Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

analysis: report rule state altered by other rule - v1 #12286

Closed
wants to merge 1 commit into from
Closed

analysis: report rule state altered by other rule - v1 #12286

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions src/detect-engine-analyzer.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1047,6 +1047,8 @@ void EngineAnalysisRules2(const DetectEngineCtx *de_ctx, const Signature *s)
break;
}

jb_set_bool(ctx.js, "rule_state_dependency", s->init_data->rule_state_dependency);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think the immediate question ppl will have is "which rule?" followed by "why?". Perhaps more info can be added through the analyzer note part of the engine analysis


jb_open_array(ctx.js, "flags");
if (s->flags & SIG_FLAG_SRC_ANY) {
jb_append_string(ctx.js, "src_any");
Expand Down
1 change: 1 addition & 0 deletions src/detect-flowbits.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -630,6 +630,7 @@ int DetectFlowbitsAnalyze(DetectEngineCtx *de_ctx)

if (to_state) {
s->init_data->init_flags |= SIG_FLAG_INIT_STATE_MATCH;
s->init_data->rule_state_dependency = true;
SCLogDebug("made SID %u stateful because it depends on "
"stateful rules that set flowbit %s", s->id, varname);
}
Expand Down
3 changes: 3 additions & 0 deletions src/detect-parse.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1537,6 +1537,9 @@ Signature *SigAlloc (void)
* overwritten, we can then assign the default value of 3 */
sig->prio = -1;

/* rule interdepency is false, at start */
sig->init_data->rule_state_dependency = false;

sig->init_data->list = DETECT_SM_LIST_NOTSET;
return sig;
}
Expand Down
3 changes: 3 additions & 0 deletions src/detect.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -597,6 +597,9 @@ typedef struct SignatureInitData_ {

/* highest list/buffer id which holds a DETECT_CONTENT */
uint32_t max_content_list_id;

/* inter-signature state dependency */
bool rule_state_dependency;
} SignatureInitData;

/** \brief Signature container */
Expand Down
Loading