]> git.ipfire.org Git - thirdparty/suricata.git/commitdiff
detect/analyzer: add more pcre detail
authorVictor Julien <vjulien@oisf.net>
Mon, 13 Mar 2023 12:53:32 +0000 (13:53 +0100)
committerVictor Julien <vjulien@oisf.net>
Thu, 23 Mar 2023 10:33:48 +0000 (11:33 +0100)
src/detect-engine-analyzer.c

index cac327c87d0af7777bd2ea90c2833e4f9fa4faed..38780d8a8b5f74935782d080f9ccb19155d06bc1 100644 (file)
@@ -34,6 +34,7 @@
 #include "detect-engine-mpm.h"
 #include "conf.h"
 #include "detect-content.h"
+#include "detect-pcre.h"
 #include "detect-flow.h"
 #include "detect-tcp-flags.h"
 #include "feature.h"
@@ -641,6 +642,14 @@ static void DumpContent(JsonBuilder *js, const DetectContentData *cd)
     jb_set_bool(js, "fast_pattern", cd->flags & DETECT_CONTENT_FAST_PATTERN);
 }
 
+static void DumpPcre(JsonBuilder *js, const DetectPcreData *cd)
+{
+    jb_set_bool(js, "relative", cd->flags & DETECT_PCRE_RELATIVE);
+    jb_set_bool(js, "relative_next", cd->flags & DETECT_PCRE_RELATIVE_NEXT);
+    jb_set_bool(js, "nocase", cd->flags & DETECT_PCRE_CASELESS);
+    jb_set_bool(js, "negated", cd->flags & DETECT_PCRE_NEGATE);
+}
+
 static void DumpMatches(RuleAnalyzer *ctx, JsonBuilder *js, const SigMatchData *smd)
 {
     if (smd == NULL)
@@ -675,6 +684,14 @@ static void DumpMatches(RuleAnalyzer *ctx, JsonBuilder *js, const SigMatchData *
                 jb_close(js);
                 break;
             }
+            case DETECT_PCRE: {
+                const DetectPcreData *cd = (const DetectPcreData *)smd->ctx;
+
+                jb_open_object(js, "pcre");
+                DumpPcre(js, cd);
+                jb_close(js);
+                break;
+            }
         }
         jb_close(js);