Project

General

Profile

Actions

Feature #2283

closed

turn content modifiers into 'sticky buffers'

Added by Victor Julien over 6 years ago. Updated almost 5 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
Label:

Description

Turn all content modifiers into sticky buffers with a '<proto>.<buffer>[.<modifier>]' notation.
Support this dot-notation for all existing sticky buffers.

In both cases the existing rule keywords need to keep working for backwards compatibility. New keywords only need to support the new notation.

Some examples:

content:"abc"; http_uri; -> http.uri; content:"abc";
content:"abc"; http_raw_uri; -> http.uri.raw; content:"abc";
content:"abc"; http_client_body; -> http.request_body; content:"abc";
dns_query; content:"abc"; -> dns.query; content:"abc";

Internally, these keywords need to be registered through the 'v2 API', so that they support transforms.

Examples can be found in https://github.com/OISF/suricata/pull/3632


Subtasks 4 (0 open4 closed)

Feature #2897: update http_content_type and others to new style sticky buffersClosedJeff LucovskyActions
Feature #2914: modernize tls sticky buffersClosedJeff LucovskyActions
Bug #2915: modernize ssh sticky buffersClosedJeff LucovskyActions
Feature #2930: http_protocol: use mpm and content inspect v2 apisClosedGiuseppe LongoActions

Related issues 3 (2 open1 closed)

Related to Suricata - Task #2309: SuriCon 2017 brainstormAssignedVictor JulienActions
Related to Suricata - Task #2685: SuriCon 2018 brainstormAssignedVictor JulienActions
Related to Suricata - Feature #2952: modernize http_header_namesClosedVictor JulienActions
Actions

Also available in: Atom PDF