diff --git a/src/detect-engine-analyzer.c b/src/detect-engine-analyzer.c index dae6f9f2f270..c8c18c60e916 100644 --- a/src/detect-engine-analyzer.c +++ b/src/detect-engine-analyzer.c @@ -1047,6 +1047,16 @@ void EngineAnalysisRules2(const DetectEngineCtx *de_ctx, const Signature *s) break; } + if (s->init_data->is_rule_state_dependant) { + jb_open_object(ctx.js, "rule_state_dependant"); + jb_set_uint(ctx.js, "rule_depends_on_sid", s->init_data->rule_state_dependant_id); + jb_set_string(ctx.js, "rule_depends_on_flowbit", + VarNameStoreSetupLookup(s->init_data->rule_state_variable_idx, VAR_TYPE_FLOW_BIT)); + jb_close(ctx.js); + } else { + jb_set_bool(ctx.js, "rule_state_dependant", s->init_data->is_rule_state_dependant); + } + jb_open_array(ctx.js, "flags"); if (s->flags & SIG_FLAG_SRC_ANY) { jb_append_string(ctx.js, "src_any"); diff --git a/src/detect-flowbits.c b/src/detect-flowbits.c index 40f04d75f305..a109fa227912 100644 --- a/src/detect-flowbits.c +++ b/src/detect-flowbits.c @@ -630,6 +630,11 @@ int DetectFlowbitsAnalyze(DetectEngineCtx *de_ctx) if (to_state) { s->init_data->init_flags |= SIG_FLAG_INIT_STATE_MATCH; + s->init_data->is_rule_state_dependant = true; + // fetch the signature id that sets the flowbit making the isset rule stateful + s->init_data->rule_state_dependant_id = + de_ctx->sig_array[array[i].set_sids[array[i].set_sids_idx - 1]]->id; + s->init_data->rule_state_variable_idx = i; SCLogDebug("made SID %u stateful because it depends on " "stateful rules that set flowbit %s", s->id, varname); } diff --git a/src/detect-parse.c b/src/detect-parse.c index 3b03dfb92b36..a9d3ca398d8c 100644 --- a/src/detect-parse.c +++ b/src/detect-parse.c @@ -1537,6 +1537,9 @@ Signature *SigAlloc (void) * overwritten, we can then assign the default value of 3 */ sig->prio = -1; + /* rule interdepency is false, at start */ + sig->init_data->is_rule_state_dependant = false; + sig->init_data->list = DETECT_SM_LIST_NOTSET; return sig; } diff --git a/src/detect.h b/src/detect.h index 4e31c5fe0284..eb49d276ccd3 100644 --- a/src/detect.h +++ b/src/detect.h @@ -597,6 +597,11 @@ typedef struct SignatureInitData_ { /* highest list/buffer id which holds a DETECT_CONTENT */ uint32_t max_content_list_id; + + /* inter-signature state dependency */ + bool is_rule_state_dependant; + uint32_t rule_state_dependant_id; + uint32_t rule_state_variable_idx; } SignatureInitData; /** \brief Signature container */