rule analyser: display message for invalid signatures

diff --git a/src/detect-engine-analyzer.c b/src/detect-engine-analyzer.c
index 916970da5e76aa0c26a6ffaa7c5a107c340d81e5..078c98c88694cb5f150011f9f87c6d019283988a 100644 (file)
--- a/src/detect-engine-analyzer.c
+++ b/src/detect-engine-analyzer.c
@@ -409,6 +409,17 @@ static void EngineAnalysisRulesPrintFP(Signature *s)
     return;
 }
 
+
+void EngineAnalysisRulesFailure(char *line, char *file, int lineno)
+{
+        fprintf(rule_engine_analysis_FD, "== Sid: UNKNOWN ==\n");
+        fprintf(rule_engine_analysis_FD, "%s\n", line);
+        fprintf(rule_engine_analysis_FD, "    FAILURE: invalid rule.\n");
+        fprintf(rule_engine_analysis_FD, "    File: %s.\n", file);
+        fprintf(rule_engine_analysis_FD, "    Line: %d.\n", lineno);
+        fprintf(rule_engine_analysis_FD, "\n");
+}
+
 /**
  * \brief Prints analysis of loaded rules.
  *

diff --git a/src/detect-engine-analyzer.h b/src/detect-engine-analyzer.h
index 2b1fc54a641e645a17e0b92f64220d7222537f3a..d92b20604c5333bccaa1007b7d0fdf93bc496d0d 100644 (file)
--- a/src/detect-engine-analyzer.h
+++ b/src/detect-engine-analyzer.h
@@ -37,5 +37,6 @@ int PerCentEncodingMatch (uint8_t *content, uint8_t content_len);
 
 void EngineAnalysisFP(Signature *s, char *line);
 void EngineAnalysisRules(Signature *s, char *line);
+void EngineAnalysisRulesFailure(char *line, char *file, int lineno);
 
 #endif /* __DETECT_ENGINE_ANALYZER_H__ */

diff --git a/src/detect.c b/src/detect.c
index 928bc31f6d0acc56287ab93b56be317409722881..338090ead1ed425b657487f3581aa0606fa9a321 100644 (file)
--- a/src/detect.c
+++ b/src/detect.c
@@ -345,6 +345,10 @@ int DetectLoadSigFile(DetectEngineCtx *de_ctx, char *sig_file, int *sigs_tot) {
         } else {
             SCLogError(SC_ERR_INVALID_SIGNATURE, "error parsing signature \"%s\" from "
                  "file %s at line %"PRId32"", line, sig_file, lineno - multiline);
+
+            if (rule_engine_analysis_set) {
+                EngineAnalysisRulesFailure(line, sig_file, lineno - multiline);
+            }
             if (de_ctx->failure_fatal == 1) {
                 exit(EXIT_FAILURE);
             }