detect/flowbits: add max-cycle-resolution config

In order to deal with the complex flowbits ordering, Suricata internally
makes a graph of the signature dependencies created by the flowbits. In
this graph, some dependencies may lead to cycles that are not always
valid. Suricata tries to resolve these cycles and come up with a final
order of signatures that makes sense.

Add a configurable limit detect.flowbits.max-cycle-resolution that can
be used to asses when to give up.

Bug 7638

rust/src/utils/flowbits_resolver.rs

@@ -17,6 +17,7 @@
 
 // Author: Shivani Bhardwaj <shivani@oisf.net>
 
+use crate::conf::*;
 use crate::jsonbuilder::*;
 use petgraph::algo::{is_cyclic_directed, tarjan_scc, toposort};
 use petgraph::graph::{GraphError, NodeIndex};
@@ -161,9 +162,20 @@ pub unsafe extern "C" fn SCDebugLogFlowbitGraph(
 }
 
 fn check_cycle_update_graph(graph: &mut StableDiGraph<SCGNode, SCGEdge>) -> i8 {
-    let MAX_STACK_SIZE: usize = 100;
+    let mut max_stack_size: usize = 100;
+    if let Some(val) = conf_get("detect.flowbits.max-cycle-resolution") {
+        if let Ok(v) = val.parse::<usize>() {
+            if v > u8::MAX as usize {
+                SCLogError!("Invalid value for max-cycle-resolution");
+            } else {
+                max_stack_size = v;
+            }
+        } else {
+            SCLogError!("Invalid value for max-cycle-resolution");
+        }
+    }
 
-    for i in 0..MAX_STACK_SIZE {
+    for i in 0..=max_stack_size {
         /* Check graph for any cycles */
         if !is_cyclic_directed(&*graph) {
             SCLogDebug!("no cycles after {} tries", i);
@@ -171,6 +183,9 @@ fn check_cycle_update_graph(graph: &mut StableDiGraph<SCGNode, SCGEdge>) -> i8 {
         }
 
         SCLogDebug!("Found a cycle in i {}. Checking if it's valid..", i);
+        if i == max_stack_size {
+            break;
+        }
 
         if !try_resolve_one_cycle(graph) {
             /* If we can't resolve any cycle, we're stuck */
@@ -181,7 +196,7 @@ fn check_cycle_update_graph(graph: &mut StableDiGraph<SCGNode, SCGEdge>) -> i8 {
 
     SCLogError!(
         "Maximum tries ({}) reached while trying to resolve cycles",
-        MAX_STACK_SIZE
+        max_stack_size
     );
     return -1;
 }

suricata.yaml.in

@@ -1897,6 +1897,12 @@ detect:
 
   #flowbits:
   #  max-per-signature: 8    # maximum number of flowbits keyword usage per signature, minimum value allowed is 1
+    # In order to determine the correct order of signatures when flowbits are present
+    # and may have inter dependencies, Suricata makes a dependency graph of the
+    # signatures with flowbits and attempts to resolve any cycles that can be
+    # fixed to give a plausible order of signatures. This value determines how many
+    # times Suricata will try to resolve cycles before it gives up.
+    #max-cycle-resolution: 100
 
 # Select the multi pattern algorithm you want to run for scan/search the
 # in the engine.