Feature #7675
openCustom content detection
Description
There currently exist many different ways to match on content, for example, PCRE, entropy, exact matches, base64 decoding, lua etc.
However, for our use case, integrating webassembly into suricata (to allow users much more diverse content matching in different languages) using the plugin system, there is no direct or nice way to have a custom content matcher.
Therefore it would be nice to add an extra callback in DetectEngineContentInspectionInternal to call into plugin code that will detect the content, in this way we're not limited to lua or limitations of the other matchers.
Our current solution is registering a custom transformer which essentially does the detection on which we then run a regular content match, but there are obvious problems with this, for example it only works on sticky buffers
Updated by Hans Vermeer 2 days ago
This is a follow up of https://redmine.openinfosecfoundation.org/issues/7154#note-5