#include "suricata-common.h"
#include "suricata.h"
#include "rust.h"
#include "action-globals.h"
#include "detect.h"
#include "detect-parse.h"
#include "detect-engine.h"
#include "detect-engine-analyzer.h"
#include "detect-engine-mpm.h"
#include "detect-engine-uint.h"
#include "conf.h"
#include "detect-content.h"
#include "detect-pcre.h"
#include "detect-bytejump.h"
#include "detect-bytetest.h"
#include "detect-isdataat.h"
#include "detect-flow.h"
#include "detect-tcp-flags.h"
#include "detect-tcp-ack.h"
#include "detect-ipopts.h"
#include "detect-tcp-seq.h"
#include "feature.h"
#include "util-print.h"
#include "util-time.h"
#include "util-validate.h"
#include "util-conf.h"
#include "detect-flowbits.h"
#include "util-var-name.h"
#include "detect-icmp-id.h"
#include "detect-tcp-window.h"
#include "app-layer-parser.h"

Include dependency graph for detect-engine-analyzer.c:

Data Structures
struct	DetectEngineAnalyzerItems

struct	FpPatternStats_

struct	ExposedItemSeen

struct	EngineAnalysisCtx_

struct	RuleAnalyzer

Macros
#define	DETECT_PERCENT_ENCODING_REGEX "%[0-9\|a-f\|A-F]{2}"

#define	CHECK(pat) if (strlen((pat)) <= len && memcmp((pat), buf, MIN(len, strlen((pat)))) == 0) return true;

Typedefs
typedef struct DetectEngineAnalyzerItems	DetectEngineAnalyzerItems

typedef struct FpPatternStats_	FpPatternStats

typedef struct EngineAnalysisCtx_	EngineAnalysisCtx

typedef struct RuleAnalyzer	RuleAnalyzer

Functions
void	EngineAnalysisFP (const DetectEngineCtx de_ctx, const Signature s, const char *line)

void	SetupEngineAnalysis (DetectEngineCtx de_ctx, bool fp_analysis, bool *rule_analysis)

void	CleanupEngineAnalysis (DetectEngineCtx *de_ctx)

void	EngineAnalysisRulesFailure (const DetectEngineCtx de_ctx, const char line, const char *file, int lineno)

void	EngineAnalysisRules2 (const DetectEngineCtx de_ctx, const Signature s)

void	DumpPatterns (DetectEngineCtx *de_ctx)

void	EngineAnalysisRules (const DetectEngineCtx de_ctx, const Signature s, const char *line)
	Prints analysis of loaded rules.

int	FirewallAnalyzer (const DetectEngineCtx *de_ctx)

Variables
const DetectEngineAnalyzerItems	analyzer_items []

SCMutex	g_rules_analyzer_write_m = SCMUTEX_INITIALIZER

Detailed Description

Author: Eileen Donlon emdon.nosp@m.lo@g.nosp@m.mail..nosp@m.com; Victor Julien victo.nosp@m.r@in.nosp@m.linia.nosp@m.c.ne.nosp@m.t

Rule analyzers for the detection engine

Definition in file detect-engine-analyzer.c.

Macro Definition Documentation

◆ CHECK

#define CHECK ( pat ) if (strlen((pat)) <= len && memcmp((pat), buf, MIN(len, strlen((pat)))) == 0) return true;

Definition at line 670 of file detect-engine-analyzer.c.

◆ DETECT_PERCENT_ENCODING_REGEX

#define DETECT_PERCENT_ENCODING_REGEX "%[0-9|a-f|A-F]{2}"

Typedef Documentation

◆ DetectEngineAnalyzerItems

typedef struct DetectEngineAnalyzerItems DetectEngineAnalyzerItems

◆ EngineAnalysisCtx

typedef struct EngineAnalysisCtx_ EngineAnalysisCtx

◆ FpPatternStats

typedef struct FpPatternStats_ FpPatternStats

◆ RuleAnalyzer

typedef struct RuleAnalyzer RuleAnalyzer

Function Documentation

◆ CleanupEngineAnalysis()

void CleanupEngineAnalysis ( DetectEngineCtx * de_ctx )

Definition at line 510 of file detect-engine-analyzer.c.

References EngineAnalysisCtx_::analyzer_items, de_ctx, DetectEngineCtx_::ea, EngineAnalysisCtx_::file_prefix, and SCFree.

Referenced by SigLoadSignatures().

Here is the caller graph for this function:

◆ DumpPatterns()

void DumpPatterns ( DetectEngineCtx * de_ctx )

Definition at line 1432 of file detect-engine-analyzer.c.

References DetectEngineCtx_::buffer_type_id, DetectPatternTracker::cd, DetectPatternTracker::cnt, DetectContentData_::content_len, de_ctx, DETECT_CONTENT_DEPTH, DETECT_CONTENT_ENDS_WITH, DETECT_CONTENT_NEGATED, DETECT_CONTENT_NOCASE, DETECT_CONTENT_OFFSET, DETECT_SM_LIST_DYNAMIC_START, DetectContentPatternPrettyPrint(), DetectEngineBufferTypeGetNameById(), DetectListToHumanString(), DetectEngineCtx_::ea, EngineAnalysisCtx_::file_prefix, DetectContentData_::flags, g_rules_analyzer_write_m, HashListTableFree(), HashListTableGetListData, HashListTableGetListHead(), HashListTableGetListNext, DetectPatternTracker::mpm, name, DetectEngineCtx_::pattern_hash_table, SCConfigGetLogDirectory(), SCMutexLock, SCMutexUnlock, DetectPatternTracker::sm_list, and str.

Here is the call graph for this function:

◆ EngineAnalysisFP()

void EngineAnalysisFP	(	const DetectEngineCtx *	de_ctx,
		const Signature *	s,
		const char *	line
	)

Definition at line 169 of file detect-engine-analyzer.c.

References DetectContentData_::content, DetectContentData_::content_len, SigMatch_::ctx, de_ctx, DETECT_CONTENT_DEPTH, DETECT_CONTENT_DISTANCE, DETECT_CONTENT_FAST_PATTERN, DETECT_CONTENT_FAST_PATTERN_CHOP, DETECT_CONTENT_FAST_PATTERN_ONLY, DETECT_CONTENT_NEGATED, DETECT_CONTENT_NOCASE, DETECT_CONTENT_OFFSET, DETECT_CONTENT_WITHIN, DETECT_SM_LIST_PMATCH, DetectEngineBufferTypeGetDescriptionById(), DetectEngineBufferTypeGetNameById(), DetectEngineCtx_::ea, FatalError, DetectContentData_::flags, DetectContentData_::fp_chop_len, DetectContentData_::fp_chop_offset, EngineAnalysisCtx_::fp_pattern_stats, Signature_::id, Signature_::init_data, SignatureInitData_::mpm_sm, SignatureInitData_::mpm_sm_list, SigTableElmt_::name, name, SignatureInitData_::prefilter_sm, PrintRawUriFp(), EngineAnalysisCtx_::rule_engine_analysis_fp, SCFree, SCMalloc, sigmatch_table, SigMatch_::type, and unlikely.

Here is the call graph for this function:

◆ EngineAnalysisRules()

void EngineAnalysisRules	(	const DetectEngineCtx *	de_ctx,
		const Signature *	s,
		const char *	line
	)

Prints analysis of loaded rules.

   Warns if potential rule issues are detected. For example,
   warns if a rule uses a construct that may perform poorly,
   e.g. pcre without content or with http_method content only;
   warns if a rule uses a construct that may not be consistent with intent,
   e.g. client side ports only, http and content without any http_* modifiers, etc.

Parameters