From b29226c7ea8b65db7fd3763d03b04f14c0c053d9 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Tue, 12 May 2026 19:16:44 +0200 Subject: [PATCH] firewall/analyzer: include all hooks For protocols using default 0-1 states, add support. For others, print 'unknown' if no name is yet supported. Ticket: #8514. --- src/detect-engine-analyzer.c | 28 ++++++++++++++++++++-------- 1 file changed, 20 insertions(+), 8 deletions(-) diff --git a/src/detect-engine-analyzer.c b/src/detect-engine-analyzer.c index 6b0e125168..772ff0254e 100644 --- a/src/detect-engine-analyzer.c +++ b/src/detect-engine-analyzer.c @@ -2239,17 +2239,21 @@ int FirewallAnalyzer(const DetectEngineCtx *de_ctx) if (!AppProtoIsValid(a)) continue; - // HACK not all protocols have named states yet - const char *hack = AppLayerParserGetStateNameById(IPPROTO_TCP, a, 0, STREAM_TOSERVER); - if (!hack) - continue; - - SCJbOpenObject(ctx.js, AppProtoToString(a)); const uint8_t complete_state_ts = (const uint8_t)AppLayerParserGetStateProgressCompletionStatus(a, STREAM_TOSERVER); - for (uint8_t state = 0; state < complete_state_ts; state++) { + SCJbOpenObject(ctx.js, AppProtoToString(a)); + for (uint8_t state = 0; state <= complete_state_ts; state++) { const char *name = AppLayerParserGetStateNameById(IPPROTO_TCP, a, state, STREAM_TOSERVER); + if (name == NULL) { + if (state == 0) + name = "request-started"; + else if (state == complete_state_ts) + name = "request-complete"; + else + name = "unknown"; + } + char table_name[128]; snprintf(table_name, sizeof(table_name), "app:%s:%s", AppProtoToString(a), name); SCJbOpenObject(ctx.js, table_name); @@ -2264,9 +2268,17 @@ int FirewallAnalyzer(const DetectEngineCtx *de_ctx) } const uint8_t complete_state_tc = (const uint8_t)AppLayerParserGetStateProgressCompletionStatus(a, STREAM_TOCLIENT); - for (uint8_t state = 0; state < complete_state_tc; state++) { + for (uint8_t state = 0; state <= complete_state_tc; state++) { const char *name = AppLayerParserGetStateNameById(IPPROTO_TCP, a, state, STREAM_TOCLIENT); + if (name == NULL) { + if (state == 0) + name = "response-started"; + else if (state == complete_state_tc) + name = "response-complete"; + else + name = "unknown"; + } char table_name[128]; snprintf(table_name, sizeof(table_name), "app:%s:%s", AppProtoToString(a), name); SCJbOpenObject(ctx.js, table_name);