Open Information Security Foundation

11/13/2025

04:27 PM Suricata Task #8109: libsuricata: allow user to change the name of the program

I guess I feel like the lib shouldn't output this at all, except perhaps when explicitly instructed. Instead it shoul... Victor Julien

03:55 PM Suricata Task #8095: libsuricata: expose API for reloading rulesets

Should we start with killing the config api hack and load a new config into a variable and pass that around in the De... Victor Julien

03:53 PM Suricata Task #8095: libsuricata: expose API for reloading rulesets

I think in Suricata currently there is a mix of detect engine logic and threading when doing reloads:
- we reload ... Victor Julien

11/12/2025

07:54 AM Suricata Feature #8019: mpm: support `endswith` condition to the fast pattern in hyperscan

I'm attaching the WIP patch I did at the time. It shouldn't be hard to get it going with a current git tree. Victor Julien

07:47 AM Suricata Feature #8019 (Feedback): mpm: support `endswith` condition to the fast pattern in hyperscan

I don't know if we can meaningfully address this. I've experimented with this years ago but the hyperscan API doesn't... Victor Julien

07:49 AM Suricata Documentation #6824 (In Review): doc: Document every parameter of the configure script

Thanks @Chris-ic Victor Julien

11/11/2025

01:39 PM Suricata Feature #5775: rules: http.headers - dynamic sticky buffers

Wrt what to do if the header is missing, I think we can leave this to the regular @absent@/@absent_or@ logic. Victor Julien

01:37 PM Suricata Feature #5775: rules: http.headers - dynamic sticky buffers

I think this would allow a something like @http.user_agent; content:"Mozilla";@ to be replaced by @http.request_heade... Victor Julien

12:51 PM Suricata Documentation #7573: Clarify which buffers affect subsequent PCRE

Added https://github.com/OISF/suricata-verify/pull/2754 to show these http body keywords parse correctly w/o this mod... Victor Julien

09:30 AM Suricata Documentation #7573: Clarify which buffers affect subsequent PCRE

@http.request_body@ and @http.response_body@ should act as regular sticky buffers. Victor Julien