From 98cd2411b6467e4489a308874be3ea4b12cd8c64 Mon Sep 17 00:00:00 2001 From: Nancy Enos Date: Thu, 24 Oct 2024 00:29:18 +0300 Subject: [PATCH] detect/analyzer: add more details for the tcp window keyword Ticket: 6352 --- src/detect-engine-analyzer.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/detect-engine-analyzer.c b/src/detect-engine-analyzer.c index dcf3ce60a6a..d852792fd3d 100644 --- a/src/detect-engine-analyzer.c +++ b/src/detect-engine-analyzer.c @@ -52,6 +52,7 @@ #include "detect-flowbits.h" #include "util-var-name.h" #include "detect-icmp-id.h" +#include "detect-tcp-window.h" static int rule_warnings_only = 0; @@ -932,6 +933,14 @@ static void DumpMatches(RuleAnalyzer *ctx, JsonBuilder *js, const SigMatchData * jb_close(js); break; } + case DETECT_WINDOW: { + const DetectWindowData *wd = (const DetectWindowData *)smd->ctx; + jb_open_object(js, "window"); + jb_set_uint(js, "size", wd->size); + jb_set_bool(js, "negated", wd->negated); + jb_close(js); + break; + } case DETECT_FLOW_AGE: { const DetectU32Data *cd = (const DetectU32Data *)smd->ctx; jb_open_object(js, "flow_age");