Actions
Feature #2283
closedturn content modifiers into 'sticky buffers'
Description
Turn all content modifiers into sticky buffers with a '<proto>.<buffer>[.<modifier>]' notation.
Support this dot-notation for all existing sticky buffers.
In both cases the existing rule keywords need to keep working for backwards compatibility. New keywords only need to support the new notation.
Some examples:
content:"abc"; http_uri; -> http.uri; content:"abc"; content:"abc"; http_raw_uri; -> http.uri.raw; content:"abc"; content:"abc"; http_client_body; -> http.request_body; content:"abc"; dns_query; content:"abc"; -> dns.query; content:"abc";
Internally, these keywords need to be registered through the 'v2 API', so that they support transforms.
Examples can be found in https://github.com/OISF/suricata/pull/3632
Actions