Suricata

This involved a code change. Should it be a bug as it was allowed as a multi buffer keyword before but is not. I think that’s the issue we’re trying to capture in a ticket.

Jason Ish wrote in #note-2:

it was allowed as a multi buffer keyword before but is not.

It was not really "allowed" as a multi-buffer : it was not implemented as a multi-buffer, even if it was documented as such.
It was just rules using the multi-buffer syntax did not warn even if they should have

Philippe Antoine wrote in #note-3:

Jason Ish wrote in #note-2:

it was allowed as a multi buffer keyword before but is not.

It was not really "allowed" as a multi-buffer : it was not implemented as a multi-buffer, even if it was documented as such.
It was just rules using the multi-buffer syntax did not warn even if they should have

Yeah, I think that is captured in #7867. We need a ticket for the bug fix though, being that we now warn on this condition instead of silently allowing as its a visible user facing change.

But, please feel free to modify the ticket as you wish :-)