Suricata

Rule writers have to count the bytes and write content:"..."; bsize:10;, or write content:"..."; startswith; endswith;, to express a content that's the whole buffer. Neither says what the writer means, and the bsize number has to be kept in step with the content by hand. Philippe suggested a keyword for it while reviewing #4226.

"exact" follows a content and takes no argument. It adds a bsize equal to the content's length, so this rule:

alert dns any any -> any any (msg:"exact"; dns.query; content:"google.com"; exact; sid:1;)

matches only when dns.query is "google.com", the same as content:"google.com"; bsize:10;.

The content has to be the only keyword in the buffer before "exact", and it can only carry nocase, a plain fast_pattern and offset:0, whether those come before or after "exact". Anything else gets the rule rejected: a negation, distance, within, depth, startswith, endswith, a non-zero offset, fast_pattern:only or a chopped fast_pattern. So does a rule that could never match, like one with another bsize that rules out the content's length, or an isdataat that wants data past the content. It works on app-layer and packet buffers such as dns.query or tcp.hdr, but not on the raw payload, where dsize does the job, or on base64_data, where bsize does.

"exact" works by adding a bsize, so anything that improves bsize improves "exact" too. Once #4226 is in, the rule is only evaluated when the buffer is exactly the content.

engine-analysis will also suggest "exact" for a single content that has both startswith and endswith, where "exact" would work, and suggest a single bsize range when a buffer has both a lower and an upper bsize.