From: Jeff Lucovsky <jlucovsky@oisf.net>
Date: Sun, 15 Jun 2025 15:06:58 +0000 (-0400)
Subject: detect/analyzer: Extend analyzer output with dsize value info
X-Git-Tag: suricata-8.0.0~52
X-Git-Url: http://git.ipfire.org/gitweb/gitweb.cgi?a=commitdiff_plain;h=4f9fa602fa98085e14427aa7c03c7172b17388fe;p=thirdparty%2Fsuricata.git

detect/analyzer: Extend analyzer output with dsize value info

Issue: 6357
---

diff --git a/src/detect-engine-analyzer.c b/src/detect-engine-analyzer.c
index 4536b6d465..b262868271 100644
--- a/src/detect-engine-analyzer.c
+++ b/src/detect-engine-analyzer.c
@@ -935,6 +935,13 @@ static void DumpMatches(RuleAnalyzer *ctx, SCJsonBuilder *js, const SigMatchData
                 SCJbClose(js);
                 break;
             }
+            case DETECT_DSIZE: {
+                const DetectU16Data *cd = (const DetectU16Data *)smd->ctx;
+                SCJbOpenObject(js, "dsize");
+                SCDetectU16ToJson(js, cd);
+                SCJbClose(js);
+                break;
+            }
             case DETECT_ICMP_ID: {
                 const DetectIcmpIdData *cd = (const DetectIcmpIdData *)smd->ctx;
                 SCJbOpenObject(js, "id");