diff --git a/rust/src/utils/flowbits_resolver.rs b/rust/src/utils/flowbits_resolver.rs index 697c58681b..9dd204400d 100644 --- a/rust/src/utils/flowbits_resolver.rs +++ b/rust/src/utils/flowbits_resolver.rs @@ -17,6 +17,7 @@ // Author: Shivani Bhardwaj +use crate::conf::*; use crate::jsonbuilder::*; use petgraph::algo::{is_cyclic_directed, tarjan_scc, toposort}; use petgraph::graph::{GraphError, NodeIndex}; @@ -161,9 +162,20 @@ pub unsafe extern "C" fn SCDebugLogFlowbitGraph( } fn check_cycle_update_graph(graph: &mut StableDiGraph) -> i8 { - let MAX_STACK_SIZE: usize = 100; + let mut max_stack_size: usize = 100; + if let Some(val) = conf_get("detect.flowbits.max-cycle-resolution") { + if let Ok(v) = val.parse::() { + if v > u8::MAX as usize { + SCLogError!("Invalid value for max-cycle-resolution"); + } else { + max_stack_size = v; + } + } else { + SCLogError!("Invalid value for max-cycle-resolution"); + } + } - for i in 0..MAX_STACK_SIZE { + for i in 0..=max_stack_size { /* Check graph for any cycles */ if !is_cyclic_directed(&*graph) { SCLogDebug!("no cycles after {} tries", i); @@ -171,6 +183,9 @@ fn check_cycle_update_graph(graph: &mut StableDiGraph) -> i8 { } SCLogDebug!("Found a cycle in i {}. Checking if it's valid..", i); + if i == max_stack_size { + break; + } if !try_resolve_one_cycle(graph) { /* If we can't resolve any cycle, we're stuck */ @@ -181,7 +196,7 @@ fn check_cycle_update_graph(graph: &mut StableDiGraph) -> i8 { SCLogError!( "Maximum tries ({}) reached while trying to resolve cycles", - MAX_STACK_SIZE + max_stack_size ); return -1; } diff --git a/suricata.yaml.in b/suricata.yaml.in index c4a4983bd6..87d10aea8a 100644 --- a/suricata.yaml.in +++ b/suricata.yaml.in @@ -1897,6 +1897,12 @@ detect: #flowbits: # max-per-signature: 8 # maximum number of flowbits keyword usage per signature, minimum value allowed is 1 + # In order to determine the correct order of signatures when flowbits are present + # and may have inter dependencies, Suricata makes a dependency graph of the + # signatures with flowbits and attempts to resolve any cycles that can be + # fixed to give a plausible order of signatures. This value determines how many + # times Suricata will try to resolve cycles before it gives up. + #max-cycle-resolution: 100 # Select the multi pattern algorithm you want to run for scan/search the # in the engine.