Feature #8133
openRelative pcre with negative distance to previous content match
Description
Currently Suricata implements the R PCRE modifier to allow the equivalent of distance:0. This is enough in most use case, except when using PCRE extraction.
See for example this rule:alert ip any any -> any any (flow:to_server; content: "ECSC_"; pcre: "/(ECSC_[A-Za-z0-9\/+]{32})/, flow:match"; sid: 1;)
Because the extraction needs to contain the ECSC_ prefix, the R modifier cannot be used.
This is problematic when trying to extract multiple values, as PCRE will return the first found match.
PA Updated by Philippe Antoine about 1 month ago
- Status changed from New to Triaged
- Assignee set to Community Ticket
OM Updated by Omar Merroun 12 days ago
I see the need for this feature (native extract of multiple structured values from a single packet).
You could ofc write a lua script that could do the trick.
But I would suggest adding a new modifier to pcre, let's call it G, that iterates the following pcre extraction across every MPM hit of the anchoring content. Then captured values are collected in an ordered list (with a configurable cap) in the alert output.