detect/analyzer: log mask flags and more engine details

diff --git a/src/detect-engine-analyzer.c b/src/detect-engine-analyzer.c
index 5bcf15f6b837e1fd84b3c1b597b4ce274c7f62bd..5d5c53760532aa141609685c5d5db00eceb3d0e8 100644 (file)
--- a/src/detect-engine-analyzer.c
+++ b/src/detect-engine-analyzer.c
@@ -490,6 +490,32 @@ void EngineAnalysisRules2(const DetectEngineCtx *de_ctx, const Signature *s)
     const char *alproto = AppProtoToString(s->alproto);
     json_object_set_new(js, "app_proto", json_string(alproto));
 
+    json_t *js_flags = json_array();
+    if (js_flags != NULL) {
+        if (s->mask & SIG_MASK_REQUIRE_PAYLOAD) {
+            json_array_append_new(js_flags, json_string("payload"));
+        }
+        if (s->mask & SIG_MASK_REQUIRE_NO_PAYLOAD) {
+            json_array_append_new(js_flags, json_string("no_payload"));
+        }
+        if (s->mask & SIG_MASK_REQUIRE_FLOW) {
+            json_array_append_new(js_flags, json_string("flow"));
+        }
+        if (s->mask & SIG_MASK_REQUIRE_FLAGS_INITDEINIT) {
+            json_array_append_new(js_flags, json_string("tcp_flags_init_deinit"));
+        }
+        if (s->mask & SIG_MASK_REQUIRE_FLAGS_UNUSUAL) {
+            json_array_append_new(js_flags, json_string("tcp_flags_unusual"));
+        }
+        if (s->mask & SIG_MASK_REQUIRE_DCERPC) {
+            json_array_append_new(js_flags, json_string("dcerpc"));
+        }
+        if (s->mask & SIG_MASK_REQUIRE_ENGINE_EVENT) {
+            json_array_append_new(js_flags, json_string("engine_event"));
+        }
+        json_object_set_new(js, "requirements", js_flags);
+    }
+
     if (s->flags & SIG_FLAG_STATE_MATCH) {
         json_t *js_array = json_array();
         const DetectEngineAppInspectionEngine *app = s->app_inspect;
@@ -511,6 +537,8 @@ void EngineAnalysisRules2(const DetectEngineCtx *de_ctx, const Signature *s)
                 const char *direction = app->dir == 0 ? "toserver" : "toclient";
                 json_object_set_new(js_engine, "direction", json_string(direction));
                 json_object_set_new(js_engine, "is_mpm", json_boolean(app->mpm));
+                json_object_set_new(js_engine, "app_proto", json_string(AppProtoToString(app->alproto)));
+                json_object_set_new(js_engine, "progress", json_integer(app->progress));
 
                 json_t *js_matches = json_array();
                 if (js_matches != NULL) {