, const char *line, const char *file, int lineno)
Definition: detect-engine-analyzer.c:625
SigMatchData_
Data needed for Match()
Definition: detect.h:365
DetectBytejumpData_::base
uint8_t base
Definition: detect-bytejump.h:49
detect-pcre.h
SIG_TYPE_APPLAYER
@ SIG_TYPE_APPLAYER
Definition: detect.h:76
SigMatchData_::type
uint16_t type
Definition: detect.h:366
DetectBytejumpData_
Definition: detect-bytejump.h:47
DetectXbitsData_
Definition: detect-xbits.h:41
DETECT_FLOW_ELEPHANT
@ DETECT_FLOW_ELEPHANT
Definition: detect-engine-register.h:138
Signature_::frame_inspect
DetectEngineFrameInspectionEngine * frame_inspect
Definition: detect.h:731
DetectBytejumpData_::offset
int32_t offset
Definition: detect-bytejump.h:51
DetectEnginePktInspectionEngine::transforms
const DetectEngineTransforms * transforms
Definition: detect.h:493
EngineAnalysisCtx_::analyzer_items
DetectEngineAnalyzerItems * analyzer_items
Definition: detect-engine-analyzer.c:91
DETECT_PERCENT_ENCODING_REGEX
#define DETECT_PERCENT_ENCODING_REGEX
FirewallAnalyzer
int FirewallAnalyzer(const DetectEngineCtx *de_ctx)
Definition: detect-engine-analyzer.c:2141
DetectBytejumpData_::multiplier
uint16_t multiplier
Definition: detect-bytejump.h:55
SIG_FLAG_APPLAYER
#define SIG_FLAG_APPLAYER
Definition: detect.h:248
DetectBufferTypeGetByName
int DetectBufferTypeGetByName(const char *name)
Definition: detect-engine.c:1278
SIG_FLAG_FIREWALL
#define SIG_FLAG_FIREWALL
Definition: detect.h:245
Signature_::gid
uint32_t gid
Definition: detect.h:718
DetectFlowintData_::idx
uint32_t idx
Definition: detect-flowint.h:66
Signature_::next
struct Signature_ * next
Definition: detect.h:754
ACTION_REJECT_DST
#define ACTION_REJECT_DST
Definition: action-globals.h:32
DetectEngineAppInspectionEngine_::sm_list
uint16_t sm_list
Definition: detect.h:424
ATTR_FMT_PRINTF
#define ATTR_FMT_PRINTF(x, y)
Definition: suricata-common.h:427
DetectFlowbitsData_
Definition: detect-flowbits.h:35
HashListTableGetListNext
#define HashListTableGetListNext(hb)
Definition: util-hashlist.h:55
DetectEngineAnalyzerItems::export_item_seen
bool export_item_seen
Definition: detect-engine-analyzer.c:67
SignaturePropertyFlowAction
SignaturePropertyFlowAction
Definition: detect.h:83
SIG_FLAG_TOSERVER
#define SIG_FLAG_TOSERVER
Definition: detect.h:270
detect-xbits.h
DETECT_XBITS_CMD_ISNOTSET
#define DETECT_XBITS_CMD_ISNOTSET
Definition: detect-xbits.h:30
DETECT_BYTETEST_RELATIVE
#define DETECT_BYTETEST_RELATIVE
Definition: detect-bytetest.h:46
SIG_TYPE_PKT
@ SIG_TYPE_PKT
Definition: detect.h:72
feature.h
RuleAnalyzer::js
SCJsonBuilder * js
Definition: detect-engine-analyzer.c:641
IpOptsFlagToString
const char * IpOptsFlagToString(uint16_t flag)
Return human readable value for ipopts flag.
Definition: detect-ipopts.c:129
JB_SET_STRING
#define JB_SET_STRING(jb, key, val)
Definition: rust.h:36
EngineAnalysisCtx
struct EngineAnalysisCtx_ EngineAnalysisCtx
DETECT_CONTENT_ENDS_WITH
#define DETECT_CONTENT_ENDS_WITH
Definition: detect-content.h:42
DETECT_PCRE_RAWBYTES
#define DETECT_PCRE_RAWBYTES
Definition: detect-pcre.h:31
DETECT_CONTENT_DISTANCE
#define DETECT_CONTENT_DISTANCE
Definition: detect-content.h:30
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:19
DetectEnginePktInspectionEngine::sm_list
uint16_t sm_list
Definition: detect.h:487
SIG_FLAG_INIT_BIDIREC
#define SIG_FLAG_INIT_BIDIREC
Definition: detect.h:292
g_alproto_max
AppProto g_alproto_max
Definition: app-layer-protos.c:30
DETECT_FLOWINT
@ DETECT_FLOWINT
Definition: detect-engine-register.h:64
SIG_MASK_REQUIRE_ENGINE_EVENT
#define SIG_MASK_REQUIRE_ENGINE_EVENT
Definition: detect.h:318
DETECT_ICODE
@ DETECT_ICODE
Definition: detect-engine-register.h:48
DETECT_FLOW_AGE
@ DETECT_FLOW_AGE
Definition: detect-engine-register.h:131
DETECT_BYTETEST_BASE_UNSET
#define DETECT_BYTETEST_BASE_UNSET
Definition: detect-bytetest.h:37
SIG_TYPE_IPONLY
@ SIG_TYPE_IPONLY
Definition: detect.h:66
FLOWINT_TARGET_VAL
@ FLOWINT_TARGET_VAL
Definition: detect-flowint.h:50
DETECT_BYTEJUMP_ALIGN
#define DETECT_BYTEJUMP_ALIGN
Definition: detect-bytejump.h:39
SignatureInitData_::mpm_sm
SigMatch * mpm_sm
Definition: detect.h:624
DetectEngineBufferTypeGetDescriptionById
const char * DetectEngineBufferTypeGetDescriptionById(const DetectEngineCtx *de_ctx, const int id)
Definition: detect-engine.c:1386
SCMutexUnlock
#define SCMutexUnlock(mut)
Definition: threads-debug.h:120
SIG_FLAG_FLUSH
#define SIG_FLAG_FLUSH
Definition: detect.h:258
DetectIpOptsData_::ipopt
uint16_t ipopt
Definition: detect-ipopts.h:38
SignatureInitData_::mpm_sm_list
int mpm_sm_list
Definition: detect.h:622
DETECT_BYTETEST_BASE_DEC
#define DETECT_BYTETEST_BASE_DEC
Definition: detect-bytetest.h:39
SIG_MASK_REQUIRE_FLOW
#define SIG_MASK_REQUIRE_FLOW
Definition: detect.h:312
SIG_FLAG_BYPASS
#define SIG_FLAG_BYPASS
Definition: detect.h:275
DETECT_CONTENT_DEPTH
#define DETECT_CONTENT_DEPTH
Definition: detect-content.h:33
DETECT_CONTENT_DISTANCE2OFFSET
#define DETECT_CONTENT_DISTANCE2OFFSET
Definition: detect-content.h:63
RuleAnalyzer
Definition: detect-engine-analyzer.c:640
DETECT_BYTEJUMP_END
#define DETECT_BYTEJUMP_END
Definition: detect-bytejump.h:42
Signature_::pkt_inspect
DetectEnginePktInspectionEngine * pkt_inspect
Definition: detect.h:730
DetectEngineAnalyzerItems
struct DetectEngineAnalyzerItems DetectEngineAnalyzerItems
util-print.h
SCEnter
#define SCEnter(...)
Definition: util-debug.h:284
detect-engine-mpm.h
detect.h
SIG_MASK_REQUIRE_FLAGS_INITDEINIT
#define SIG_MASK_REQUIRE_FLAGS_INITDEINIT
Definition: detect.h:313
SignatureInitData_::rule_state_flowbits_ids_size
uint32_t rule_state_flowbits_ids_size
Definition: detect.h:665
DetectEngineFrameInspectionEngine::sm_list
uint16_t sm_list
Definition: detect.h:514
DETECT_XBITS_TRACK_IPPAIR
#define DETECT_XBITS_TRACK_IPPAIR
Definition: detect-xbits.h:36
detect-tcp-window.h
SigMatch_::next
struct SigMatch_ * next
Definition: detect.h:360
DetectEngineAnalyzerItems::item_seen
bool item_seen
Definition: detect-engine-analyzer.c:66
DETECT_CONTENT_NEGATED
#define DETECT_CONTENT_NEGATED
Definition: detect-content.h:40
SignatureInitData_::proto
DetectProto proto
Definition: detect.h:635
DetectU8Data
DetectUintData_u8 DetectU8Data
Definition: detect-engine-uint.h:43
util-time.h
DETECT_ICMP_ID
@ DETECT_ICMP_ID
Definition: detect-engine-register.h:49
DETECT_SM_LIST_MATCH
@ DETECT_SM_LIST_MATCH
Definition: detect.h:117
EngineAnalysisRules
void EngineAnalysisRules(const DetectEngineCtx *de_ctx, const Signature *s, const char *line)
Prints analysis of loaded rules.
Definition: detect-engine-analyzer.c:1699
app-layer-parser.h
Signature_::app_inspect
DetectEngineAppInspectionEngine * app_inspect
Definition: detect.h:729
DETECT_XBITS
@ DETECT_XBITS
Definition: detect-engine-register.h:66
DETECT_SEQ
@ DETECT_SEQ
Definition: detect-engine-register.h:37
SigMatch_::ctx
SigMatchCtx * ctx
Definition: detect.h:359
DETECT_ACK
@ DETECT_ACK
Definition: detect-engine-register.h:36
RuleAnalyzer::js_warnings
SCJsonBuilder * js_warnings
Definition: detect-engine-analyzer.c:643
SIG_FLAG_REQUIRE_FLOWVAR
#define SIG_FLAG_REQUIRE_FLOWVAR
Definition: detect.h:266
Signature_::action
uint8_t action
Definition: detect.h:687
FpPatternStats_::cnt
uint32_t cnt
Definition: detect-engine-analyzer.c:76
DetectXbitsData_::type
enum VarTypes type
Definition: detect-xbits.h:47
SCReturn
#define SCReturn
Definition: util-debug.h:286
Signature_::flags
uint32_t flags
Definition: detect.h:673
DetectContentData_::depth
uint16_t depth
Definition: detect-content.h:106
DetectEngineFrameInspectionEngine::v1
struct DetectEngineFrameInspectionEngine::@86 v1
ACTION_ALERT
#define ACTION_ALERT
Definition: action-globals.h:29
DETECT_BYTETEST_BIG
#define DETECT_BYTETEST_BIG
Definition: detect-bytetest.h:44
FLOWINT_MODIFIER_LE
@ FLOWINT_MODIFIER_LE
Definition: detect-flowint.h:36
SCLocalTime
struct tm * SCLocalTime(time_t timep, struct tm *result)
Definition: util-time.c:267
detect-bytejump.h
ACTION_SCOPE_TX
@ ACTION_SCOPE_TX
Definition: action-globals.h:47
SCConfigGetLogDirectory
const char * SCConfigGetLogDirectory(void)
Definition: util-conf.c:38
ACTION_SCOPE_AUTO
@ ACTION_SCOPE_AUTO
Definition: action-globals.h:43
conf.h
DetectContentData_::flags
uint32_t flags
Definition: detect-content.h:104
CHECK
#define CHECK(pat)
Definition: detect-engine-analyzer.c:677
DetectEngineFrameInspectionEngine
Definition: detect.h:509
DetectFlowbitsData_::idx
uint32_t idx
Definition: detect-flowbits.h:36
DetectEngineBufferTypeGetById
const DetectBufferType * DetectEngineBufferTypeGetById(const DetectEngineCtx *de_ctx, const int id)
Definition: detect-engine.c:1298
DETECT_BYTEJUMP_BASE_UNSET
#define DETECT_BYTEJUMP_BASE_UNSET
Definition: detect-bytejump.h:28
Signature_::init_data
SignatureInitData * init_data
Definition: detect.h:751
DetectFlowintData_::modifier
uint8_t modifier
Definition: detect-flowint.h:70
SIG_FLAG_SRC_IS_TARGET
#define SIG_FLAG_SRC_IS_TARGET
Definition: detect.h:282
SignatureInitData_::rule_state_dependant_sids_array
uint32_t * rule_state_dependant_sids_array
Definition: detect.h:661
SignatureInitData_::rule_state_dependant_sids_size
uint32_t rule_state_dependant_sids_size
Definition: detect.h:662
DetectEngineTransforms::transforms
TransformData transforms[DETECT_TRANSFORMS_MAX]
Definition: detect.h:392
DETECT_BYTEJUMP_BASE_HEX
#define DETECT_BYTEJUMP_BASE_HEX
Definition: detect-bytejump.h:31
SIG_TYPE_DEONLY
@ SIG_TYPE_DEONLY
Definition: detect.h:71
SIG_PROP_FLOW_ACTION_PACKET
@ SIG_PROP_FLOW_ACTION_PACKET
Definition: detect.h:84
signature_properties
const struct SignatureProperties signature_properties[SIG_TYPE_MAX]
Definition: detect-engine.c:116
detect-flowbits.h
SIG_MASK_REQUIRE_PAYLOAD
#define SIG_MASK_REQUIRE_PAYLOAD
Definition: detect.h:311
SCLogInfo
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:232
DETECT_PCRE
@ DETECT_PCRE
Definition: detect-engine-register.h:73
DETECT_DSIZE
@ DETECT_DSIZE
Definition: detect-engine-register.h:54
SIG_TYPE_NOT_SET
@ SIG_TYPE_NOT_SET
Definition: detect.h:65
ExposedItemSeen::bufname
const char * bufname
Definition: detect-engine-analyzer.c:82
DETECT_BYTEJUMP_OFFSET_BE
#define DETECT_BYTEJUMP_OFFSET_BE
Definition: detect-bytejump.h:41
FLOWINT_MODIFIER_GT
@ FLOWINT_MODIFIER_GT
Definition: detect-flowint.h:40
detect-ttl.h
DetectEngineCtx_::config_prefix
char config_prefix[64]
Definition: detect.h:1059
DetectSigmatchListEnumToString
const char * DetectSigmatchListEnumToString(enum DetectSigmatchListEnum type)
Definition: detect-engine.c:5018
analyzer_items
const DetectEngineAnalyzerItems analyzer_items[]
Definition: detect-engine-analyzer.c:115
DetectEngineAppInspectionEngine_::alproto
AppProto alproto
Definition: detect.h:417
SIG_FLAG_MPM_NEG
#define SIG_FLAG_MPM_NEG
Definition: detect.h:256
detect-engine-analyzer.h
SIG_FLAG_INIT_STATE_MATCH
#define SIG_FLAG_INIT_STATE_MATCH
Definition: detect.h:296
DetectEngineAnalyzerItems::item_id
int16_t item_id
Definition: detect-engine-analyzer.c:65
DETECT_XBITS_TRACK_TX
#define DETECT_XBITS_TRACK_TX
Definition: detect-xbits.h:37
DetectPatternTracker::sm_list
int sm_list
Definition: detect.h:815
DetectEngineAppInspectionEngine_::smd
SigMatchData * smd
Definition: detect.h:439
EngineAnalysisRules2
void EngineAnalysisRules2(const DetectEngineCtx *de_ctx, const Signature *s)
Definition: detect-engine-analyzer.c:1111
ACTION_REJECT_BOTH
#define ACTION_REJECT_BOTH
Definition: action-globals.h:33
FLOWINT_MODIFIER_LT
@ FLOWINT_MODIFIER_LT
Definition: detect-flowint.h:35
DetectFlowintData_::target
union DetectFlowintData_::@68 target
ARRAY_SIZE
#define ARRAY_SIZE(arr)
Definition: suricata-common.h:562
DETECT_CONTENT_STARTS_WITH
#define DETECT_CONTENT_STARTS_WITH
Definition: detect-content.h:59
DetectProto_::flags
uint8_t flags
Definition: detect-engine-proto.h:40
DETECT_BYTETEST
@ DETECT_BYTETEST
Definition: detect-engine-register.h:84
DETECT_PROTO_IPV4
#define DETECT_PROTO_IPV4
Definition: detect-engine-proto.h:31
util-conf.h
SignatureHasStreamContent
int SignatureHasStreamContent(const Signature *s)
check if a signature has patterns that are to be inspected against the stream payload (as opposed to ...
Definition: detect-engine-mpm.c:883
FpPatternStats_::min
uint16_t min
Definition: detect-engine-analyzer.c:74
VAR_TYPE_FLOW_BIT
@ VAR_TYPE_FLOW_BIT
Definition: util-var.h:36
FLOWINT_TARGET_VAR
@ FLOWINT_TARGET_VAR
Definition: detect-flowint.h:51
suricata-common.h
SIG_MASK_REQUIRE_NO_PAYLOAD
#define SIG_MASK_REQUIRE_NO_PAYLOAD
Definition: detect.h:315
FLOWINT_MODIFIER_SET
@ FLOWINT_MODIFIER_SET
Definition: detect-flowint.h:30
DetectEnginePktInspectionEngine::v1
struct DetectEnginePktInspectionEngine::@85 v1
SIG_FLAG_SP_ANY
#define SIG_FLAG_SP_ANY
Definition: detect.h:242
SIG_PROP_FLOW_ACTION_FLOW_IF_STATEFUL
@ SIG_PROP_FLOW_ACTION_FLOW_IF_STATEFUL
Definition: detect.h:86
ActionScope
ActionScope
Definition: action-globals.h:42
FLOWINT_MODIFIER_ISSET
@ FLOWINT_MODIFIER_ISSET
Definition: detect-flowint.h:42
DetectAbsentData_
Definition: detect-isdataat.h:37
ExposedItemSeen
Definition: detect-engine-analyzer.c:81
SigMatch_::type
uint16_t type
Definition: detect.h:357
HashListTableFree
void HashListTableFree(HashListTable *ht)
Definition: util-hashlist.c:88
DetectEngineAnalyzerItems::check_encoding_match
bool check_encoding_match
Definition: detect-engine-analyzer.c:68
DetectContentData_::distance
int32_t distance
Definition: detect-content.h:108
ACTION_SCOPE_HOOK
@ ACTION_SCOPE_HOOK
Definition: action-globals.h:46
CleanupEngineAnalysis
void CleanupEngineAnalysis(DetectEngineCtx *de_ctx)
Definition: detect-engine-analyzer.c:513
DetectBytejumpData_::nbytes
uint8_t nbytes
Definition: detect-bytejump.h:48
Signature_::action_scope
uint8_t action_scope
Definition: detect.h:694
ALPROTO_HTTP1
@ ALPROTO_HTTP1
Definition: app-layer-protos.h:36
DetectEngineFrameInspectionEngine::next
struct DetectEngineFrameInspectionEngine * next
Definition: detect.h:522
DetectU32Data
DetectUintData_u32 DetectU32Data
Definition: detect-engine-uint.h:41
ACTION_DROP
#define ACTION_DROP
Definition: action-globals.h:30
DetectEnginePktInspectionEngine::next
struct DetectEnginePktInspectionEngine * next
Definition: detect.h:495
DetectContentData_::content
uint8_t * content
Definition: detect-content.h:94
DetectXbitsData_::idx
uint32_t idx
Definition: detect-xbits.h:42
Signature_::rev
uint32_t rev
Definition: detect.h:719
Signature_::proto
DetectProto * proto
Definition: detect.h:691
SCStrdup
#define SCStrdup(s)
Definition: util-mem.h:56
FatalError
#define FatalError(...)
Definition: util-debug.h:517
DetectEngineCtx_::sig_list
Signature * sig_list
Definition: detect.h:946
DETECT_BYTEJUMP_BASE_DEC
#define DETECT_BYTEJUMP_BASE_DEC
Definition: detect-bytejump.h:30
DetectIpOptsData_
Definition: detect-ipopts.h:37
ACTION_CONFIG
#define ACTION_CONFIG
Definition: action-globals.h:35
PrintRawUriFp
void PrintRawUriFp(FILE *fp, const uint8_t *buf, uint32_t buflen)
Definition: util-print.c:69
SIG_MASK_REQUIRE_FLAGS_UNUSUAL
#define SIG_MASK_REQUIRE_FLAGS_UNUSUAL
Definition: detect.h:314
TransformData_::transform
int transform
Definition: detect.h:387
FLOWINT_MODIFIER_ISNOTSET
@ FLOWINT_MODIFIER_ISNOTSET
Definition: detect-flowint.h:43
DETECT_FLOWBITS
@ DETECT_FLOWBITS
Definition: detect-engine-register.h:61
SIG_TYPE_MAX
@ SIG_TYPE_MAX
Definition: detect.h:79
DetectEngineCtx_::ea
struct EngineAnalysisCtx_ * ea
Definition: detect.h:1137
DetectEngineAppInspectionEngine_::progress
int16_t progress
Definition: detect.h:426
DETECT_BYTETEST_BASE_OCT
#define DETECT_BYTETEST_BASE_OCT
Definition: detect-bytetest.h:38
util-validate.h
detect-flow.h
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
EngineAnalysisFP
void EngineAnalysisFP(const DetectEngineCtx *de_ctx, const Signature *s, const char *line)
Definition: detect-engine-analyzer.c:172
SignatureInitData_::firewall_rule
bool firewall_rule
Definition: detect.h:668
FpPatternStats
struct FpPatternStats_ FpPatternStats
detect-tcp-ack.h
DetectXbitsData_::tracker
uint8_t tracker
Definition: detect-xbits.h:44
str
#define str(s)
Definition: suricata-common.h:308
SCConfGetNode
SCConfNode * SCConfGetNode(const char *name)
Get a SCConfNode by name.
Definition: conf.c:182
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:274
SigMatchListSMBelongsTo
int SigMatchListSMBelongsTo(const Signature *s, const SigMatch *key_sm)
Definition: detect-parse.c:762
SCFree
#define SCFree(p)
Definition: util-mem.h:61
DetectFlowbitsData_::or_list
uint32_t * or_list
Definition: detect-flowbits.h:42
Signature_::id
uint32_t id
Definition: detect.h:717
DETECT_CONTENT_OFFSET
#define DETECT_CONTENT_OFFSET
Definition: detect-content.h:32
HashListTableBucket_
Definition: util-hashlist.h:28
DETECT_XBITS_TRACK_IPSRC
#define DETECT_XBITS_TRACK_IPSRC
Definition: detect-xbits.h:34
DETECT_FLOWBITS_CMD_UNSET
#define DETECT_FLOWBITS_CMD_UNSET
Definition: detect-flowbits.h:30
DETECT_CONTENT_FAST_PATTERN_ONLY
#define DETECT_CONTENT_FAST_PATTERN_ONLY
Definition: detect-content.h:35
DETECT_CONTENT_MPM
#define DETECT_CONTENT_MPM
Definition: detect-content.h:61
ACTION_SCOPE_PACKET
@ ACTION_SCOPE_PACKET
Definition: action-globals.h:44
DetectBufferType_::transforms
DetectEngineTransforms transforms
Definition: detect.h:463
detect-parse.h
Signature_
Signature container.
Definition: detect.h:672
SigMatch_
a single match condition for a signature
Definition: detect.h:356
DetectEngineAppInspectionEngine_::transforms
const DetectEngineTransforms * transforms
Definition: detect.h:436
DETECT_SM_LIST_MAX
@ DETECT_SM_LIST_MAX
Definition: detect.h:135
SCRequiresFeature
bool SCRequiresFeature(const char *feature_name)
Definition: feature.c:121
FpPatternStats_::tot
uint64_t tot
Definition: detect-engine-analyzer.c:77
DetectFlowintData_::tvar
TargetVar tvar
Definition: detect-flowint.h:77
DETECT_XBITS_CMD_ISSET
#define DETECT_XBITS_CMD_ISSET
Definition: detect-xbits.h:31
DETECT_BYTETEST_STRING
#define DETECT_BYTETEST_STRING
Definition: detect-bytetest.h:45
DetectBytetestData_::offset
int32_t offset
Definition: detect-bytetest.h:60
VAR_TYPE_FLOW_INT
@ VAR_TYPE_FLOW_INT
Definition: util-var.h:37
ALPROTO_UNKNOWN
@ ALPROTO_UNKNOWN
Definition: app-layer-protos.h:29
DETECT_PCRE_RELATIVE_NEXT
#define DETECT_PCRE_RELATIVE_NEXT
Definition: detect-pcre.h:34
detect-icmp-id.h
ACTION_ACCEPT
#define ACTION_ACCEPT
Definition: action-globals.h:36
detect-ipopts.h
DetectEngineTransforms::cnt
int cnt
Definition: detect.h:393
suricata.h
DetectPcreData_
Definition: detect-pcre.h:47
DetectEngineAppInspectionEngine_::dir
uint8_t dir
Definition: detect.h:418
DetectEngineAnalyzerItems::item_name
const char * item_name
Definition: detect-engine-analyzer.c:69
DetectContentData_::content_len
uint16_t content_len
Definition: detect-content.h:95
ExposedItemSeen::item_seen_ptr
bool * item_seen_ptr
Definition: detect-engine-analyzer.c:83
DETECT_BYTEJUMP_STRING
#define DETECT_BYTEJUMP_STRING
Definition: detect-bytejump.h:37
DetectEngineCtx_::buffer_type_id
uint32_t buffer_type_id
Definition: detect.h:1089
EngineAnalysisCtx_::file_prefix
char * file_prefix
Definition: detect-engine-analyzer.c:92
DETECT_XBITS_CMD_SET
#define DETECT_XBITS_CMD_SET
Definition: detect-xbits.h:27
DetectEnginePktInspectionEngine::mpm
bool mpm
Definition: detect.h:486
DETECT_BYTEJUMP_BEGIN
#define DETECT_BYTEJUMP_BEGIN
Definition: detect-bytejump.h:34
SignatureInitData_::rule_state_flowbits_ids_array
uint32_t * rule_state_flowbits_ids_array
Definition: detect.h:664
SIG_PROP_FLOW_ACTION_FLOW
@ SIG_PROP_FLOW_ACTION_FLOW
Definition: detect.h:85
DETECT_PCRE_RELATIVE
#define DETECT_PCRE_RELATIVE
Definition: detect-pcre.h:29
TargetVar_::name
char * name
Definition: detect-flowint.h:57
FLOWINT_MODIFIER_EQ
@ FLOWINT_MODIFIER_EQ
Definition: detect-flowint.h:37
RuleAnalyzer
struct RuleAnalyzer RuleAnalyzer
DETECT_WINDOW
@ DETECT_WINDOW
Definition: detect-engine-register.h:38
SIG_FLAG_TLSSTORE
#define SIG_FLAG_TLSSTORE
Definition: detect.h:273
DETECT_XBITS_CMD_TOGGLE
#define DETECT_XBITS_CMD_TOGGLE
Definition: detect-xbits.h:28
DetectU16Data
DetectUintData_u16 DetectU16Data
Definition: detect-engine-uint.h:42
Signature_::msg
char * msg
Definition: detect.h:740
DETECT_XBITS_CMD_UNSET
#define DETECT_XBITS_CMD_UNSET
Definition: detect-xbits.h:29
DETECT_CONTENT_FAST_PATTERN
#define DETECT_CONTENT_FAST_PATTERN
Definition: detect-content.h:34
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
DetectAbsentData_::or_else
bool or_else
Definition: detect-isdataat.h:39
RuleAnalyzer::js_notes
SCJsonBuilder * js_notes
Definition: detect-engine-analyzer.c:644
DETECT_FLAGS
@ DETECT_FLAGS
Definition: detect-engine-register.h:42
DETECT_PCRE_NEGATE
#define DETECT_PCRE_NEGATE
Definition: detect-pcre.h:35
EngineAnalysisCtx_::exposed_item_seen_list
struct ExposedItemSeen exposed_item_seen_list[2]
Definition: detect-engine-analyzer.c:110
Signature_::type
enum SignatureType type
Definition: detect.h:675
SCConfNode_
Definition: conf.h:37
FpPatternStats_
Definition: detect-engine-analyzer.c:73
DetectBytetestData_::base
uint8_t base
Definition: detect-bytetest.h:56
FLOWINT_MODIFIER_SUB
@ FLOWINT_MODIFIER_SUB
Definition: detect-flowint.h:32
DETECT_BYTETEST_LITTLE
#define DETECT_BYTETEST_LITTLE
Definition: detect-bytetest.h:43
SCMutex
#define SCMutex
Definition: threads-debug.h:114
SIG_TYPE_PDONLY
@ SIG_TYPE_PDONLY
Definition: detect.h:70
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:102
SIG_FLAG_PREFILTER
#define SIG_FLAG_PREFILTER
Definition: detect.h:277
SignatureProperties::flow_action
enum SignaturePropertyFlowAction flow_action
Definition: detect.h:90
DETECT_TCPMSS
@ DETECT_TCPMSS
Definition: detect-engine-register.h:271
SIG_FLAG_FILESTORE
#define SIG_FLAG_FILESTORE
Definition: detect.h:268
DETECT_CONTENT_WITHIN
#define DETECT_CONTENT_WITHIN
Definition: detect-content.h:31
DETECT_BYTEJUMP_RELATIVE
#define DETECT_BYTEJUMP_RELATIVE
Definition: detect-bytejump.h:38
SIG_FLAG_DP_ANY
#define SIG_FLAG_DP_ANY
Definition: detect.h:243
DETECT_FLOWBITS_CMD_SET
#define DETECT_FLOWBITS_CMD_SET
Definition: detect-flowbits.h:28
SIG_FLAG_DSIZE
#define SIG_FLAG_DSIZE
Definition: detect.h:247
FLOWINT_MODIFIER_GE
@ FLOWINT_MODIFIER_GE
Definition: detect-flowint.h:39
DetectBytejumpData_::flags
uint16_t flags
Definition: detect-bytejump.h:50
Signature_::mask
SignatureMask mask
Definition: detect.h:683
SIG_TYPE_LIKE_IPONLY
@ SIG_TYPE_LIKE_IPONLY
Definition: detect.h:67
detect-bytetest.h
DetectFlowintData_::value
uint32_t value
Definition: detect-flowint.h:75
DetectProtoContainsProto
int DetectProtoContainsProto(const DetectProto *dp, int proto)
see if a DetectProto contains a certain proto
Definition: detect-engine-proto.c:115
SIG_FLAG_REQUIRE_PACKET
#define SIG_FLAG_REQUIRE_PACKET
Definition: detect.h:253
DetectEngineFrameInspectionEngine::smd
SigMatchData * smd
Definition: detect.h:521