suricata
detect-engine-analyzer.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2023 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Eileen Donlon <emdonlo@gmail.com>
22  * \author Victor Julien <victor@inliniac.net>
23  *
24  * Rule analyzers for the detection engine
25  */
26 
27 #include "suricata-common.h"
28 #include "suricata.h"
29 #include "rust.h"
30 #include "action-globals.h"
31 #include "detect.h"
32 #include "detect-parse.h"
33 #include "detect-engine.h"
34 #include "detect-engine-analyzer.h"
35 #include "detect-engine-mpm.h"
36 #include "detect-engine-uint.h"
37 #include "conf.h"
38 #include "detect-content.h"
39 #include "detect-pcre.h"
40 #include "detect-bytejump.h"
41 #include "detect-bytetest.h"
42 #include "detect-flow.h"
43 #include "detect-tcp-flags.h"
44 #include "detect-tcp-ack.h"
45 #include "detect-ipopts.h"
46 #include "detect-tcp-seq.h"
47 #include "feature.h"
48 #include "util-print.h"
49 #include "util-time.h"
50 #include "util-validate.h"
51 #include "util-conf.h"
52 #include "detect-flowbits.h"
53 #include "util-var-name.h"
54 
55 static int rule_warnings_only = 0;
56 
57 /* Details for each buffer being tracked */
58 typedef struct DetectEngineAnalyzerItems {
59  int16_t item_id;
60  bool item_seen;
63  const char *item_name;
64  const char *display_name;
66 
67 typedef struct FpPatternStats_ {
68  uint16_t min;
69  uint16_t max;
70  uint32_t cnt;
71  uint64_t tot;
73 
74 /* Track which items require the item_seen value to be exposed */
76  const char *bufname;
78 };
79 
80 typedef struct EngineAnalysisCtx_ {
81 
84 
86  char *file_prefix;
87  pcre2_code *percent_re;
88 
89  /*
90  * This array contains the map between the `analyzer_items` array listed above and
91  * the item ids returned by DetectBufferTypeGetByName. Iterating signature's sigmatch
92  * array provides list_ids. The map converts those ids into elements of the
93  * analyzer items array.
94  *
95  * Ultimately, the g_buffer_type_hash is searched for each buffer name. The size of that
96  * hashlist is 256, so that's the value we use here.
97  */
98  int16_t analyzer_item_map[256];
100  /*
101  * Certain values must be directly accessible. This array contains items that are directly
102  * accessed when checking if they've been seen or not.
103  */
105 
108 
110  /* request keywords */
111  { 0, false, false, true, "http_uri", "http uri" },
112  { 0, false, false, false, "http_raw_uri", "http raw uri" },
113  { 0, false, true, false, "http_method", "http method" },
114  { 0, false, false, false, "http_request_line", "http request line" },
115  { 0, false, false, false, "http_client_body", "http client body" },
116  { 0, false, false, true, "http_header", "http header" },
117  { 0, false, false, false, "http_raw_header", "http raw header" },
118  { 0, false, false, true, "http_cookie", "http cookie" },
119  { 0, false, false, false, "http_user_agent", "http user agent" },
120  { 0, false, false, false, "http_host", "http host" },
121  { 0, false, false, false, "http_raw_host", "http raw host" },
122  { 0, false, false, false, "http_accept_enc", "http accept enc" },
123  { 0, false, false, false, "http_referer", "http referer" },
124  { 0, false, false, false, "http_content_type", "http content type" },
125  { 0, false, false, false, "http_header_names", "http header names" },
126 
127  /* response keywords not listed above */
128  { 0, false, false, false, "http_stat_msg", "http stat msg" },
129  { 0, false, false, false, "http_stat_code", "http stat code" },
130  { 0, false, true, false, "file_data", "http server body" },
131 
132  /* missing request keywords */
133  { 0, false, false, false, "http_request_line", "http request line" },
134  { 0, false, false, false, "http_accept", "http accept" },
135  { 0, false, false, false, "http_accept_lang", "http accept lang" },
136  { 0, false, false, false, "http_connection", "http connection" },
137  { 0, false, false, false, "http_content_len", "http content len" },
138  { 0, false, false, false, "http_protocol", "http protocol" },
139  { 0, false, false, false, "http_start", "http start" },
140 
141  /* missing response keywords; some of the missing are listed above*/
142  { 0, false, false, false, "http_response_line", "http response line" },
143  { 0, false, false, false, "http.server", "http server" },
144  { 0, false, false, false, "http.location", "http location" },
145 };
146 
147 static void FpPatternStatsAdd(FpPatternStats *fp, int list, uint16_t patlen)
148 {
149  if (list < 0 || list >= DETECT_SM_LIST_MAX)
150  return;
151 
152  FpPatternStats *f = &fp[list];
153 
154  if (f->min == 0)
155  f->min = patlen;
156  else if (patlen < f->min)
157  f->min = patlen;
158 
159  if (patlen > f->max)
160  f->max = patlen;
161 
162  f->cnt++;
163  f->tot += patlen;
164 }
165 
166 void EngineAnalysisFP(const DetectEngineCtx *de_ctx, const Signature *s, char *line)
167 {
168  int fast_pattern_set = 0;
169  int fast_pattern_only_set = 0;
170  int fast_pattern_chop_set = 0;
171  const DetectContentData *fp_cd = NULL;
172  const SigMatch *mpm_sm = s->init_data->mpm_sm;
173  const int mpm_sm_list = s->init_data->mpm_sm_list;
174 
175  if (mpm_sm != NULL) {
176  fp_cd = (DetectContentData *)mpm_sm->ctx;
177  if (fp_cd->flags & DETECT_CONTENT_FAST_PATTERN) {
178  fast_pattern_set = 1;
180  fast_pattern_only_set = 1;
181  } else if (fp_cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) {
182  fast_pattern_chop_set = 1;
183  }
184  }
185  }
186 
187  FILE *fp = de_ctx->ea->rule_engine_analysis_fp;
188  fprintf(fp, "== Sid: %u ==\n", s->id);
189  fprintf(fp, "%s\n", line);
190 
191  fprintf(fp, " Fast Pattern analysis:\n");
192  if (s->init_data->prefilter_sm != NULL) {
193  fprintf(fp, " Prefilter on: %s\n",
195  fprintf(fp, "\n");
196  return;
197  }
198 
199  if (fp_cd == NULL) {
200  fprintf(fp, " No content present\n");
201  fprintf(fp, "\n");
202  return;
203  }
204 
205  fprintf(fp, " Fast pattern matcher: ");
206  int list_type = mpm_sm_list;
207  if (list_type == DETECT_SM_LIST_PMATCH)
208  fprintf(fp, "content\n");
209  else {
210  const char *desc = DetectEngineBufferTypeGetDescriptionById(de_ctx, list_type);
211  const char *name = DetectEngineBufferTypeGetNameById(de_ctx, list_type);
212  if (desc && name) {
213  fprintf(fp, "%s (%s)\n", desc, name);
214  }
215  }
216 
217  int flags_set = 0;
218  fprintf(fp, " Flags:");
219  if (fp_cd->flags & DETECT_CONTENT_OFFSET) {
220  fprintf(fp, " Offset");
221  flags_set = 1;
222  } if (fp_cd->flags & DETECT_CONTENT_DEPTH) {
223  fprintf(fp, " Depth");
224  flags_set = 1;
225  }
226  if (fp_cd->flags & DETECT_CONTENT_WITHIN) {
227  fprintf(fp, " Within");
228  flags_set = 1;
229  }
230  if (fp_cd->flags & DETECT_CONTENT_DISTANCE) {
231  fprintf(fp, " Distance");
232  flags_set = 1;
233  }
234  if (fp_cd->flags & DETECT_CONTENT_NOCASE) {
235  fprintf(fp, " Nocase");
236  flags_set = 1;
237  }
238  if (fp_cd->flags & DETECT_CONTENT_NEGATED) {
239  fprintf(fp, " Negated");
240  flags_set = 1;
241  }
242  if (flags_set == 0)
243  fprintf(fp, " None");
244  fprintf(fp, "\n");
245 
246  fprintf(fp, " Fast pattern set: %s\n", fast_pattern_set ? "yes" : "no");
247  fprintf(fp, " Fast pattern only set: %s\n", fast_pattern_only_set ? "yes" : "no");
248  fprintf(fp, " Fast pattern chop set: %s\n", fast_pattern_chop_set ? "yes" : "no");
249  if (fast_pattern_chop_set) {
250  fprintf(fp, " Fast pattern offset, length: %u, %u\n", fp_cd->fp_chop_offset,
251  fp_cd->fp_chop_len);
252  }
253 
254  uint16_t patlen = fp_cd->content_len;
255  uint8_t *pat = SCMalloc(fp_cd->content_len + 1);
256  if (unlikely(pat == NULL)) {
257  FatalError("Error allocating memory");
258  }
259  memcpy(pat, fp_cd->content, fp_cd->content_len);
260  pat[fp_cd->content_len] = '\0';
261  fprintf(fp, " Original content: ");
262  PrintRawUriFp(fp, pat, patlen);
263  fprintf(fp, "\n");
264 
265  if (fast_pattern_chop_set) {
266  SCFree(pat);
267  patlen = fp_cd->fp_chop_len;
268  pat = SCMalloc(fp_cd->fp_chop_len + 1);
269  if (unlikely(pat == NULL)) {
270  exit(EXIT_FAILURE);
271  }
272  memcpy(pat, fp_cd->content + fp_cd->fp_chop_offset, fp_cd->fp_chop_len);
273  pat[fp_cd->fp_chop_len] = '\0';
274  fprintf(fp, " Final content: ");
275  PrintRawUriFp(fp, pat, patlen);
276  fprintf(fp, "\n");
277 
278  FpPatternStatsAdd(&de_ctx->ea->fp_pattern_stats[0], list_type, patlen);
279  } else {
280  fprintf(fp, " Final content: ");
281  PrintRawUriFp(fp, pat, patlen);
282  fprintf(fp, "\n");
283 
284  FpPatternStatsAdd(&de_ctx->ea->fp_pattern_stats[0], list_type, patlen);
285  }
286  SCFree(pat);
287 
288  fprintf(fp, "\n");
289 }
290 
291 /**
292  * \brief Sets up the fast pattern analyzer according to the config.
293  *
294  * \retval 1 If rule analyzer successfully enabled.
295  * \retval 0 If not enabled.
296  */
297 static int SetupFPAnalyzer(DetectEngineCtx *de_ctx)
298 {
299  int fp_engine_analysis_set = 0;
300 
301  if ((ConfGetBool("engine-analysis.rules-fast-pattern",
302  &fp_engine_analysis_set)) == 0) {
303  return false;
304  }
305 
306  if (fp_engine_analysis_set == 0)
307  return false;
308 
309  const char *log_dir = ConfigGetLogDirectory();
310  char *log_path = SCMalloc(PATH_MAX);
311  if (log_path == NULL) {
312  FatalError("Unable to allocate scratch memory for rule filename");
313  }
314  snprintf(log_path, PATH_MAX, "%s/%s%s", log_dir,
315  de_ctx->ea->file_prefix ? de_ctx->ea->file_prefix : "", "rules_fast_pattern.txt");
316 
317  FILE *fp = fopen(log_path, "w");
318  if (fp == NULL) {
319  SCLogError("failed to open %s: %s", log_path, strerror(errno));
320  SCFree(log_path);
321  return false;
322  }
323 
325 
326  SCLogInfo("Engine-Analysis for fast_pattern printed to file - %s",
327  log_path);
328  SCFree(log_path);
329 
330  struct timeval tval;
331  gettimeofday(&tval, NULL);
332  struct tm local_tm;
333  struct tm *tms = SCLocalTime(tval.tv_sec, &local_tm);
334  fprintf(fp, "----------------------------------------------"
335  "---------------------\n");
336  fprintf(fp,
337  "Date: %" PRId32 "/%" PRId32 "/%04d -- "
338  "%02d:%02d:%02d\n",
339  tms->tm_mday, tms->tm_mon + 1, tms->tm_year + 1900, tms->tm_hour, tms->tm_min,
340  tms->tm_sec);
341  fprintf(fp, "----------------------------------------------"
342  "---------------------\n");
343 
344  memset(&de_ctx->ea->fp_pattern_stats[0], 0, sizeof(de_ctx->ea->fp_pattern_stats));
345  return true;
346 }
347 
348 /**
349  * \brief Compiles regex for rule analysis
350  * \retval 1 if successful
351  * \retval 0 if on error
352  */
353 static bool PerCentEncodingSetup(EngineAnalysisCtx *ea_ctx)
354 {
355 #define DETECT_PERCENT_ENCODING_REGEX "%[0-9|a-f|A-F]{2}"
356  int en;
357  PCRE2_SIZE eo = 0;
358  int opts = 0; // PCRE2_NEWLINE_ANY??
359 
360  ea_ctx->percent_re = pcre2_compile((PCRE2_SPTR8)DETECT_PERCENT_ENCODING_REGEX,
361  PCRE2_ZERO_TERMINATED, opts, &en, &eo, NULL);
362  if (ea_ctx->percent_re == NULL) {
363  PCRE2_UCHAR errbuffer[256];
364  pcre2_get_error_message(en, errbuffer, sizeof(errbuffer));
365  SCLogError("Compile of \"%s\" failed at offset %d: %s", DETECT_PERCENT_ENCODING_REGEX,
366  (int)eo, errbuffer);
367  return false;
368  }
369 
370  return true;
371 }
372 /**
373  * \brief Sets up the rule analyzer according to the config
374  * \retval 1 if rule analyzer successfully enabled
375  * \retval 0 if not enabled
376  */
377 static int SetupRuleAnalyzer(DetectEngineCtx *de_ctx)
378 {
379  ConfNode *conf = ConfGetNode("engine-analysis");
380  int enabled = 0;
381  if (conf != NULL) {
382  const char *value = ConfNodeLookupChildValue(conf, "rules");
383  if (value && ConfValIsTrue(value)) {
384  enabled = 1;
385  } else if (value && strcasecmp(value, "warnings-only") == 0) {
386  enabled = 1;
387  rule_warnings_only = 1;
388  }
389  if (enabled) {
390  const char *log_dir;
391  log_dir = ConfigGetLogDirectory();
392  char log_path[PATH_MAX];
393  snprintf(log_path, sizeof(log_path), "%s/%s%s", log_dir,
394  de_ctx->ea->file_prefix ? de_ctx->ea->file_prefix : "", "rules_analysis.txt");
395  de_ctx->ea->rule_engine_analysis_fp = fopen(log_path, "w");
396  if (de_ctx->ea->rule_engine_analysis_fp == NULL) {
397  SCLogError("failed to open %s: %s", log_path, strerror(errno));
398  return 0;
399  }
400 
401  SCLogInfo("Engine-Analysis for rules printed to file - %s",
402  log_path);
403 
404  struct timeval tval;
405  gettimeofday(&tval, NULL);
406  struct tm local_tm;
407  struct tm *tms = SCLocalTime(tval.tv_sec, &local_tm);
409  "----------------------------------------------"
410  "---------------------\n");
412  "Date: %" PRId32 "/%" PRId32 "/%04d -- "
413  "%02d:%02d:%02d\n",
414  tms->tm_mday, tms->tm_mon + 1, tms->tm_year + 1900, tms->tm_hour, tms->tm_min,
415  tms->tm_sec);
417  "----------------------------------------------"
418  "---------------------\n");
419 
420  /*compile regex's for rule analysis*/
421  if (!PerCentEncodingSetup(de_ctx->ea)) {
423  "Error compiling regex; can't check for percent encoding in normalized "
424  "http content.\n");
425  }
426  }
427  }
428  else {
429  SCLogInfo("Conf parameter \"engine-analysis.rules\" not found. "
430  "Defaulting to not printing the rules analysis report.");
431  }
432  if (!enabled) {
433  SCLogInfo("Engine-Analysis for rules disabled in conf file.");
434  return 0;
435  }
436  return 1;
437 }
438 
439 static void CleanupFPAnalyzer(DetectEngineCtx *de_ctx)
440 {
441  FILE *fp = de_ctx->ea->rule_engine_analysis_fp;
442  fprintf(fp, "============\n"
443  "Summary:\n============\n");
444 
445  for (int i = 0; i < DETECT_SM_LIST_MAX; i++) {
447  if (f->cnt == 0)
448  continue;
449 
450  fprintf(fp,
451  "%s, smallest pattern %u byte(s), longest pattern %u byte(s), number of patterns "
452  "%u, avg pattern len %.2f byte(s)\n",
453  DetectSigmatchListEnumToString(i), f->min, f->max, f->cnt,
454  (float)((double)f->tot / (float)f->cnt));
455  }
456 
459 }
460 
461 static void CleanupRuleAnalyzer(DetectEngineCtx *de_ctx)
462 {
463  if (de_ctx->ea->fp_engine_analysis_fp != NULL) {
464  fclose(de_ctx->ea->fp_engine_analysis_fp);
466  }
467  if (de_ctx->ea->percent_re != NULL) {
468  pcre2_code_free(de_ctx->ea->percent_re);
469  }
470 }
471 
472 void SetupEngineAnalysis(DetectEngineCtx *de_ctx, bool *fp_analysis, bool *rule_analysis)
473 {
474  *fp_analysis = false;
475  *rule_analysis = false;
476 
477  EngineAnalysisCtx *ea = SCCalloc(1, sizeof(EngineAnalysisCtx));
478  if (ea == NULL) {
479  FatalError("Unable to allocate per-engine analysis context");
480  }
481 
482  ea->file_prefix = NULL;
483  int cfg_prefix_len = strlen(de_ctx->config_prefix);
484  if (cfg_prefix_len > 0) {
485  /* length of prefix + NULL + "." */
486  ea->file_prefix = SCCalloc(1, cfg_prefix_len + 1 + 1);
487  if (ea->file_prefix == NULL) {
488  FatalError("Unable to allocate per-engine analysis context name buffer");
489  }
490 
491  snprintf(ea->file_prefix, cfg_prefix_len + 1 + 1, "%s.", de_ctx->config_prefix);
492  }
493 
494  de_ctx->ea = ea;
495 
496  *fp_analysis = SetupFPAnalyzer(de_ctx);
497  *rule_analysis = SetupRuleAnalyzer(de_ctx);
498 
499  if (!(*fp_analysis || *rule_analysis)) {
500  if (ea->file_prefix)
501  SCFree(ea->file_prefix);
502  if (ea->analyzer_items)
503  SCFree(ea->analyzer_items);
504  SCFree(ea);
505  }
506 }
507 
509 {
510  if (de_ctx->ea) {
511  CleanupRuleAnalyzer(de_ctx);
512  CleanupFPAnalyzer(de_ctx);
513  if (de_ctx->ea->file_prefix)
515  if (de_ctx->ea->analyzer_items)
517  SCFree(de_ctx->ea);
518  de_ctx->ea = NULL;
519  }
520 }
521 
522 /**
523  * \brief Checks for % encoding in content.
524  * \param Pointer to content
525  * \retval number of matches if content has % encoding
526  * \retval 0 if it doesn't have % encoding
527  * \retval -1 on error
528  */
529 static int PerCentEncodingMatch(EngineAnalysisCtx *ea_ctx, uint8_t *content, uint16_t content_len)
530 {
531  int ret = 0;
532 
533  pcre2_match_data *match = pcre2_match_data_create_from_pattern(ea_ctx->percent_re, NULL);
534  ret = pcre2_match(ea_ctx->percent_re, (PCRE2_SPTR8)content, content_len, 0, 0, match, NULL);
535  if (ret == -1) {
536  return 0;
537  } else if (ret < -1) {
538  SCLogError("Error parsing content - %s; error code is %d", content, ret);
539  ret = -1;
540  }
541  pcre2_match_data_free(match);
542  return ret;
543 }
544 
545 static void EngineAnalysisRulesPrintFP(const DetectEngineCtx *de_ctx, const Signature *s)
546 {
547  const DetectContentData *fp_cd = NULL;
548  const SigMatch *mpm_sm = s->init_data->mpm_sm;
549  const int mpm_sm_list = s->init_data->mpm_sm_list;
550 
551  if (mpm_sm != NULL) {
552  fp_cd = (DetectContentData *)mpm_sm->ctx;
553  }
554 
555  if (fp_cd == NULL) {
556  return;
557  }
558 
559  uint16_t patlen = fp_cd->content_len;
560  uint8_t *pat = SCMalloc(fp_cd->content_len + 1);
561  if (unlikely(pat == NULL)) {
562  FatalError("Error allocating memory");
563  }
564 
565  EngineAnalysisCtx *ea_ctx = de_ctx->ea;
566 
567  memcpy(pat, fp_cd->content, fp_cd->content_len);
568  pat[fp_cd->content_len] = '\0';
569 
571  SCFree(pat);
572  patlen = fp_cd->fp_chop_len;
573  pat = SCMalloc(fp_cd->fp_chop_len + 1);
574  if (unlikely(pat == NULL)) {
575  exit(EXIT_FAILURE);
576  }
577  memcpy(pat, fp_cd->content + fp_cd->fp_chop_offset, fp_cd->fp_chop_len);
578  pat[fp_cd->fp_chop_len] = '\0';
579  fprintf(ea_ctx->rule_engine_analysis_fp, " Fast Pattern \"");
580  PrintRawUriFp(ea_ctx->rule_engine_analysis_fp, pat, patlen);
581  } else {
582  fprintf(ea_ctx->rule_engine_analysis_fp, " Fast Pattern \"");
583  PrintRawUriFp(ea_ctx->rule_engine_analysis_fp, pat, patlen);
584  }
585  SCFree(pat);
586 
587  fprintf(ea_ctx->rule_engine_analysis_fp, "\" on \"");
588 
589  const int list_type = mpm_sm_list;
590  if (list_type == DETECT_SM_LIST_PMATCH) {
591  int payload = 0;
592  int stream = 0;
594  payload = 1;
596  stream = 1;
597  fprintf(ea_ctx->rule_engine_analysis_fp, "%s",
598  payload ? (stream ? "payload and reassembled stream" : "payload")
599  : "reassembled stream");
600  }
601  else {
602  const char *desc = DetectEngineBufferTypeGetDescriptionById(de_ctx, list_type);
603  const char *name = DetectEngineBufferTypeGetNameById(de_ctx, list_type);
604  if (desc && name) {
605  fprintf(ea_ctx->rule_engine_analysis_fp, "%s (%s)", desc, name);
606  } else if (desc || name) {
607  fprintf(ea_ctx->rule_engine_analysis_fp, "%s", desc ? desc : name);
608  }
609 
610  }
611 
612  fprintf(ea_ctx->rule_engine_analysis_fp, "\" ");
613  const DetectBufferType *bt = DetectEngineBufferTypeGetById(de_ctx, list_type);
614  if (bt && bt->transforms.cnt) {
615  fprintf(ea_ctx->rule_engine_analysis_fp, "(with %d transform(s)) ", bt->transforms.cnt);
616  }
617  fprintf(ea_ctx->rule_engine_analysis_fp, "buffer.\n");
618 }
619 
620 void EngineAnalysisRulesFailure(const DetectEngineCtx *de_ctx, char *line, char *file, int lineno)
621 {
622  fprintf(de_ctx->ea->fp_engine_analysis_fp, "== Sid: UNKNOWN ==\n");
623  fprintf(de_ctx->ea->fp_engine_analysis_fp, "%s\n", line);
624  fprintf(de_ctx->ea->fp_engine_analysis_fp, " FAILURE: invalid rule.\n");
625  fprintf(de_ctx->ea->fp_engine_analysis_fp, " File: %s.\n", file);
626  fprintf(de_ctx->ea->fp_engine_analysis_fp, " Line: %d.\n", lineno);
627  fprintf(de_ctx->ea->fp_engine_analysis_fp, "\n");
628 }
629 
630 typedef struct RuleAnalyzer {
631  JsonBuilder *js; /* document root */
632 
633  JsonBuilder *js_warnings;
634  JsonBuilder *js_notes;
636 
637 static void ATTR_FMT_PRINTF(2, 3) AnalyzerNote(RuleAnalyzer *ctx, char *fmt, ...)
638 {
639  va_list ap;
640  char str[1024];
641 
642  va_start(ap, fmt);
643  vsnprintf(str, sizeof(str), fmt, ap);
644  va_end(ap);
645 
646  if (!ctx->js_notes)
647  ctx->js_notes = jb_new_array();
648  if (ctx->js_notes)
649  jb_append_string(ctx->js_notes, str);
650 }
651 
652 static void ATTR_FMT_PRINTF(2, 3) AnalyzerWarning(RuleAnalyzer *ctx, char *fmt, ...)
653 {
654  va_list ap;
655  char str[1024];
656 
657  va_start(ap, fmt);
658  vsnprintf(str, sizeof(str), fmt, ap);
659  va_end(ap);
660 
661  if (!ctx->js_warnings)
662  ctx->js_warnings = jb_new_array();
663  if (ctx->js_warnings)
664  jb_append_string(ctx->js_warnings, str);
665 }
666 
667 #define CHECK(pat) if (strlen((pat)) <= len && memcmp((pat), buf, MIN(len, strlen((pat)))) == 0) return true;
668 
669 static bool LooksLikeHTTPMethod(const uint8_t *buf, uint16_t len)
670 {
671  CHECK("GET /");
672  CHECK("POST /");
673  CHECK("HEAD /");
674  CHECK("PUT /");
675  return false;
676 }
677 
678 static bool LooksLikeHTTPUA(const uint8_t *buf, uint16_t len)
679 {
680  CHECK("User-Agent: ");
681  CHECK("\nUser-Agent: ");
682  return false;
683 }
684 
685 static void DumpContent(JsonBuilder *js, const DetectContentData *cd)
686 {
687  char pattern_str[1024] = "";
688  DetectContentPatternPrettyPrint(cd, pattern_str, sizeof(pattern_str));
689 
690  jb_set_string(js, "pattern", pattern_str);
691  jb_set_uint(js, "length", cd->content_len);
692  jb_set_bool(js, "nocase", cd->flags & DETECT_CONTENT_NOCASE);
693  jb_set_bool(js, "negated", cd->flags & DETECT_CONTENT_NEGATED);
694  jb_set_bool(js, "starts_with", cd->flags & DETECT_CONTENT_STARTS_WITH);
695  jb_set_bool(js, "ends_with", cd->flags & DETECT_CONTENT_ENDS_WITH);
696  jb_set_bool(js, "is_mpm", cd->flags & DETECT_CONTENT_MPM);
697  jb_set_bool(js, "no_double_inspect", cd->flags & DETECT_CONTENT_NO_DOUBLE_INSPECTION_REQUIRED);
698  if (cd->flags & DETECT_CONTENT_OFFSET) {
699  jb_set_uint(js, "offset", cd->offset);
700  }
701  if (cd->flags & DETECT_CONTENT_DEPTH) {
702  jb_set_uint(js, "depth", cd->depth);
703  }
704  if (cd->flags & DETECT_CONTENT_DISTANCE) {
705  jb_set_int(js, "distance", cd->distance);
706  }
707  if (cd->flags & DETECT_CONTENT_WITHIN) {
708  jb_set_int(js, "within", cd->within);
709  }
710  jb_set_bool(js, "fast_pattern", cd->flags & DETECT_CONTENT_FAST_PATTERN);
711  jb_set_bool(js, "relative_next", cd->flags & DETECT_CONTENT_RELATIVE_NEXT);
712 }
713 
714 static void DumpPcre(JsonBuilder *js, const DetectPcreData *cd)
715 {
716  jb_set_bool(js, "relative", cd->flags & DETECT_PCRE_RELATIVE);
717  jb_set_bool(js, "relative_next", cd->flags & DETECT_PCRE_RELATIVE_NEXT);
718  jb_set_bool(js, "nocase", cd->flags & DETECT_PCRE_CASELESS);
719  jb_set_bool(js, "negated", cd->flags & DETECT_PCRE_NEGATE);
720 }
721 
722 static void DumpMatches(RuleAnalyzer *ctx, JsonBuilder *js, const SigMatchData *smd)
723 {
724  if (smd == NULL)
725  return;
726 
727  jb_open_array(js, "matches");
728  do {
729  jb_start_object(js);
730  const char *mname = sigmatch_table[smd->type].name;
731  jb_set_string(js, "name", mname);
732 
733  switch (smd->type) {
734  case DETECT_CONTENT: {
735  const DetectContentData *cd = (const DetectContentData *)smd->ctx;
736 
737  jb_open_object(js, "content");
738  DumpContent(js, cd);
740  AnalyzerNote(ctx, (char *)"'fast_pattern:only' option is silently ignored and "
741  "is interpreted as regular 'fast_pattern'");
742  }
743  if (LooksLikeHTTPMethod(cd->content, cd->content_len)) {
744  AnalyzerWarning(ctx,
745  (char *)"pattern looks like it inspects HTTP, use http.request_line or "
746  "http.method and http.uri instead for improved performance");
747  }
748  if (LooksLikeHTTPUA(cd->content, cd->content_len)) {
749  AnalyzerWarning(ctx,
750  (char *)"pattern looks like it inspects HTTP, use http.user_agent "
751  "or http.header for improved performance");
752  }
754  AnalyzerNote(ctx, (char *)"'within' option for pattern w/o previous content "
755  "was converted to 'depth'");
756  }
758  AnalyzerNote(ctx, (char *)"'distance' option for pattern w/o previous content "
759  "was converted to 'offset'");
760  }
761  jb_close(js);
762  break;
763  }
764  case DETECT_PCRE: {
765  const DetectPcreData *cd = (const DetectPcreData *)smd->ctx;
766 
767  jb_open_object(js, "pcre");
768  DumpPcre(js, cd);
769  jb_close(js);
770  if (cd->flags & DETECT_PCRE_RAWBYTES) {
771  AnalyzerNote(ctx,
772  (char *)"'/B' (rawbytes) option is a no-op and is silently ignored");
773  }
774  break;
775  }
776  case DETECT_BYTEJUMP: {
777  const DetectBytejumpData *cd = (const DetectBytejumpData *)smd->ctx;
778 
779  jb_open_object(js, "byte_jump");
780  jb_set_uint(js, "nbytes", cd->nbytes);
781  jb_set_int(js, "offset", cd->offset);
782  jb_set_uint(js, "multiplier", cd->multiplier);
783  jb_set_int(js, "post_offset", cd->post_offset);
784  switch (cd->base) {
786  jb_set_string(js, "base", "unset");
787  break;
789  jb_set_string(js, "base", "oct");
790  break;
792  jb_set_string(js, "base", "dec");
793  break;
795  jb_set_string(js, "base", "hex");
796  break;
797  }
798  jb_open_array(js, "flags");
799  if (cd->flags & DETECT_BYTEJUMP_BEGIN)
800  jb_append_string(js, "from_beginning");
801  if (cd->flags & DETECT_BYTEJUMP_LITTLE)
802  jb_append_string(js, "little_endian");
803  if (cd->flags & DETECT_BYTEJUMP_BIG)
804  jb_append_string(js, "big_endian");
805  if (cd->flags & DETECT_BYTEJUMP_STRING)
806  jb_append_string(js, "string");
808  jb_append_string(js, "relative");
809  if (cd->flags & DETECT_BYTEJUMP_ALIGN)
810  jb_append_string(js, "align");
811  if (cd->flags & DETECT_BYTEJUMP_DCE)
812  jb_append_string(js, "dce");
814  jb_append_string(js, "offset_be");
815  if (cd->flags & DETECT_BYTEJUMP_END)
816  jb_append_string(js, "from_end");
817  jb_close(js);
818  jb_close(js);
819  break;
820  }
821  case DETECT_BYTETEST: {
822  const DetectBytetestData *cd = (const DetectBytetestData *)smd->ctx;
823 
824  jb_open_object(js, "byte_test");
825  jb_set_uint(js, "nbytes", cd->nbytes);
826  jb_set_int(js, "offset", cd->offset);
827  switch (cd->base) {
829  jb_set_string(js, "base", "unset");
830  break;
832  jb_set_string(js, "base", "oct");
833  break;
835  jb_set_string(js, "base", "dec");
836  break;
838  jb_set_string(js, "base", "hex");
839  break;
840  }
841  jb_open_array(js, "flags");
842  if (cd->flags & DETECT_BYTETEST_LITTLE)
843  jb_append_string(js, "little_endian");
844  if (cd->flags & DETECT_BYTETEST_BIG)
845  jb_append_string(js, "big_endian");
846  if (cd->flags & DETECT_BYTETEST_STRING)
847  jb_append_string(js, "string");
849  jb_append_string(js, "relative");
850  if (cd->flags & DETECT_BYTETEST_DCE)
851  jb_append_string(js, "dce");
852  jb_close(js);
853  jb_close(js);
854  break;
855  }
856  case DETECT_IPOPTS: {
857  const DetectIpOptsData *cd = (const DetectIpOptsData *)smd->ctx;
858 
859  jb_open_object(js, "ipopts");
860  const char *flag = IpOptsFlagToString(cd->ipopt);
861  jb_set_string(js, "option", flag);
862  jb_close(js);
863  break;
864  }
865  case DETECT_FLOWBITS: {
866  const DetectFlowbitsData *cd = (const DetectFlowbitsData *)smd->ctx;
867 
868  jb_open_object(js, "flowbits");
869  switch (cd->cmd) {
871  jb_set_string(js, "cmd", "isset");
872  break;
874  jb_set_string(js, "cmd", "isnotset");
875  break;
877  jb_set_string(js, "cmd", "set");
878  break;
880  jb_set_string(js, "cmd", "unset");
881  break;
883  jb_set_string(js, "cmd", "toggle");
884  break;
885  }
886  bool is_or = false;
887  jb_open_array(js, "names");
888  if (cd->or_list_size == 0) {
889  jb_append_string(js, VarNameStoreSetupLookup(cd->idx, VAR_TYPE_FLOW_BIT));
890  } else if (cd->or_list_size > 0) {
891  is_or = true;
892  for (uint8_t i = 0; i < cd->or_list_size; i++) {
893  const char *varname =
895  jb_append_string(js, varname);
896  }
897  }
898  jb_close(js); // array
899  if (is_or) {
900  jb_set_string(js, "operator", "or");
901  }
902  jb_close(js); // object
903  break;
904  }
905  case DETECT_ACK: {
906  const DetectAckData *cd = (const DetectAckData *)smd->ctx;
907 
908  jb_open_object(js, "ack");
909  jb_set_uint(js, "number", cd->ack);
910  jb_close(js);
911  break;
912  }
913  case DETECT_SEQ: {
914  const DetectSeqData *cd = (const DetectSeqData *)smd->ctx;
915  jb_open_object(js, "seq");
916  jb_set_uint(js, "number", cd->seq);
917  jb_close(js);
918  break;
919  }
920  case DETECT_TCPMSS: {
921  const DetectU16Data *cd = (const DetectU16Data *)smd->ctx;
922  jb_open_object(js, "tcp_mss");
923  SCDetectU16ToJson(js, cd);
924  jb_close(js);
925  break;
926  }
927  }
928  jb_close(js);
929 
930  if (smd->is_last)
931  break;
932  smd++;
933  } while (1);
934  jb_close(js);
935 }
936 
939 {
940  SCEnter();
941 
942  RuleAnalyzer ctx = { NULL, NULL, NULL };
943 
944  ctx.js = jb_new_object();
945  if (ctx.js == NULL)
946  SCReturn;
947 
948  jb_set_string(ctx.js, "raw", s->sig_str);
949  jb_set_uint(ctx.js, "id", s->id);
950  jb_set_uint(ctx.js, "gid", s->gid);
951  jb_set_uint(ctx.js, "rev", s->rev);
952  jb_set_string(ctx.js, "msg", s->msg);
953 
954  const char *alproto = AppProtoToString(s->alproto);
955  jb_set_string(ctx.js, "app_proto", alproto);
956 
957  jb_open_array(ctx.js, "requirements");
958  if (s->mask & SIG_MASK_REQUIRE_PAYLOAD) {
959  jb_append_string(ctx.js, "payload");
960  }
962  jb_append_string(ctx.js, "no_payload");
963  }
964  if (s->mask & SIG_MASK_REQUIRE_FLOW) {
965  jb_append_string(ctx.js, "flow");
966  }
968  jb_append_string(ctx.js, "tcp_flags_init_deinit");
969  }
971  jb_append_string(ctx.js, "tcp_flags_unusual");
972  }
974  jb_append_string(ctx.js, "engine_event");
975  }
976  if (s->mask & SIG_MASK_REQUIRE_REAL_PKT) {
977  jb_append_string(ctx.js, "real_pkt");
978  }
979  jb_close(ctx.js);
980 
981  switch (s->type) {
982  case SIG_TYPE_NOT_SET:
983  jb_set_string(ctx.js, "type", "unset");
984  break;
985  case SIG_TYPE_IPONLY:
986  jb_set_string(ctx.js, "type", "ip_only");
987  break;
989  jb_set_string(ctx.js, "type", "like_ip_only");
990  break;
991  case SIG_TYPE_PDONLY:
992  jb_set_string(ctx.js, "type", "pd_only");
993  break;
994  case SIG_TYPE_DEONLY:
995  jb_set_string(ctx.js, "type", "de_only");
996  break;
997  case SIG_TYPE_PKT:
998  jb_set_string(ctx.js, "type", "pkt");
999  break;
1000  case SIG_TYPE_PKT_STREAM:
1001  jb_set_string(ctx.js, "type", "pkt_stream");
1002  break;
1003  case SIG_TYPE_STREAM:
1004  jb_set_string(ctx.js, "type", "stream");
1005  break;
1006  case SIG_TYPE_APPLAYER:
1007  jb_set_string(ctx.js, "type", "app_layer");
1008  break;
1009  case SIG_TYPE_APP_TX:
1010  jb_set_string(ctx.js, "type", "app_tx");
1011  break;
1012  case SIG_TYPE_MAX:
1013  jb_set_string(ctx.js, "type", "error");
1014  break;
1015  }
1016 
1017  jb_open_array(ctx.js, "flags");
1018  if (s->flags & SIG_FLAG_SRC_ANY) {
1019  jb_append_string(ctx.js, "src_any");
1020  }
1021  if (s->flags & SIG_FLAG_DST_ANY) {
1022  jb_append_string(ctx.js, "dst_any");
1023  }
1024  if (s->flags & SIG_FLAG_SP_ANY) {
1025  jb_append_string(ctx.js, "sp_any");
1026  }
1027  if (s->flags & SIG_FLAG_DP_ANY) {
1028  jb_append_string(ctx.js, "dp_any");
1029  }
1030  if ((s->action & ACTION_ALERT) == 0) {
1031  jb_append_string(ctx.js, "noalert");
1032  }
1033  if (s->flags & SIG_FLAG_DSIZE) {
1034  jb_append_string(ctx.js, "dsize");
1035  }
1036  if (s->flags & SIG_FLAG_APPLAYER) {
1037  jb_append_string(ctx.js, "applayer");
1038  }
1039  if (s->flags & SIG_FLAG_REQUIRE_PACKET) {
1040  jb_append_string(ctx.js, "need_packet");
1041  }
1042  if (s->flags & SIG_FLAG_REQUIRE_STREAM) {
1043  jb_append_string(ctx.js, "need_stream");
1044  }
1045  if (s->flags & SIG_FLAG_MPM_NEG) {
1046  jb_append_string(ctx.js, "negated_mpm");
1047  }
1048  if (s->flags & SIG_FLAG_FLUSH) {
1049  jb_append_string(ctx.js, "flush");
1050  }
1051  if (s->flags & SIG_FLAG_REQUIRE_FLOWVAR) {
1052  jb_append_string(ctx.js, "need_flowvar");
1053  }
1054  if (s->flags & SIG_FLAG_FILESTORE) {
1055  jb_append_string(ctx.js, "filestore");
1056  }
1057  if (s->flags & SIG_FLAG_TOSERVER) {
1058  jb_append_string(ctx.js, "toserver");
1059  }
1060  if (s->flags & SIG_FLAG_TOCLIENT) {
1061  jb_append_string(ctx.js, "toclient");
1062  }
1063  if (s->flags & SIG_FLAG_TLSSTORE) {
1064  jb_append_string(ctx.js, "tlsstore");
1065  }
1066  if (s->flags & SIG_FLAG_BYPASS) {
1067  jb_append_string(ctx.js, "bypass");
1068  }
1069  if (s->flags & SIG_FLAG_PREFILTER) {
1070  jb_append_string(ctx.js, "prefilter");
1071  }
1072  if (s->flags & SIG_FLAG_SRC_IS_TARGET) {
1073  jb_append_string(ctx.js, "src_is_target");
1074  }
1075  if (s->flags & SIG_FLAG_DEST_IS_TARGET) {
1076  jb_append_string(ctx.js, "dst_is_target");
1077  }
1078  jb_close(ctx.js);
1079 
1080  const DetectEnginePktInspectionEngine *pkt_mpm = NULL;
1081  const DetectEngineAppInspectionEngine *app_mpm = NULL;
1082 
1083  jb_open_array(ctx.js, "pkt_engines");
1085  for ( ; pkt != NULL; pkt = pkt->next) {
1086  const char *name = DetectEngineBufferTypeGetNameById(de_ctx, pkt->sm_list);
1087  if (name == NULL) {
1088  switch (pkt->sm_list) {
1089  case DETECT_SM_LIST_PMATCH:
1090  name = "payload";
1091  break;
1092  case DETECT_SM_LIST_MATCH:
1093  name = "packet";
1094  break;
1095  default:
1096  name = "unknown";
1097  break;
1098  }
1099  }
1100  jb_start_object(ctx.js);
1101  jb_set_string(ctx.js, "name", name);
1102  jb_set_bool(ctx.js, "is_mpm", pkt->mpm);
1103  if (pkt->v1.transforms != NULL) {
1104  jb_open_array(ctx.js, "transforms");
1105  for (int t = 0; t < pkt->v1.transforms->cnt; t++) {
1106  jb_start_object(ctx.js);
1107  jb_set_string(ctx.js, "name",
1109  jb_close(ctx.js);
1110  }
1111  jb_close(ctx.js);
1112  }
1113  DumpMatches(&ctx, ctx.js, pkt->smd);
1114  jb_close(ctx.js);
1115  if (pkt->mpm) {
1116  pkt_mpm = pkt;
1117  }
1118  }
1119  jb_close(ctx.js);
1120  jb_open_array(ctx.js, "frame_engines");
1122  for (; frame != NULL; frame = frame->next) {
1123  const char *name = DetectEngineBufferTypeGetNameById(de_ctx, frame->sm_list);
1124  jb_start_object(ctx.js);
1125  jb_set_string(ctx.js, "name", name);
1126  jb_set_bool(ctx.js, "is_mpm", frame->mpm);
1127  if (frame->v1.transforms != NULL) {
1128  jb_open_array(ctx.js, "transforms");
1129  for (int t = 0; t < frame->v1.transforms->cnt; t++) {
1130  jb_start_object(ctx.js);
1131  jb_set_string(ctx.js, "name",
1133  jb_close(ctx.js);
1134  }
1135  jb_close(ctx.js);
1136  }
1137  DumpMatches(&ctx, ctx.js, frame->smd);
1138  jb_close(ctx.js);
1139  }
1140  jb_close(ctx.js);
1141 
1143  bool has_stream = false;
1144  bool has_client_body_mpm = false;
1145  bool has_file_data_mpm = false;
1146 
1147  jb_open_array(ctx.js, "engines");
1149  for ( ; app != NULL; app = app->next) {
1150  const char *name = DetectEngineBufferTypeGetNameById(de_ctx, app->sm_list);
1151  if (name == NULL) {
1152  switch (app->sm_list) {
1153  case DETECT_SM_LIST_PMATCH:
1154  name = "stream";
1155  break;
1156  default:
1157  name = "unknown";
1158  break;
1159  }
1160  }
1161 
1162  if (app->sm_list == DETECT_SM_LIST_PMATCH && !app->mpm) {
1163  has_stream = true;
1164  } else if (app->mpm && strcmp(name, "http_client_body") == 0) {
1165  has_client_body_mpm = true;
1166  } else if (app->mpm && strcmp(name, "file_data") == 0) {
1167  has_file_data_mpm = true;
1168  }
1169 
1170  jb_start_object(ctx.js);
1171  jb_set_string(ctx.js, "name", name);
1172  const char *direction = app->dir == 0 ? "toserver" : "toclient";
1173  jb_set_string(ctx.js, "direction", direction);
1174  jb_set_bool(ctx.js, "is_mpm", app->mpm);
1175  jb_set_string(ctx.js, "app_proto", AppProtoToString(app->alproto));
1176  jb_set_uint(ctx.js, "progress", app->progress);
1177 
1178  if (app->v2.transforms != NULL) {
1179  jb_open_array(ctx.js, "transforms");
1180  for (int t = 0; t < app->v2.transforms->cnt; t++) {
1181  jb_start_object(ctx.js);
1182  jb_set_string(ctx.js, "name",
1184  jb_close(ctx.js);
1185  }
1186  jb_close(ctx.js);
1187  }
1188  DumpMatches(&ctx, ctx.js, app->smd);
1189  jb_close(ctx.js);
1190  if (app->mpm) {
1191  app_mpm = app;
1192  }
1193  }
1194  jb_close(ctx.js);
1195 
1196  if (has_stream && has_client_body_mpm)
1197  AnalyzerNote(&ctx, (char *)"mpm in http_client_body combined with stream match leads to stream buffering");
1198  if (has_stream && has_file_data_mpm)
1199  AnalyzerNote(&ctx, (char *)"mpm in file_data combined with stream match leads to stream buffering");
1200  }
1201 
1202  jb_open_object(ctx.js, "lists");
1203  for (int i = 0; i < DETECT_SM_LIST_MAX; i++) {
1204  if (s->sm_arrays[i] != NULL) {
1205  jb_open_object(ctx.js, DetectListToHumanString(i));
1206  DumpMatches(&ctx, ctx.js, s->sm_arrays[i]);
1207  jb_close(ctx.js);
1208  }
1209  }
1210  jb_close(ctx.js);
1211 
1212  if (pkt_mpm || app_mpm) {
1213  jb_open_object(ctx.js, "mpm");
1214 
1215  int mpm_list = pkt_mpm ? DETECT_SM_LIST_PMATCH : app_mpm->sm_list;
1216  const char *name;
1217  if (mpm_list < DETECT_SM_LIST_DYNAMIC_START)
1218  name = DetectListToHumanString(mpm_list);
1219  else
1220  name = DetectEngineBufferTypeGetNameById(de_ctx, mpm_list);
1221  jb_set_string(ctx.js, "buffer", name);
1222 
1223  SigMatchData *smd = pkt_mpm ? pkt_mpm->smd : app_mpm->smd;
1224  if (smd == NULL && mpm_list == DETECT_SM_LIST_PMATCH) {
1225  smd = s->sm_arrays[mpm_list];
1226  }
1227  do {
1228  switch (smd->type) {
1229  case DETECT_CONTENT: {
1230  const DetectContentData *cd = (const DetectContentData *)smd->ctx;
1231  if (cd->flags & DETECT_CONTENT_MPM) {
1232  DumpContent(ctx.js, cd);
1233  }
1234  break;
1235  }
1236  }
1237 
1238  if (smd->is_last)
1239  break;
1240  smd++;
1241  } while (1);
1242  jb_close(ctx.js);
1243  } else if (s->init_data->prefilter_sm) {
1244  jb_open_object(ctx.js, "prefilter");
1245  int prefilter_list = SigMatchListSMBelongsTo(s, s->init_data->prefilter_sm);
1246  const char *name;
1247  if (prefilter_list < DETECT_SM_LIST_DYNAMIC_START)
1248  name = DetectListToHumanString(prefilter_list);
1249  else
1250  name = DetectEngineBufferTypeGetNameById(de_ctx, prefilter_list);
1251  jb_set_string(ctx.js, "buffer", name);
1252  const char *mname = sigmatch_table[s->init_data->prefilter_sm->type].name;
1253  jb_set_string(ctx.js, "name", mname);
1254  jb_close(ctx.js);
1255  }
1256 
1257  if (ctx.js_warnings) {
1258  jb_close(ctx.js_warnings);
1259  jb_set_object(ctx.js, "warnings", ctx.js_warnings);
1260  jb_free(ctx.js_warnings);
1261  ctx.js_warnings = NULL;
1262  }
1263  if (ctx.js_notes) {
1264  jb_close(ctx.js_notes);
1265  jb_set_object(ctx.js, "notes", ctx.js_notes);
1266  jb_free(ctx.js_notes);
1267  ctx.js_notes = NULL;
1268  }
1269  jb_close(ctx.js);
1270 
1271  const char *filename = "rules.json";
1272  const char *log_dir = ConfigGetLogDirectory();
1273  char json_path[PATH_MAX] = "";
1274  snprintf(json_path, sizeof(json_path), "%s/%s%s", log_dir,
1275  de_ctx->ea->file_prefix ? de_ctx->ea->file_prefix : "", filename);
1276 
1278  FILE *fp = fopen(json_path, "a");
1279  if (fp != NULL) {
1280  fwrite(jb_ptr(ctx.js), jb_len(ctx.js), 1, fp);
1281  fprintf(fp, "\n");
1282  fclose(fp);
1283  }
1285  jb_free(ctx.js);
1286  SCReturn;
1287 }
1288 
1290 {
1291  if (de_ctx->pattern_hash_table == NULL)
1292  return;
1293 
1294  JsonBuilder *root_jb = jb_new_object();
1295  JsonBuilder *arrays[de_ctx->buffer_type_id];
1296  memset(&arrays, 0, sizeof(JsonBuilder *) * de_ctx->buffer_type_id);
1297 
1298  jb_open_array(root_jb, "buffers");
1299 
1301  htb != NULL; htb = HashListTableGetListNext(htb)) {
1302  char str[1024] = "";
1304  DetectContentPatternPrettyPrint(p->cd, str, sizeof(str));
1305 
1306  JsonBuilder *jb = arrays[p->sm_list];
1307  if (arrays[p->sm_list] == NULL) {
1308  jb = arrays[p->sm_list] = jb_new_object();
1309  const char *name;
1311  name = DetectListToHumanString(p->sm_list);
1312  else
1314  jb_set_string(jb, "name", name);
1315  jb_set_uint(jb, "list_id", p->sm_list);
1316 
1317  jb_open_array(jb, "patterns");
1318  }
1319 
1320  jb_start_object(jb);
1321  jb_set_string(jb, "pattern", str);
1322  jb_set_uint(jb, "patlen", p->cd->content_len);
1323  jb_set_uint(jb, "cnt", p->cnt);
1324  jb_set_uint(jb, "mpm", p->mpm);
1325  jb_open_object(jb, "flags");
1326  jb_set_bool(jb, "nocase", p->cd->flags & DETECT_CONTENT_NOCASE);
1327  jb_set_bool(jb, "negated", p->cd->flags & DETECT_CONTENT_NEGATED);
1328  jb_set_bool(jb, "depth", p->cd->flags & DETECT_CONTENT_DEPTH);
1329  jb_set_bool(jb, "offset", p->cd->flags & DETECT_CONTENT_OFFSET);
1330  jb_set_bool(jb, "endswith", p->cd->flags & DETECT_CONTENT_ENDS_WITH);
1331  jb_close(jb);
1332  jb_close(jb);
1333  }
1334 
1335  for (uint32_t i = 0; i < de_ctx->buffer_type_id; i++) {
1336  JsonBuilder *jb = arrays[i];
1337  if (jb == NULL)
1338  continue;
1339 
1340  jb_close(jb); // array
1341  jb_close(jb); // object
1342 
1343  jb_append_object(root_jb, jb);
1344  jb_free(jb);
1345  }
1346  jb_close(root_jb);
1347  jb_close(root_jb);
1348 
1349  const char *filename = "patterns.json";
1350  const char *log_dir = ConfigGetLogDirectory();
1351  char json_path[PATH_MAX] = "";
1352  snprintf(json_path, sizeof(json_path), "%s/%s%s", log_dir,
1353  de_ctx->ea->file_prefix ? de_ctx->ea->file_prefix : "", filename);
1354 
1356  FILE *fp = fopen(json_path, "a");
1357  if (fp != NULL) {
1358  fwrite(jb_ptr(root_jb), jb_len(root_jb), 1, fp);
1359  fprintf(fp, "\n");
1360  fclose(fp);
1361  }
1363  jb_free(root_jb);
1364 
1366  de_ctx->pattern_hash_table = NULL;
1367 }
1368 
1369 static void EngineAnalysisItemsReset(EngineAnalysisCtx *ea_ctx)
1370 {
1371  for (size_t i = 0; i < ARRAY_SIZE(analyzer_items); i++) {
1372  ea_ctx->analyzer_items[i].item_seen = false;
1373  }
1374 }
1375 
1376 static void EngineAnalysisItemsInit(EngineAnalysisCtx *ea_ctx)
1377 {
1378  if (ea_ctx->analyzer_initialized) {
1379  EngineAnalysisItemsReset(ea_ctx);
1380  return;
1381  }
1382 
1383  ea_ctx->exposed_item_seen_list[0].bufname = "http_method";
1384  ea_ctx->exposed_item_seen_list[1].bufname = "file_data";
1385  ea_ctx->analyzer_items = SCCalloc(1, sizeof(analyzer_items));
1386  if (!ea_ctx->analyzer_items) {
1387  FatalError("Unable to allocate analysis scratch pad");
1388  }
1389  memset(ea_ctx->analyzer_item_map, -1, sizeof(ea_ctx->analyzer_item_map));
1390 
1391  for (size_t i = 0; i < ARRAY_SIZE(analyzer_items); i++) {
1392  ea_ctx->analyzer_items[i] = analyzer_items[i];
1393  DetectEngineAnalyzerItems *analyzer_item = &ea_ctx->analyzer_items[i];
1394 
1395  int item_id = DetectBufferTypeGetByName(analyzer_item->item_name);
1396  DEBUG_VALIDATE_BUG_ON(item_id < 0 || item_id > UINT16_MAX);
1397  analyzer_item->item_id = (uint16_t)item_id;
1398  if (analyzer_item->item_id == -1) {
1399  /* Mismatch between the analyzer_items array and what's supported */
1400  FatalError("unable to initialize engine-analysis table: detect buffer \"%s\" not "
1401  "recognized.",
1402  analyzer_item->item_name);
1403  }
1404  analyzer_item->item_seen = false;
1405 
1406  if (analyzer_item->export_item_seen) {
1407  for (size_t k = 0; k < ARRAY_SIZE(ea_ctx->exposed_item_seen_list); k++) {
1408  if (0 ==
1409  strcmp(ea_ctx->exposed_item_seen_list[k].bufname, analyzer_item->item_name))
1410  ea_ctx->exposed_item_seen_list[k].item_seen_ptr = &analyzer_item->item_seen;
1411  }
1412  }
1413  ea_ctx->analyzer_item_map[analyzer_item->item_id] = (int16_t)i;
1414  }
1415 
1416  ea_ctx->analyzer_initialized = true;
1417 }
1418 
1419 /**
1420  * \brief Prints analysis of loaded rules.
1421  *
1422  * Warns if potential rule issues are detected. For example,
1423  * warns if a rule uses a construct that may perform poorly,
1424  * e.g. pcre without content or with http_method content only;
1425  * warns if a rule uses a construct that may not be consistent with intent,
1426  * e.g. client side ports only, http and content without any http_* modifiers, etc.
1427  *
1428  * \param s Pointer to the signature.
1429  */
1431  const Signature *s, const char *line)
1432 {
1433  uint32_t rule_bidirectional = 0;
1434  uint32_t rule_pcre = 0;
1435  uint32_t rule_pcre_http = 0;
1436  uint32_t rule_content = 0;
1437  uint32_t rule_flow = 0;
1438  uint32_t rule_flags = 0;
1439  uint32_t rule_flow_toserver = 0;
1440  uint32_t rule_flow_toclient = 0;
1441  uint32_t rule_flow_nostream = 0;
1442  uint32_t rule_ipv4_only = 0;
1443  uint32_t rule_ipv6_only = 0;
1444  uint32_t rule_flowbits = 0;
1445  uint32_t rule_flowint = 0;
1446  uint32_t rule_content_http = 0;
1447  uint32_t rule_content_offset_depth = 0;
1448  int32_t list_id = 0;
1449  uint32_t rule_warning = 0;
1450  uint32_t stream_buf = 0;
1451  uint32_t packet_buf = 0;
1452  uint32_t file_store = 0;
1453  uint32_t warn_pcre_no_content = 0;
1454  uint32_t warn_pcre_http_content = 0;
1455  uint32_t warn_pcre_http = 0;
1456  uint32_t warn_content_http_content = 0;
1457  uint32_t warn_content_http = 0;
1458  uint32_t warn_tcp_no_flow = 0;
1459  uint32_t warn_client_ports = 0;
1460  uint32_t warn_direction = 0;
1461  uint32_t warn_method_toclient = 0;
1462  uint32_t warn_method_serverbody = 0;
1463  uint32_t warn_pcre_method = 0;
1464  uint32_t warn_encoding_norm_http_buf = 0;
1465  uint32_t warn_file_store_not_present = 0;
1466  uint32_t warn_offset_depth_pkt_stream = 0;
1467  uint32_t warn_offset_depth_alproto = 0;
1468  uint32_t warn_non_alproto_fp_for_alproto_sig = 0;
1469  uint32_t warn_no_direction = 0;
1470  uint32_t warn_both_direction = 0;
1471 
1472  EngineAnalysisItemsInit(de_ctx->ea);
1473 
1474  bool *http_method_item_seen_ptr = de_ctx->ea->exposed_item_seen_list[0].item_seen_ptr;
1475  bool *http_server_body_item_seen_ptr = de_ctx->ea->exposed_item_seen_list[1].item_seen_ptr;
1476 
1478  rule_bidirectional = 1;
1479  }
1480 
1481  if (s->flags & SIG_FLAG_REQUIRE_PACKET) {
1482  packet_buf += 1;
1483  }
1484  if (s->flags & SIG_FLAG_FILESTORE) {
1485  file_store += 1;
1486  }
1487  if (s->flags & SIG_FLAG_REQUIRE_STREAM) {
1488  stream_buf += 1;
1489  }
1490 
1491  if (s->proto.flags & DETECT_PROTO_IPV4) {
1492  rule_ipv4_only += 1;
1493  }
1494  if (s->proto.flags & DETECT_PROTO_IPV6) {
1495  rule_ipv6_only += 1;
1496  }
1497 
1498  for (list_id = 0; list_id < DETECT_SM_LIST_MAX; list_id++) {
1499  SigMatch *sm = NULL;
1500  for (sm = s->init_data->smlists[list_id]; sm != NULL; sm = sm->next) {
1501  int16_t item_slot = de_ctx->ea->analyzer_item_map[list_id];
1502  if (sm->type == DETECT_PCRE) {
1503  if (item_slot == -1) {
1504  rule_pcre++;
1505  continue;
1506  }
1507 
1508  rule_pcre_http++;
1509  de_ctx->ea->analyzer_items[item_slot].item_seen = true;
1510  } else if (sm->type == DETECT_CONTENT) {
1511  if (item_slot == -1) {
1512  rule_content++;
1513  if (list_id == DETECT_SM_LIST_PMATCH) {
1516  rule_content_offset_depth++;
1517  }
1518  }
1519  continue;
1520  }
1521 
1522  rule_content_http++;
1523  de_ctx->ea->analyzer_items[item_slot].item_seen = true;
1524 
1525  if (de_ctx->ea->analyzer_items[item_slot].check_encoding_match) {
1527  if (cd != NULL &&
1528  PerCentEncodingMatch(de_ctx->ea, cd->content, cd->content_len) > 0) {
1529  warn_encoding_norm_http_buf += 1;
1530  }
1531  }
1532  }
1533  else if (sm->type == DETECT_FLOW) {
1534  rule_flow += 1;
1535  if ((s->flags & SIG_FLAG_TOSERVER) && !(s->flags & SIG_FLAG_TOCLIENT)) {
1536  rule_flow_toserver = 1;
1537  }
1538  else if ((s->flags & SIG_FLAG_TOCLIENT) && !(s->flags & SIG_FLAG_TOSERVER)) {
1539  rule_flow_toclient = 1;
1540  }
1541  DetectFlowData *fd = (DetectFlowData *)sm->ctx;
1542  if (fd != NULL) {
1543  if (fd->flags & DETECT_FLOW_FLAG_NOSTREAM)
1544  rule_flow_nostream = 1;
1545  }
1546  }
1547  else if (sm->type == DETECT_FLOWBITS) {
1548  if (list_id == DETECT_SM_LIST_MATCH) {
1549  rule_flowbits += 1;
1550  }
1551  }
1552  else if (sm->type == DETECT_FLOWINT) {
1553  if (list_id == DETECT_SM_LIST_MATCH) {
1554  rule_flowint += 1;
1555  }
1556  }
1557  else if (sm->type == DETECT_FLAGS) {
1558  DetectFlagsData *fd = (DetectFlagsData *)sm->ctx;
1559  if (fd != NULL) {
1560  rule_flags = 1;
1561  }
1562  }
1563  } /* for (sm = s->init_data->smlists[list_id]; sm != NULL; sm = sm->next) */
1564 
1565  } /* for ( ; list_id < DETECT_SM_LIST_MAX; list_id++) */
1566 
1567  if (file_store && !RequiresFeature("output::file-store")) {
1568  rule_warning += 1;
1569  warn_file_store_not_present = 1;
1570  }
1571 
1572  if (rule_pcre > 0 && rule_content == 0 && rule_content_http == 0) {
1573  rule_warning += 1;
1574  warn_pcre_no_content = 1;
1575  }
1576 
1577  if (rule_content_http > 0 && rule_pcre > 0 && rule_pcre_http == 0) {
1578  rule_warning += 1;
1579  warn_pcre_http_content = 1;
1580  } else if (s->alproto == ALPROTO_HTTP1 && rule_pcre > 0 && rule_pcre_http == 0) {
1581  rule_warning += 1;
1582  warn_pcre_http = 1;
1583  }
1584 
1585  if (rule_content > 0 && rule_content_http > 0) {
1586  rule_warning += 1;
1587  warn_content_http_content = 1;
1588  }
1589  if (s->alproto == ALPROTO_HTTP1 && rule_content > 0 && rule_content_http == 0) {
1590  rule_warning += 1;
1591  warn_content_http = 1;
1592  }
1593  if (rule_content == 1) {
1594  //todo: warning if content is weak, separate warning for pcre + weak content
1595  }
1596  if (rule_flow == 0 && rule_flags == 0 && !(s->proto.flags & DETECT_PROTO_ANY) &&
1597  DetectProtoContainsProto(&s->proto, IPPROTO_TCP) &&
1598  (rule_content || rule_content_http || rule_pcre || rule_pcre_http || rule_flowbits ||
1599  rule_flowint)) {
1600  rule_warning += 1;
1601  warn_tcp_no_flow = 1;
1602  }
1603  if (rule_flow && !rule_bidirectional && (rule_flow_toserver || rule_flow_toclient)
1604  && !((s->flags & SIG_FLAG_SP_ANY) && (s->flags & SIG_FLAG_DP_ANY))) {
1605  if (((s->flags & SIG_FLAG_TOSERVER) && !(s->flags & SIG_FLAG_SP_ANY) && (s->flags & SIG_FLAG_DP_ANY))
1606  || ((s->flags & SIG_FLAG_TOCLIENT) && !(s->flags & SIG_FLAG_DP_ANY) && (s->flags & SIG_FLAG_SP_ANY))) {
1607  rule_warning += 1;
1608  warn_client_ports = 1;
1609  }
1610  }
1611  if (rule_flow && rule_bidirectional && (rule_flow_toserver || rule_flow_toclient)) {
1612  rule_warning += 1;
1613  warn_direction = 1;
1614  }
1615 
1616  if (*http_method_item_seen_ptr) {
1617  if (rule_flow && rule_flow_toclient) {
1618  rule_warning += 1;
1619  warn_method_toclient = 1;
1620  }
1621  if (*http_server_body_item_seen_ptr) {
1622  rule_warning += 1;
1623  warn_method_serverbody = 1;
1624  }
1625  if (rule_content == 0 && rule_content_http == 0 && (rule_pcre > 0 || rule_pcre_http > 0)) {
1626  rule_warning += 1;
1627  warn_pcre_method = 1;
1628  }
1629  }
1630  if (rule_content_offset_depth > 0 && stream_buf && packet_buf) {
1631  rule_warning += 1;
1632  warn_offset_depth_pkt_stream = 1;
1633  }
1634  if (rule_content_offset_depth > 0 && !stream_buf && packet_buf && s->alproto != ALPROTO_UNKNOWN) {
1635  rule_warning += 1;
1636  warn_offset_depth_alproto = 1;
1637  }
1638  if (s->init_data->mpm_sm != NULL && s->alproto == ALPROTO_HTTP1 &&
1640  rule_warning += 1;
1641  warn_non_alproto_fp_for_alproto_sig = 1;
1642  }
1643 
1644  if ((s->flags & (SIG_FLAG_TOSERVER|SIG_FLAG_TOCLIENT)) == 0) {
1645  warn_no_direction += 1;
1646  rule_warning += 1;
1647  }
1648 
1649  /* No warning about direction for ICMP protos */
1650  if (!(DetectProtoContainsProto(&s->proto, IPPROTO_ICMPV6) && DetectProtoContainsProto(&s->proto, IPPROTO_ICMP))) {
1652  warn_both_direction += 1;
1653  rule_warning += 1;
1654  }
1655  }
1656 
1657  if (!rule_warnings_only || (rule_warnings_only && rule_warning > 0)) {
1658  FILE *fp = de_ctx->ea->rule_engine_analysis_fp;
1659  fprintf(fp, "== Sid: %u ==\n", s->id);
1660  fprintf(fp, "%s\n", line);
1661 
1662  switch (s->type) {
1663  case SIG_TYPE_NOT_SET:
1664  break;
1665  case SIG_TYPE_IPONLY:
1666  fprintf(fp, " Rule is ip only.\n");
1667  break;
1668  case SIG_TYPE_LIKE_IPONLY:
1669  fprintf(fp, " Rule is like ip only.\n");
1670  break;
1671  case SIG_TYPE_PDONLY:
1672  fprintf(fp, " Rule is PD only.\n");
1673  break;
1674  case SIG_TYPE_DEONLY:
1675  fprintf(fp, " Rule is DE only.\n");
1676  break;
1677  case SIG_TYPE_PKT:
1678  fprintf(fp, " Rule is packet inspecting.\n");
1679  break;
1680  case SIG_TYPE_PKT_STREAM:
1681  fprintf(fp, " Rule is packet and stream inspecting.\n");
1682  break;
1683  case SIG_TYPE_STREAM:
1684  fprintf(fp, " Rule is stream inspecting.\n");
1685  break;
1686  case SIG_TYPE_APPLAYER:
1687  fprintf(fp, " Rule is app-layer inspecting.\n");
1688  break;
1689  case SIG_TYPE_APP_TX:
1690  fprintf(fp, " Rule is App-layer TX inspecting.\n");
1691  break;
1692  case SIG_TYPE_MAX:
1693  break;
1694  }
1695  if (rule_ipv6_only)
1696  fprintf(fp, " Rule is IPv6 only.\n");
1697  if (rule_ipv4_only)
1698  fprintf(fp, " Rule is IPv4 only.\n");
1699  if (packet_buf)
1700  fprintf(fp, " Rule matches on packets.\n");
1701  if (!rule_flow_nostream && stream_buf &&
1702  (rule_flow || rule_flowbits || rule_flowint || rule_content || rule_pcre)) {
1703  fprintf(fp, " Rule matches on reassembled stream.\n");
1704  }
1705  for(size_t i = 0; i < ARRAY_SIZE(analyzer_items); i++) {
1707  if (ai->item_seen) {
1708  fprintf(fp, " Rule matches on %s buffer.\n", ai->display_name);
1709  }
1710  }
1711  if (s->alproto != ALPROTO_UNKNOWN) {
1712  fprintf(fp, " App layer protocol is %s.\n", AppProtoToString(s->alproto));
1713  }
1714  if (rule_content || rule_content_http || rule_pcre || rule_pcre_http) {
1715  fprintf(fp,
1716  " Rule contains %u content options, %u http content options, %u pcre "
1717  "options, and %u pcre options with http modifiers.\n",
1718  rule_content, rule_content_http, rule_pcre, rule_pcre_http);
1719  }
1720 
1721  /* print fast pattern info */
1722  if (s->init_data->prefilter_sm) {
1723  fprintf(fp, " Prefilter on: %s.\n",
1725  } else {
1726  EngineAnalysisRulesPrintFP(de_ctx, s);
1727  }
1728 
1729  /* this is where the warnings start */
1730  if (warn_pcre_no_content /*rule_pcre > 0 && rule_content == 0 && rule_content_http == 0*/) {
1731  fprintf(fp, " Warning: Rule uses pcre without a content option present.\n"
1732  " -Consider adding a content to improve performance of this "
1733  "rule.\n");
1734  }
1735  if (warn_pcre_http_content /*rule_content_http > 0 && rule_pcre > 0 && rule_pcre_http == 0*/) {
1736  fprintf(fp, " Warning: Rule uses content options with http_* and pcre options "
1737  "without http modifiers.\n"
1738  " -Consider adding http pcre modifier.\n");
1739  }
1740  else if (warn_pcre_http /*s->alproto == ALPROTO_HTTP1 && rule_pcre > 0 && rule_pcre_http == 0*/) {
1741  fprintf(fp, " Warning: Rule app layer protocol is http, but pcre options do not "
1742  "have http modifiers.\n"
1743  " -Consider adding http pcre modifiers.\n");
1744  }
1745  if (warn_content_http_content /*rule_content > 0 && rule_content_http > 0*/) {
1746  fprintf(fp,
1747  " Warning: Rule contains content with http_* and content without http_*.\n"
1748  " -Consider adding http content modifiers.\n");
1749  }
1750  if (warn_content_http /*s->alproto == ALPROTO_HTTP1 && rule_content > 0 && rule_content_http == 0*/) {
1751  fprintf(fp, " Warning: Rule app layer protocol is http, but content options do not "
1752  "have http_* modifiers.\n"
1753  " -Consider adding http content modifiers.\n");
1754  }
1755  if (rule_content == 1) {
1756  //todo: warning if content is weak, separate warning for pcre + weak content
1757  }
1758  if (warn_encoding_norm_http_buf) {
1759  fprintf(fp, " Warning: Rule may contain percent encoded content for a normalized "
1760  "http buffer match.\n");
1761  }
1762  if (warn_tcp_no_flow /*rule_flow == 0 && rule_flags == 0
1763  && !(s->proto.flags & DETECT_PROTO_ANY) && DetectProtoContainsProto(&s->proto, IPPROTO_TCP)*/) {
1764  fprintf(fp, " Warning: TCP rule without a flow or flags option.\n"
1765  " -Consider adding flow or flags to improve performance of "
1766  "this rule.\n");
1767  }
1768  if (warn_client_ports /*rule_flow && !rule_bidirectional && (rule_flow_toserver || rule_flow_toclient)
1769  && !((s->flags & SIG_FLAG_SP_ANY) && (s->flags & SIG_FLAG_DP_ANY)))
1770  if (((s->flags & SIG_FLAG_TOSERVER) && !(s->flags & SIG_FLAG_SP_ANY) && (s->flags & SIG_FLAG_DP_ANY))
1771  || ((s->flags & SIG_FLAG_TOCLIENT) && !(s->flags & SIG_FLAG_DP_ANY) && (s->flags & SIG_FLAG_SP_ANY))*/) {
1772  fprintf(fp,
1773  " Warning: Rule contains ports or port variables only on the client side.\n"
1774  " -Flow direction possibly inconsistent with rule.\n");
1775  }
1776  if (warn_direction /*rule_flow && rule_bidirectional && (rule_flow_toserver || rule_flow_toclient)*/) {
1777  fprintf(fp, " Warning: Rule is bidirectional and has a flow option with a specific "
1778  "direction.\n");
1779  }
1780  if (warn_method_toclient /*http_method_buf && rule_flow && rule_flow_toclient*/) {
1781  fprintf(fp, " Warning: Rule uses content or pcre for http_method with "
1782  "flow:to_client or from_server\n");
1783  }
1784  if (warn_method_serverbody /*http_method_buf && http_server_body_buf*/) {
1785  fprintf(fp, " Warning: Rule uses content or pcre for http_method with content or "
1786  "pcre for http_server_body.\n");
1787  }
1788  if (warn_pcre_method /*http_method_buf && rule_content == 0 && rule_content_http == 0
1789  && (rule_pcre > 0 || rule_pcre_http > 0)*/) {
1790  fprintf(fp, " Warning: Rule uses pcre with only a http_method content; possible "
1791  "performance issue.\n");
1792  }
1793  if (warn_offset_depth_pkt_stream) {
1794  fprintf(fp, " Warning: Rule has depth"
1795  "/offset with raw content keywords. Please note the "
1796  "offset/depth will be checked against both packet "
1797  "payloads and stream. If you meant to have the offset/"
1798  "depth checked against just the payload, you can update "
1799  "the signature as \"alert tcp-pkt...\"\n");
1800  }
1801  if (warn_offset_depth_alproto) {
1802  fprintf(fp,
1803  " Warning: Rule has "
1804  "offset/depth set along with a match on a specific "
1805  "app layer protocol - %d. This can lead to FNs if we "
1806  "have a offset/depth content match on a packet payload "
1807  "before we can detect the app layer protocol for the "
1808  "flow.\n",
1809  s->alproto);
1810  }
1811  if (warn_non_alproto_fp_for_alproto_sig) {
1812  fprintf(fp, " Warning: Rule app layer "
1813  "protocol is http, but the fast_pattern is set on the raw "
1814  "stream. Consider adding fast_pattern over a http "
1815  "buffer for increased performance.");
1816  }
1817  if (warn_no_direction) {
1818  fprintf(fp, " Warning: Rule has no direction indicator.\n");
1819  }
1820  if (warn_both_direction) {
1821  fprintf(fp, " Warning: Rule is inspecting both the request and the response.\n");
1822  }
1823  if (warn_file_store_not_present) {
1824  fprintf(fp, " Warning: Rule requires file-store but the output file-store is not "
1825  "enabled.\n");
1826  }
1827  if (rule_warning == 0) {
1828  fprintf(fp, " No warnings for this rule.\n");
1829  }
1830  fprintf(fp, "\n");
1831  }
1832 }
detect-tcp-flags.h
DETECT_PCRE_CASELESS
#define DETECT_PCRE_CASELESS
Definition: detect-pcre.h:32
DETECT_CONTENT_NOCASE
#define DETECT_CONTENT_NOCASE
Definition: detect-content.h:29
SignatureHasPacketContent
int SignatureHasPacketContent(const Signature *s)
check if a signature has patterns that are to be inspected against a packets payload (as opposed to t...
Definition: detect-engine-mpm.c:796
RuleAnalyzer::js
JsonBuilder * js
Definition: detect-engine-analyzer.c:631
DetectBytejumpData_::post_offset
int32_t post_offset
Definition: detect-bytejump.h:51
HashListTableGetListData
#define HashListTableGetListData(hb)
Definition: util-hashlist.h:56
SIG_TYPE_STREAM
@ SIG_TYPE_STREAM
Definition: detect.h:72
DetectContentData_::offset
uint16_t offset
Definition: detect-content.h:107
DetectBytetestData_::flags
uint16_t flags
Definition: detect-bytetest.h:58
detect-engine-uint.h
DetectPatternTracker
Definition: detect.h:730
DetectEngineAppInspectionEngine_
Definition: detect.h:429
DETECT_CONTENT_RELATIVE_NEXT
#define DETECT_CONTENT_RELATIVE_NEXT
Definition: detect-content.h:66
DetectEngineAppInspectionEngine_::mpm
bool mpm
Definition: detect.h:433
detect-content.h
DetectFlowbitsData_::or_list_size
uint8_t or_list_size
Definition: detect-flowbits.h:38
len
uint8_t len
Definition: app-layer-dnp3.h:2
detect-engine.h
DETECT_SM_LIST_PMATCH
@ DETECT_SM_LIST_PMATCH
Definition: detect.h:116
SIG_MASK_REQUIRE_REAL_PKT
#define SIG_MASK_REQUIRE_REAL_PKT
Definition: detect.h:306
DETECT_CONTENT_FAST_PATTERN_CHOP
#define DETECT_CONTENT_FAST_PATTERN_CHOP
Definition: detect-content.h:36
SignatureInitData_::smlists
struct SigMatch_ * smlists[DETECT_SM_LIST_MAX]
Definition: detect.h:586
DetectContentData_::fp_chop_len
uint16_t fp_chop_len
Definition: detect-content.h:98
sigmatch_table
SigTableElmt * sigmatch_table
Definition: detect-parse.c:127
Signature_::sig_str
char * sig_str
Definition: detect.h:668
SIG_TYPE_APP_TX
@ SIG_TYPE_APP_TX
Definition: detect.h:75
DetectSeqData_::seq
uint32_t seq
Definition: detect-tcp-seq.h:31
DetectEnginePktInspectionEngine
Definition: detect.h:486
DetectEngineAppInspectionEngine_::next
struct DetectEngineAppInspectionEngine_ * next
Definition: detect.h:451
DETECT_PROTO_IPV6
#define DETECT_PROTO_IPV6
Definition: detect-engine-proto.h:34
DetectFlowData_
Definition: detect-flow.h:37
DETECT_FLOW_FLAG_NOSTREAM
#define DETECT_FLOW_FLAG_NOSTREAM
Definition: detect-flow.h:33
SigTableElmt_::name
const char * name
Definition: detect.h:1304
DETECT_BYTEJUMP
@ DETECT_BYTEJUMP
Definition: detect-engine-register.h:84
DetectPatternTracker::mpm
uint32_t mpm
Definition: detect.h:734
ConfGetBool
int ConfGetBool(const char *name, int *val)
Retrieve a configuration value as a boolean.
Definition: conf.c:482
DetectListToHumanString
const char * DetectListToHumanString(int list)
Definition: detect-parse.c:160
DetectEngineCtx_::pattern_hash_table
HashListTable * pattern_hash_table
Definition: detect.h:877
DumpPatterns
void DumpPatterns(DetectEngineCtx *de_ctx)
Definition: detect-engine-analyzer.c:1289
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
DetectContentData_::within
int32_t within
Definition: detect-content.h:109
DETECT_BYTEJUMP_LITTLE
#define DETECT_BYTEJUMP_LITTLE
Definition: detect-bytejump.h:35
SetupEngineAnalysis
void SetupEngineAnalysis(DetectEngineCtx *de_ctx, bool *fp_analysis, bool *rule_analysis)
Definition: detect-engine-analyzer.c:472
DETECT_CONTENT
@ DETECT_CONTENT
Definition: detect-engine-register.h:70
SignatureInitData_::prefilter_sm
SigMatch * prefilter_sm
Definition: detect.h:567
EngineAnalysisCtx_::rule_engine_analysis_fp
FILE * rule_engine_analysis_fp
Definition: detect-engine-analyzer.c:82
DETECT_FLOW
@ DETECT_FLOW
Definition: detect-engine-register.h:54
Signature_::alproto
AppProto alproto
Definition: detect.h:606
RuleAnalyzer::js_warnings
JsonBuilder * js_warnings
Definition: detect-engine-analyzer.c:633
DETECT_BYTETEST_BASE_HEX
#define DETECT_BYTETEST_BASE_HEX
Definition: detect-bytetest.h:40
SigMatchData_::is_last
bool is_last
Definition: detect.h:360
g_rules_analyzer_write_m
SCMutex g_rules_analyzer_write_m
Definition: detect-engine-analyzer.c:937
DetectEngineAnalyzerItems::display_name
const char * display_name
Definition: detect-engine-analyzer.c:64
DETECT_CONTENT_WITHIN2DEPTH
#define DETECT_CONTENT_WITHIN2DEPTH
Definition: detect-content.h:62
EngineAnalysisCtx_::percent_re
pcre2_code * percent_re
Definition: detect-engine-analyzer.c:87
DETECT_SM_LIST_DYNAMIC_START
@ DETECT_SM_LIST_DYNAMIC_START
Definition: detect.h:135
DETECT_FLOWBITS_CMD_ISNOTSET
#define DETECT_FLOWBITS_CMD_ISNOTSET
Definition: detect-flowbits.h:31
SIG_FLAG_DEST_IS_TARGET
#define SIG_FLAG_DEST_IS_TARGET
Definition: detect.h:281
SigMatchData_::ctx
SigMatchCtx * ctx
Definition: detect.h:361
DETECT_CONTENT_NO_DOUBLE_INSPECTION_REQUIRED
#define DETECT_CONTENT_NO_DOUBLE_INSPECTION_REQUIRED
Definition: detect-content.h:55
action-globals.h
ConfGetNode
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
Definition: conf.c:181
EngineAnalysisCtx_
Definition: detect-engine-analyzer.c:80
DETECT_IPOPTS
@ DETECT_IPOPTS
Definition: detect-engine-register.h:39
AppProtoToString
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
Definition: app-layer-protos.c:78
ctx
struct Thresholds ctx
DETECT_BYTEJUMP_BASE_OCT
#define DETECT_BYTEJUMP_BASE_OCT
Definition: detect-bytejump.h:29
DetectEngineFrameInspectionEngine::transforms
const DetectEngineTransforms * transforms
Definition: detect.h:521
DetectFlowData_::flags
uint16_t flags
Definition: detect-flow.h:38
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:841
DETECT_PROTO_ANY
#define DETECT_PROTO_ANY
Definition: detect-engine-proto.h:27
DetectEnginePktInspectionEngine::smd
SigMatchData * smd
Definition: detect.h:487
SIG_TYPE_PKT_STREAM
@ SIG_TYPE_PKT_STREAM
Definition: detect.h:71
DetectFlowbitsData_::cmd
uint8_t cmd
Definition: detect-flowbits.h:37
DetectEngineFrameInspectionEngine::mpm
bool mpm
Definition: detect.h:515
DETECT_BYTETEST_DCE
#define DETECT_BYTETEST_DCE
Definition: detect-bytetest.h:47
HashListTableGetListHead
HashListTableBucket * HashListTableGetListHead(HashListTable *ht)
Definition: util-hashlist.c:287
detect-tcp-seq.h
DetectEngineAppInspectionEngine_::v2
struct DetectEngineAppInspectionEngine_::@79 v2
EngineAnalysisCtx_::fp_pattern_stats
FpPatternStats fp_pattern_stats[DETECT_SM_LIST_MAX]
Definition: detect-engine-analyzer.c:99
DetectEngineBufferTypeGetNameById
const char * DetectEngineBufferTypeGetNameById(const DetectEngineCtx *de_ctx, const int id)
Definition: detect-engine.c:1121
SIG_FLAG_DST_ANY
#define SIG_FLAG_DST_ANY
Definition: detect.h:239
SCMutexLock
#define SCMutexLock(mut)
Definition: threads-debug.h:117
util-var-name.h
SIG_FLAG_REQUIRE_STREAM
#define SIG_FLAG_REQUIRE_STREAM
Definition: detect.h:251
DetectPatternTracker::cnt
uint32_t cnt
Definition: detect.h:733
rust.h
EngineAnalysisCtx_::fp_engine_analysis_fp
FILE * fp_engine_analysis_fp
Definition: detect-engine-analyzer.c:83
EngineAnalysisCtx_::analyzer_initialized
bool analyzer_initialized
Definition: detect-engine-analyzer.c:106
DetectEngineAnalyzerItems
Definition: detect-engine-analyzer.c:58
DETECT_BYTEJUMP_DCE
#define DETECT_BYTEJUMP_DCE
Definition: detect-bytejump.h:40
DetectPatternTracker::cd
const struct DetectContentData_ * cd
Definition: detect.h:731
VarNameStoreSetupLookup
const char * VarNameStoreSetupLookup(const uint32_t id, const enum VarTypes type)
Definition: util-var-name.c:188
SCMUTEX_INITIALIZER
#define SCMUTEX_INITIALIZER
Definition: threads-debug.h:121
Signature_::sm_arrays
SigMatchData * sm_arrays[DETECT_SM_LIST_MAX]
Definition: detect.h:654
FpPatternStats_::max
uint16_t max
Definition: detect-engine-analyzer.c:69
SignatureInitData_::init_flags
uint32_t init_flags
Definition: detect.h:553
DetectBufferType_
Definition: detect.h:454
DETECT_FLOWBITS_CMD_TOGGLE
#define DETECT_FLOWBITS_CMD_TOGGLE
Definition: detect-flowbits.h:29
DetectContentData_
Definition: detect-content.h:93
DETECT_FLOWBITS_CMD_ISSET
#define DETECT_FLOWBITS_CMD_ISSET
Definition: detect-flowbits.h:32
DetectPcreData_::flags
uint16_t flags
Definition: detect-pcre.h:46
DetectContentData_::fp_chop_offset
uint16_t fp_chop_offset
Definition: detect-content.h:100
DetectBytetestData_::nbytes
uint8_t nbytes
Definition: detect-bytetest.h:54
DetectBytetestData_
Definition: detect-bytetest.h:53
EngineAnalysisCtx_::analyzer_item_map
int16_t analyzer_item_map[256]
Definition: detect-engine-analyzer.c:98
SIG_FLAG_TOCLIENT
#define SIG_FLAG_TOCLIENT
Definition: detect.h:268
DETECT_BYTEJUMP_BIG
#define DETECT_BYTEJUMP_BIG
Definition: detect-bytejump.h:36
SIG_FLAG_SRC_ANY
#define SIG_FLAG_SRC_ANY
Definition: detect.h:238
SigMatchData_
Data needed for Match()
Definition: detect.h:358
DetectBytejumpData_::base
uint8_t base
Definition: detect-bytejump.h:48
detect-pcre.h
SIG_TYPE_APPLAYER
@ SIG_TYPE_APPLAYER
Definition: detect.h:74
SigMatchData_::type
uint16_t type
Definition: detect.h:359
DetectBytejumpData_
Definition: detect-bytejump.h:46
Signature_::frame_inspect
DetectEngineFrameInspectionEngine * frame_inspect
Definition: detect.h:650
DetectBytejumpData_::offset
int32_t offset
Definition: detect-bytejump.h:50
DetectEnginePktInspectionEngine::transforms
const DetectEngineTransforms * transforms
Definition: detect.h:495
ConfValIsTrue
int ConfValIsTrue(const char *val)
Check if a value is true.
Definition: conf.c:536
EngineAnalysisCtx_::analyzer_items
DetectEngineAnalyzerItems * analyzer_items
Definition: detect-engine-analyzer.c:85
DETECT_PERCENT_ENCODING_REGEX
#define DETECT_PERCENT_ENCODING_REGEX
DetectEngineBufferTypeGetById
const DetectBufferType * DetectEngineBufferTypeGetById(const DetectEngineCtx *de_ctx, const int id)
Definition: detect-engine.c:1111
DetectBytejumpData_::multiplier
uint16_t multiplier
Definition: detect-bytejump.h:52
SIG_FLAG_APPLAYER
#define SIG_FLAG_APPLAYER
Definition: detect.h:246
DetectBufferTypeGetByName
int DetectBufferTypeGetByName(const char *name)
Definition: detect-engine.c:1091
Signature_::gid
uint32_t gid
Definition: detect.h:637
DetectEngineAppInspectionEngine_::sm_list
uint16_t sm_list
Definition: detect.h:435
ATTR_FMT_PRINTF
#define ATTR_FMT_PRINTF(x, y)
Definition: suricata-common.h:410
DetectFlowbitsData_
Definition: detect-flowbits.h:35
HashListTableGetListNext
#define HashListTableGetListNext(hb)
Definition: util-hashlist.h:55
DetectEngineAnalyzerItems::export_item_seen
bool export_item_seen
Definition: detect-engine-analyzer.c:61
SIG_FLAG_TOSERVER
#define SIG_FLAG_TOSERVER
Definition: detect.h:267
RequiresFeature
bool RequiresFeature(const char *feature_name)
Definition: feature.c:126
DETECT_BYTETEST_RELATIVE
#define DETECT_BYTETEST_RELATIVE
Definition: detect-bytetest.h:46
SIG_TYPE_PKT
@ SIG_TYPE_PKT
Definition: detect.h:70
DetectSeqData_
seq data
Definition: detect-tcp-seq.h:30
feature.h
IpOptsFlagToString
const char * IpOptsFlagToString(uint16_t flag)
Return human readable value for ipopts flag.
Definition: detect-ipopts.c:117
EngineAnalysisCtx
struct EngineAnalysisCtx_ EngineAnalysisCtx
DETECT_CONTENT_ENDS_WITH
#define DETECT_CONTENT_ENDS_WITH
Definition: detect-content.h:42
DETECT_PCRE_RAWBYTES
#define DETECT_PCRE_RAWBYTES
Definition: detect-pcre.h:31
DETECT_CONTENT_DISTANCE
#define DETECT_CONTENT_DISTANCE
Definition: detect-content.h:30
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
DetectEnginePktInspectionEngine::sm_list
uint16_t sm_list
Definition: detect.h:489
SIG_FLAG_INIT_BIDIREC
#define SIG_FLAG_INIT_BIDIREC
Definition: detect.h:289
DETECT_FLOWINT
@ DETECT_FLOWINT
Definition: detect-engine-register.h:63
SIG_MASK_REQUIRE_ENGINE_EVENT
#define SIG_MASK_REQUIRE_ENGINE_EVENT
Definition: detect.h:308
DETECT_BYTETEST_BASE_UNSET
#define DETECT_BYTETEST_BASE_UNSET
Definition: detect-bytetest.h:37
SIG_TYPE_IPONLY
@ SIG_TYPE_IPONLY
Definition: detect.h:64
DETECT_BYTEJUMP_ALIGN
#define DETECT_BYTEJUMP_ALIGN
Definition: detect-bytejump.h:39
SignatureInitData_::mpm_sm
SigMatch * mpm_sm
Definition: detect.h:565
DetectEngineBufferTypeGetDescriptionById
const char * DetectEngineBufferTypeGetDescriptionById(const DetectEngineCtx *de_ctx, const int id)
Definition: detect-engine.c:1199
SCMutexUnlock
#define SCMutexUnlock(mut)
Definition: threads-debug.h:119
SIG_FLAG_FLUSH
#define SIG_FLAG_FLUSH
Definition: detect.h:255
DetectIpOptsData_::ipopt
uint16_t ipopt
Definition: detect-ipopts.h:38
SignatureInitData_::mpm_sm_list
int mpm_sm_list
Definition: detect.h:563
DETECT_BYTETEST_BASE_DEC
#define DETECT_BYTETEST_BASE_DEC
Definition: detect-bytetest.h:39
SIG_MASK_REQUIRE_FLOW
#define SIG_MASK_REQUIRE_FLOW
Definition: detect.h:302
SIG_FLAG_BYPASS
#define SIG_FLAG_BYPASS
Definition: detect.h:272
DETECT_CONTENT_DEPTH
#define DETECT_CONTENT_DEPTH
Definition: detect-content.h:33
DETECT_CONTENT_DISTANCE2OFFSET
#define DETECT_CONTENT_DISTANCE2OFFSET
Definition: detect-content.h:63
RuleAnalyzer
Definition: detect-engine-analyzer.c:630
DETECT_BYTEJUMP_END
#define DETECT_BYTEJUMP_END
Definition: detect-bytejump.h:42
Signature_::pkt_inspect
DetectEnginePktInspectionEngine * pkt_inspect
Definition: detect.h:649
DetectEngineAnalyzerItems
struct DetectEngineAnalyzerItems DetectEngineAnalyzerItems
util-print.h
SCEnter
#define SCEnter(...)
Definition: util-debug.h:271
detect-engine-mpm.h
detect.h
SIG_MASK_REQUIRE_FLAGS_INITDEINIT
#define SIG_MASK_REQUIRE_FLAGS_INITDEINIT
Definition: detect.h:303
DetectEngineFrameInspectionEngine::sm_list
uint16_t sm_list
Definition: detect.h:516
SigMatch_::next
struct SigMatch_ * next
Definition: detect.h:353
DetectEngineAnalyzerItems::item_seen
bool item_seen
Definition: detect-engine-analyzer.c:60
DETECT_CONTENT_NEGATED
#define DETECT_CONTENT_NEGATED
Definition: detect-content.h:40
util-time.h
DETECT_SM_LIST_MATCH
@ DETECT_SM_LIST_MATCH
Definition: detect.h:114
DetectAckData_::ack
uint32_t ack
Definition: detect-tcp-ack.h:31
EngineAnalysisRules
void EngineAnalysisRules(const DetectEngineCtx *de_ctx, const Signature *s, const char *line)
Prints analysis of loaded rules.
Definition: detect-engine-analyzer.c:1430
Signature_::app_inspect
DetectEngineAppInspectionEngine * app_inspect
Definition: detect.h:648
DETECT_SEQ
@ DETECT_SEQ
Definition: detect-engine-register.h:37
SigMatch_::ctx
SigMatchCtx * ctx
Definition: detect.h:352
DETECT_ACK
@ DETECT_ACK
Definition: detect-engine-register.h:36
SIG_FLAG_REQUIRE_FLOWVAR
#define SIG_FLAG_REQUIRE_FLOWVAR
Definition: detect.h:263
Signature_::action
uint8_t action
Definition: detect.h:616
FpPatternStats_::cnt
uint32_t cnt
Definition: detect-engine-analyzer.c:70
SCReturn
#define SCReturn
Definition: util-debug.h:273
Signature_::flags
uint32_t flags
Definition: detect.h:602
DetectContentData_::depth
uint16_t depth
Definition: detect-content.h:106
ACTION_ALERT
#define ACTION_ALERT
Definition: action-globals.h:29
DETECT_BYTETEST_BIG
#define DETECT_BYTETEST_BIG
Definition: detect-bytetest.h:44
SCLocalTime
struct tm * SCLocalTime(time_t timep, struct tm *result)
Definition: util-time.c:267
detect-bytejump.h
conf.h
DetectContentData_::flags
uint32_t flags
Definition: detect-content.h:104
CHECK
#define CHECK(pat)
Definition: detect-engine-analyzer.c:667
DetectEngineFrameInspectionEngine
Definition: detect.h:511
DetectFlowbitsData_::idx
uint32_t idx
Definition: detect-flowbits.h:36
DETECT_BYTEJUMP_BASE_UNSET
#define DETECT_BYTEJUMP_BASE_UNSET
Definition: detect-bytejump.h:28
Signature_::init_data
SignatureInitData * init_data
Definition: detect.h:670
SIG_FLAG_SRC_IS_TARGET
#define SIG_FLAG_SRC_IS_TARGET
Definition: detect.h:279
DetectContentPatternPrettyPrint
void DetectContentPatternPrettyPrint(const DetectContentData *cd, char *str, size_t str_len)
Definition: detect-content.c:744
DetectEngineTransforms::transforms
TransformData transforms[DETECT_TRANSFORMS_MAX]
Definition: detect.h:409
DETECT_BYTEJUMP_BASE_HEX
#define DETECT_BYTEJUMP_BASE_HEX
Definition: detect-bytejump.h:31
SIG_TYPE_DEONLY
@ SIG_TYPE_DEONLY
Definition: detect.h:69
detect-flowbits.h
SIG_MASK_REQUIRE_PAYLOAD
#define SIG_MASK_REQUIRE_PAYLOAD
Definition: detect.h:301
SCLogInfo
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:224
DETECT_PCRE
@ DETECT_PCRE
Definition: detect-engine-register.h:72
SIG_TYPE_NOT_SET
@ SIG_TYPE_NOT_SET
Definition: detect.h:63
ExposedItemSeen::bufname
const char * bufname
Definition: detect-engine-analyzer.c:76
EngineAnalysisRulesFailure
void EngineAnalysisRulesFailure(const DetectEngineCtx *de_ctx, char *line, char *file, int lineno)
Definition: detect-engine-analyzer.c:620
DETECT_BYTEJUMP_OFFSET_BE
#define DETECT_BYTEJUMP_OFFSET_BE
Definition: detect-bytejump.h:41
DetectEngineCtx_::config_prefix
char config_prefix[64]
Definition: detect.h:960
DetectSigmatchListEnumToString
const char * DetectSigmatchListEnumToString(enum DetectSigmatchListEnum type)
Definition: detect-engine.c:4920
analyzer_items
const DetectEngineAnalyzerItems analyzer_items[]
Definition: detect-engine-analyzer.c:109
DetectEngineAppInspectionEngine_::alproto
AppProto alproto
Definition: detect.h:430
SIG_FLAG_MPM_NEG
#define SIG_FLAG_MPM_NEG
Definition: detect.h:253
detect-engine-analyzer.h
SIG_FLAG_INIT_STATE_MATCH
#define SIG_FLAG_INIT_STATE_MATCH
Definition: detect.h:292
DetectEngineAnalyzerItems::item_id
int16_t item_id
Definition: detect-engine-analyzer.c:59
DetectPatternTracker::sm_list
int sm_list
Definition: detect.h:732
DetectEngineAppInspectionEngine_::smd
SigMatchData * smd
Definition: detect.h:449
EngineAnalysisRules2
void EngineAnalysisRules2(const DetectEngineCtx *de_ctx, const Signature *s)
Definition: detect-engine-analyzer.c:938
ARRAY_SIZE
#define ARRAY_SIZE(arr)
Definition: suricata-common.h:545
DETECT_CONTENT_STARTS_WITH
#define DETECT_CONTENT_STARTS_WITH
Definition: detect-content.h:59
DetectProto_::flags
uint8_t flags
Definition: detect-engine-proto.h:38
DETECT_BYTETEST
@ DETECT_BYTETEST
Definition: detect-engine-register.h:83
DETECT_PROTO_IPV4
#define DETECT_PROTO_IPV4
Definition: detect-engine-proto.h:33
util-conf.h
SignatureHasStreamContent
int SignatureHasStreamContent(const Signature *s)
check if a signature has patterns that are to be inspected against the stream payload (as opposed to ...
Definition: detect-engine-mpm.c:826
RuleAnalyzer::js_notes
JsonBuilder * js_notes
Definition: detect-engine-analyzer.c:634
EngineAnalysisFP
void EngineAnalysisFP(const DetectEngineCtx *de_ctx, const Signature *s, char *line)
Definition: detect-engine-analyzer.c:166
FpPatternStats_::min
uint16_t min
Definition: detect-engine-analyzer.c:68
VAR_TYPE_FLOW_BIT
@ VAR_TYPE_FLOW_BIT
Definition: util-var.h:36
Signature_::proto
DetectProto proto
Definition: detect.h:620
suricata-common.h
SIG_MASK_REQUIRE_NO_PAYLOAD
#define SIG_MASK_REQUIRE_NO_PAYLOAD
Definition: detect.h:305
SIG_FLAG_SP_ANY
#define SIG_FLAG_SP_ANY
Definition: detect.h:240
ExposedItemSeen
Definition: detect-engine-analyzer.c:75
SigMatch_::type
uint16_t type
Definition: detect.h:350
HashListTableFree
void HashListTableFree(HashListTable *ht)
Definition: util-hashlist.c:88
DetectEngineAnalyzerItems::check_encoding_match
bool check_encoding_match
Definition: detect-engine-analyzer.c:62
DetectContentData_::distance
int32_t distance
Definition: detect-content.h:108
CleanupEngineAnalysis
void CleanupEngineAnalysis(DetectEngineCtx *de_ctx)
Definition: detect-engine-analyzer.c:508
DetectBytejumpData_::nbytes
uint8_t nbytes
Definition: detect-bytejump.h:47
ALPROTO_HTTP1
@ ALPROTO_HTTP1
Definition: app-layer-protos.h:30
DetectEngineFrameInspectionEngine::next
struct DetectEngineFrameInspectionEngine * next
Definition: detect.h:524
DetectEnginePktInspectionEngine::next
struct DetectEnginePktInspectionEngine * next
Definition: detect.h:497
DetectContentData_::content
uint8_t * content
Definition: detect-content.h:94
Signature_::rev
uint32_t rev
Definition: detect.h:638
DetectEngineFrameInspectionEngine::v1
struct DetectEngineFrameInspectionEngine::@83 v1
FatalError
#define FatalError(...)
Definition: util-debug.h:502
DETECT_BYTEJUMP_BASE_DEC
#define DETECT_BYTEJUMP_BASE_DEC
Definition: detect-bytejump.h:30
DetectIpOptsData_
Definition: detect-ipopts.h:37
SIG_MASK_REQUIRE_FLAGS_UNUSUAL
#define SIG_MASK_REQUIRE_FLAGS_UNUSUAL
Definition: detect.h:304
TransformData_::transform
int transform
Definition: detect.h:404
DETECT_FLOWBITS
@ DETECT_FLOWBITS
Definition: detect-engine-register.h:60
SIG_TYPE_MAX
@ SIG_TYPE_MAX
Definition: detect.h:77
DetectEngineCtx_::ea
struct EngineAnalysisCtx_ * ea
Definition: detect.h:1038
DetectEngineAppInspectionEngine_::progress
int16_t progress
Definition: detect.h:437
DETECT_BYTETEST_BASE_OCT
#define DETECT_BYTETEST_BASE_OCT
Definition: detect-bytetest.h:38
util-validate.h
detect-flow.h
PrintRawUriFp
void PrintRawUriFp(FILE *fp, uint8_t *buf, uint32_t buflen)
Definition: util-print.c:69
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
ConfigGetLogDirectory
const char * ConfigGetLogDirectory(void)
Definition: util-conf.c:38
FpPatternStats
struct FpPatternStats_ FpPatternStats
detect-tcp-ack.h
str
#define str(s)
Definition: suricata-common.h:291
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:261
SigMatchListSMBelongsTo
int SigMatchListSMBelongsTo(const Signature *s, const SigMatch *key_sm)
Definition: detect-parse.c:805
SCFree
#define SCFree(p)
Definition: util-mem.h:61
DetectFlowbitsData_::or_list
uint32_t * or_list
Definition: detect-flowbits.h:39
ConfNode_
Definition: conf.h:32
Signature_::id
uint32_t id
Definition: detect.h:636
DETECT_CONTENT_OFFSET
#define DETECT_CONTENT_OFFSET
Definition: detect-content.h:32
HashListTableBucket_
Definition: util-hashlist.h:28
DETECT_FLOWBITS_CMD_UNSET
#define DETECT_FLOWBITS_CMD_UNSET
Definition: detect-flowbits.h:30
DETECT_CONTENT_FAST_PATTERN_ONLY
#define DETECT_CONTENT_FAST_PATTERN_ONLY
Definition: detect-content.h:35
DETECT_CONTENT_MPM
#define DETECT_CONTENT_MPM
Definition: detect-content.h:61
DetectBufferType_::transforms
DetectEngineTransforms transforms
Definition: detect.h:466
DetectEnginePktInspectionEngine::v1
struct DetectEnginePktInspectionEngine::@82 v1
detect-parse.h
Signature_
Signature container.
Definition: detect.h:601
SigMatch_
a single match condition for a signature
Definition: detect.h:349
DetectEngineAppInspectionEngine_::transforms
const DetectEngineTransforms * transforms
Definition: detect.h:446
DETECT_SM_LIST_MAX
@ DETECT_SM_LIST_MAX
Definition: detect.h:132
FpPatternStats_::tot
uint64_t tot
Definition: detect-engine-analyzer.c:71
DETECT_BYTETEST_STRING
#define DETECT_BYTETEST_STRING
Definition: detect-bytetest.h:45
DetectBytetestData_::offset
int32_t offset
Definition: detect-bytetest.h:60
DetectFlagsData_
Definition: detect-tcp-flags.h:37
ALPROTO_UNKNOWN
@ ALPROTO_UNKNOWN
Definition: app-layer-protos.h:29
DETECT_PCRE_RELATIVE_NEXT
#define DETECT_PCRE_RELATIVE_NEXT
Definition: detect-pcre.h:34
detect-ipopts.h
DetectEngineTransforms::cnt
int cnt
Definition: detect.h:410
suricata.h
DetectPcreData_
Definition: detect-pcre.h:42
DetectEngineAppInspectionEngine_::dir
uint8_t dir
Definition: detect.h:431
DetectEngineAnalyzerItems::item_name
const char * item_name
Definition: detect-engine-analyzer.c:63
DetectContentData_::content_len
uint16_t content_len
Definition: detect-content.h:95
ExposedItemSeen::item_seen_ptr
bool * item_seen_ptr
Definition: detect-engine-analyzer.c:77
DETECT_BYTEJUMP_STRING
#define DETECT_BYTEJUMP_STRING
Definition: detect-bytejump.h:37
DetectEngineCtx_::buffer_type_id
uint32_t buffer_type_id
Definition: detect.h:990
EngineAnalysisCtx_::file_prefix
char * file_prefix
Definition: detect-engine-analyzer.c:86
DetectEnginePktInspectionEngine::mpm
bool mpm
Definition: detect.h:488
DETECT_BYTEJUMP_BEGIN
#define DETECT_BYTEJUMP_BEGIN
Definition: detect-bytejump.h:34
DETECT_PCRE_RELATIVE
#define DETECT_PCRE_RELATIVE
Definition: detect-pcre.h:29
RuleAnalyzer
struct RuleAnalyzer RuleAnalyzer
SIG_FLAG_TLSSTORE
#define SIG_FLAG_TLSSTORE
Definition: detect.h:270
DetectU16Data
DetectUintData_u16 DetectU16Data
Definition: detect-engine-uint.h:42
Signature_::msg
char * msg
Definition: detect.h:659
DETECT_CONTENT_FAST_PATTERN
#define DETECT_CONTENT_FAST_PATTERN
Definition: detect-content.h:34
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
DETECT_FLAGS
@ DETECT_FLAGS
Definition: detect-engine-register.h:42
DETECT_PCRE_NEGATE
#define DETECT_PCRE_NEGATE
Definition: detect-pcre.h:35
EngineAnalysisCtx_::exposed_item_seen_list
struct ExposedItemSeen exposed_item_seen_list[2]
Definition: detect-engine-analyzer.c:104
Signature_::type
enum SignatureType type
Definition: detect.h:604
FpPatternStats_
Definition: detect-engine-analyzer.c:67
DetectBytetestData_::base
uint8_t base
Definition: detect-bytetest.h:56
DETECT_BYTETEST_LITTLE
#define DETECT_BYTETEST_LITTLE
Definition: detect-bytetest.h:43
SCMutex
#define SCMutex
Definition: threads-debug.h:114
SIG_TYPE_PDONLY
@ SIG_TYPE_PDONLY
Definition: detect.h:68
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:102
SIG_FLAG_PREFILTER
#define SIG_FLAG_PREFILTER
Definition: detect.h:274
DETECT_TCPMSS
@ DETECT_TCPMSS
Definition: detect-engine-register.h:291
DetectAckData_
ack data
Definition: detect-tcp-ack.h:30
SIG_FLAG_FILESTORE
#define SIG_FLAG_FILESTORE
Definition: detect.h:265
DETECT_CONTENT_WITHIN
#define DETECT_CONTENT_WITHIN
Definition: detect-content.h:31
DETECT_BYTEJUMP_RELATIVE
#define DETECT_BYTEJUMP_RELATIVE
Definition: detect-bytejump.h:38
SIG_FLAG_DP_ANY
#define SIG_FLAG_DP_ANY
Definition: detect.h:241
DETECT_FLOWBITS_CMD_SET
#define DETECT_FLOWBITS_CMD_SET
Definition: detect-flowbits.h:28
SIG_FLAG_DSIZE
#define SIG_FLAG_DSIZE
Definition: detect.h:245
DetectBytejumpData_::flags
uint16_t flags
Definition: detect-bytejump.h:49
Signature_::mask
SignatureMask mask
Definition: detect.h:612
SIG_TYPE_LIKE_IPONLY
@ SIG_TYPE_LIKE_IPONLY
Definition: detect.h:65
detect-bytetest.h
DetectProtoContainsProto
int DetectProtoContainsProto(const DetectProto *dp, int proto)
see if a DetectProto contains a certain proto
Definition: detect-engine-proto.c:135
SIG_FLAG_REQUIRE_PACKET
#define SIG_FLAG_REQUIRE_PACKET
Definition: detect.h:250
DetectEngineFrameInspectionEngine::smd
SigMatchData * smd
Definition: detect.h:523
ConfNodeLookupChildValue
const char * ConfNodeLookupChildValue(const ConfNode *node, const char *name)
Lookup the value of a child configuration node by name.
Definition: conf.c:809