Project

General

Profile

Actions

Feature #8427

open

Feature request: support glob patterns in include directive

Added by Willem Van Asperen 4 days ago.

Status:
New
Priority:
Normal
Assignee:
-
Target version:
Effort:
Difficulty:
Label:

Description

Suricata's include directive currently requires explicit file paths. Unlike the rule-files directive which already supports glob patterns, include does not. This makes it impossible to implement a clean conf.d-style drop-in configuration directory — a standard Unix pattern used by nginx, Apache, syslog-ng, systemd and many others.

Use case:
OPNsense 26.1 introduced /usr/local/etc/suricata/conf.d/ as the documented mechanism for persistent custom Suricata configuration. However, because include does not support globs, there is no way to wire up that directory in suricata.yaml without enumerating files explicitly at config-generation time. This defeats the purpose of a drop-in directory.

Expected behaviour:
The following should work at Suricata startup, loading all .yaml files from the directory at runtime:
```yaml
include:
- /usr/local/etc/suricata/conf.d/*.yaml
```

Current behaviour:
Glob patterns in include are silently ignored or cause an error — only explicit file paths are supported.
Versions:

Suricata: 8.0.3 (as shipped with OPNsense 26.1.5)
OS: FreeBSD 14 (OPNsense 26.1.5)

Precedent:
The rule-files directive already supports glob patterns. Extending include to do the same would be consistent and straightforward, likely implemented via glob(3) in src/conf-yaml-loader.c.

No data to display

Actions

Also available in: Atom PDF