turn content modifiers into 'sticky buffers'
Turn all content modifiers into sticky buffers with a '<proto>.<buffer>[.<modifier>]' notation.
Support this dot-notation for all existing sticky buffers.
In both cases the existing rule keywords need to keep working for backwards compatibility. New keywords only need to support the new notation.
content:"abc"; http_uri; -> http.uri; content:"abc"; content:"abc"; http_raw_uri; -> http.uri.raw; content:"abc"; content:"abc"; http_client_body; -> http.request_body; content:"abc"; dns_query; content:"abc"; -> dns.query; content:"abc";
Internally, these keywords need to be registered through the 'v2 API', so that they support transforms.
Examples can be found in https://github.com/OISF/suricata/pull/3632
Updated by Jason Williams about 4 years ago
1. flip the proto to the end
- this complicates the naming a little
- breaks the current "proto_buffer"; naming scheme
2. use similar naming to 'raw'
- a little more typing
- looks fairly similar to what we already have
http_raw_sticky_uri; - in instances where we have raw
3. put sticky at the end
- not a naming convention we have currently
4. let suricata decide the function of the buffer
- this could possibly complicate the engine's parsing of the rules
content:"/example/"; http_uri; (old - modifier)
http_uri; content:"/example/"; (new - sticky)