From 0ae40a8383b0bcf7a56fd5a8645ea090a92a4178 Mon Sep 17 00:00:00 2001
From: Daniel Olatunji <danielolatunji20@outlook.com>
Date: Mon, 13 Nov 2023 15:45:59 +0000
Subject: [PATCH] detect/analyzer: add more details for tcp_mss

Add more details to the tcp.mss keyword engine analysis output
Issue: #6355
---
 src/detect-engine-analyzer.c | 18 ++++++++++++++++++
 src/detect-tcpmss.c          | 27 +++++++++++++++++++++++++++
 src/detect-tcpmss.h          |  2 ++
 3 files changed, 47 insertions(+)

diff --git a/src/detect-engine-analyzer.c b/src/detect-engine-analyzer.c
index a37afabb0f00..9e23ac242695 100644
--- a/src/detect-engine-analyzer.c
+++ b/src/detect-engine-analyzer.c
@@ -32,6 +32,7 @@
 #include "detect-engine.h"
 #include "detect-engine-analyzer.h"
 #include "detect-engine-mpm.h"
+#include "detect-engine-uint.h"
 #include "conf.h"
 #include "detect-content.h"
 #include "detect-pcre.h"
@@ -39,6 +40,7 @@
 #include "detect-bytetest.h"
 #include "detect-flow.h"
 #include "detect-tcp-flags.h"
+#include "detect-tcpmss.h"
 #include "detect-ipopts.h"
 #include "feature.h"
 #include "util-print.h"
@@ -861,6 +863,22 @@ static void DumpMatches(RuleAnalyzer *ctx, JsonBuilder *js, const SigMatchData *
                 jb_close(js);
                 break;
             }
+            case DETECT_TCPMSS: {
+                const DetectU16Data *cd = (const DetectU16Data *)smd->ctx;
+
+                jb_open_object(js, "tcp_mss");
+                const char *flag = DetectTcpmssModeToString(cd->mode);
+                jb_set_string(js, "operand", flag);
+                if (strcmp(flag, "range") == 0) {
+                    jb_set_uint(js, "min", cd->arg1);
+                    jb_set_uint(js, "max", cd->arg2);
+                } else {
+                    jb_set_uint(js, "value", cd->arg1);
+                }
+
+                jb_close(js);
+                break;
+            }
         }
         jb_close(js);
 
diff --git a/src/detect-tcpmss.c b/src/detect-tcpmss.c
index 1ed04d349943..752de054116a 100644
--- a/src/detect-tcpmss.c
+++ b/src/detect-tcpmss.c
@@ -62,6 +62,33 @@ void DetectTcpmssRegister(void)
     return;
 }
 
+/**
+ * \brief Return human readable value for tcp.mss mode
+ *
+ * \param mode uint8_t DetectU16Data tcp.mss mode value
+ */
+const char *DetectTcpmssModeToString(DetectUintMode mode)
+{
+    switch (mode) {
+        case DetectUintModeEqual:
+            return "equal";
+        case DetectUintModeLt:
+            return "less than";
+        case DetectUintModeLte:
+            return "less than or equal to";
+        case DetectUintModeGt:
+            return "greater than";
+        case DetectUintModeGte:
+            return "greater than or equal to";
+        case DetectUintModeRange:
+            return "range";
+        case DetectUintModeNe:
+            return "not equal to";
+        default:
+            return NULL;
+    }
+}
+
 /**
  * \brief This function is used to match TCPMSS rule option on a packet with those passed via
  * tcpmss:
diff --git a/src/detect-tcpmss.h b/src/detect-tcpmss.h
index d01f2819b563..0e3dc6fddf81 100644
--- a/src/detect-tcpmss.h
+++ b/src/detect-tcpmss.h
@@ -26,4 +26,6 @@
 
 void DetectTcpmssRegister(void);
 
+const char *DetectTcpmssModeToString(DetectUintMode mode);
+
 #endif	/* _DETECT_TCPMSS_H */