Suricata

Description¶

The Suricata PCRE modifier documentation says:

O: Overrides the configures pcre match limit.

With O, Suricata uses pcre.match-limit and pcre.match-limit-recursion from the configuration. Without O, it uses its built-in defaults: a match limit of 3500 and a recursion limit of 1500 in normal builds. These limits cannot be changed through configuration for expressions without O. See the implementation.

Comparison with Snort¶

Snort's documentation describes O as:

overrides the configured pcre match limit and pcre match limit recursion for this expression

In Snort 3's PCRE implementation, expressions without O use the configured limits when nonzero. With O, Snort skips applying those limits, leaving PCRE2's library defaults in place. The administrator can disable this exception by setting detection.pcre_override to false, which makes Snort ignore O. This setting is enabled by default.

Thus, Snort uses O to bypass its configured limits, whereas Suricata uses it to apply them.

Possible fixes¶

1. Change the behavior¶

Apply the configured limits to expressions without O, and let O bypass them in favor of PCRE2's library defaults (or Suricata's hardcoded defaults). A separate setting could let administrators disable these exceptions, as in Snort. This would let administrators configure the limits for expressions without O. It would change behavior for expressions both with and without O, so compatibility with existing rules and configurations would need consideration.

Suggested documentation:

O: Overrides the configured pcre match limit and pcre match limit recursion for this expression with PCRE2's library defaults.

For the hardcoded-defaults alternative, replace "PCRE2's library defaults" with "Suricata's hardcoded defaults".

2. Keep the current behavior and change the documentation¶

Describe O as applying the configured limits:

O: Overrides the default pcre match limit and pcre match limit recursion for this expression with the values from the configuration. If either setting is absent from the configuration, its built-in default is used.