detect/parse: add flag to indicate keyword is deprecated

Issue warning when it is still used.

diff --git a/src/detect-parse.c b/src/detect-parse.c
index 4786da53dc2eb15dc4c860ccb75102640a33615c..2f4ea94777bfc95f6ca1215e081d66d5bc925cd0 100644 (file)
--- a/src/detect-parse.c
+++ b/src/detect-parse.c
@@ -647,6 +647,18 @@ static int SigParseOptions(DetectEngineCtx *de_ctx, Signature *s, char *optstr,
     }
     s->init_data->negated = false;
 
+    if (st->flags & SIGMATCH_INFO_DEPRECATED) {
+#define URL "https://suricata-ids.org/about/deprecation-policy/"
+        if (st->alternative == 0)
+            SCLogWarning(SC_WARN_DEPRECATED, "keyword '%s' is deprecated "
+                    "and will be removed soon. See %s", st->name, URL);
+        else
+            SCLogWarning(SC_WARN_DEPRECATED, "keyword '%s' is deprecated "
+                    "and will be removed soon. Use '%s' instead. "
+                    "See %s", st->name, sigmatch_table[st->alternative].name, URL);
+#undef URL
+    }
+
     /* Validate double quoting, trimming trailing white space along the way. */
     if (optvalue != NULL && strlen(optvalue) > 0) {
         size_t ovlen = strlen(optvalue);

diff --git a/src/detect.h b/src/detect.h
index b6a317f4b3fd22e45f188576fd88105583834a2b..30c26bc4c2d98c6d5687fe4342500fda605ca1af 100644 (file)
--- a/src/detect.h
+++ b/src/detect.h
@@ -1354,6 +1354,8 @@ typedef struct SigGroupHead_ {
 #define SIGMATCH_INFO_CONTENT_MODIFIER  BIT_U16(8)
 /** keyword is a sticky buffer */
 #define SIGMATCH_INFO_STICKY_BUFFER     BIT_U16(9)
+/** keyword is deprecated: used to suggest an alternative */
+#define SIGMATCH_INFO_DEPRECATED        BIT_U16(10)
 
 enum DetectEngineTenantSelectors
 {