suricata
detect-engine-analyzer.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2025 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Eileen Donlon <emdonlo@gmail.com>
22  * \author Victor Julien <victor@inliniac.net>
23  *
24  * Rule analyzers for the detection engine
25  */
26 
27 #include "suricata-common.h"
28 #include "suricata.h"
29 #include "rust.h"
30 #include "action-globals.h"
31 #include "detect.h"
32 #include "detect-parse.h"
33 #include "detect-engine.h"
34 #include "detect-engine-analyzer.h"
35 #include "detect-engine-mpm.h"
36 #include "detect-engine-uint.h"
37 #include "conf.h"
38 #include "detect-content.h"
39 #include "detect-pcre.h"
40 #include "detect-bytejump.h"
41 #include "detect-bytetest.h"
42 #include "detect-isdataat.h"
43 #include "detect-flow.h"
44 #include "detect-ttl.h"
45 #include "detect-tcp-flags.h"
46 #include "detect-tcp-ack.h"
47 #include "detect-ipopts.h"
48 #include "detect-tcp-seq.h"
49 #include "feature.h"
50 #include "util-print.h"
51 #include "util-time.h"
52 #include "util-validate.h"
53 #include "util-conf.h"
54 #include "detect-flowbits.h"
55 #include "detect-flowint.h"
56 #include "detect-xbits.h"
57 #include "util-var-name.h"
58 #include "detect-icmp-id.h"
59 #include "detect-tcp-window.h"
60 #include "detect-app-layer-protocol.h"
61 #include "app-layer-parser.h"
62 #include "detect-tcp-session.h"
63 
64 static int rule_warnings_only = 0;
65 
66 /* Details for each buffer being tracked */
67 typedef struct DetectEngineAnalyzerItems {
68  int16_t item_id;
69  bool item_seen;
70  bool export_item_seen;
71  bool check_encoding_match;
72  const char *item_name;
73  const char *display_name;
74 } DetectEngineAnalyzerItems;
75 
76 typedef struct FpPatternStats_ {
77  uint16_t min;
78  uint16_t max;
79  uint32_t cnt;
80  uint64_t tot;
81 } FpPatternStats;
82 
83 /* Track which items require the item_seen value to be exposed */
84 struct ExposedItemSeen {
85  const char *bufname;
86  bool *item_seen_ptr;
87 };
88 
89 typedef struct EngineAnalysisCtx_ {
90 
91  FILE *rule_engine_analysis_fp;
92  FILE *fp_engine_analysis_fp;
93 
94  DetectEngineAnalyzerItems *analyzer_items;
95  char *file_prefix;
96  pcre2_code *percent_re;
97 
98  /*
99  * This array contains the map between the `analyzer_items` array listed above and
100  * the item ids returned by DetectBufferTypeGetByName. Iterating signature's sigmatch
101  * array provides list_ids. The map converts those ids into elements of the
102  * analyzer items array.
103  *
104  * Ultimately, the g_buffer_type_hash is searched for each buffer name. The size of that
105  * hashlist is 256, so that's the value we use here.
106  */
107  int16_t analyzer_item_map[256];
108  FpPatternStats fp_pattern_stats[DETECT_SM_LIST_MAX];
109  /*
110  * Certain values must be directly accessible. This array contains items that are directly
111  * accessed when checking if they've been seen or not.
112  */
113  struct ExposedItemSeen exposed_item_seen_list[2];
114 
115  bool analyzer_initialized;
116 } EngineAnalysisCtx;
117 
118 const DetectEngineAnalyzerItems analyzer_items[] = {
119  /* request keywords */
120  { 0, false, false, true, "http_uri", "http uri" },
121  { 0, false, false, false, "http_raw_uri", "http raw uri" },
122  { 0, false, true, false, "http_method", "http method" },
123  { 0, false, false, false, "http_request_line", "http request line" },
124  { 0, false, false, false, "http_client_body", "http client body" },
125  { 0, false, false, true, "http_header", "http header" },
126  { 0, false, false, false, "http_raw_header", "http raw header" },
127  { 0, false, false, true, "http_cookie", "http cookie" },
128  { 0, false, false, false, "http_user_agent", "http user agent" },
129  { 0, false, false, false, "http_host", "http host" },
130  { 0, false, false, false, "http_raw_host", "http raw host" },
131  { 0, false, false, false, "http_accept_enc", "http accept enc" },
132  { 0, false, false, false, "http_referer", "http referer" },
133  { 0, false, false, false, "http_content_type", "http content type" },
134  { 0, false, false, false, "http_header_names", "http header names" },
135 
136  /* response keywords not listed above */
137  { 0, false, false, false, "http_stat_msg", "http stat msg" },
138  { 0, false, false, false, "http_stat_code", "http stat code" },
139  { 0, false, true, false, "file_data", "http server body" },
140 
141  /* missing request keywords */
142  { 0, false, false, false, "http_request_line", "http request line" },
143  { 0, false, false, false, "http_accept", "http accept" },
144  { 0, false, false, false, "http_accept_lang", "http accept lang" },
145  { 0, false, false, false, "http_connection", "http connection" },
146  { 0, false, false, false, "http_content_len", "http content len" },
147  { 0, false, false, false, "http_protocol", "http protocol" },
148  { 0, false, false, false, "http_start", "http start" },
149 
150  /* missing response keywords; some of the missing are listed above*/
151  { 0, false, false, false, "http_response_line", "http response line" },
152  { 0, false, false, false, "http.server", "http server" },
153  { 0, false, false, false, "http.location", "http location" },
154 };
155 
156 static void FpPatternStatsAdd(FpPatternStats *fp, int list, uint16_t patlen)
157 {
158  if (list < 0 || list >= DETECT_SM_LIST_MAX)
159  return;
160 
161  FpPatternStats *f = &fp[list];
162 
163  if (f->min == 0)
164  f->min = patlen;
165  else if (patlen < f->min)
166  f->min = patlen;
167 
168  if (patlen > f->max)
169  f->max = patlen;
170 
171  f->cnt++;
172  f->tot += patlen;
173 }
174 
175 void EngineAnalysisFP(const DetectEngineCtx *de_ctx, const Signature *s, const char *line)
176 {
177  int fast_pattern_set = 0;
178  int fast_pattern_only_set = 0;
179  int fast_pattern_chop_set = 0;
180  const DetectContentData *fp_cd = NULL;
181  const SigMatch *mpm_sm = s->init_data->mpm_sm;
182  const int mpm_sm_list = s->init_data->mpm_sm_list;
183 
184  if (mpm_sm != NULL) {
185  fp_cd = (DetectContentData *)mpm_sm->ctx;
186  if (fp_cd->flags & DETECT_CONTENT_FAST_PATTERN) {
187  fast_pattern_set = 1;
188  if (fp_cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) {
189  fast_pattern_only_set = 1;
190  } else if (fp_cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) {
191  fast_pattern_chop_set = 1;
192  }
193  }
194  }
195 
196  FILE *fp = de_ctx->ea->fp_engine_analysis_fp;
197  fprintf(fp, "== Sid: %u ==\n", s->id);
198  fprintf(fp, "%s\n", line);
199 
200  fprintf(fp, " Fast Pattern analysis:\n");
201  if (s->init_data->prefilter_sm != NULL) {
202  fprintf(fp, " Prefilter on: %s\n",
203  sigmatch_table[s->init_data->prefilter_sm->type].name);
204  fprintf(fp, "\n");
205  return;
206  }
207 
208  if (fp_cd == NULL) {
209  fprintf(fp, " No content present\n");
210  fprintf(fp, "\n");
211  return;
212  }
213 
214  fprintf(fp, " Fast pattern matcher: ");
215  int list_type = mpm_sm_list;
216  if (list_type == DETECT_SM_LIST_PMATCH)
217  fprintf(fp, "content\n");
218  else {
219  const char *desc = DetectEngineBufferTypeGetDescriptionById(de_ctx, list_type);
220  const char *name = DetectEngineBufferTypeGetNameById(de_ctx, list_type);
221  if (desc && name) {
222  fprintf(fp, "%s (%s)\n", desc, name);
223  }
224  }
225 
226  int flags_set = 0;
227  fprintf(fp, " Flags:");
228  if (fp_cd->flags & DETECT_CONTENT_OFFSET) {
229  fprintf(fp, " Offset");
230  flags_set = 1;
231  } if (fp_cd->flags & DETECT_CONTENT_DEPTH) {
232  fprintf(fp, " Depth");
233  flags_set = 1;
234  }
235  if (fp_cd->flags & DETECT_CONTENT_WITHIN) {
236  fprintf(fp, " Within");
237  flags_set = 1;
238  }
239  if (fp_cd->flags & DETECT_CONTENT_DISTANCE) {
240  fprintf(fp, " Distance");
241  flags_set = 1;
242  }
243  if (fp_cd->flags & DETECT_CONTENT_NOCASE) {
244  fprintf(fp, " Nocase");
245  flags_set = 1;
246  }
247  if (fp_cd->flags & DETECT_CONTENT_NEGATED) {
248  fprintf(fp, " Negated");
249  flags_set = 1;
250  }
251  if (flags_set == 0)
252  fprintf(fp, " None");
253  fprintf(fp, "\n");
254 
255  fprintf(fp, " Fast pattern set: %s\n", fast_pattern_set ? "yes" : "no");
256  fprintf(fp, " Fast pattern only set: %s\n", fast_pattern_only_set ? "yes" : "no");
257  fprintf(fp, " Fast pattern chop set: %s\n", fast_pattern_chop_set ? "yes" : "no");
258  if (fast_pattern_chop_set) {
259  fprintf(fp, " Fast pattern offset, length: %u, %u\n", fp_cd->fp_chop_offset,
260  fp_cd->fp_chop_len);
261  }
262 
263  uint16_t patlen = fp_cd->content_len;
264  uint8_t *pat = SCMalloc(fp_cd->content_len + 1);
265  if (unlikely(pat == NULL)) {
266  FatalError("Error allocating memory");
267  }
268  memcpy(pat, fp_cd->content, fp_cd->content_len);
269  pat[fp_cd->content_len] = '\0';
270  fprintf(fp, " Original content: ");
271  PrintRawUriFp(fp, pat, patlen);
272  fprintf(fp, "\n");
273 
274  if (fast_pattern_chop_set) {
275  SCFree(pat);
276  patlen = fp_cd->fp_chop_len;
277  pat = SCMalloc(fp_cd->fp_chop_len + 1);
278  if (unlikely(pat == NULL)) {
279  exit(EXIT_FAILURE);
280  }
281  memcpy(pat, fp_cd->content + fp_cd->fp_chop_offset, fp_cd->fp_chop_len);
282  pat[fp_cd->fp_chop_len] = '\0';
283  fprintf(fp, " Final content: ");
284  PrintRawUriFp(fp, pat, patlen);
285  fprintf(fp, "\n");
286 
287  FpPatternStatsAdd(&de_ctx->ea->fp_pattern_stats[0], list_type, patlen);
288  } else {
289  fprintf(fp, " Final content: ");
290  PrintRawUriFp(fp, pat, patlen);
291  fprintf(fp, "\n");
292 
293  FpPatternStatsAdd(&de_ctx->ea->fp_pattern_stats[0], list_type, patlen);
294  }
295  SCFree(pat);
296 
297  fprintf(fp, "\n");
298 }
299 
300 /**
301  * \brief Sets up the fast pattern analyzer according to the config.
302  *
303  * \retval 1 If rule analyzer successfully enabled.
304  * \retval 0 If not enabled.
305  */
306 static int SetupFPAnalyzer(DetectEngineCtx *de_ctx)
307 {
308  int fp_engine_analysis_set = 0;
309 
310  if ((SCConfGetBool("engine-analysis.rules-fast-pattern", &fp_engine_analysis_set)) == 0) {
311  return false;
312  }
313 
314  if (fp_engine_analysis_set == 0)
315  return false;
316 
317  const char *log_dir = SCConfigGetLogDirectory();
318  char *log_path = SCMalloc(PATH_MAX);
319  if (log_path == NULL) {
320  FatalError("Unable to allocate scratch memory for rule filename");
321  }
322  snprintf(log_path, PATH_MAX, "%s/%s%s", log_dir,
323  de_ctx->ea->file_prefix ? de_ctx->ea->file_prefix : "", "rules_fast_pattern.txt");
324 
325  FILE *fp = fopen(log_path, "w");
326  if (fp == NULL) {
327  SCLogError("failed to open %s: %s", log_path, strerror(errno));
328  SCFree(log_path);
329  return false;
330  }
331 
332  de_ctx->ea->fp_engine_analysis_fp = fp;
333 
334  SCLogInfo("Engine-Analysis for fast_pattern printed to file - %s",
335  log_path);
336  SCFree(log_path);
337 
338  struct timeval tval;
339  gettimeofday(&tval, NULL);
340  struct tm local_tm;
341  struct tm *tms = SCLocalTime(tval.tv_sec, &local_tm);
342  fprintf(fp, "----------------------------------------------"
343  "---------------------\n");
344  fprintf(fp,
345  "Date: %" PRId32 "/%" PRId32 "/%04d -- "
346  "%02d:%02d:%02d\n",
347  tms->tm_mday, tms->tm_mon + 1, tms->tm_year + 1900, tms->tm_hour, tms->tm_min,
348  tms->tm_sec);
349  fprintf(fp, "----------------------------------------------"
350  "---------------------\n");
351 
352  memset(&de_ctx->ea->fp_pattern_stats[0], 0, sizeof(de_ctx->ea->fp_pattern_stats));
353  return true;
354 }
355 
356 /**
357  * \brief Compiles regex for rule analysis
358  * \retval 1 if successful
359  * \retval 0 if on error
360  */
361 static bool PerCentEncodingSetup(EngineAnalysisCtx *ea_ctx)
362 {
363 #define DETECT_PERCENT_ENCODING_REGEX "%[0-9|a-f|A-F]{2}"
364  int en;
365  PCRE2_SIZE eo = 0;
366  int opts = 0; // PCRE2_NEWLINE_ANY??
367 
368  ea_ctx->percent_re = pcre2_compile((PCRE2_SPTR8)DETECT_PERCENT_ENCODING_REGEX,
369  PCRE2_ZERO_TERMINATED, opts, &en, &eo, NULL);
370  if (ea_ctx->percent_re == NULL) {
371  PCRE2_UCHAR errbuffer[256];
372  pcre2_get_error_message(en, errbuffer, sizeof(errbuffer));
373  SCLogError("Compile of \"%s\" failed at offset %d: %s", DETECT_PERCENT_ENCODING_REGEX,
374  (int)eo, errbuffer);
375  return false;
376  }
377 
378  return true;
379 }
380 /**
381  * \brief Sets up the rule analyzer according to the config
382  * \retval 1 if rule analyzer successfully enabled
383  * \retval 0 if not enabled
384  */
385 static int SetupRuleAnalyzer(DetectEngineCtx *de_ctx)
386 {
387  SCConfNode *conf = SCConfGetNode("engine-analysis");
388  int enabled = 0;
389  if (conf != NULL) {
390  const char *value = SCConfNodeLookupChildValue(conf, "rules");
391  if (value && SCConfValIsTrue(value)) {
392  enabled = 1;
393  } else if (value && strcasecmp(value, "warnings-only") == 0) {
394  enabled = 1;
395  rule_warnings_only = 1;
396  }
397  if (enabled) {
398  const char *log_dir;
399  log_dir = SCConfigGetLogDirectory();
400  char log_path[PATH_MAX];
401  snprintf(log_path, sizeof(log_path), "%s/%s%s", log_dir,
402  de_ctx->ea->file_prefix ? de_ctx->ea->file_prefix : "", "rules_analysis.txt");
403  de_ctx->ea->rule_engine_analysis_fp = fopen(log_path, "w");
404  if (de_ctx->ea->rule_engine_analysis_fp == NULL) {
405  SCLogError("failed to open %s: %s", log_path, strerror(errno));
406  return 0;
407  }
408 
409  SCLogInfo("Engine-Analysis for rules printed to file - %s",
410  log_path);
411 
412  struct timeval tval;
413  gettimeofday(&tval, NULL);
414  struct tm local_tm;
415  struct tm *tms = SCLocalTime(tval.tv_sec, &local_tm);
416  fprintf(de_ctx->ea->rule_engine_analysis_fp,
417  "----------------------------------------------"
418  "---------------------\n");
419  fprintf(de_ctx->ea->rule_engine_analysis_fp,
420  "Date: %" PRId32 "/%" PRId32 "/%04d -- "
421  "%02d:%02d:%02d\n",
422  tms->tm_mday, tms->tm_mon + 1, tms->tm_year + 1900, tms->tm_hour, tms->tm_min,
423  tms->tm_sec);
424  fprintf(de_ctx->ea->rule_engine_analysis_fp,
425  "----------------------------------------------"
426  "---------------------\n");
427 
428  /*compile regex's for rule analysis*/
429  if (!PerCentEncodingSetup(de_ctx->ea)) {
430  fprintf(de_ctx->ea->rule_engine_analysis_fp,
431  "Error compiling regex; can't check for percent encoding in normalized "
432  "http content.\n");
433  }
434  }
435  }
436  else {
437  SCLogInfo("Conf parameter \"engine-analysis.rules\" not found. "
438  "Defaulting to not printing the rules analysis report.");
439  }
440  if (!enabled) {
441  SCLogInfo("Engine-Analysis for rules disabled in conf file.");
442  return 0;
443  }
444  return 1;
445 }
446 
447 static void CleanupFPAnalyzer(DetectEngineCtx *de_ctx)
448 {
449  FILE *fp = de_ctx->ea->fp_engine_analysis_fp;
450  if (fp == NULL) {
451  return;
452  }
453  fprintf(fp, "============\n"
454  "Summary:\n============\n");
455 
456  for (int i = 0; i < DETECT_SM_LIST_MAX; i++) {
457  FpPatternStats *f = &de_ctx->ea->fp_pattern_stats[i];
458  if (f->cnt == 0)
459  continue;
460 
461  fprintf(fp,
462  "%s, smallest pattern %u byte(s), longest pattern %u byte(s), number of patterns "
463  "%u, avg pattern len %.2f byte(s)\n",
464  DetectSigmatchListEnumToString(i), f->min, f->max, f->cnt,
465  (float)((double)f->tot / (float)f->cnt));
466  }
467 
468  fclose(de_ctx->ea->fp_engine_analysis_fp);
469  de_ctx->ea->fp_engine_analysis_fp = NULL;
470 }
471 
472 static void CleanupRuleAnalyzer(DetectEngineCtx *de_ctx)
473 {
474  if (de_ctx->ea->rule_engine_analysis_fp != NULL) {
475  fclose(de_ctx->ea->rule_engine_analysis_fp);
476  de_ctx->ea->rule_engine_analysis_fp = NULL;
477  }
478  if (de_ctx->ea->percent_re != NULL) {
479  pcre2_code_free(de_ctx->ea->percent_re);
480  }
481 }
482 
483 void SetupEngineAnalysis(DetectEngineCtx *de_ctx, bool *fp_analysis, bool *rule_analysis)
484 {
485  *fp_analysis = false;
486  *rule_analysis = false;
487 
488  EngineAnalysisCtx *ea = SCCalloc(1, sizeof(EngineAnalysisCtx));
489  if (ea == NULL) {
490  FatalError("Unable to allocate per-engine analysis context");
491  }
492 
493  ea->file_prefix = NULL;
494  size_t cfg_prefix_len = strlen(de_ctx->config_prefix);
495  if (cfg_prefix_len > 0) {
496  char prefix[sizeof(de_ctx->config_prefix) + 1];
497  snprintf(prefix, sizeof(prefix), "%s.", de_ctx->config_prefix);
498  ea->file_prefix = SCStrdup(prefix);
499  if (ea->file_prefix == NULL) {
500  FatalError("Unable to allocate per-engine analysis context name buffer");
501  }
502  }
503 
504  de_ctx->ea = ea;
505 
506  *fp_analysis = SetupFPAnalyzer(de_ctx);
507  *rule_analysis = SetupRuleAnalyzer(de_ctx);
508 
509  if (!(*fp_analysis || *rule_analysis)) {
510  if (ea->file_prefix)
511  SCFree(ea->file_prefix);
512  if (ea->analyzer_items)
513  SCFree(ea->analyzer_items);
514  SCFree(ea);
515  de_ctx->ea = NULL;
516  }
517 }
518 
519 void CleanupEngineAnalysis(DetectEngineCtx *de_ctx)
520 {
521  if (de_ctx->ea) {
522  CleanupRuleAnalyzer(de_ctx);
523  CleanupFPAnalyzer(de_ctx);
524  if (de_ctx->ea->file_prefix)
525  SCFree(de_ctx->ea->file_prefix);
526  if (de_ctx->ea->analyzer_items)
527  SCFree(de_ctx->ea->analyzer_items);
528  SCFree(de_ctx->ea);
529  de_ctx->ea = NULL;
530  }
531 }
532 
533 /**
534  * \brief Checks for % encoding in content.
535  * \param Pointer to content
536  * \retval number of matches if content has % encoding
537  * \retval 0 if it doesn't have % encoding
538  * \retval -1 on error
539  */
540 static int PerCentEncodingMatch(EngineAnalysisCtx *ea_ctx, uint8_t *content, uint16_t content_len)
541 {
542  int ret = 0;
543 
544  pcre2_match_data *match = pcre2_match_data_create_from_pattern(ea_ctx->percent_re, NULL);
545  ret = pcre2_match(ea_ctx->percent_re, (PCRE2_SPTR8)content, content_len, 0, 0, match, NULL);
546  if (ret == -1) {
547  return 0;
548  } else if (ret < -1) {
549  SCLogError("Error parsing content - %s; error code is %d", content, ret);
550  ret = -1;
551  }
552  pcre2_match_data_free(match);
553  return ret;
554 }
555 
556 static void EngineAnalysisRulesPrintFP(const DetectEngineCtx *de_ctx, const Signature *s)
557 {
558  const DetectContentData *fp_cd = NULL;
559  const SigMatch *mpm_sm = s->init_data->mpm_sm;
560  const int mpm_sm_list = s->init_data->mpm_sm_list;
561 
562  if (mpm_sm != NULL) {
563  fp_cd = (DetectContentData *)mpm_sm->ctx;
564  }
565 
566  if (fp_cd == NULL) {
567  return;
568  }
569 
570  uint16_t patlen = fp_cd->content_len;
571  uint8_t *pat = SCMalloc(fp_cd->content_len + 1);
572  if (unlikely(pat == NULL)) {
573  FatalError("Error allocating memory");
574  }
575 
576  EngineAnalysisCtx *ea_ctx = de_ctx->ea;
577 
578  memcpy(pat, fp_cd->content, fp_cd->content_len);
579  pat[fp_cd->content_len] = '\0';
580 
581  if (fp_cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) {
582  SCFree(pat);
583  patlen = fp_cd->fp_chop_len;
584  pat = SCMalloc(fp_cd->fp_chop_len + 1);
585  if (unlikely(pat == NULL)) {
586  exit(EXIT_FAILURE);
587  }
588  memcpy(pat, fp_cd->content + fp_cd->fp_chop_offset, fp_cd->fp_chop_len);
589  pat[fp_cd->fp_chop_len] = '\0';
590  fprintf(ea_ctx->rule_engine_analysis_fp, " Fast Pattern \"");
591  PrintRawUriFp(ea_ctx->rule_engine_analysis_fp, pat, patlen);
592  } else {
593  fprintf(ea_ctx->rule_engine_analysis_fp, " Fast Pattern \"");
594  PrintRawUriFp(ea_ctx->rule_engine_analysis_fp, pat, patlen);
595  }
596  SCFree(pat);
597 
598  fprintf(ea_ctx->rule_engine_analysis_fp, "\" on \"");
599 
600  const int list_type = mpm_sm_list;
601  if (list_type == DETECT_SM_LIST_PMATCH) {
602  int payload = 0;
603  int stream = 0;
604  if (SignatureHasPacketContent(s))
605  payload = 1;
606  if (SignatureHasStreamContent(s))
607  stream = 1;
608  fprintf(ea_ctx->rule_engine_analysis_fp, "%s",
609  payload ? (stream ? "payload and reassembled stream" : "payload")
610  : "reassembled stream");
611  }
612  else {
613  const char *desc = DetectEngineBufferTypeGetDescriptionById(de_ctx, list_type);
614  const char *name = DetectEngineBufferTypeGetNameById(de_ctx, list_type);
615  if (desc && name) {
616  fprintf(ea_ctx->rule_engine_analysis_fp, "%s (%s)", desc, name);
617  } else if (desc || name) {
618  fprintf(ea_ctx->rule_engine_analysis_fp, "%s", desc ? desc : name);
619  }
620 
621  }
622 
623  fprintf(ea_ctx->rule_engine_analysis_fp, "\" ");
624  const DetectBufferType *bt = DetectEngineBufferTypeGetById(de_ctx, list_type);
625  if (bt && bt->transforms.cnt) {
626  fprintf(ea_ctx->rule_engine_analysis_fp, "(with %d transform(s)) ", bt->transforms.cnt);
627  }
628  fprintf(ea_ctx->rule_engine_analysis_fp, "buffer.\n");
629 }
630 
631 void EngineAnalysisRulesFailure(
632  const DetectEngineCtx *de_ctx, const char *line, const char *file, int lineno)
633 {
634  FILE *tmp_fp = de_ctx->ea->fp_engine_analysis_fp ? de_ctx->ea->fp_engine_analysis_fp
635  : de_ctx->ea->rule_engine_analysis_fp;
636  if (tmp_fp) {
637  fprintf(tmp_fp, "== Sid: UNKNOWN ==\n");
638  fprintf(tmp_fp, "%s\n", line);
639  fprintf(tmp_fp, " FAILURE: invalid rule.\n");
640  fprintf(tmp_fp, " File: %s.\n", file);
641  fprintf(tmp_fp, " Line: %d.\n", lineno);
642  fprintf(tmp_fp, "\n");
643  }
644 }
645 
646 typedef struct RuleAnalyzer {
647  SCJsonBuilder *js; /* document root */
648 
649  SCJsonBuilder *js_warnings;
650  SCJsonBuilder *js_notes;
651 } RuleAnalyzer;
652 
653 static void ATTR_FMT_PRINTF(2, 3) AnalyzerNote(RuleAnalyzer *ctx, char *fmt, ...)
654 {
655  va_list ap;
656  char str[1024];
657 
658  va_start(ap, fmt);
659  vsnprintf(str, sizeof(str), fmt, ap);
660  va_end(ap);
661 
662  if (!ctx->js_notes)
663  ctx->js_notes = SCJbNewArray();
664  if (ctx->js_notes)
665  SCJbAppendString(ctx->js_notes, str);
666 }
667 
668 static void ATTR_FMT_PRINTF(2, 3) AnalyzerWarning(RuleAnalyzer *ctx, char *fmt, ...)
669 {
670  va_list ap;
671  char str[1024];
672 
673  va_start(ap, fmt);
674  vsnprintf(str, sizeof(str), fmt, ap);
675  va_end(ap);
676 
677  if (!ctx->js_warnings)
678  ctx->js_warnings = SCJbNewArray();
679  if (ctx->js_warnings)
680  SCJbAppendString(ctx->js_warnings, str);
681 }
682 
683 #define CHECK(pat) if (strlen((pat)) <= len && memcmp((pat), buf, MIN(len, strlen((pat)))) == 0) return true;
684 
685 static bool LooksLikeHTTPMethod(const uint8_t *buf, uint16_t len)
686 {
687  CHECK("GET /");
688  CHECK("POST /");
689  CHECK("HEAD /");
690  CHECK("PUT /");
691  return false;
692 }
693 
694 static bool LooksLikeHTTPUA(const uint8_t *buf, uint16_t len)
695 {
696  CHECK("User-Agent: ");
697  CHECK("\nUser-Agent: ");
698  return false;
699 }
700 
701 static void DumpContent(SCJsonBuilder *js, const DetectContentData *cd)
702 {
703  char pattern_str[1024] = "";
704  DetectContentPatternPrettyPrint(cd->content, cd->content_len, pattern_str, sizeof(pattern_str));
705 
706  SCJbSetString(js, "pattern", pattern_str);
707  SCJbSetUint(js, "length", cd->content_len);
708  SCJbSetBool(js, "nocase", cd->flags & DETECT_CONTENT_NOCASE);
709  SCJbSetBool(js, "negated", cd->flags & DETECT_CONTENT_NEGATED);
710  SCJbSetBool(js, "starts_with", cd->flags & DETECT_CONTENT_STARTS_WITH);
711  SCJbSetBool(js, "ends_with", cd->flags & DETECT_CONTENT_ENDS_WITH);
712  SCJbSetBool(js, "is_mpm", cd->flags & DETECT_CONTENT_MPM);
713  SCJbSetBool(js, "no_double_inspect", cd->flags & DETECT_CONTENT_NO_DOUBLE_INSPECTION_REQUIRED);
714  if (cd->flags & DETECT_CONTENT_OFFSET) {
715  SCJbSetUint(js, "offset", cd->offset);
716  }
717  if (cd->flags & DETECT_CONTENT_DEPTH) {
718  SCJbSetUint(js, "depth", cd->depth);
719  }
720  if (cd->flags & DETECT_CONTENT_DISTANCE) {
721  SCJbSetInt(js, "distance", cd->distance);
722  }
723  if (cd->flags & DETECT_CONTENT_WITHIN) {
724  SCJbSetInt(js, "within", cd->within);
725  }
726  SCJbSetBool(js, "fast_pattern", cd->flags & DETECT_CONTENT_FAST_PATTERN);
727  SCJbSetBool(js, "relative_next", cd->flags & DETECT_CONTENT_RELATIVE_NEXT);
728 }
729 
730 static void DumpPcre(SCJsonBuilder *js, const DetectPcreData *cd)
731 {
732  SCJbSetBool(js, "relative", cd->flags & DETECT_PCRE_RELATIVE);
733  SCJbSetBool(js, "relative_next", cd->flags & DETECT_PCRE_RELATIVE_NEXT);
734  SCJbSetBool(js, "nocase", cd->flags & DETECT_PCRE_CASELESS);
735  SCJbSetBool(js, "negated", cd->flags & DETECT_PCRE_NEGATE);
736 }
737 
738 static void DumpMatches(RuleAnalyzer *ctx, SCJsonBuilder *js, const SigMatchData *smd)
739 {
740  if (smd == NULL)
741  return;
742 
743  SCJbOpenArray(js, "matches");
744  do {
745  SCJbStartObject(js);
746  const char *mname = sigmatch_table[smd->type].name;
747  SCJbSetString(js, "name", mname);
748 
749  switch (smd->type) {
750  case DETECT_CONTENT: {
751  const DetectContentData *cd = (const DetectContentData *)smd->ctx;
752 
753  SCJbOpenObject(js, "content");
754  DumpContent(js, cd);
755  if (cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) {
756  AnalyzerNote(ctx, (char *)"'fast_pattern:only' option is silently ignored and "
757  "is interpreted as regular 'fast_pattern'");
758  }
759  if (LooksLikeHTTPMethod(cd->content, cd->content_len)) {
760  AnalyzerNote(ctx,
761  (char *)"pattern looks like it inspects HTTP, use http.request_line or "
762  "http.method and http.uri instead for improved performance");
763  }
764  if (LooksLikeHTTPUA(cd->content, cd->content_len)) {
765  AnalyzerNote(ctx,
766  (char *)"pattern looks like it inspects HTTP, use http.user_agent "
767  "or http.header for improved performance");
768  }
769  if (cd->flags & DETECT_CONTENT_WITHIN2DEPTH) {
770  AnalyzerNote(ctx, (char *)"'within' option for pattern w/o previous content "
771  "was converted to 'depth'");
772  }
773  if (cd->flags & DETECT_CONTENT_DISTANCE2OFFSET) {
774  AnalyzerNote(ctx, (char *)"'distance' option for pattern w/o previous content "
775  "was converted to 'offset'");
776  }
777  SCJbClose(js);
778  break;
779  }
780  case DETECT_PCRE: {
781  const DetectPcreData *cd = (const DetectPcreData *)smd->ctx;
782 
783  SCJbOpenObject(js, "pcre");
784  DumpPcre(js, cd);
785  SCJbClose(js);
786  if (cd->flags & DETECT_PCRE_RAWBYTES) {
787  AnalyzerNote(ctx,
788  (char *)"'/B' (rawbytes) option is a no-op and is silently ignored");
789  }
790  if (cd->flags & DETECT_PCRE_HAS_UNICODE_CLUSTER) {
791  AnalyzerNote(ctx, (char *)"pcre with \\X (Unicode extended grapheme cluster) "
792  "may be slow");
793  }
794  break;
795  }
796  case DETECT_BYTEJUMP: {
797  const DetectBytejumpData *cd = (const DetectBytejumpData *)smd->ctx;
798 
799  SCJbOpenObject(js, "byte_jump");
800  SCJbSetUint(js, "nbytes", cd->nbytes);
801  SCJbSetInt(js, "offset", cd->offset);
802  SCJbSetUint(js, "multiplier", cd->multiplier);
803  SCJbSetInt(js, "post_offset", cd->post_offset);
804  switch (cd->base) {
805  case DETECT_BYTEJUMP_BASE_UNSET:
806  SCJbSetString(js, "base", "unset");
807  break;
808  case DETECT_BYTEJUMP_BASE_OCT:
809  SCJbSetString(js, "base", "oct");
810  break;
811  case DETECT_BYTEJUMP_BASE_DEC:
812  SCJbSetString(js, "base", "dec");
813  break;
814  case DETECT_BYTEJUMP_BASE_HEX:
815  SCJbSetString(js, "base", "hex");
816  break;
817  }
818  SCJbOpenArray(js, "flags");
819  if (cd->flags & DETECT_BYTEJUMP_BEGIN)
820  SCJbAppendString(js, "from_beginning");
821  if (cd->flags & DETECT_BYTEJUMP_LITTLE)
822  SCJbAppendString(js, "little_endian");
823  if (cd->flags & DETECT_BYTEJUMP_BIG)
824  SCJbAppendString(js, "big_endian");
825  if (cd->flags & DETECT_BYTEJUMP_STRING)
826  SCJbAppendString(js, "string");
827  if (cd->flags & DETECT_BYTEJUMP_RELATIVE)
828  SCJbAppendString(js, "relative");
829  if (cd->flags & DETECT_BYTEJUMP_ALIGN)
830  SCJbAppendString(js, "align");
831  if (cd->flags & DETECT_BYTEJUMP_DCE)
832  SCJbAppendString(js, "dce");
833  if (cd->flags & DETECT_BYTEJUMP_OFFSET_BE)
834  SCJbAppendString(js, "offset_be");
835  if (cd->flags & DETECT_BYTEJUMP_END)
836  SCJbAppendString(js, "from_end");
837  SCJbClose(js);
838  SCJbClose(js);
839  break;
840  }
841  case DETECT_BYTETEST: {
842  const DetectBytetestData *cd = (const DetectBytetestData *)smd->ctx;
843 
844  SCJbOpenObject(js, "byte_test");
845  SCJbSetUint(js, "nbytes", cd->nbytes);
846  SCJbSetInt(js, "offset", cd->offset);
847  switch (cd->base) {
848  case DETECT_BYTETEST_BASE_UNSET:
849  SCJbSetString(js, "base", "unset");
850  break;
851  case DETECT_BYTETEST_BASE_OCT:
852  SCJbSetString(js, "base", "oct");
853  break;
854  case DETECT_BYTETEST_BASE_DEC:
855  SCJbSetString(js, "base", "dec");
856  break;
857  case DETECT_BYTETEST_BASE_HEX:
858  SCJbSetString(js, "base", "hex");
859  break;
860  }
861  SCJbOpenArray(js, "flags");
862  if (cd->flags & DETECT_BYTETEST_LITTLE)
863  SCJbAppendString(js, "little_endian");
864  if (cd->flags & DETECT_BYTETEST_BIG)
865  SCJbAppendString(js, "big_endian");
866  if (cd->flags & DETECT_BYTETEST_STRING)
867  SCJbAppendString(js, "string");
868  if (cd->flags & DETECT_BYTETEST_RELATIVE)
869  SCJbAppendString(js, "relative");
870  if (cd->flags & DETECT_BYTETEST_DCE)
871  SCJbAppendString(js, "dce");
872  SCJbClose(js);
873  SCJbClose(js);
874  break;
875  }
876  case DETECT_ABSENT: {
877  const DetectAbsentData *dad = (const DetectAbsentData *)smd->ctx;
878  SCJbOpenObject(js, "absent");
879  SCJbSetBool(js, "or_else", dad->or_else);
880  SCJbClose(js);
881  break;
882  }
883 
884  case DETECT_IPOPTS: {
885  const DetectIpOptsData *cd = (const DetectIpOptsData *)smd->ctx;
886 
887  SCJbOpenObject(js, "ipopts");
888  const char *flag = IpOptsFlagToString(cd->ipopt);
889  SCJbSetString(js, "option", flag);
890  SCJbClose(js);
891  break;
892  }
893  case DETECT_FLOWBITS: {
894  const DetectFlowbitsData *cd = (const DetectFlowbitsData *)smd->ctx;
895 
896  SCJbOpenObject(js, "flowbits");
897  switch (cd->cmd) {
898  case DETECT_FLOWBITS_CMD_ISSET:
899  SCJbSetString(js, "cmd", "isset");
900  break;
901  case DETECT_FLOWBITS_CMD_ISNOTSET:
902  SCJbSetString(js, "cmd", "isnotset");
903  break;
904  case DETECT_FLOWBITS_CMD_SET:
905  SCJbSetString(js, "cmd", "set");
906  break;
907  case DETECT_FLOWBITS_CMD_UNSET:
908  SCJbSetString(js, "cmd", "unset");
909  break;
910  }
911  bool is_or = false;
912  SCJbOpenArray(js, "names");
913  if (cd->or_list_size == 0) {
914  SCJbAppendString(js, VarNameStoreSetupLookup(cd->idx, VAR_TYPE_FLOW_BIT));
915  } else if (cd->or_list_size > 0) {
916  is_or = true;
917  for (uint8_t i = 0; i < cd->or_list_size; i++) {
918  const char *varname =
919  VarNameStoreSetupLookup(cd->or_list[i], VAR_TYPE_FLOW_BIT);
920  SCJbAppendString(js, varname);
921  }
922  }
923  SCJbClose(js); // array
924  if (is_or) {
925  SCJbSetString(js, "operator", "or");
926  }
927  SCJbClose(js); // object
928  break;
929  }
930  case DETECT_XBITS: {
931  const DetectXbitsData *xd = (const DetectXbitsData *)smd->ctx;
932 
933  SCJbOpenObject(js, "xbits");
934  switch (xd->cmd) {
935  case DETECT_XBITS_CMD_ISSET:
936  SCJbSetString(js, "cmd", "isset");
937  break;
938  case DETECT_XBITS_CMD_ISNOTSET:
939  SCJbSetString(js, "cmd", "isnotset");
940  break;
941  case DETECT_XBITS_CMD_SET:
942  SCJbSetString(js, "cmd", "set");
943  break;
944  case DETECT_XBITS_CMD_UNSET:
945  SCJbSetString(js, "cmd", "unset");
946  break;
947  case DETECT_XBITS_CMD_TOGGLE:
948  SCJbSetString(js, "cmd", "toggle");
949  break;
950  }
951  SCJbSetString(js, "name", VarNameStoreSetupLookup(xd->idx, xd->type));
952  switch (xd->tracker) {
953  case DETECT_XBITS_TRACK_IPSRC:
954  SCJbSetString(js, "track", "ip_src");
955  break;
956  case DETECT_XBITS_TRACK_IPDST:
957  SCJbSetString(js, "track", "ip_dst");
958  break;
959  case DETECT_XBITS_TRACK_IPPAIR:
960  SCJbSetString(js, "track", "ip_pair");
961  break;
962  case DETECT_XBITS_TRACK_TX:
963  SCJbSetString(js, "track", "tx");
964  break;
965  }
966  // always log expire value
967  SCJbSetUint(js, "expire", xd->expire);
968  SCJbClose(js); // object
969  break;
970  }
971  case DETECT_FLOWINT: {
972  const DetectFlowintData *cd = (const DetectFlowintData *)smd->ctx;
973 
974  SCJbOpenObject(js, "flowint");
975  switch (cd->modifier) {
976  case FLOWINT_MODIFIER_SET:
977  SCJbSetString(js, "cmd", "set");
978  break;
979  case FLOWINT_MODIFIER_ADD:
980  SCJbSetString(js, "cmd", "add");
981  break;
982  case FLOWINT_MODIFIER_SUB:
983  SCJbSetString(js, "cmd", "sub");
984  break;
985  case FLOWINT_MODIFIER_LT:
986  SCJbSetString(js, "cmd", "lt");
987  break;
988  case FLOWINT_MODIFIER_LE:
989  SCJbSetString(js, "cmd", "lte");
990  break;
991  case FLOWINT_MODIFIER_EQ:
992  SCJbSetString(js, "cmd", "eq");
993  break;
994  case FLOWINT_MODIFIER_NE:
995  SCJbSetString(js, "cmd", "ne");
996  break;
997  case FLOWINT_MODIFIER_GE:
998  SCJbSetString(js, "cmd", "gte");
999  break;
1000  case FLOWINT_MODIFIER_GT:
1001  SCJbSetString(js, "cmd", "gt");
1002  break;
1003  case FLOWINT_MODIFIER_ISSET:
1004  SCJbSetString(js, "cmd", "isset");
1005  break;
1006  case FLOWINT_MODIFIER_ISNOTSET:
1007  SCJbSetString(js, "cmd", "isnotset");
1008  break;
1009  }
1010  const char *varname = VarNameStoreSetupLookup(cd->idx, VAR_TYPE_FLOW_INT);
1011  if (varname != NULL) {
1012  SCJbSetString(js, "var", varname);
1013  }
1014  if (cd->targettype == FLOWINT_TARGET_VAL) {
1015  SCJbSetUint(js, "value", cd->target.value);
1016  } else if (cd->targettype == FLOWINT_TARGET_VAR) {
1017  if (cd->target.tvar.name != NULL) {
1018  SCJbSetString(js, "target", cd->target.tvar.name);
1019  }
1020  }
1021  SCJbClose(js);
1022  break;
1023  }
1024  case DETECT_ACK: {
1025  const DetectU32Data *cd = (const DetectU32Data *)smd->ctx;
1026  SCJbOpenObject(js, "ack");
1027  SCDetectU32ToJson(js, cd);
1028  SCJbClose(js);
1029  break;
1030  }
1031  case DETECT_SEQ: {
1032  const DetectU32Data *cd = (const DetectU32Data *)smd->ctx;
1033  SCJbOpenObject(js, "seq");
1034  SCDetectU32ToJson(js, cd);
1035  SCJbClose(js);
1036  break;
1037  }
1038  case DETECT_TCPMSS: {
1039  const DetectU16Data *cd = (const DetectU16Data *)smd->ctx;
1040  SCJbOpenObject(js, "tcp_mss");
1041  SCDetectU16ToJson(js, cd);
1042  SCJbClose(js);
1043  break;
1044  }
1045  case DETECT_DSIZE: {
1046  const DetectU16Data *cd = (const DetectU16Data *)smd->ctx;
1047  SCJbOpenObject(js, "dsize");
1048  SCDetectU16ToJson(js, cd);
1049  SCJbClose(js);
1050  break;
1051  }
1052  case DETECT_ICODE: {
1053  const DetectU8Data *cd = (const DetectU8Data *)smd->ctx;
1054  SCJbOpenObject(js, "code");
1055  SCDetectU8ToJson(js, cd);
1056  SCJbClose(js);
1057  break;
1058  }
1059  case DETECT_TTL: {
1060  const DetectU8Data *cd = (const DetectU8Data *)smd->ctx;
1061  SCJbOpenObject(js, "ttl");
1062  SCDetectU8ToJson(js, cd);
1063  SCJbClose(js);
1064  break;
1065  }
1066  case DETECT_ICMP_ID: {
1067  const DetectU16Data *cd = (const DetectU16Data *)smd->ctx;
1068  SCJbOpenObject(js, "id");
1069  SCDetectU16ToJson(js, cd);
1070  SCJbClose(js);
1071  break;
1072  }
1073  case DETECT_WINDOW: {
1074  const DetectU16Data *cd = (const DetectU16Data *)smd->ctx;
1075  SCJbOpenObject(js, "window");
1076  SCDetectU16ToJson(js, cd);
1077  SCJbClose(js);
1078  break;
1079  }
1080  case DETECT_FLOW_AGE: {
1081  const DetectU32Data *cd = (const DetectU32Data *)smd->ctx;
1082  SCJbOpenObject(js, "flow_age");
1083  SCDetectU32ToJson(js, cd);
1084  SCJbClose(js);
1085  break;
1086  }
1087  case DETECT_FLOW_ELEPHANT: {
1088  const uint8_t *dfd = (const uint8_t *)smd->ctx;
1089  SCJbOpenObject(js, "flow_elephant");
1090  switch (*dfd) {
1091  case DETECT_FLOW_TOSERVER:
1092  SCJbSetString(js, "dir", "toserver");
1093  break;
1094  case DETECT_FLOW_TOCLIENT:
1095  SCJbSetString(js, "dir", "toclient");
1096  break;
1097  case DETECT_FLOW_TOEITHER:
1098  SCJbSetString(js, "dir", "either");
1099  break;
1100  case DETECT_FLOW_TOBOTH:
1101  SCJbSetString(js, "dir", "both");
1102  break;
1103  }
1104  SCJbClose(js);
1105  break;
1106  }
1107  case DETECT_APP_LAYER_PROTOCOL: {
1108  const DetectAppLayerProtocolData *ad = (const DetectAppLayerProtocolData *)smd->ctx;
1109  SCJbOpenObject(js, "app_layer_protocol");
1110  AppProto vals[256];
1111  uint16_t n = DetectAppLayerProtocolGetValues(ad, vals, ARRAY_SIZE(vals));
1112  SCJbOpenArray(js, "protocols");
1113  for (uint16_t i = 0; i < n; i++) {
1114  SCJbAppendString(js, AppProtoToString(vals[i]));
1115  }
1116  SCJbClose(js);
1117  SCJbSetString(js, "mode", DetectAppLayerProtocolModeName(ad->mode));
1118  SCJbSetBool(js, "negated", ad->negated);
1119  SCJbClose(js);
1120  break;
1121  }
1122  case DETECT_TCP_SESSION: {
1123  const DetectTcpSessionData *tsd = (const DetectTcpSessionData *)smd->ctx;
1124  SCJbOpenObject(js, "tcp_session");
1125  SCJbOpenArray(js, "phases");
1126  if (tsd->phase_flags & DETECT_TCP_SESSION_PHASE_SETUP)
1127  SCJbAppendString(js, "setup");
1128  if (tsd->phase_flags & DETECT_TCP_SESSION_PHASE_ESTABLISHED)
1129  SCJbAppendString(js, "established");
1130  if (tsd->phase_flags & DETECT_TCP_SESSION_PHASE_CLOSING)
1131  SCJbAppendString(js, "closing");
1132  SCJbClose(js); // phases
1133  SCJbClose(js); // tcp_session
1134  break;
1135  }
1136  }
1137  SCJbClose(js);
1138 
1139  if (smd->is_last)
1140  break;
1141  smd++;
1142  } while (1);
1143  SCJbClose(js);
1144 }
1145 
1146 SCMutex g_rules_analyzer_write_m = SCMUTEX_INITIALIZER;
1147 void EngineAnalysisRules2(const DetectEngineCtx *de_ctx, const Signature *s)
1148 {
1149  SCEnter();
1150 
1151  RuleAnalyzer ctx = { NULL, NULL, NULL };
1152 
1153  ctx.js = SCJbNewObject();
1154  if (ctx.js == NULL)
1155  SCReturn;
1156 
1157  if (s->init_data->firewall_rule) {
1158  JB_SET_STRING(ctx.js, "class", "firewall");
1159  } else {
1160  JB_SET_STRING(ctx.js, "class", "threat detection");
1161  }
1162 
1163  SCJbSetString(ctx.js, "raw", s->sig_str);
1164  SCJbSetUint(ctx.js, "id", s->id);
1165  SCJbSetUint(ctx.js, "gid", s->gid);
1166  SCJbSetUint(ctx.js, "rev", s->rev);
1167  SCJbSetString(ctx.js, "msg", s->msg);
1168 
1169  const char *alproto = AppProtoToString(s->alproto);
1170  SCJbSetString(ctx.js, "app_proto", alproto);
1171 
1172  SCJbOpenArray(ctx.js, "requirements");
1173  if (s->mask & SIG_MASK_REQUIRE_PAYLOAD) {
1174  SCJbAppendString(ctx.js, "payload");
1175  }
1176  if (s->mask & SIG_MASK_REQUIRE_NO_PAYLOAD) {
1177  SCJbAppendString(ctx.js, "no_payload");
1178  }
1179  if (s->mask & SIG_MASK_REQUIRE_FLOW) {
1180  SCJbAppendString(ctx.js, "flow");
1181  }
1182  if (s->mask & SIG_MASK_REQUIRE_FLAGS_INITDEINIT) {
1183  SCJbAppendString(ctx.js, "tcp_flags_init_deinit");
1184  }
1185  if (s->mask & SIG_MASK_REQUIRE_FLAGS_UNUSUAL) {
1186  SCJbAppendString(ctx.js, "tcp_flags_unusual");
1187  }
1188  if (s->mask & SIG_MASK_REQUIRE_ENGINE_EVENT) {
1189  SCJbAppendString(ctx.js, "engine_event");
1190  }
1191  if (s->mask & SIG_MASK_REQUIRE_REAL_PKT) {
1192  SCJbAppendString(ctx.js, "real_pkt");
1193  }
1194  SCJbClose(ctx.js);
1195 
1196  SCJbOpenObject(ctx.js, "match_policy");
1197  SCJbOpenArray(ctx.js, "actions");
1198  if (s->action & ACTION_ALERT) {
1199  SCJbAppendString(ctx.js, "alert");
1200  }
1201  if (s->action & ACTION_DROP) {
1202  SCJbAppendString(ctx.js, "drop");
1203  }
1204  if (s->action & ACTION_REJECT) {
1205  SCJbAppendString(ctx.js, "reject");
1206  }
1207  if (s->action & ACTION_REJECT_DST) {
1208  SCJbAppendString(ctx.js, "reject_dst");
1209  }
1210  if (s->action & ACTION_REJECT_BOTH) {
1211  SCJbAppendString(ctx.js, "reject_both");
1212  }
1213  if (s->action & ACTION_CONFIG) {
1214  SCJbAppendString(ctx.js, "config");
1215  }
1216  if (s->action & ACTION_PASS) {
1217  SCJbAppendString(ctx.js, "pass");
1218  }
1219  if (s->action & ACTION_ACCEPT) {
1220  SCJbAppendString(ctx.js, "accept");
1221  }
1222  SCJbClose(ctx.js);
1223 
1224  if (s->action_scope == ACTION_SCOPE_AUTO) {
1225  enum SignaturePropertyFlowAction flow_action = signature_properties[s->type].flow_action;
1226  switch (flow_action) {
1227  case SIG_PROP_FLOW_ACTION_PACKET:
1228  SCJbSetString(ctx.js, "scope", "packet");
1229  break;
1230  case SIG_PROP_FLOW_ACTION_FLOW:
1231  SCJbSetString(ctx.js, "scope", "flow");
1232  break;
1233  case SIG_PROP_FLOW_ACTION_FLOW_IF_STATEFUL:
1234  SCJbSetString(ctx.js, "scope", "flow_if_stateful");
1235  break;
1236  }
1237  } else {
1238  enum ActionScope as = s->action_scope;
1239  switch (as) {
1240  case ACTION_SCOPE_PACKET:
1241  SCJbSetString(ctx.js, "scope", "packet");
1242  break;
1243  case ACTION_SCOPE_FLOW:
1244  SCJbSetString(ctx.js, "scope", "flow");
1245  break;
1246  case ACTION_SCOPE_HOOK:
1247  SCJbSetString(ctx.js, "scope", "hook");
1248  break;
1249  case ACTION_SCOPE_TX:
1250  SCJbSetString(ctx.js, "scope", "tx");
1251  break;
1252  case ACTION_SCOPE_AUTO: /* should be unreachable */
1253  break;
1254  }
1255  }
1256  SCJbClose(ctx.js);
1257 
1258  switch (s->type) {
1259  case SIG_TYPE_NOT_SET:
1260  SCJbSetString(ctx.js, "type", "unset");
1261  break;
1262  case SIG_TYPE_IPONLY:
1263  SCJbSetString(ctx.js, "type", "ip_only");
1264  break;
1265  case SIG_TYPE_LIKE_IPONLY:
1266  SCJbSetString(ctx.js, "type", "like_ip_only");
1267  break;
1268  case SIG_TYPE_PDONLY:
1269  SCJbSetString(ctx.js, "type", "pd_only");
1270  break;
1271  case SIG_TYPE_DEONLY:
1272  SCJbSetString(ctx.js, "type", "de_only");
1273  break;
1274  case SIG_TYPE_PKT:
1275  SCJbSetString(ctx.js, "type", "pkt");
1276  break;
1277  case SIG_TYPE_PKT_STREAM:
1278  SCJbSetString(ctx.js, "type", "pkt_stream");
1279  break;
1280  case SIG_TYPE_STREAM:
1281  SCJbSetString(ctx.js, "type", "stream");
1282  break;
1283  case SIG_TYPE_APPLAYER:
1284  SCJbSetString(ctx.js, "type", "app_layer");
1285  break;
1286  case SIG_TYPE_APP_TX:
1287  SCJbSetString(ctx.js, "type", "app_tx");
1288  break;
1289  case SIG_TYPE_MAX:
1290  SCJbSetString(ctx.js, "type", "error");
1291  break;
1292  }
1293 
1294  // dependencies object and its subfields only logged if we have values
1295  if (s->init_data->is_rule_state_dependant) {
1296  SCJbOpenObject(ctx.js, "dependencies");
1297  SCJbOpenObject(ctx.js, "flowbits");
1298  SCJbOpenObject(ctx.js, "upstream");
1299  if (s->init_data->rule_state_dependant_sids_size > 0) {
1300  SCJbOpenObject(ctx.js, "state_modifying_rules");
1301  SCJbOpenArray(ctx.js, "sids");
1302  for (uint32_t i = 0; i < s->init_data->rule_state_dependant_sids_idx; i++) {
1303  SCJbAppendUint(ctx.js, s->init_data->rule_state_dependant_sids_array[i]);
1304  }
1305  SCJbClose(ctx.js); // sids
1306  SCJbOpenArray(ctx.js, "names");
1307  for (uint32_t i = 0; i < s->init_data->rule_state_flowbits_ids_size - 1; i++) {
1308  if (s->init_data->rule_state_flowbits_ids_array[i] != 0) {
1309  SCJbAppendString(ctx.js,
1310  VarNameStoreSetupLookup(s->init_data->rule_state_flowbits_ids_array[i],
1311  VAR_TYPE_FLOW_BIT));
1312  }
1313  }
1314  SCJbClose(ctx.js); // names
1315  SCJbClose(ctx.js); // state_modifying_rules
1316  }
1317  SCJbClose(ctx.js); // upstream
1318  SCJbClose(ctx.js); // flowbits
1319  SCJbClose(ctx.js); // dependencies
1320  }
1321 
1322  SCJbOpenArray(ctx.js, "flags");
1323  if (s->flags & SIG_FLAG_SRC_ANY) {
1324  SCJbAppendString(ctx.js, "src_any");
1325  }
1326  if (s->flags & SIG_FLAG_DST_ANY) {
1327  SCJbAppendString(ctx.js, "dst_any");
1328  }
1329  if (s->flags & SIG_FLAG_SP_ANY) {
1330  SCJbAppendString(ctx.js, "sp_any");
1331  }
1332  if (s->flags & SIG_FLAG_DP_ANY) {
1333  SCJbAppendString(ctx.js, "dp_any");
1334  }
1335  if ((s->action & ACTION_ALERT) == 0) {
1336  SCJbAppendString(ctx.js, "noalert");
1337  }
1338  if (s->flags & SIG_FLAG_DSIZE) {
1339  SCJbAppendString(ctx.js, "dsize");
1340  }
1341  if (s->flags & SIG_FLAG_APPLAYER) {
1342  SCJbAppendString(ctx.js, "applayer");
1343  }
1344  if (s->flags & SIG_FLAG_REQUIRE_PACKET) {
1345  SCJbAppendString(ctx.js, "need_packet");
1346  }
1347  if (s->flags & SIG_FLAG_REQUIRE_STREAM) {
1348  SCJbAppendString(ctx.js, "need_stream");
1349  }
1350  if (s->flags & SIG_FLAG_MPM_NEG) {
1351  SCJbAppendString(ctx.js, "negated_mpm");
1352  }
1353  if (s->flags & SIG_FLAG_FLUSH) {
1354  SCJbAppendString(ctx.js, "flush");
1355  }
1356  if (s->flags & SIG_FLAG_REQUIRE_FLOWVAR) {
1357  SCJbAppendString(ctx.js, "need_flowvar");
1358  }
1359  if (s->flags & SIG_FLAG_FILESTORE) {
1360  SCJbAppendString(ctx.js, "filestore");
1361  }
1362  if (s->flags & SIG_FLAG_TOSERVER) {
1363  SCJbAppendString(ctx.js, "toserver");
1364  }
1365  if (s->flags & SIG_FLAG_TOCLIENT) {
1366  SCJbAppendString(ctx.js, "toclient");
1367  }
1368  if (s->flags & SIG_FLAG_TLSSTORE) {
1369  SCJbAppendString(ctx.js, "tlsstore");
1370  }
1371  if (s->flags & SIG_FLAG_BYPASS) {
1372  SCJbAppendString(ctx.js, "bypass");
1373  }
1374  if (s->flags & SIG_FLAG_PREFILTER) {
1375  SCJbAppendString(ctx.js, "prefilter");
1376  }
1377  if (s->flags & SIG_FLAG_SRC_IS_TARGET) {
1378  SCJbAppendString(ctx.js, "src_is_target");
1379  }
1380  if (s->flags & SIG_FLAG_DEST_IS_TARGET) {
1381  SCJbAppendString(ctx.js, "dst_is_target");
1382  }
1383  SCJbClose(ctx.js);
1384 
1385  const DetectEnginePktInspectionEngine *pkt_mpm = NULL;
1386  const DetectEngineAppInspectionEngine *app_mpm = NULL;
1387 
1388  SCJbOpenArray(ctx.js, "pkt_engines");
1389  const DetectEnginePktInspectionEngine *pkt = s->pkt_inspect;
1390  for ( ; pkt != NULL; pkt = pkt->next) {
1391  const char *name = DetectEngineBufferTypeGetNameById(de_ctx, pkt->sm_list);
1392  if (name == NULL) {
1393  switch (pkt->sm_list) {
1394  case DETECT_SM_LIST_PMATCH:
1395  name = "payload";
1396  break;
1397  case DETECT_SM_LIST_MATCH:
1398  name = "packet";
1399  break;
1400  default:
1401  name = "unknown";
1402  break;
1403  }
1404  }
1405  SCJbStartObject(ctx.js);
1406  SCJbSetString(ctx.js, "name", name);
1407  SCJbSetBool(ctx.js, "is_mpm", pkt->mpm);
1408  if (pkt->v1.transforms != NULL) {
1409  SCJbOpenArray(ctx.js, "transforms");
1410  for (int t = 0; t < pkt->v1.transforms->cnt; t++) {
1411  SCJbStartObject(ctx.js);
1412  SCJbSetString(ctx.js, "name",
1413  sigmatch_table[pkt->v1.transforms->transforms[t].transform].name);
1414  SCJbClose(ctx.js);
1415  }
1416  SCJbClose(ctx.js);
1417  }
1418  DumpMatches(&ctx, ctx.js, pkt->smd);
1419  SCJbClose(ctx.js);
1420  if (pkt->mpm) {
1421  pkt_mpm = pkt;
1422  }
1423  }
1424  SCJbClose(ctx.js);
1425  SCJbOpenArray(ctx.js, "frame_engines");
1426  const DetectEngineFrameInspectionEngine *frame = s->frame_inspect;
1427  for (; frame != NULL; frame = frame->next) {
1428  const char *name = DetectEngineBufferTypeGetNameById(de_ctx, frame->sm_list);
1429  SCJbStartObject(ctx.js);
1430  SCJbSetString(ctx.js, "name", name);
1431  SCJbSetBool(ctx.js, "is_mpm", frame->mpm);
1432  if (frame->v1.transforms != NULL) {
1433  SCJbOpenArray(ctx.js, "transforms");
1434  for (int t = 0; t < frame->v1.transforms->cnt; t++) {
1435  SCJbStartObject(ctx.js);
1436  SCJbSetString(ctx.js, "name",
1437  sigmatch_table[frame->v1.transforms->transforms[t].transform].name);
1438  SCJbClose(ctx.js);
1439  }
1440  SCJbClose(ctx.js);
1441  }
1442  DumpMatches(&ctx, ctx.js, frame->smd);
1443  SCJbClose(ctx.js);
1444  }
1445  SCJbClose(ctx.js);
1446 
1447  if (s->init_data->init_flags & SIG_FLAG_INIT_STATE_MATCH) {
1448  bool has_stream = false;
1449  bool has_client_body_mpm = false;
1450  bool has_file_data_mpm = false;
1451 
1452  SCJbOpenArray(ctx.js, "engines");
1453  const DetectEngineAppInspectionEngine *app = s->app_inspect;
1454  for ( ; app != NULL; app = app->next) {
1455  const char *name = DetectEngineBufferTypeGetNameById(de_ctx, app->sm_list);
1456  if (name == NULL) {
1457  switch (app->sm_list) {
1458  case DETECT_SM_LIST_PMATCH:
1459  name = "stream";
1460  break;
1461  default:
1462  name = "unknown";
1463  break;
1464  }
1465  }
1466 
1467  if (app->sm_list == DETECT_SM_LIST_PMATCH && !app->mpm) {
1468  has_stream = true;
1469  } else if (app->mpm && strcmp(name, "http_client_body") == 0) {
1470  has_client_body_mpm = true;
1471  } else if (app->mpm && strcmp(name, "file_data") == 0) {
1472  has_file_data_mpm = true;
1473  }
1474 
1475  SCJbStartObject(ctx.js);
1476  SCJbSetString(ctx.js, "name", name);
1477  const char *direction = app->dir == 0 ? "toserver" : "toclient";
1478  SCJbSetString(ctx.js, "direction", direction);
1479  SCJbSetBool(ctx.js, "is_mpm", app->mpm);
1480  SCJbSetString(ctx.js, "app_proto", AppProtoToString(app->alproto));
1481  SCJbSetUint(ctx.js, "progress", app->progress);
1482  if (app->sub_state)
1483  SCJbSetString(ctx.js, "sub_state",
1484  AppLayerParserGetSubStateName(app->alproto, app->sub_state));
1485 
1486  if (app->v2.transforms != NULL) {
1487  SCJbOpenArray(ctx.js, "transforms");
1488  for (int t = 0; t < app->v2.transforms->cnt; t++) {
1489  SCJbStartObject(ctx.js);
1490  SCJbSetString(ctx.js, "name",
1491  sigmatch_table[app->v2.transforms->transforms[t].transform].name);
1492  SCJbClose(ctx.js);
1493  }
1494  SCJbClose(ctx.js);
1495  }
1496  DumpMatches(&ctx, ctx.js, app->smd);
1497  SCJbClose(ctx.js);
1498  if (app->mpm) {
1499  app_mpm = app;
1500  }
1501  }
1502  SCJbClose(ctx.js);
1503 
1504  if (has_stream && has_client_body_mpm)
1505  AnalyzerNote(&ctx, (char *)"mpm in http_client_body combined with stream match leads to stream buffering");
1506  if (has_stream && has_file_data_mpm)
1507  AnalyzerNote(&ctx, (char *)"mpm in file_data combined with stream match leads to stream buffering");
1508  }
1509 
1510  SCJbOpenObject(ctx.js, "lists");
1511  for (int i = 0; i < DETECT_SM_LIST_MAX; i++) {
1512  if (s->sm_arrays[i] != NULL) {
1513  SCJbOpenObject(ctx.js, DetectListToHumanString(i));
1514  DumpMatches(&ctx, ctx.js, s->sm_arrays[i]);
1515  SCJbClose(ctx.js);
1516  }
1517  }
1518  SCJbClose(ctx.js);
1519 
1520  if (pkt_mpm || app_mpm) {
1521  SCJbOpenObject(ctx.js, "mpm");
1522 
1523  int mpm_list = pkt_mpm ? DETECT_SM_LIST_PMATCH : app_mpm->sm_list;
1524  const char *name;
1525  if (mpm_list < DETECT_SM_LIST_DYNAMIC_START)
1526  name = DetectListToHumanString(mpm_list);
1527  else
1528  name = DetectEngineBufferTypeGetNameById(de_ctx, mpm_list);
1529  SCJbSetString(ctx.js, "buffer", name);
1530 
1531  SigMatchData *smd = pkt_mpm ? pkt_mpm->smd : app_mpm->smd;
1532  if (smd == NULL) {
1533  DEBUG_VALIDATE_BUG_ON(mpm_list != DETECT_SM_LIST_PMATCH);
1534  smd = s->sm_arrays[mpm_list];
1535  }
1536  do {
1537  switch (smd->type) {
1538  case DETECT_CONTENT: {
1539  const DetectContentData *cd = (const DetectContentData *)smd->ctx;
1540  if (cd->flags & DETECT_CONTENT_MPM) {
1541  DumpContent(ctx.js, cd);
1542  }
1543  break;
1544  }
1545  }
1546 
1547  if (smd->is_last)
1548  break;
1549  smd++;
1550  } while (1);
1551  SCJbClose(ctx.js);
1552  } else if (s->init_data->prefilter_sm) {
1553  SCJbOpenObject(ctx.js, "prefilter");
1554  int prefilter_list = SigMatchListSMBelongsTo(s, s->init_data->prefilter_sm);
1555  const char *name;
1556  if (prefilter_list < DETECT_SM_LIST_DYNAMIC_START)
1557  name = DetectListToHumanString(prefilter_list);
1558  else
1559  name = DetectEngineBufferTypeGetNameById(de_ctx, prefilter_list);
1560  SCJbSetString(ctx.js, "buffer", name);
1561  const char *mname = sigmatch_table[s->init_data->prefilter_sm->type].name;
1562  SCJbSetString(ctx.js, "name", mname);
1563  SCJbClose(ctx.js);
1564  }
1565 
1566  if (ctx.js_warnings) {
1567  SCJbClose(ctx.js_warnings);
1568  SCJbSetObject(ctx.js, "warnings", ctx.js_warnings);
1569  SCJbFree(ctx.js_warnings);
1570  ctx.js_warnings = NULL;
1571  }
1572  if (ctx.js_notes) {
1573  SCJbClose(ctx.js_notes);
1574  SCJbSetObject(ctx.js, "notes", ctx.js_notes);
1575  SCJbFree(ctx.js_notes);
1576  ctx.js_notes = NULL;
1577  }
1578  SCJbClose(ctx.js);
1579 
1580  const char *filename = "rules.json";
1581  const char *log_dir = SCConfigGetLogDirectory();
1582  char json_path[PATH_MAX] = "";
1583  snprintf(json_path, sizeof(json_path), "%s/%s%s", log_dir,
1584  de_ctx->ea->file_prefix ? de_ctx->ea->file_prefix : "", filename);
1585 
1586  SCMutexLock(&g_rules_analyzer_write_m);
1587  FILE *fp = fopen(json_path, "a");
1588  if (fp != NULL) {
1589  fwrite(SCJbPtr(ctx.js), SCJbLen(ctx.js), 1, fp);
1590  fprintf(fp, "\n");
1591  fclose(fp);
1592  }
1593  SCMutexUnlock(&g_rules_analyzer_write_m);
1594  SCJbFree(ctx.js);
1595  SCReturn;
1596 }
1597 
1598 void DumpPatterns(DetectEngineCtx *de_ctx)
1599 {
1600  if (de_ctx->pattern_hash_table == NULL)
1601  return;
1602 
1603  SCJsonBuilder *root_jb = SCJbNewObject();
1604  if (root_jb == NULL) {
1605  return;
1606  }
1607  SCJsonBuilder **arrays = SCCalloc(de_ctx->buffer_type_id, sizeof(SCJsonBuilder *));
1608  if (arrays == NULL) {
1609  SCJbFree(root_jb);
1610  return;
1611  }
1612 
1613  SCJbOpenArray(root_jb, "buffers");
1614 
1615  for (HashListTableBucket *htb = HashListTableGetListHead(de_ctx->pattern_hash_table);
1616  htb != NULL; htb = HashListTableGetListNext(htb)) {
1617  char str[1024] = "";
1618  DetectPatternTracker *p = HashListTableGetListData(htb);
1619  DetectContentPatternPrettyPrint(p->cd->content, p->cd->content_len, str, sizeof(str));
1620 
1621  SCJsonBuilder *jb = arrays[p->sm_list];
1622  if (arrays[p->sm_list] == NULL) {
1623  jb = arrays[p->sm_list] = SCJbNewObject();
1624  const char *name;
1625  if (p->sm_list < DETECT_SM_LIST_DYNAMIC_START)
1626  name = DetectListToHumanString(p->sm_list);
1627  else
1628  name = DetectEngineBufferTypeGetNameById(de_ctx, p->sm_list);
1629  SCJbSetString(jb, "name", name);
1630  SCJbSetUint(jb, "list_id", p->sm_list);
1631 
1632  SCJbOpenArray(jb, "patterns");
1633  }
1634 
1635  SCJbStartObject(jb);
1636  SCJbSetString(jb, "pattern", str);
1637  SCJbSetUint(jb, "patlen", p->cd->content_len);
1638  SCJbSetUint(jb, "cnt", p->cnt);
1639  SCJbSetUint(jb, "mpm", p->mpm);
1640  SCJbOpenObject(jb, "flags");
1641  SCJbSetBool(jb, "nocase", p->cd->flags & DETECT_CONTENT_NOCASE);
1642  SCJbSetBool(jb, "negated", p->cd->flags & DETECT_CONTENT_NEGATED);
1643  SCJbSetBool(jb, "depth", p->cd->flags & DETECT_CONTENT_DEPTH);
1644  SCJbSetBool(jb, "offset", p->cd->flags & DETECT_CONTENT_OFFSET);
1645  SCJbSetBool(jb, "endswith", p->cd->flags & DETECT_CONTENT_ENDS_WITH);
1646  SCJbClose(jb);
1647  SCJbClose(jb);
1648  }
1649 
1650  for (uint32_t i = 0; i < de_ctx->buffer_type_id; i++) {
1651  SCJsonBuilder *jb = arrays[i];
1652  if (jb == NULL)
1653  continue;
1654 
1655  SCJbClose(jb); // array
1656  SCJbClose(jb); // object
1657 
1658  SCJbAppendObject(root_jb, jb);
1659  SCJbFree(jb);
1660  }
1661  SCJbClose(root_jb);
1662  SCJbClose(root_jb);
1663 
1664  const char *filename = "patterns.json";
1665  const char *log_dir = SCConfigGetLogDirectory();
1666  char json_path[PATH_MAX] = "";
1667  snprintf(json_path, sizeof(json_path), "%s/%s%s", log_dir,
1668  de_ctx->ea->file_prefix ? de_ctx->ea->file_prefix : "", filename);
1669 
1670  SCMutexLock(&g_rules_analyzer_write_m);
1671  FILE *fp = fopen(json_path, "a");
1672  if (fp != NULL) {
1673  fwrite(SCJbPtr(root_jb), SCJbLen(root_jb), 1, fp);
1674  fprintf(fp, "\n");
1675  fclose(fp);
1676  }
1677  SCMutexUnlock(&g_rules_analyzer_write_m);
1678  SCJbFree(root_jb);
1679  SCFree(arrays);
1680 
1681  HashListTableFree(de_ctx->pattern_hash_table);
1682  de_ctx->pattern_hash_table = NULL;
1683 }
1684 
1685 static void EngineAnalysisItemsReset(EngineAnalysisCtx *ea_ctx)
1686 {
1687  for (size_t i = 0; i < ARRAY_SIZE(analyzer_items); i++) {
1688  ea_ctx->analyzer_items[i].item_seen = false;
1689  }
1690 }
1691 
1692 static void EngineAnalysisItemsInit(EngineAnalysisCtx *ea_ctx)
1693 {
1694  if (ea_ctx->analyzer_initialized) {
1695  EngineAnalysisItemsReset(ea_ctx);
1696  return;
1697  }
1698 
1699  ea_ctx->exposed_item_seen_list[0].bufname = "http_method";
1700  ea_ctx->exposed_item_seen_list[1].bufname = "file_data";
1701  ea_ctx->analyzer_items = SCCalloc(1, sizeof(analyzer_items));
1702  if (!ea_ctx->analyzer_items) {
1703  FatalError("Unable to allocate analysis scratch pad");
1704  }
1705  memset(ea_ctx->analyzer_item_map, -1, sizeof(ea_ctx->analyzer_item_map));
1706 
1707  for (size_t i = 0; i < ARRAY_SIZE(analyzer_items); i++) {
1708  ea_ctx->analyzer_items[i] = analyzer_items[i];
1709  DetectEngineAnalyzerItems *analyzer_item = &ea_ctx->analyzer_items[i];
1710 
1711  int item_id = DetectBufferTypeGetByName(analyzer_item->item_name);
1712  DEBUG_VALIDATE_BUG_ON(item_id < 0 || item_id > UINT16_MAX);
1713  analyzer_item->item_id = (uint16_t)item_id;
1714  if (analyzer_item->item_id == -1) {
1715  /* Mismatch between the analyzer_items array and what's supported */
1716  FatalError("unable to initialize engine-analysis table: detect buffer \"%s\" not "
1717  "recognized.",
1718  analyzer_item->item_name);
1719  }
1720  analyzer_item->item_seen = false;
1721 
1722  if (analyzer_item->export_item_seen) {
1723  for (size_t k = 0; k < ARRAY_SIZE(ea_ctx->exposed_item_seen_list); k++) {
1724  if (0 ==
1725  strcmp(ea_ctx->exposed_item_seen_list[k].bufname, analyzer_item->item_name))
1726  ea_ctx->exposed_item_seen_list[k].item_seen_ptr = &analyzer_item->item_seen;
1727  }
1728  }
1729  ea_ctx->analyzer_item_map[analyzer_item->item_id] = (int16_t)i;
1730  }
1731 
1732  ea_ctx->analyzer_initialized = true;
1733 }
1734 
1735 /**
1736  * \brief Prints analysis of loaded rules.
1737  *
1738  * Warns if potential rule issues are detected. For example,
1739  * warns if a rule uses a construct that may perform poorly,
1740  * e.g. pcre without content or with http_method content only;
1741  * warns if a rule uses a construct that may not be consistent with intent,
1742  * e.g. client side ports only, http and content without any http_* modifiers, etc.
1743  *
1744  * \param s Pointer to the signature.
1745  */
1746 void EngineAnalysisRules(const DetectEngineCtx *de_ctx,
1747  const Signature *s, const char *line)
1748 {
1749  uint32_t rule_bidirectional = 0;
1750  uint32_t rule_pcre = 0;
1751  uint32_t rule_pcre_http = 0;
1752  uint32_t rule_content = 0;
1753  uint32_t rule_flow = 0;
1754  uint32_t rule_flags = 0;
1755  uint32_t rule_flow_toserver = 0;
1756  uint32_t rule_flow_toclient = 0;
1757  uint32_t rule_flow_nostream = 0;
1758  uint32_t rule_ipv4_only = 0;
1759  uint32_t rule_ipv6_only = 0;
1760  uint32_t rule_flowbits = 0;
1761  uint32_t rule_flowint = 0;
1762  uint32_t rule_content_http = 0;
1763  uint32_t rule_content_offset_depth = 0;
1764  int32_t list_id = 0;
1765  uint32_t rule_warning = 0;
1766  uint32_t stream_buf = 0;
1767  uint32_t packet_buf = 0;
1768  uint32_t file_store = 0;
1769  uint32_t warn_pcre_no_content = 0;
1770  uint32_t warn_pcre_http_content = 0;
1771  uint32_t warn_pcre_http = 0;
1772  uint32_t warn_content_http_content = 0;
1773  uint32_t warn_content_http = 0;
1774  uint32_t warn_tcp_no_flow = 0;
1775  uint32_t warn_client_ports = 0;
1776  uint32_t warn_direction = 0;
1777  uint32_t warn_method_toclient = 0;
1778  uint32_t warn_method_serverbody = 0;
1779  uint32_t warn_pcre_method = 0;
1780  uint32_t warn_encoding_norm_http_buf = 0;
1781  uint32_t warn_file_store_not_present = 0;
1782  uint32_t warn_offset_depth_pkt_stream = 0;
1783  uint32_t warn_offset_depth_alproto = 0;
1784  uint32_t warn_non_alproto_fp_for_alproto_sig = 0;
1785  uint32_t warn_no_direction = 0;
1786  uint32_t warn_both_direction = 0;
1787 
1788  EngineAnalysisItemsInit(de_ctx->ea);
1789 
1790  bool *http_method_item_seen_ptr = de_ctx->ea->exposed_item_seen_list[0].item_seen_ptr;
1791  bool *http_server_body_item_seen_ptr = de_ctx->ea->exposed_item_seen_list[1].item_seen_ptr;
1792 
1793  if (s->init_data->init_flags & SIG_FLAG_INIT_BIDIREC) {
1794  rule_bidirectional = 1;
1795  }
1796 
1797  if (s->flags & SIG_FLAG_REQUIRE_PACKET) {
1798  packet_buf += 1;
1799  }
1800  if (s->flags & SIG_FLAG_FILESTORE) {
1801  file_store += 1;
1802  }
1803  if (s->flags & SIG_FLAG_REQUIRE_STREAM) {
1804  stream_buf += 1;
1805  }
1806 
1807  if (s->proto && s->proto->flags & DETECT_PROTO_IPV4) {
1808  rule_ipv4_only += 1;
1809  }
1810  if (s->proto && s->proto->flags & DETECT_PROTO_IPV6) {
1811  rule_ipv6_only += 1;
1812  }
1813 
1814  for (list_id = 0; list_id < DETECT_SM_LIST_MAX; list_id++) {
1815  SigMatch *sm = NULL;
1816  for (sm = s->init_data->smlists[list_id]; sm != NULL; sm = sm->next) {
1817  int16_t item_slot = de_ctx->ea->analyzer_item_map[list_id];
1818  if (sm->type == DETECT_PCRE) {
1819  if (item_slot == -1) {
1820  rule_pcre++;
1821  continue;
1822  }
1823 
1824  rule_pcre_http++;
1825  de_ctx->ea->analyzer_items[item_slot].item_seen = true;
1826  } else if (sm->type == DETECT_CONTENT) {
1827  if (item_slot == -1) {
1828  rule_content++;
1829  if (list_id == DETECT_SM_LIST_PMATCH) {
1830  DetectContentData *cd = (DetectContentData *)sm->ctx;
1831  if (cd->flags & (DETECT_CONTENT_OFFSET | DETECT_CONTENT_DEPTH)) {
1832  rule_content_offset_depth++;
1833  }
1834  }
1835  continue;
1836  }
1837 
1838  rule_content_http++;
1839  de_ctx->ea->analyzer_items[item_slot].item_seen = true;
1840 
1841  if (de_ctx->ea->analyzer_items[item_slot].check_encoding_match) {
1842  DetectContentData *cd = (DetectContentData *)sm->ctx;
1843  if (cd != NULL &&
1844  PerCentEncodingMatch(de_ctx->ea, cd->content, cd->content_len) > 0) {
1845  warn_encoding_norm_http_buf += 1;
1846  }
1847  }
1848  }
1849  else if (sm->type == DETECT_FLOW) {
1850  rule_flow += 1;
1851  if ((s->flags & SIG_FLAG_TOSERVER) && !(s->flags & SIG_FLAG_TOCLIENT)) {
1852  rule_flow_toserver = 1;
1853  }
1854  else if ((s->flags & SIG_FLAG_TOCLIENT) && !(s->flags & SIG_FLAG_TOSERVER)) {
1855  rule_flow_toclient = 1;
1856  }
1857  DetectFlowData *fd = (DetectFlowData *)sm->ctx;
1858  if (fd != NULL) {
1859  if (fd->flags & DETECT_FLOW_FLAG_NOSTREAM)
1860  rule_flow_nostream = 1;
1861  }
1862  }
1863  else if (sm->type == DETECT_FLOWBITS) {
1864  if (list_id == DETECT_SM_LIST_MATCH) {
1865  rule_flowbits += 1;
1866  }
1867  }
1868  else if (sm->type == DETECT_FLOWINT) {
1869  if (list_id == DETECT_SM_LIST_MATCH) {
1870  rule_flowint += 1;
1871  }
1872  }
1873  else if (sm->type == DETECT_FLAGS) {
1874  if (sm->ctx != NULL) {
1875  rule_flags = 1;
1876  }
1877  }
1878  } /* for (sm = s->init_data->smlists[list_id]; sm != NULL; sm = sm->next) */
1879 
1880  } /* for ( ; list_id < DETECT_SM_LIST_MAX; list_id++) */
1881 
1882  if (file_store && !SCRequiresFeature("output::file-store")) {
1883  rule_warning += 1;
1884  warn_file_store_not_present = 1;
1885  }
1886 
1887  if (rule_pcre > 0 && rule_content == 0 && rule_content_http == 0) {
1888  rule_warning += 1;
1889  warn_pcre_no_content = 1;
1890  }
1891 
1892  if (rule_content_http > 0 && rule_pcre > 0 && rule_pcre_http == 0) {
1893  rule_warning += 1;
1894  warn_pcre_http_content = 1;
1895  } else if (s->alproto == ALPROTO_HTTP1 && rule_pcre > 0 && rule_pcre_http == 0) {
1896  rule_warning += 1;
1897  warn_pcre_http = 1;
1898  }
1899 
1900  if (rule_content > 0 && rule_content_http > 0) {
1901  rule_warning += 1;
1902  warn_content_http_content = 1;
1903  }
1904  if (s->alproto == ALPROTO_HTTP1 && rule_content > 0 && rule_content_http == 0) {
1905  rule_warning += 1;
1906  warn_content_http = 1;
1907  }
1908  if (rule_content == 1) {
1909  //todo: warning if content is weak, separate warning for pcre + weak content
1910  }
1911  if (rule_flow == 0 && rule_flags == 0 && !(s->init_data->proto.flags & DETECT_PROTO_ANY) &&
1912  DetectProtoContainsProto(&s->init_data->proto, IPPROTO_TCP) &&
1913  (rule_content || rule_content_http || rule_pcre || rule_pcre_http || rule_flowbits ||
1914  rule_flowint)) {
1915  rule_warning += 1;
1916  warn_tcp_no_flow = 1;
1917  }
1918  if (rule_flow && !rule_bidirectional && (rule_flow_toserver || rule_flow_toclient)
1919  && !((s->flags & SIG_FLAG_SP_ANY) && (s->flags & SIG_FLAG_DP_ANY))) {
1920  if (((s->flags & SIG_FLAG_TOSERVER) && !(s->flags & SIG_FLAG_SP_ANY) && (s->flags & SIG_FLAG_DP_ANY))
1921  || ((s->flags & SIG_FLAG_TOCLIENT) && !(s->flags & SIG_FLAG_DP_ANY) && (s->flags & SIG_FLAG_SP_ANY))) {
1922  rule_warning += 1;
1923  warn_client_ports = 1;
1924  }
1925  }
1926  if (rule_flow && rule_bidirectional && (rule_flow_toserver || rule_flow_toclient)) {
1927  rule_warning += 1;
1928  warn_direction = 1;
1929  }
1930 
1931  if (*http_method_item_seen_ptr) {
1932  if (rule_flow && rule_flow_toclient) {
1933  rule_warning += 1;
1934  warn_method_toclient = 1;
1935  }
1936  if (*http_server_body_item_seen_ptr) {
1937  rule_warning += 1;
1938  warn_method_serverbody = 1;
1939  }
1940  if (rule_content == 0 && rule_content_http == 0 && (rule_pcre > 0 || rule_pcre_http > 0)) {
1941  rule_warning += 1;
1942  warn_pcre_method = 1;
1943  }
1944  }
1945  if (rule_content_offset_depth > 0 && stream_buf && packet_buf) {
1946  rule_warning += 1;
1947  warn_offset_depth_pkt_stream = 1;
1948  }
1949  if (rule_content_offset_depth > 0 && !stream_buf && packet_buf && s->alproto != ALPROTO_UNKNOWN) {
1950  rule_warning += 1;
1951  warn_offset_depth_alproto = 1;
1952  }
1953  if (s->init_data->mpm_sm != NULL && s->alproto == ALPROTO_HTTP1 &&
1954  s->init_data->mpm_sm_list == DETECT_SM_LIST_PMATCH) {
1955  rule_warning += 1;
1956  warn_non_alproto_fp_for_alproto_sig = 1;
1957  }
1958 
1959  if ((s->flags & (SIG_FLAG_TOSERVER|SIG_FLAG_TOCLIENT)) == 0) {
1960  warn_no_direction += 1;
1961  rule_warning += 1;
1962  }
1963 
1964  /* No warning about direction for ICMP protos */
1965  if (!(DetectProtoContainsProto(&s->init_data->proto, IPPROTO_ICMPV6) &&
1966  DetectProtoContainsProto(&s->init_data->proto, IPPROTO_ICMP))) {
1967  if ((s->flags & (SIG_FLAG_TOSERVER|SIG_FLAG_TOCLIENT)) == (SIG_FLAG_TOSERVER|SIG_FLAG_TOCLIENT)) {
1968  warn_both_direction += 1;
1969  rule_warning += 1;
1970  }
1971  }
1972 
1973  if (!rule_warnings_only || (rule_warnings_only && rule_warning > 0)) {
1974  FILE *fp = de_ctx->ea->rule_engine_analysis_fp;
1975  fprintf(fp, "== Sid: %u ==\n", s->id);
1976  fprintf(fp, "%s\n", line);
1977 
1978  switch (s->type) {
1979  case SIG_TYPE_NOT_SET:
1980  break;
1981  case SIG_TYPE_IPONLY:
1982  fprintf(fp, " Rule is ip only.\n");
1983  break;
1984  case SIG_TYPE_LIKE_IPONLY:
1985  fprintf(fp, " Rule is like ip only.\n");
1986  break;
1987  case SIG_TYPE_PDONLY:
1988  fprintf(fp, " Rule is PD only.\n");
1989  break;
1990  case SIG_TYPE_DEONLY:
1991  fprintf(fp, " Rule is DE only.\n");
1992  break;
1993  case SIG_TYPE_PKT:
1994  fprintf(fp, " Rule is packet inspecting.\n");
1995  break;
1996  case SIG_TYPE_PKT_STREAM:
1997  fprintf(fp, " Rule is packet and stream inspecting.\n");
1998  break;
1999  case SIG_TYPE_STREAM:
2000  fprintf(fp, " Rule is stream inspecting.\n");
2001  break;
2002  case SIG_TYPE_APPLAYER:
2003  fprintf(fp, " Rule is app-layer inspecting.\n");
2004  break;
2005  case SIG_TYPE_APP_TX:
2006  fprintf(fp, " Rule is App-layer TX inspecting.\n");
2007  break;
2008  case SIG_TYPE_MAX:
2009  break;
2010  }
2011  if (rule_ipv6_only)
2012  fprintf(fp, " Rule is IPv6 only.\n");
2013  if (rule_ipv4_only)
2014  fprintf(fp, " Rule is IPv4 only.\n");
2015  if (packet_buf)
2016  fprintf(fp, " Rule matches on packets.\n");
2017  if (!rule_flow_nostream && stream_buf &&
2018  (rule_flow || rule_flowbits || rule_flowint || rule_content || rule_pcre)) {
2019  fprintf(fp, " Rule matches on reassembled stream.\n");
2020  }
2021  for(size_t i = 0; i < ARRAY_SIZE(analyzer_items); i++) {
2022  DetectEngineAnalyzerItems *ai = &de_ctx->ea->analyzer_items[i];
2023  if (ai->item_seen) {
2024  fprintf(fp, " Rule matches on %s buffer.\n", ai->display_name);
2025  }
2026  }
2027  if (s->alproto != ALPROTO_UNKNOWN) {
2028  fprintf(fp, " App layer protocol is %s.\n", AppProtoToString(s->alproto));
2029  }
2030  if (rule_content || rule_content_http || rule_pcre || rule_pcre_http) {
2031  fprintf(fp,
2032  " Rule contains %u content options, %u http content options, %u pcre "
2033  "options, and %u pcre options with http modifiers.\n",
2034  rule_content, rule_content_http, rule_pcre, rule_pcre_http);
2035  }
2036 
2037  /* print fast pattern info */
2038  if (s->init_data->prefilter_sm) {
2039  fprintf(fp, " Prefilter on: %s.\n",
2040  sigmatch_table[s->init_data->prefilter_sm->type].name);
2041  } else {
2042  EngineAnalysisRulesPrintFP(de_ctx, s);
2043  }
2044 
2045  /* this is where the warnings start */
2046  if (warn_pcre_no_content /*rule_pcre > 0 && rule_content == 0 && rule_content_http == 0*/) {
2047  fprintf(fp, " Warning: Rule uses pcre without a content option present.\n"
2048  " -Consider adding a content to improve performance of this "
2049  "rule.\n");
2050  }
2051  if (warn_pcre_http_content /*rule_content_http > 0 && rule_pcre > 0 && rule_pcre_http == 0*/) {
2052  fprintf(fp, " Warning: Rule uses content options with http_* and pcre options "
2053  "without http modifiers.\n"
2054  " -Consider adding http pcre modifier.\n");
2055  }
2056  else if (warn_pcre_http /*s->alproto == ALPROTO_HTTP1 && rule_pcre > 0 && rule_pcre_http == 0*/) {
2057  fprintf(fp, " Warning: Rule app layer protocol is http, but pcre options do not "
2058  "have http modifiers.\n"
2059  " -Consider adding http pcre modifiers.\n");
2060  }
2061  if (warn_content_http_content /*rule_content > 0 && rule_content_http > 0*/) {
2062  fprintf(fp,
2063  " Warning: Rule contains content with http_* and content without http_*.\n"
2064  " -Consider adding http content modifiers.\n");
2065  }
2066  if (warn_content_http /*s->alproto == ALPROTO_HTTP1 && rule_content > 0 && rule_content_http == 0*/) {
2067  fprintf(fp, " Warning: Rule app layer protocol is http, but content options do not "
2068  "have http_* modifiers.\n"
2069  " -Consider adding http content modifiers.\n");
2070  }
2071  if (rule_content == 1) {
2072  //todo: warning if content is weak, separate warning for pcre + weak content
2073  }
2074  if (warn_encoding_norm_http_buf) {
2075  fprintf(fp, " Warning: Rule may contain percent encoded content for a normalized "
2076  "http buffer match.\n");
2077  }
2078  if (warn_tcp_no_flow /*rule_flow == 0 && rule_flags == 0
2079  && !(s->proto.flags & DETECT_PROTO_ANY) && DetectProtoContainsProto(&s->proto, IPPROTO_TCP)*/) {
2080  fprintf(fp, " Warning: TCP rule without a flow or flags option.\n"
2081  " -Consider adding flow or flags to improve performance of "
2082  "this rule.\n");
2083  }
2084  if (warn_client_ports /*rule_flow && !rule_bidirectional && (rule_flow_toserver || rule_flow_toclient)
2085  && !((s->flags & SIG_FLAG_SP_ANY) && (s->flags & SIG_FLAG_DP_ANY)))
2086  if (((s->flags & SIG_FLAG_TOSERVER) && !(s->flags & SIG_FLAG_SP_ANY) && (s->flags & SIG_FLAG_DP_ANY))
2087  || ((s->flags & SIG_FLAG_TOCLIENT) && !(s->flags & SIG_FLAG_DP_ANY) && (s->flags & SIG_FLAG_SP_ANY))*/) {
2088  fprintf(fp,
2089  " Warning: Rule contains ports or port variables only on the client side.\n"
2090  " -Flow direction possibly inconsistent with rule.\n");
2091  }
2092  if (warn_direction /*rule_flow && rule_bidirectional && (rule_flow_toserver || rule_flow_toclient)*/) {
2093  fprintf(fp, " Warning: Rule is bidirectional and has a flow option with a specific "
2094  "direction.\n");
2095  }
2096  if (warn_method_toclient /*http_method_buf && rule_flow && rule_flow_toclient*/) {
2097  fprintf(fp, " Warning: Rule uses content or pcre for http_method with "
2098  "flow:to_client or from_server\n");
2099  }
2100  if (warn_method_serverbody /*http_method_buf && http_server_body_buf*/) {
2101  fprintf(fp, " Warning: Rule uses content or pcre for http_method with content or "
2102  "pcre for http_server_body.\n");
2103  }
2104  if (warn_pcre_method /*http_method_buf && rule_content == 0 && rule_content_http == 0
2105  && (rule_pcre > 0 || rule_pcre_http > 0)*/) {
2106  fprintf(fp, " Warning: Rule uses pcre with only a http_method content; possible "
2107  "performance issue.\n");
2108  }
2109  if (warn_offset_depth_pkt_stream) {
2110  fprintf(fp, " Warning: Rule has depth"
2111  "/offset with raw content keywords. Please note the "
2112  "offset/depth will be checked against both packet "
2113  "payloads and stream. If you meant to have the offset/"
2114  "depth checked against just the payload, you can update "
2115  "the signature as \"alert tcp-pkt...\"\n");
2116  }
2117  if (warn_offset_depth_alproto) {
2118  fprintf(fp,
2119  " Warning: Rule has "
2120  "offset/depth set along with a match on a specific "
2121  "app layer protocol - %d. This can lead to FNs if we "
2122  "have a offset/depth content match on a packet payload "
2123  "before we can detect the app layer protocol for the "
2124  "flow.\n",
2125  s->alproto);
2126  }
2127  if (warn_non_alproto_fp_for_alproto_sig) {
2128  fprintf(fp, " Warning: Rule app layer "
2129  "protocol is http, but the fast_pattern is set on the raw "
2130  "stream. Consider adding fast_pattern over a http "
2131  "buffer for increased performance.");
2132  }
2133  if (warn_no_direction) {
2134  fprintf(fp, " Warning: Rule has no direction indicator.\n");
2135  }
2136  if (warn_both_direction) {
2137  fprintf(fp, " Warning: Rule is inspecting both the request and the response.\n");
2138  }
2139  if (warn_file_store_not_present) {
2140  fprintf(fp, " Warning: Rule requires file-store but the output file-store is not "
2141  "enabled.\n");
2142  }
2143  if (rule_warning == 0) {
2144  fprintf(fp, " No warnings for this rule.\n");
2145  }
2146  fprintf(fp, "\n");
2147  }
2148 }
2149 
2150 #include "app-layer-parser.h"
2151 
2152 /**
2153  * \brief Render a resolved firewall default policy as "<action>:<scope>".
2154  *
2155  * \retval true \p out holds the rendered policy
2156  * \retval false the policy could not be rendered
2157  */
2158 static bool FirewallPolicyToString(
2159  const struct DetectFirewallPolicy *p, char *out, const size_t out_size)
2160 {
2161  const char *as = ActionScopeToString(p->action_scope);
2162  DEBUG_VALIDATE_BUG_ON(as == NULL);
2163  if (as == NULL)
2164  return false;
2165  if (p->action & ACTION_REJECT_ANY) {
2166  if (p->action & ACTION_REJECT_DST) {
2167  snprintf(out, out_size, "rejectdst:%s", as);
2168  } else if (p->action & ACTION_REJECT_BOTH) {
2169  snprintf(out, out_size, "rejectboth:%s", as);
2170  } else {
2171  snprintf(out, out_size, "rejectsrc:%s", as);
2172  }
2173  } else if (p->action & ACTION_DROP) {
2174  snprintf(out, out_size, "drop:%s", as);
2175  } else if (p->action & ACTION_ACCEPT) {
2176  snprintf(out, out_size, "accept:%s", as);
2177  } else {
2178  DEBUG_VALIDATE_BUG_ON(1);
2179  return false;
2180  }
2181  if (p->action & ACTION_PASS) {
2182  if (p->action_scope == ACTION_SCOPE_FLOW || p->action_scope == ACTION_SCOPE_PACKET) {
2183  if (strlcat(out, ",pass:", out_size) >= out_size ||
2184  strlcat(out, as, out_size) >= out_size) {
2185  DEBUG_VALIDATE_BUG_ON(1);
2186  return false;
2187  }
2188  } else {
2189  DEBUG_VALIDATE_BUG_ON(1);
2190  return false;
2191  }
2192  }
2193  if (p->action & ACTION_ALERT) {
2194  if (strlcat(out, ",alert", out_size) >= out_size) {
2195  DEBUG_VALIDATE_BUG_ON(1);
2196  return false;
2197  }
2198  }
2199  return true;
2200 }
2201 
2202 static void AddPolicy(const DetectEngineCtx *de_ctx, RuleAnalyzer *ctx, const AppProto a,
2203  const uint8_t sub_state, const uint8_t state, const uint8_t direction)
2204 {
2205  char policy_string[64] = "";
2206  const struct DetectFirewallPolicies *fw_policies = de_ctx->fw_policies;
2207  const struct DetectFirewallAppPolicy lookup = {
2208  .alproto = a, .sub_state = sub_state, .progress = state, .direction = direction
2209  };
2210  const struct DetectFirewallAppPolicy *ap =
2211  HashTableLookup(fw_policies->app_policies, (void *)&lookup, 0);
2212  if (ap == NULL)
2213  return;
2214  if (!FirewallPolicyToString(&ap->policy, policy_string, sizeof(policy_string)))
2215  return;
2216  SCJbSetString(ctx->js, "policy", policy_string);
2217 }
2218 
2219 static void FirewallAddRulesForState(const DetectEngineCtx *de_ctx, const AppProto a,
2220  const uint8_t sub_state, const uint8_t state, const uint8_t direction, RuleAnalyzer *ctx)
2221 {
2222  uint32_t accept_rules = 0;
2223  AddPolicy(de_ctx, ctx, a, sub_state, state, direction);
2224  SCJbOpenArray(ctx->js, "rules");
2225  for (const Signature *s = de_ctx->sig_list; s != NULL; s = s->next) {
2226  if ((s->flags & SIG_FLAG_FIREWALL) == 0)
2227  break;
2228  if (s->type != SIG_TYPE_APP_TX)
2229  continue;
2230  if (s->alproto != a)
2231  continue;
2232 
2233  if (direction == STREAM_TOSERVER) {
2234  if (s->flags & SIG_FLAG_TOCLIENT) {
2235  continue;
2236  }
2237  } else {
2238  if (s->flags & SIG_FLAG_TOSERVER) {
2239  continue;
2240  }
2241  }
2242 
2243  /* sig has no sub_state field, so check the app inspect engines (if any).
2244  * We assume that the only engines we have either:
2245  * - are unknown/substate 0
2246  * - matching the rule's substate */
2247  if (s->app_inspect != NULL) {
2248  bool skip_rule = false;
2249  for (const DetectEngineAppInspectionEngine *engine = s->app_inspect; engine != NULL;
2250  engine = engine->next) {
2251  if (engine->alproto == ALPROTO_UNKNOWN) {
2252  // skip engines targeting unknown, like stream or app-layer-event
2253  } else if (engine->sub_state != sub_state) {
2254  skip_rule = true;
2255  break;
2256  }
2257  }
2258  if (skip_rule) {
2259  continue;
2260  }
2261  }
2262  if ((s->flags & SIG_FLAG_FW_HOOK_LTE) && state < s->app_progress_hook) {
2263  SCJbAppendString(ctx->js, s->sig_str);
2264  accept_rules += ((s->action & ACTION_ACCEPT) != 0);
2265  }
2266 
2267  if (s->app_progress_hook == state) {
2268  SCJbAppendString(ctx->js, s->sig_str);
2269  accept_rules += ((s->action & ACTION_ACCEPT) != 0);
2270  }
2271  }
2272  SCJbClose(ctx->js);
2273 
2274  if (accept_rules == 0) {
2275  AnalyzerWarning(ctx, (char *)"no accept rules for state, default policy will be applied");
2276  }
2277 }
2278 
2279 int FirewallAnalyzer(const DetectEngineCtx *de_ctx)
2280 {
2281  RuleAnalyzer ctx = { NULL, NULL, NULL };
2282  ctx.js = SCJbNewObject();
2283  if (ctx.js == NULL)
2284  return -1;
2285 
2286  SCJbOpenObject(ctx.js, "tables");
2287  SCJbOpenObject(ctx.js, "packet:filter");
2288  char pkt_policy[64] = "";
2289  if (FirewallPolicyToString(&de_ctx->fw_policies->pkt[DETECT_FIREWALL_POLICY_PACKET_FILTER],
2290  pkt_policy, sizeof(pkt_policy))) {
2291  SCJbSetString(ctx.js, "policy", pkt_policy);
2292  }
2293  SCJbOpenArray(ctx.js, "rules");
2294  uint32_t accept_rules = 0;
2295  uint32_t last_sid = 0;
2296  for (Signature *s = de_ctx->sig_list; s != NULL; s = s->next) {
2297  if ((s->flags & SIG_FLAG_FIREWALL) == 0)
2298  break;
2299  if (s->type != SIG_TYPE_PKT)
2300  continue;
2301  /* don't double list <> sigs */
2302  if (last_sid == s->id)
2303  continue;
2304  last_sid = s->id;
2305  SCJbAppendString(ctx.js, s->sig_str);
2306  accept_rules += ((s->action & ACTION_ACCEPT) != 0);
2307  }
2308  SCJbClose(ctx.js);
2309  if (accept_rules == 0) {
2310  AnalyzerWarning(&ctx,
2311  (char *)"no accept rules for \'packet:filter\', default policy will be applied");
2312  }
2313  if (ctx.js_warnings) {
2314  SCJbClose(ctx.js_warnings);
2315  SCJbSetObject(ctx.js, "warnings", ctx.js_warnings);
2316  SCJbFree(ctx.js_warnings);
2317  ctx.js_warnings = NULL;
2318  }
2319  SCJbClose(ctx.js); // packet_filter
2320 
2321  for (AppProto a = 0; a < g_alproto_max; a++) {
2322  if (!AppProtoIsValid(a))
2323  continue;
2324 
2325  if (AppLayerParserSupportsSubStates(a)) {
2326  SCJbOpenObject(ctx.js, AppProtoToString(a));
2327  const uint8_t max_sub_state = AppLayerParserGetMaxSubState(a);
2328  for (uint8_t sub_state = 1; sub_state <= max_sub_state; sub_state++) {
2329  const char *sub_state_name = AppLayerParserGetSubStateName(a, sub_state);
2330  const uint8_t max_progress = AppLayerParserGetSubStateCompletion(a, sub_state);
2331  for (uint8_t state = 0; state <= max_progress; state++) {
2332  const char *name = AppLayerParserGetSubStateProgressName(
2333  a, sub_state, state, STREAM_TOSERVER);
2334  if (name == NULL)
2335  continue;
2336 
2337  char table_name[256];
2338  snprintf(table_name, sizeof(table_name), "app:%s:%s:%s", AppProtoToString(a),
2339  sub_state_name, name);
2340  SCJbOpenObject(ctx.js, table_name);
2341  FirewallAddRulesForState(de_ctx, a, sub_state, state, STREAM_TOSERVER, &ctx);
2342  if (ctx.js_warnings) {
2343  SCJbClose(ctx.js_warnings);
2344  SCJbSetObject(ctx.js, "warnings", ctx.js_warnings);
2345  SCJbFree(ctx.js_warnings);
2346  ctx.js_warnings = NULL;
2347  }
2348  SCJbClose(ctx.js);
2349  }
2350  for (uint8_t state = 0; state <= max_progress; state++) {
2351  const char *name = AppLayerParserGetSubStateProgressName(
2352  a, sub_state, state, STREAM_TOCLIENT);
2353  if (name == NULL)
2354  continue;
2355 
2356  char table_name[256];
2357  snprintf(table_name, sizeof(table_name), "app:%s:%s:%s", AppProtoToString(a),
2358  sub_state_name, name);
2359  SCJbOpenObject(ctx.js, table_name);
2360  FirewallAddRulesForState(de_ctx, a, sub_state, state, STREAM_TOCLIENT, &ctx);
2361  if (ctx.js_warnings) {
2362  SCJbClose(ctx.js_warnings);
2363  SCJbSetObject(ctx.js, "warnings", ctx.js_warnings);
2364  SCJbFree(ctx.js_warnings);
2365  ctx.js_warnings = NULL;
2366  }
2367  SCJbClose(ctx.js);
2368  }
2369  }
2370  SCJbClose(ctx.js); // app layer
2371  continue;
2372  }
2373 
2374  /* no sub state follows */
2375 
2376  const uint8_t complete_state_ts =
2377  (const uint8_t)AppLayerParserGetStateProgressCompletionStatus(a, STREAM_TOSERVER);
2378  SCJbOpenObject(ctx.js, AppProtoToString(a));
2379  for (uint8_t state = 0; state <= complete_state_ts; state++) {
2380  const char *name =
2381  AppLayerParserGetStateNameById(IPPROTO_TCP, a, state, STREAM_TOSERVER);
2382  if (name == NULL) {
2383  name = DetectFirewallAppGenericHookName(state, complete_state_ts, STREAM_TOSERVER);
2384  if (name == NULL)
2385  name = "unknown";
2386  }
2387 
2388  char table_name[128];
2389  snprintf(table_name, sizeof(table_name), "app:%s:%s", AppProtoToString(a), name);
2390  SCJbOpenObject(ctx.js, table_name);
2391  FirewallAddRulesForState(de_ctx, a, 0, state, STREAM_TOSERVER, &ctx);
2392  if (ctx.js_warnings) {
2393  SCJbClose(ctx.js_warnings);
2394  SCJbSetObject(ctx.js, "warnings", ctx.js_warnings);
2395  SCJbFree(ctx.js_warnings);
2396  ctx.js_warnings = NULL;
2397  }
2398  SCJbClose(ctx.js);
2399  }
2400  const uint8_t complete_state_tc =
2401  (const uint8_t)AppLayerParserGetStateProgressCompletionStatus(a, STREAM_TOCLIENT);
2402  for (uint8_t state = 0; state <= complete_state_tc; state++) {
2403  const char *name =
2404  AppLayerParserGetStateNameById(IPPROTO_TCP, a, state, STREAM_TOCLIENT);
2405  if (name == NULL) {
2406  name = DetectFirewallAppGenericHookName(state, complete_state_tc, STREAM_TOCLIENT);
2407  if (name == NULL)
2408  name = "unknown";
2409  }
2410  char table_name[128];
2411  snprintf(table_name, sizeof(table_name), "app:%s:%s", AppProtoToString(a), name);
2412  SCJbOpenObject(ctx.js, table_name);
2413  FirewallAddRulesForState(de_ctx, a, 0, state, STREAM_TOCLIENT, &ctx);
2414  if (ctx.js_warnings) {
2415  SCJbClose(ctx.js_warnings);
2416  SCJbSetObject(ctx.js, "warnings", ctx.js_warnings);
2417  SCJbFree(ctx.js_warnings);
2418  ctx.js_warnings = NULL;
2419  }
2420  SCJbClose(ctx.js);
2421  }
2422  SCJbClose(ctx.js); // app layer
2423  }
2424  SCJbOpenObject(ctx.js, "packet:td");
2425  SCJbSetString(ctx.js, "policy", "accept:hook");
2426  last_sid = 0;
2427  SCJbOpenArray(ctx.js, "rules");
2428  for (Signature *s = de_ctx->sig_list; s != NULL; s = s->next) {
2429  if ((s->flags & SIG_FLAG_FIREWALL) != 0)
2430  continue;
2431  if (s->type == SIG_TYPE_APP_TX)
2432  continue;
2433  if (last_sid == s->id)
2434  continue;
2435  last_sid = s->id;
2436  SCJbAppendString(ctx.js, s->sig_str);
2437  }
2438  SCJbClose(ctx.js); // rules
2439  SCJbClose(ctx.js); // packet:td
2440  SCJbOpenObject(ctx.js, "app:td");
2441  SCJbSetString(ctx.js, "policy", "accept:hook");
2442  last_sid = 0;
2443  SCJbOpenArray(ctx.js, "rules");
2444  for (Signature *s = de_ctx->sig_list; s != NULL; s = s->next) {
2445  if ((s->flags & SIG_FLAG_FIREWALL) != 0)
2446  continue;
2447  if (s->type != SIG_TYPE_APP_TX)
2448  continue;
2449  if (last_sid == s->id)
2450  continue;
2451  last_sid = s->id;
2452  SCJbAppendString(ctx.js, s->sig_str);
2453  }
2454  SCJbClose(ctx.js); // rules
2455  SCJbClose(ctx.js); // app:td
2456  SCJbClose(ctx.js); // tables
2457 
2458  SCJbOpenObject(ctx.js, "lists");
2459  SCJbOpenObject(ctx.js, "firewall");
2460  last_sid = 0;
2461  SCJbOpenArray(ctx.js, "rules");
2462  for (Signature *s = de_ctx->sig_list; s != NULL; s = s->next) {
2463  if ((s->flags & SIG_FLAG_FIREWALL) == 0)
2464  continue;
2465  if (last_sid == s->id)
2466  continue;
2467  last_sid = s->id;
2468  SCJbAppendString(ctx.js, s->sig_str);
2469  }
2470  SCJbClose(ctx.js); // rules
2471  SCJbClose(ctx.js); // firewall
2472 
2473  SCJbOpenObject(ctx.js, "td");
2474  last_sid = 0;
2475  SCJbOpenArray(ctx.js, "rules");
2476  for (Signature *s = de_ctx->sig_list; s != NULL; s = s->next) {
2477  if ((s->flags & SIG_FLAG_FIREWALL) != 0)
2478  continue;
2479  if (last_sid == s->id)
2480  continue;
2481  last_sid = s->id;
2482  SCJbAppendString(ctx.js, s->sig_str);
2483  }
2484  SCJbClose(ctx.js); // rules
2485  SCJbClose(ctx.js); // td
2486 
2487  SCJbOpenObject(ctx.js, "all");
2488  last_sid = 0;
2489  SCJbOpenArray(ctx.js, "rules");
2490  for (Signature *s = de_ctx->sig_list; s != NULL; s = s->next) {
2491  if (last_sid == s->id)
2492  continue;
2493  last_sid = s->id;
2494  SCJbAppendString(ctx.js, s->sig_str);
2495  }
2496  SCJbClose(ctx.js); // rules
2497  SCJbClose(ctx.js); // all
2498 
2499  SCJbClose(ctx.js); // lists
2500 
2501  /* Per-rule keyword metadata for tcp.session */
2502  SCJbOpenObject(ctx.js, "keyword_info");
2503  for (Signature *s = de_ctx->sig_list; s != NULL; s = s->next) {
2504  const SigMatchData *smd = s->sm_arrays[DETECT_SM_LIST_MATCH];
2505  if (smd == NULL)
2506  continue;
2507  for (;;) {
2508  if (smd->type == DETECT_TCP_SESSION) {
2509  const DetectTcpSessionData *tsd = (const DetectTcpSessionData *)smd->ctx;
2510  if (tsd != NULL) {
2511  char sid_key[32];
2512  snprintf(sid_key, sizeof(sid_key), "%u", s->id);
2513  SCJbOpenObject(ctx.js, sid_key);
2514  SCJbOpenArray(ctx.js, "tcp_session");
2515  if (tsd->phase_flags & DETECT_TCP_SESSION_PHASE_SETUP)
2516  SCJbAppendString(ctx.js, "setup");
2517  if (tsd->phase_flags & DETECT_TCP_SESSION_PHASE_ESTABLISHED)
2518  SCJbAppendString(ctx.js, "established");
2519  if (tsd->phase_flags & DETECT_TCP_SESSION_PHASE_CLOSING)
2520  SCJbAppendString(ctx.js, "closing");
2521  SCJbClose(ctx.js); // tcp_session
2522  SCJbClose(ctx.js); // sid_key
2523  }
2524  break;
2525  }
2526  if (smd->is_last)
2527  break;
2528  smd++;
2529  }
2530  }
2531  SCJbClose(ctx.js); // keyword_info
2532 
2533  SCJbClose(ctx.js); // top level object
2534 
2535  const char *filename = "firewall.json";
2536  const char *log_dir = SCConfigGetLogDirectory();
2537  char json_path[PATH_MAX] = "";
2538  snprintf(json_path, sizeof(json_path), "%s/%s", log_dir, filename);
2539 
2540  SCMutexLock(&g_rules_analyzer_write_m);
2541  FILE *fp = fopen(json_path, "w");
2542  if (fp != NULL) {
2543  fwrite(SCJbPtr(ctx.js), SCJbLen(ctx.js), 1, fp);
2544  fprintf(fp, "\n");
2545  fclose(fp);
2546  }
2547  SCMutexUnlock(&g_rules_analyzer_write_m);
2548  SCJbFree(ctx.js);
2549  return 0;
2550 }
detect-tcp-flags.h
DETECT_PCRE_CASELESS
#define DETECT_PCRE_CASELESS
Definition: detect-pcre.h:32
DETECT_CONTENT_NOCASE
#define DETECT_CONTENT_NOCASE
Definition: detect-content.h:29
SignatureHasPacketContent
int SignatureHasPacketContent(const Signature *s)
check if a signature has patterns that are to be inspected against a packets payload (as opposed to t...
Definition: detect-engine-mpm.c:878
DetectBytejumpData_::post_offset
int32_t post_offset
Definition: detect-bytejump.h:52
HashListTableGetListData
#define HashListTableGetListData(hb)
Definition: util-hashlist.h:56
SIG_TYPE_STREAM
@ SIG_TYPE_STREAM
Definition: detect.h:74
DetectContentData_::offset
uint16_t offset
Definition: detect-content.h:107
DetectBytetestData_::flags
uint16_t flags
Definition: detect-bytetest.h:58
detect-engine-uint.h
DetectFirewallPolicies
Definition: detect.h:954
DetectPatternTracker
Definition: detect.h:830
SignatureInitData_::rule_state_dependant_sids_idx
uint32_t rule_state_dependant_sids_idx
Definition: detect.h:679
DetectEngineAppInspectionEngine_
Definition: detect.h:419
DETECT_CONTENT_RELATIVE_NEXT
#define DETECT_CONTENT_RELATIVE_NEXT
Definition: detect-content.h:66
DetectEngineAppInspectionEngine_::mpm
bool mpm
Definition: detect.h:423
DETECT_TTL
@ DETECT_TTL
Definition: detect-engine-register.h:45
detect-content.h
DetectFlowbitsData_::or_list_size
uint8_t or_list_size
Definition: detect-flowbits.h:68
len
uint8_t len
Definition: app-layer-dnp3.h:2
DetectEngineAppInspectionEngine_::v2
struct DetectEngineAppInspectionEngine_::@82 v2
SCConfValIsTrue
int SCConfValIsTrue(const char *val)
Check if a value is true.
Definition: conf.c:578
detect-engine.h
detect-app-layer-protocol.h
DETECT_SM_LIST_PMATCH
@ DETECT_SM_LIST_PMATCH
Definition: detect.h:119
SIG_MASK_REQUIRE_REAL_PKT
#define SIG_MASK_REQUIRE_REAL_PKT
Definition: detect.h:319
DETECT_CONTENT_FAST_PATTERN_CHOP
#define DETECT_CONTENT_FAST_PATTERN_CHOP
Definition: detect-content.h:36
SignatureInitData_::smlists
struct SigMatch_ * smlists[DETECT_SM_LIST_MAX]
Definition: detect.h:662
DetectContentData_::fp_chop_len
uint16_t fp_chop_len
Definition: detect-content.h:98
SIG_FLAG_FW_HOOK_LTE
#define SIG_FLAG_FW_HOOK_LTE
Definition: detect.h:254
sigmatch_table
SigTableElmt * sigmatch_table
Definition: detect-parse.c:79
DetectXbitsData_::expire
uint32_t expire
Definition: detect-xbits.h:45
Signature_::sig_str
char * sig_str
Definition: detect.h:765
SIG_TYPE_APP_TX
@ SIG_TYPE_APP_TX
Definition: detect.h:77
AppLayerParserGetStateNameById
const char * AppLayerParserGetStateNameById(uint8_t ipproto, AppProto alproto, const int id, const uint8_t direction)
Definition: app-layer-parser.c:1873
DetectFirewallAppPolicy
Definition: detect.h:943
DetectEnginePktInspectionEngine
Definition: detect.h:488
DetectEngineAppInspectionEngine_::next
struct DetectEngineAppInspectionEngine_ * next
Definition: detect.h:445
DetectAppLayerProtocolData_::mode
uint8_t mode
Definition: detect-app-layer-protocol.h:50
DETECT_PROTO_IPV6
#define DETECT_PROTO_IPV6
Definition: detect-engine-proto.h:32
DetectFlowData_
Definition: detect-flow.h:37
DETECT_FLOW_FLAG_NOSTREAM
#define DETECT_FLOW_FLAG_NOSTREAM
Definition: detect-flow.h:33
SigTableElmt_::name
const char * name
Definition: detect.h:1524
DETECT_BYTEJUMP
@ DETECT_BYTEJUMP
Definition: detect-engine-register.h:92
DETECT_ABSENT
@ DETECT_ABSENT
Definition: detect-engine-register.h:104
DetectListToHumanString
const char * DetectListToHumanString(int list)
Definition: detect-parse.c:145
DetectEngineCtx_::pattern_hash_table
HashListTable * pattern_hash_table
Definition: detect.h:1024
DumpPatterns
void DumpPatterns(DetectEngineCtx *de_ctx)
Definition: detect-engine-analyzer.c:1598
FLOWINT_MODIFIER_ADD
@ FLOWINT_MODIFIER_ADD
Definition: detect-flowint.h:31
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
DetectContentData_::within
int32_t within
Definition: detect-content.h:109
ACTION_PASS
#define ACTION_PASS
Definition: action-globals.h:34
ACTION_REJECT
#define ACTION_REJECT
Definition: action-globals.h:31
DETECT_BYTEJUMP_LITTLE
#define DETECT_BYTEJUMP_LITTLE
Definition: detect-bytejump.h:35
SetupEngineAnalysis
void SetupEngineAnalysis(DetectEngineCtx *de_ctx, bool *fp_analysis, bool *rule_analysis)
Definition: detect-engine-analyzer.c:483
Signature_::app_progress_hook
uint8_t app_progress_hook
Definition: detect.h:725
DETECT_CONTENT
@ DETECT_CONTENT
Definition: detect-engine-register.h:78
SignatureInitData_::prefilter_sm
SigMatch * prefilter_sm
Definition: detect.h:638
EngineAnalysisCtx_::rule_engine_analysis_fp
FILE * rule_engine_analysis_fp
Definition: detect-engine-analyzer.c:91
DETECT_FLOW
@ DETECT_FLOW
Definition: detect-engine-register.h:61
Signature_::alproto
AppProto alproto
Definition: detect.h:693
SignatureInitData_::is_rule_state_dependant
bool is_rule_state_dependant
Definition: detect.h:676
detect-isdataat.h
FLOWINT_MODIFIER_NE
@ FLOWINT_MODIFIER_NE
Definition: detect-flowint.h:38
DETECT_BYTETEST_BASE_HEX
#define DETECT_BYTETEST_BASE_HEX
Definition: detect-bytetest.h:40
SigMatchData_::is_last
bool is_last
Definition: detect.h:370
ActionScopeToString
const char * ActionScopeToString(enum ActionScope s)
Definition: detect-parse.c:4079
DetectAppLayerProtocolData_
Per-rule keyword data for app-layer-protocol:.
Definition: detect-app-layer-protocol.h:45
name
const char * name
Definition: detect-engine-proto.c:48
DetectContentPatternPrettyPrint
void DetectContentPatternPrettyPrint(const uint8_t *pat, const uint16_t pat_len, char *str, size_t str_len)
Definition: detect-content.c:743
g_rules_analyzer_write_m
SCMutex g_rules_analyzer_write_m
Definition: detect-engine-analyzer.c:1146
DetectEngineAnalyzerItems::display_name
const char * display_name
Definition: detect-engine-analyzer.c:73
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:87
DETECT_CONTENT_WITHIN2DEPTH
#define DETECT_CONTENT_WITHIN2DEPTH
Definition: detect-content.h:62
EngineAnalysisCtx_::percent_re
pcre2_code * percent_re
Definition: detect-engine-analyzer.c:96
DETECT_SM_LIST_DYNAMIC_START
@ DETECT_SM_LIST_DYNAMIC_START
Definition: detect.h:138
DETECT_FLOWBITS_CMD_ISNOTSET
#define DETECT_FLOWBITS_CMD_ISNOTSET
Definition: detect-flowbits.h:30
SIG_FLAG_DEST_IS_TARGET
#define SIG_FLAG_DEST_IS_TARGET
Definition: detect.h:287
SigMatchData_::ctx
SigMatchCtx * ctx
Definition: detect.h:371
DETECT_CONTENT_NO_DOUBLE_INSPECTION_REQUIRED
#define DETECT_CONTENT_NO_DOUBLE_INSPECTION_REQUIRED
Definition: detect-content.h:55
DetectFlowintData_::targettype
uint8_t targettype
Definition: detect-flowint.h:71
AppLayerParserGetStateProgressCompletionStatus
uint8_t AppLayerParserGetStateProgressCompletionStatus(AppProto alproto, uint8_t direction)
Definition: app-layer-parser.c:1252
action-globals.h
Packet_::flags
uint32_t flags
Definition: decode.h:562
Packet_::action
uint8_t action
Definition: decode.h:624
EngineAnalysisCtx_
Definition: detect-engine-analyzer.c:89
DETECT_IPOPTS
@ DETECT_IPOPTS
Definition: detect-engine-register.h:39
AppProtoToString
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its normalized string equivalent.
Definition: app-layer-protos.c:51
detect-tcp-session.h
tcp.session: keyword (Redmine #7704).
DetectFirewallAppPolicy::sub_state
uint8_t sub_state
Definition: detect.h:945
ctx
struct Thresholds ctx
DETECT_BYTEJUMP_BASE_OCT
#define DETECT_BYTEJUMP_BASE_OCT
Definition: detect-bytejump.h:29
DetectEngineFrameInspectionEngine::transforms
const DetectEngineTransforms * transforms
Definition: detect.h:523
DetectFlowData_::flags
uint16_t flags
Definition: detect-flow.h:38
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:987
DETECT_PROTO_ANY
#define DETECT_PROTO_ANY
Definition: detect-engine-proto.h:28
DetectFlowintData_
Definition: detect-flowint.h:61
DetectXbitsData_::cmd
uint8_t cmd
Definition: detect-xbits.h:43
DetectEnginePktInspectionEngine::smd
SigMatchData * smd
Definition: detect.h:489
SIG_TYPE_PKT_STREAM
@ SIG_TYPE_PKT_STREAM
Definition: detect.h:73
DetectFlowbitsData_::cmd
uint8_t cmd
Definition: detect-flowbits.h:67
DetectFirewallAppPolicy::policy
struct DetectFirewallPolicy policy
Definition: detect.h:948
DetectEngineFrameInspectionEngine::mpm
bool mpm
Definition: detect.h:517
DETECT_BYTETEST_DCE
#define DETECT_BYTETEST_DCE
Definition: detect-bytetest.h:47
HashListTableGetListHead
HashListTableBucket * HashListTableGetListHead(HashListTable *ht)
Definition: util-hashlist.c:287
detect-tcp-seq.h
EngineAnalysisCtx_::fp_pattern_stats
FpPatternStats fp_pattern_stats[DETECT_SM_LIST_MAX]
Definition: detect-engine-analyzer.c:108
DetectAppLayerProtocolModeName
const char * DetectAppLayerProtocolModeName(uint8_t mode)
Map a DETECT_ALPROTO_* mode value to its textual qualifier.
Definition: detect-app-layer-protocol.c:196
detect-flowint.h
DetectEngineBufferTypeGetNameById
const char * DetectEngineBufferTypeGetNameById(const DetectEngineCtx *de_ctx, const int id)
Definition: detect-engine.c:1483
SIG_FLAG_DST_ANY
#define SIG_FLAG_DST_ANY
Definition: detect.h:244
ACTION_SCOPE_FLOW
@ ACTION_SCOPE_FLOW
Definition: action-globals.h:45
SCMutexLock
#define SCMutexLock(mut)
Definition: threads-debug.h:117
util-var-name.h
SIG_FLAG_REQUIRE_STREAM
#define SIG_FLAG_REQUIRE_STREAM
Definition: detect.h:257
DETECT_XBITS_TRACK_IPDST
#define DETECT_XBITS_TRACK_IPDST
Definition: detect-xbits.h:35
rust.h
EngineAnalysisCtx_::fp_engine_analysis_fp
FILE * fp_engine_analysis_fp
Definition: detect-engine-analyzer.c:92
SCConfGetBool
int SCConfGetBool(const char *name, int *val)
Retrieve a configuration value as a boolean.
Definition: conf.c:524
EngineAnalysisCtx_::analyzer_initialized
bool analyzer_initialized
Definition: detect-engine-analyzer.c:115
ACTION_REJECT_ANY
#define ACTION_REJECT_ANY
Definition: action-globals.h:38
DetectEngineAnalyzerItems
Definition: detect-engine-analyzer.c:67
DETECT_BYTEJUMP_DCE
#define DETECT_BYTEJUMP_DCE
Definition: detect-bytejump.h:40
VarNameStoreSetupLookup
const char * VarNameStoreSetupLookup(const uint32_t id, const enum VarTypes type)
Definition: util-var-name.c:192
SCMUTEX_INITIALIZER
#define SCMUTEX_INITIALIZER
Definition: threads-debug.h:122
Signature_::sm_arrays
SigMatchData * sm_arrays[DETECT_SM_LIST_MAX]
Definition: detect.h:751
FpPatternStats_::max
uint16_t max
Definition: detect-engine-analyzer.c:78
SignatureInitData_::init_flags
uint32_t init_flags
Definition: detect.h:621
DetectBufferType_
Definition: detect.h:453
DetectContentData_
Definition: detect-content.h:93
DETECT_FLOWBITS_CMD_ISSET
#define DETECT_FLOWBITS_CMD_ISSET
Definition: detect-flowbits.h:31
p
Packet * p
Definition: fuzz_iprep.c:21
DetectPcreData_::flags
uint16_t flags
Definition: detect-pcre.h:52
SCConfNodeLookupChildValue
const char * SCConfNodeLookupChildValue(const SCConfNode *node, const char *name)
Lookup the value of a child configuration node by name.
Definition: conf.c:878
DetectContentData_::fp_chop_offset
uint16_t fp_chop_offset
Definition: detect-content.h:100
DetectBytetestData_::nbytes
uint8_t nbytes
Definition: detect-bytetest.h:54
DetectBytetestData_
Definition: detect-bytetest.h:53
EngineAnalysisCtx_::analyzer_item_map
int16_t analyzer_item_map[256]
Definition: detect-engine-analyzer.c:107
SIG_FLAG_TOCLIENT
#define SIG_FLAG_TOCLIENT
Definition: detect.h:274
DETECT_BYTEJUMP_BIG
#define DETECT_BYTEJUMP_BIG
Definition: detect-bytejump.h:36
SIG_FLAG_SRC_ANY
#define SIG_FLAG_SRC_ANY
Definition: detect.h:243
EngineAnalysisRulesFailure
void EngineAnalysisRulesFailure(const DetectEngineCtx *de_ctx, const char *line, const char *file, int lineno)
Definition: detect-engine-analyzer.c:631
SigMatchData_
Data needed for Match()
Definition: detect.h:368
DetectBytejumpData_::base
uint8_t base
Definition: detect-bytejump.h:49
detect-pcre.h
SIG_TYPE_APPLAYER
@ SIG_TYPE_APPLAYER
Definition: detect.h:76
SigMatchData_::type
uint16_t type
Definition: detect.h:369
DetectBytejumpData_
Definition: detect-bytejump.h:47
DetectXbitsData_
Definition: detect-xbits.h:41
DETECT_FLOW_ELEPHANT
@ DETECT_FLOW_ELEPHANT
Definition: detect-engine-register.h:145
Signature_::frame_inspect
DetectEngineFrameInspectionEngine * frame_inspect
Definition: detect.h:747
DetectBytejumpData_::offset
int32_t offset
Definition: detect-bytejump.h:51
DetectEnginePktInspectionEngine::transforms
const DetectEngineTransforms * transforms
Definition: detect.h:497
EngineAnalysisCtx_::analyzer_items
DetectEngineAnalyzerItems * analyzer_items
Definition: detect-engine-analyzer.c:94
DETECT_PERCENT_ENCODING_REGEX
#define DETECT_PERCENT_ENCODING_REGEX
FirewallAnalyzer
int FirewallAnalyzer(const DetectEngineCtx *de_ctx)
Definition: detect-engine-analyzer.c:2279
DetectBytejumpData_::multiplier
uint16_t multiplier
Definition: detect-bytejump.h:55
SIG_FLAG_APPLAYER
#define SIG_FLAG_APPLAYER
Definition: detect.h:251
DetectBufferTypeGetByName
int DetectBufferTypeGetByName(const char *name)
Definition: detect-engine.c:1453
DetectAppLayerProtocolGetValues
uint16_t DetectAppLayerProtocolGetValues(const DetectAppLayerProtocolData *data, AppProto *out, uint16_t max)
Fill out[] with the keyword's set protocol values.
Definition: detect-app-layer-protocol.c:217
SIG_FLAG_FIREWALL
#define SIG_FLAG_FIREWALL
Definition: detect.h:248
Signature_::gid
uint32_t gid
Definition: detect.h:734
DetectFlowintData_::idx
uint32_t idx
Definition: detect-flowint.h:66
DetectFirewallAppGenericHookName
const char * DetectFirewallAppGenericHookName(const uint8_t state, const uint8_t complete_state, const int direction)
Generic start/complete hook alias for an app progress state, in config form (hyphens),...
Definition: detect-parse.c:1185
Signature_::next
struct Signature_ * next
Definition: detect.h:770
ACTION_REJECT_DST
#define ACTION_REJECT_DST
Definition: action-globals.h:32
DetectEngineAppInspectionEngine_::sm_list
uint16_t sm_list
Definition: detect.h:427
ATTR_FMT_PRINTF
#define ATTR_FMT_PRINTF(x, y)
Definition: suricata-common.h:435
DetectFlowbitsData_
Definition: detect-flowbits.h:65
HashListTableGetListNext
#define HashListTableGetListNext(hb)
Definition: util-hashlist.h:55
DETECT_APP_LAYER_PROTOCOL
@ DETECT_APP_LAYER_PROTOCOL
Definition: detect-engine-register.h:35
DetectEngineAnalyzerItems::export_item_seen
bool export_item_seen
Definition: detect-engine-analyzer.c:70
SignaturePropertyFlowAction
SignaturePropertyFlowAction
Definition: detect.h:83
SIG_FLAG_TOSERVER
#define SIG_FLAG_TOSERVER
Definition: detect.h:273
detect-xbits.h
DETECT_XBITS_CMD_ISNOTSET
#define DETECT_XBITS_CMD_ISNOTSET
Definition: detect-xbits.h:30
DETECT_BYTETEST_RELATIVE
#define DETECT_BYTETEST_RELATIVE
Definition: detect-bytetest.h:46
SIG_TYPE_PKT
@ SIG_TYPE_PKT
Definition: detect.h:72
feature.h
AppLayerParserGetSubStateCompletion
uint8_t AppLayerParserGetSubStateCompletion(const AppProto alproto, const uint8_t sub_state)
Definition: app-layer-parser.c:1329
RuleAnalyzer::js
SCJsonBuilder * js
Definition: detect-engine-analyzer.c:647
IpOptsFlagToString
const char * IpOptsFlagToString(uint16_t flag)
Return human readable value for ipopts flag.
Definition: detect-ipopts.c:129
JB_SET_STRING
#define JB_SET_STRING(jb, key, val)
Definition: rust.h:36
EngineAnalysisCtx
struct EngineAnalysisCtx_ EngineAnalysisCtx
DetectEngineCtx_::fw_policies
struct DetectFirewallPolicies * fw_policies
Definition: detect.h:1018
DETECT_CONTENT_ENDS_WITH
#define DETECT_CONTENT_ENDS_WITH
Definition: detect-content.h:42
DETECT_PCRE_RAWBYTES
#define DETECT_PCRE_RAWBYTES
Definition: detect-pcre.h:31
DETECT_CONTENT_DISTANCE
#define DETECT_CONTENT_DISTANCE
Definition: detect-content.h:30
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:22
DetectEnginePktInspectionEngine::sm_list
uint16_t sm_list
Definition: detect.h:491
SIG_FLAG_INIT_BIDIREC
#define SIG_FLAG_INIT_BIDIREC
Definition: detect.h:295
g_alproto_max
AppProto g_alproto_max
Definition: app-layer-protos.c:30
DETECT_FLOWINT
@ DETECT_FLOWINT
Definition: detect-engine-register.h:71
strlcat
size_t strlcat(char *, const char *src, size_t siz)
Definition: util-strlcatu.c:45
SIG_MASK_REQUIRE_ENGINE_EVENT
#define SIG_MASK_REQUIRE_ENGINE_EVENT
Definition: detect.h:321
DETECT_ICODE
@ DETECT_ICODE
Definition: detect-engine-register.h:48
DETECT_FLOW_AGE
@ DETECT_FLOW_AGE
Definition: detect-engine-register.h:138
DETECT_BYTETEST_BASE_UNSET
#define DETECT_BYTETEST_BASE_UNSET
Definition: detect-bytetest.h:37
SIG_TYPE_IPONLY
@ SIG_TYPE_IPONLY
Definition: detect.h:66
FLOWINT_TARGET_VAL
@ FLOWINT_TARGET_VAL
Definition: detect-flowint.h:50
DETECT_BYTEJUMP_ALIGN
#define DETECT_BYTEJUMP_ALIGN
Definition: detect-bytejump.h:39
SignatureInitData_::mpm_sm
SigMatch * mpm_sm
Definition: detect.h:636
DetectEngineBufferTypeGetDescriptionById
const char * DetectEngineBufferTypeGetDescriptionById(const DetectEngineCtx *de_ctx, const int id)
Definition: detect-engine.c:1561
SCMutexUnlock
#define SCMutexUnlock(mut)
Definition: threads-debug.h:120
SIG_FLAG_FLUSH
#define SIG_FLAG_FLUSH
Definition: detect.h:261
DetectIpOptsData_::ipopt
uint16_t ipopt
Definition: detect-ipopts.h:38
SignatureInitData_::mpm_sm_list
int mpm_sm_list
Definition: detect.h:634
DETECT_BYTETEST_BASE_DEC
#define DETECT_BYTETEST_BASE_DEC
Definition: detect-bytetest.h:39
SIG_MASK_REQUIRE_FLOW
#define SIG_MASK_REQUIRE_FLOW
Definition: detect.h:315
SIG_FLAG_BYPASS
#define SIG_FLAG_BYPASS
Definition: detect.h:278
DETECT_CONTENT_DEPTH
#define DETECT_CONTENT_DEPTH
Definition: detect-content.h:33
DETECT_CONTENT_DISTANCE2OFFSET
#define DETECT_CONTENT_DISTANCE2OFFSET
Definition: detect-content.h:63
RuleAnalyzer
Definition: detect-engine-analyzer.c:646
DETECT_BYTEJUMP_END
#define DETECT_BYTEJUMP_END
Definition: detect-bytejump.h:42
Signature_::pkt_inspect
DetectEnginePktInspectionEngine * pkt_inspect
Definition: detect.h:746
DetectEngineAnalyzerItems
struct DetectEngineAnalyzerItems DetectEngineAnalyzerItems
util-print.h
SCEnter
#define SCEnter(...)
Definition: util-debug.h:284
detect-engine-mpm.h
HashTableLookup
void * HashTableLookup(HashTable *ht, void *data, uint16_t datalen)
Definition: util-hash.c:194
detect.h
SIG_MASK_REQUIRE_FLAGS_INITDEINIT
#define SIG_MASK_REQUIRE_FLAGS_INITDEINIT
Definition: detect.h:316
SignatureInitData_::rule_state_flowbits_ids_size
uint32_t rule_state_flowbits_ids_size
Definition: detect.h:681
DETECT_TCP_SESSION
@ DETECT_TCP_SESSION
Definition: detect-engine-register.h:64
DetectEngineFrameInspectionEngine::sm_list
uint16_t sm_list
Definition: detect.h:518
DETECT_XBITS_TRACK_IPPAIR
#define DETECT_XBITS_TRACK_IPPAIR
Definition: detect-xbits.h:36
detect-tcp-window.h
SigMatch_::next
struct SigMatch_ * next
Definition: detect.h:363
DetectFirewallPolicies::pkt
struct DetectFirewallPolicy pkt[DETECT_FIREWALL_POLICY_SIZE]
Definition: detect.h:956
DetectEngineAnalyzerItems::item_seen
bool item_seen
Definition: detect-engine-analyzer.c:69
DETECT_CONTENT_NEGATED
#define DETECT_CONTENT_NEGATED
Definition: detect-content.h:40
SignatureInitData_::proto
DetectProto proto
Definition: detect.h:651
DetectU8Data
DetectUintData_u8 DetectU8Data
Definition: detect-engine-uint.h:43
util-time.h
DETECT_ICMP_ID
@ DETECT_ICMP_ID
Definition: detect-engine-register.h:49
DETECT_SM_LIST_MATCH
@ DETECT_SM_LIST_MATCH
Definition: detect.h:117
EngineAnalysisRules
void EngineAnalysisRules(const DetectEngineCtx *de_ctx, const Signature *s, const char *line)
Prints analysis of loaded rules.
Definition: detect-engine-analyzer.c:1746
app-layer-parser.h
Signature_::app_inspect
DetectEngineAppInspectionEngine * app_inspect
Definition: detect.h:745
DETECT_XBITS
@ DETECT_XBITS
Definition: detect-engine-register.h:73
DETECT_SEQ
@ DETECT_SEQ
Definition: detect-engine-register.h:37
SigMatch_::ctx
SigMatchCtx * ctx
Definition: detect.h:362
DETECT_TCP_SESSION_PHASE_SETUP
#define DETECT_TCP_SESSION_PHASE_SETUP
Definition: detect-tcp-session.h:29
DETECT_ACK
@ DETECT_ACK
Definition: detect-engine-register.h:36
RuleAnalyzer::js_warnings
SCJsonBuilder * js_warnings
Definition: detect-engine-analyzer.c:649
SIG_FLAG_REQUIRE_FLOWVAR
#define SIG_FLAG_REQUIRE_FLOWVAR
Definition: detect.h:269
Signature_::action
uint8_t action
Definition: detect.h:703
FpPatternStats_::cnt
uint32_t cnt
Definition: detect-engine-analyzer.c:79
DetectXbitsData_::type
enum VarTypes type
Definition: detect-xbits.h:47
SCReturn
#define SCReturn
Definition: util-debug.h:286
Signature_::flags
uint32_t flags
Definition: detect.h:689
DetectContentData_::depth
uint16_t depth
Definition: detect-content.h:106
DetectEngineFrameInspectionEngine::v1
struct DetectEngineFrameInspectionEngine::@86 v1
ACTION_ALERT
#define ACTION_ALERT
Definition: action-globals.h:29
DETECT_BYTETEST_BIG
#define DETECT_BYTETEST_BIG
Definition: detect-bytetest.h:44
FLOWINT_MODIFIER_LE
@ FLOWINT_MODIFIER_LE
Definition: detect-flowint.h:36
SCLocalTime
struct tm * SCLocalTime(time_t timep, struct tm *result)
Definition: util-time.c:268
DetectTcpSessionData_::phase_flags
uint8_t phase_flags
Definition: detect-tcp-session.h:34
detect-bytejump.h
ACTION_SCOPE_TX
@ ACTION_SCOPE_TX
Definition: action-globals.h:47
SCConfigGetLogDirectory
const char * SCConfigGetLogDirectory(void)
Definition: util-conf.c:38
ACTION_SCOPE_AUTO
@ ACTION_SCOPE_AUTO
Definition: action-globals.h:43
conf.h
DetectContentData_::flags
uint32_t flags
Definition: detect-content.h:104
CHECK
#define CHECK(pat)
Definition: detect-engine-analyzer.c:683
DetectEngineFrameInspectionEngine
Definition: detect.h:513
DetectFlowbitsData_::idx
uint32_t idx
Definition: detect-flowbits.h:66
DetectEngineBufferTypeGetById
const DetectBufferType * DetectEngineBufferTypeGetById(const DetectEngineCtx *de_ctx, const int id)
Definition: detect-engine.c:1473
DETECT_BYTEJUMP_BASE_UNSET
#define DETECT_BYTEJUMP_BASE_UNSET
Definition: detect-bytejump.h:28
Signature_::init_data
SignatureInitData * init_data
Definition: detect.h:767
DetectFlowintData_::modifier
uint8_t modifier
Definition: detect-flowint.h:70
SIG_FLAG_SRC_IS_TARGET
#define SIG_FLAG_SRC_IS_TARGET
Definition: detect.h:285
SignatureInitData_::rule_state_dependant_sids_array
uint32_t * rule_state_dependant_sids_array
Definition: detect.h:677
fp_engine_analysis_set
bool fp_engine_analysis_set
Definition: fuzz_siginit.c:25
SignatureInitData_::rule_state_dependant_sids_size
uint32_t rule_state_dependant_sids_size
Definition: detect.h:678
DETECT_PCRE_HAS_UNICODE_CLUSTER
#define DETECT_PCRE_HAS_UNICODE_CLUSTER
Definition: detect-pcre.h:36
DetectEngineTransforms::transforms
TransformData transforms[DETECT_TRANSFORMS_MAX]
Definition: detect.h:395
DETECT_BYTEJUMP_BASE_HEX
#define DETECT_BYTEJUMP_BASE_HEX
Definition: detect-bytejump.h:31
DetectTcpSessionData_
Definition: detect-tcp-session.h:33
SIG_TYPE_DEONLY
@ SIG_TYPE_DEONLY
Definition: detect.h:71
SIG_PROP_FLOW_ACTION_PACKET
@ SIG_PROP_FLOW_ACTION_PACKET
Definition: detect.h:84
signature_properties
const struct SignatureProperties signature_properties[SIG_TYPE_MAX]
Definition: detect-engine.c:119
detect-flowbits.h
SIG_MASK_REQUIRE_PAYLOAD
#define SIG_MASK_REQUIRE_PAYLOAD
Definition: detect.h:314
DETECT_TCP_SESSION_PHASE_ESTABLISHED
#define DETECT_TCP_SESSION_PHASE_ESTABLISHED
Definition: detect-tcp-session.h:30
SCLogInfo
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:232
DETECT_PCRE
@ DETECT_PCRE
Definition: detect-engine-register.h:80
DETECT_DSIZE
@ DETECT_DSIZE
Definition: detect-engine-register.h:59
SIG_TYPE_NOT_SET
@ SIG_TYPE_NOT_SET
Definition: detect.h:65
ExposedItemSeen::bufname
const char * bufname
Definition: detect-engine-analyzer.c:85
DETECT_BYTEJUMP_OFFSET_BE
#define DETECT_BYTEJUMP_OFFSET_BE
Definition: detect-bytejump.h:41
FLOWINT_MODIFIER_GT
@ FLOWINT_MODIFIER_GT
Definition: detect-flowint.h:40
detect-ttl.h
DetectEngineCtx_::config_prefix
char config_prefix[64]
Definition: detect.h:1113
DetectSigmatchListEnumToString
const char * DetectSigmatchListEnumToString(enum DetectSigmatchListEnum type)
Definition: detect-engine.c:5264
analyzer_items
const DetectEngineAnalyzerItems analyzer_items[]
Definition: detect-engine-analyzer.c:118
DetectEngineAppInspectionEngine_::alproto
AppProto alproto
Definition: detect.h:420
SIG_FLAG_MPM_NEG
#define SIG_FLAG_MPM_NEG
Definition: detect.h:259
detect-engine-analyzer.h
SIG_FLAG_INIT_STATE_MATCH
#define SIG_FLAG_INIT_STATE_MATCH
Definition: detect.h:299
DetectEngineAnalyzerItems::item_id
int16_t item_id
Definition: detect-engine-analyzer.c:68
DETECT_XBITS_TRACK_TX
#define DETECT_XBITS_TRACK_TX
Definition: detect-xbits.h:37
DetectEngineAppInspectionEngine_::smd
SigMatchData * smd
Definition: detect.h:443
EngineAnalysisRules2
void EngineAnalysisRules2(const DetectEngineCtx *de_ctx, const Signature *s)
Definition: detect-engine-analyzer.c:1147
ACTION_REJECT_BOTH
#define ACTION_REJECT_BOTH
Definition: action-globals.h:33
FLOWINT_MODIFIER_LT
@ FLOWINT_MODIFIER_LT
Definition: detect-flowint.h:35
DetectFlowintData_::target
union DetectFlowintData_::@68 target
ARRAY_SIZE
#define ARRAY_SIZE(arr)
Definition: suricata-common.h:569
DETECT_CONTENT_STARTS_WITH
#define DETECT_CONTENT_STARTS_WITH
Definition: detect-content.h:59
DetectProto_::flags
uint8_t flags
Definition: detect-engine-proto.h:40
DETECT_BYTETEST
@ DETECT_BYTETEST
Definition: detect-engine-register.h:91
DETECT_PROTO_IPV4
#define DETECT_PROTO_IPV4
Definition: detect-engine-proto.h:31
util-conf.h
DETECT_TCP_SESSION_PHASE_CLOSING
#define DETECT_TCP_SESSION_PHASE_CLOSING
Definition: detect-tcp-session.h:31
SignatureHasStreamContent
int SignatureHasStreamContent(const Signature *s)
check if a signature has patterns that are to be inspected against the stream payload (as opposed to ...
Definition: detect-engine-mpm.c:908
FpPatternStats_::min
uint16_t min
Definition: detect-engine-analyzer.c:77
VAR_TYPE_FLOW_BIT
@ VAR_TYPE_FLOW_BIT
Definition: util-var.h:36
FLOWINT_TARGET_VAR
@ FLOWINT_TARGET_VAR
Definition: detect-flowint.h:51
suricata-common.h
SIG_MASK_REQUIRE_NO_PAYLOAD
#define SIG_MASK_REQUIRE_NO_PAYLOAD
Definition: detect.h:318
FLOWINT_MODIFIER_SET
@ FLOWINT_MODIFIER_SET
Definition: detect-flowint.h:30
DetectEnginePktInspectionEngine::v1
struct DetectEnginePktInspectionEngine::@85 v1
SIG_FLAG_SP_ANY
#define SIG_FLAG_SP_ANY
Definition: detect.h:245
SIG_PROP_FLOW_ACTION_FLOW_IF_STATEFUL
@ SIG_PROP_FLOW_ACTION_FLOW_IF_STATEFUL
Definition: detect.h:86
ActionScope
ActionScope
Definition: action-globals.h:42
FLOWINT_MODIFIER_ISSET
@ FLOWINT_MODIFIER_ISSET
Definition: detect-flowint.h:42
DetectAbsentData_
Definition: detect-isdataat.h:37
ExposedItemSeen
Definition: detect-engine-analyzer.c:84
SigMatch_::type
uint16_t type
Definition: detect.h:360
DETECT_FIREWALL_POLICY_PACKET_FILTER
@ DETECT_FIREWALL_POLICY_PACKET_FILTER
Definition: detect.h:931
HashListTableFree
void HashListTableFree(HashListTable *ht)
Definition: util-hashlist.c:88
DetectEngineAnalyzerItems::check_encoding_match
bool check_encoding_match
Definition: detect-engine-analyzer.c:71
DetectContentData_::distance
int32_t distance
Definition: detect-content.h:108
ACTION_SCOPE_HOOK
@ ACTION_SCOPE_HOOK
Definition: action-globals.h:46
CleanupEngineAnalysis
void CleanupEngineAnalysis(DetectEngineCtx *de_ctx)
Definition: detect-engine-analyzer.c:519
DetectBytejumpData_::nbytes
uint8_t nbytes
Definition: detect-bytejump.h:48
Signature_::action_scope
uint8_t action_scope
Definition: detect.h:710
ALPROTO_HTTP1
@ ALPROTO_HTTP1
Definition: app-layer-protos.h:36
DetectEngineFrameInspectionEngine::next
struct DetectEngineFrameInspectionEngine * next
Definition: detect.h:526
DetectU32Data
DetectUintData_u32 DetectU32Data
Definition: detect-engine-uint.h:41
ACTION_DROP
#define ACTION_DROP
Definition: action-globals.h:30
DetectEnginePktInspectionEngine::next
struct DetectEnginePktInspectionEngine * next
Definition: detect.h:499
DetectContentData_::content
uint8_t * content
Definition: detect-content.h:94
DetectXbitsData_::idx
uint32_t idx
Definition: detect-xbits.h:42
Signature_::rev
uint32_t rev
Definition: detect.h:735
AppLayerParserGetSubStateProgressName
const char * AppLayerParserGetSubStateProgressName(const AppProto alproto, const uint8_t sub_state, const uint8_t state, const uint8_t dir_flag)
Definition: app-layer-parser.c:1303
Signature_::proto
DetectProto * proto
Definition: detect.h:707
SCStrdup
#define SCStrdup(s)
Definition: util-mem.h:56
FatalError
#define FatalError(...)
Definition: util-debug.h:517
DetectEngineCtx_::sig_list
Signature * sig_list
Definition: detect.h:997
DETECT_BYTEJUMP_BASE_DEC
#define DETECT_BYTEJUMP_BASE_DEC
Definition: detect-bytejump.h:30
DetectIpOptsData_
Definition: detect-ipopts.h:37
ACTION_CONFIG
#define ACTION_CONFIG
Definition: action-globals.h:35
PrintRawUriFp
void PrintRawUriFp(FILE *fp, const uint8_t *buf, uint32_t buflen)
Definition: util-print.c:69
SIG_MASK_REQUIRE_FLAGS_UNUSUAL
#define SIG_MASK_REQUIRE_FLAGS_UNUSUAL
Definition: detect.h:317
TransformData_::transform
int transform
Definition: detect.h:390
FLOWINT_MODIFIER_ISNOTSET
@ FLOWINT_MODIFIER_ISNOTSET
Definition: detect-flowint.h:43
DETECT_FLOWBITS
@ DETECT_FLOWBITS
Definition: detect-engine-register.h:68
SIG_TYPE_MAX
@ SIG_TYPE_MAX
Definition: detect.h:79
DetectEngineCtx_::ea
struct EngineAnalysisCtx_ * ea
Definition: detect.h:1191
DETECT_BYTETEST_BASE_OCT
#define DETECT_BYTETEST_BASE_OCT
Definition: detect-bytetest.h:38
util-validate.h
detect-flow.h
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
EngineAnalysisFP
void EngineAnalysisFP(const DetectEngineCtx *de_ctx, const Signature *s, const char *line)
Definition: detect-engine-analyzer.c:175
SignatureInitData_::firewall_rule
bool firewall_rule
Definition: detect.h:684
FpPatternStats
struct FpPatternStats_ FpPatternStats
detect-tcp-ack.h
DetectXbitsData_::tracker
uint8_t tracker
Definition: detect-xbits.h:44
str
#define str(s)
Definition: suricata-common.h:316
DetectFirewallPolicy
Definition: detect.h:938
SCConfGetNode
SCConfNode * SCConfGetNode(const char *name)
Get a SCConfNode by name.
Definition: conf.c:184
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:274
SigMatchListSMBelongsTo
int SigMatchListSMBelongsTo(const Signature *s, const SigMatch *key_sm)
Definition: detect-parse.c:795
SCFree
#define SCFree(p)
Definition: util-mem.h:61
AppLayerParserGetSubStateName
const char * AppLayerParserGetSubStateName(const AppProto alproto, const uint8_t sub_state)
Definition: app-layer-parser.c:1352
DetectFlowbitsData_::or_list
uint32_t * or_list
Definition: detect-flowbits.h:72
DetectEngineAppInspectionEngine_::sub_state
uint8_t sub_state
Definition: detect.h:430
Signature_::id
uint32_t id
Definition: detect.h:733
DETECT_CONTENT_OFFSET
#define DETECT_CONTENT_OFFSET
Definition: detect-content.h:32
HashListTableBucket_
Definition: util-hashlist.h:28
DETECT_XBITS_TRACK_IPSRC
#define DETECT_XBITS_TRACK_IPSRC
Definition: detect-xbits.h:34
DETECT_FLOWBITS_CMD_UNSET
#define DETECT_FLOWBITS_CMD_UNSET
Definition: detect-flowbits.h:29
DETECT_CONTENT_FAST_PATTERN_ONLY
#define DETECT_CONTENT_FAST_PATTERN_ONLY
Definition: detect-content.h:35
DETECT_CONTENT_MPM
#define DETECT_CONTENT_MPM
Definition: detect-content.h:61
ACTION_SCOPE_PACKET
@ ACTION_SCOPE_PACKET
Definition: action-globals.h:44
DetectBufferType_::transforms
DetectEngineTransforms transforms
Definition: detect.h:467
detect-parse.h
Signature_
Signature container.
Definition: detect.h:688
SigMatch_
a single match condition for a signature
Definition: detect.h:359
DetectEngineAppInspectionEngine_::transforms
const DetectEngineTransforms * transforms
Definition: detect.h:440
DETECT_SM_LIST_MAX
@ DETECT_SM_LIST_MAX
Definition: detect.h:135
SCRequiresFeature
bool SCRequiresFeature(const char *feature_name)
Definition: feature.c:121
FpPatternStats_::tot
uint64_t tot
Definition: detect-engine-analyzer.c:80
DetectFlowintData_::tvar
TargetVar tvar
Definition: detect-flowint.h:77
DETECT_XBITS_CMD_ISSET
#define DETECT_XBITS_CMD_ISSET
Definition: detect-xbits.h:31
DETECT_BYTETEST_STRING
#define DETECT_BYTETEST_STRING
Definition: detect-bytetest.h:45
DetectBytetestData_::offset
int32_t offset
Definition: detect-bytetest.h:60
VAR_TYPE_FLOW_INT
@ VAR_TYPE_FLOW_INT
Definition: util-var.h:37
ALPROTO_UNKNOWN
@ ALPROTO_UNKNOWN
Definition: app-layer-protos.h:29
DETECT_PCRE_RELATIVE_NEXT
#define DETECT_PCRE_RELATIVE_NEXT
Definition: detect-pcre.h:34
detect-icmp-id.h
ACTION_ACCEPT
#define ACTION_ACCEPT
Definition: action-globals.h:36
DetectAppLayerProtocolData_::negated
bool negated
Definition: detect-app-layer-protocol.h:47
detect-ipopts.h
suricata.h
DetectPcreData_
Definition: detect-pcre.h:48
DetectEngineAppInspectionEngine_::dir
uint8_t dir
Definition: detect.h:421
DetectEngineAnalyzerItems::item_name
const char * item_name
Definition: detect-engine-analyzer.c:72
DetectContentData_::content_len
uint16_t content_len
Definition: detect-content.h:95
ExposedItemSeen::item_seen_ptr
bool * item_seen_ptr
Definition: detect-engine-analyzer.c:86
DETECT_BYTEJUMP_STRING
#define DETECT_BYTEJUMP_STRING
Definition: detect-bytejump.h:37
DetectEngineCtx_::buffer_type_id
uint32_t buffer_type_id
Definition: detect.h:1143
AppLayerParserGetMaxSubState
uint8_t AppLayerParserGetMaxSubState(const AppProto alproto)
Definition: app-layer-parser.c:1375
EngineAnalysisCtx_::file_prefix
char * file_prefix
Definition: detect-engine-analyzer.c:95
DETECT_XBITS_CMD_SET
#define DETECT_XBITS_CMD_SET
Definition: detect-xbits.h:27
DetectEnginePktInspectionEngine::mpm
bool mpm
Definition: detect.h:490
DETECT_BYTEJUMP_BEGIN
#define DETECT_BYTEJUMP_BEGIN
Definition: detect-bytejump.h:34
SignatureInitData_::rule_state_flowbits_ids_array
uint32_t * rule_state_flowbits_ids_array
Definition: detect.h:680
AppLayerParserSupportsSubStates
bool AppLayerParserSupportsSubStates(const AppProto alproto)
Definition: app-layer-parser.c:1382
SIG_PROP_FLOW_ACTION_FLOW
@ SIG_PROP_FLOW_ACTION_FLOW
Definition: detect.h:85
DETECT_PCRE_RELATIVE
#define DETECT_PCRE_RELATIVE
Definition: detect-pcre.h:29
TargetVar_::name
char * name
Definition: detect-flowint.h:57
DetectFirewallAppPolicy::alproto
AppProto alproto
Definition: detect.h:944
DetectFirewallPolicies::app_policies
HashTable * app_policies
Definition: detect.h:960
FLOWINT_MODIFIER_EQ
@ FLOWINT_MODIFIER_EQ
Definition: detect-flowint.h:37
RuleAnalyzer
struct RuleAnalyzer RuleAnalyzer
DETECT_WINDOW
@ DETECT_WINDOW
Definition: detect-engine-register.h:38
SIG_FLAG_TLSSTORE
#define SIG_FLAG_TLSSTORE
Definition: detect.h:276
DETECT_XBITS_CMD_TOGGLE
#define DETECT_XBITS_CMD_TOGGLE
Definition: detect-xbits.h:28
DetectU16Data
DetectUintData_u16 DetectU16Data
Definition: detect-engine-uint.h:42
Signature_::msg
char * msg
Definition: detect.h:756
DETECT_XBITS_CMD_UNSET
#define DETECT_XBITS_CMD_UNSET
Definition: detect-xbits.h:29
DETECT_CONTENT_FAST_PATTERN
#define DETECT_CONTENT_FAST_PATTERN
Definition: detect-content.h:34
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
DetectAbsentData_::or_else
bool or_else
Definition: detect-isdataat.h:39
RuleAnalyzer::js_notes
SCJsonBuilder * js_notes
Definition: detect-engine-analyzer.c:650
DETECT_FLAGS
@ DETECT_FLAGS
Definition: detect-engine-register.h:42
DETECT_PCRE_NEGATE
#define DETECT_PCRE_NEGATE
Definition: detect-pcre.h:35
EngineAnalysisCtx_::exposed_item_seen_list
struct ExposedItemSeen exposed_item_seen_list[2]
Definition: detect-engine-analyzer.c:113
Signature_::type
enum SignatureType type
Definition: detect.h:691
SCConfNode_
Definition: conf.h:37
FpPatternStats_
Definition: detect-engine-analyzer.c:76
DetectBytetestData_::base
uint8_t base
Definition: detect-bytetest.h:56
DetectFirewallAppPolicy::direction
uint8_t direction
Definition: detect.h:947
FLOWINT_MODIFIER_SUB
@ FLOWINT_MODIFIER_SUB
Definition: detect-flowint.h:32
DETECT_BYTETEST_LITTLE
#define DETECT_BYTETEST_LITTLE
Definition: detect-bytetest.h:43
SCMutex
#define SCMutex
Definition: threads-debug.h:114
SIG_TYPE_PDONLY
@ SIG_TYPE_PDONLY
Definition: detect.h:70
DetectEngineTransforms::cnt
uint8_t cnt
Definition: detect.h:396
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:109
SIG_FLAG_PREFILTER
#define SIG_FLAG_PREFILTER
Definition: detect.h:280
SignatureProperties::flow_action
enum SignaturePropertyFlowAction flow_action
Definition: detect.h:90
DETECT_TCPMSS
@ DETECT_TCPMSS
Definition: detect-engine-register.h:273
SIG_FLAG_FILESTORE
#define SIG_FLAG_FILESTORE
Definition: detect.h:271
DETECT_CONTENT_WITHIN
#define DETECT_CONTENT_WITHIN
Definition: detect-content.h:31
DETECT_BYTEJUMP_RELATIVE
#define DETECT_BYTEJUMP_RELATIVE
Definition: detect-bytejump.h:38
SIG_FLAG_DP_ANY
#define SIG_FLAG_DP_ANY
Definition: detect.h:246
DETECT_FLOWBITS_CMD_SET
#define DETECT_FLOWBITS_CMD_SET
Definition: detect-flowbits.h:28
SIG_FLAG_DSIZE
#define SIG_FLAG_DSIZE
Definition: detect.h:250
FLOWINT_MODIFIER_GE
@ FLOWINT_MODIFIER_GE
Definition: detect-flowint.h:39
DetectBytejumpData_::flags
uint16_t flags
Definition: detect-bytejump.h:50
Signature_::mask
SignatureMask mask
Definition: detect.h:699
SIG_TYPE_LIKE_IPONLY
@ SIG_TYPE_LIKE_IPONLY
Definition: detect.h:67
DetectEngineAppInspectionEngine_::progress
uint8_t progress
Definition: detect.h:429
detect-bytetest.h
DetectFlowintData_::value
uint32_t value
Definition: detect-flowint.h:75
DetectProtoContainsProto
int DetectProtoContainsProto(const DetectProto *dp, int proto)
see if a DetectProto contains a certain proto
Definition: detect-engine-proto.c:115
SIG_FLAG_REQUIRE_PACKET
#define SIG_FLAG_REQUIRE_PACKET
Definition: detect.h:256
DetectEngineFrameInspectionEngine::smd
SigMatchData * smd
Definition: detect.h:525