Suricata

When a rule uses bsize, Suricata checks at load time whether the rule's contents can fit in the buffer, and rejects the rule if they can't. That check gets some rules wrong in both directions.

It only looks at the first bsize on a buffer, and skips the check when that bsize is a lower bound (bsize:>N) or uses <=. It only counts the first content and the contents after it that use distance or within. And it counts negated contents, and a negated content's within window, as bytes the buffer has to hold.

These rules load on main but can never match:

dns.query; content:"0123456789"; bsize:<20; bsize:<8;
dns.query; content:"0123456789"; bsize:>5; bsize:<8;
dns.query; content:"abcdef"; bsize:<=5;
dns.query; content:"abc"; bsize:15; bsize:27;
dns.query; bsize:>20; bsize:<10;
dns.query; content:"abc"; content:"defghij"; content:"k"; distance:0; bsize:5;

These are rejected on main but can match, since a buffer too short to hold a negated content satisfies the negation:

dns.query; content:!"abcdef"; bsize:5;
http.uri; content:"/"; content:!"admin"; within:100; bsize:<32;

Four ET rules load today and can never match: 2063355 (bsize:15 and bsize:27 on the same http.host), and 2068295, 2068345 and 2866524 (a content longer than the bsize allows).

Proposed fix: check against the smallest upper bound of all the bsize keywords on the buffer, <= included. Reject bsize keywords that no buffer length can satisfy. Check each group of contents tied together by distance or within on its own, so every content has to fit, and don't count negated contents. dsize is not affected.

main-8.0.x has the same code. Found while working on #4226 (https://github.com/OISF/suricata/pull/16429).