Project

General

Profile

Actions

Feature #7675

open

Custom content detection

Added by Hans Vermeer 2 days ago. Updated 2 days ago.

Status:
New
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
Label:

Description

There currently exist many different ways to match on content, for example, PCRE, entropy, exact matches, base64 decoding, lua etc.
However, for our use case, integrating webassembly into suricata (to allow users much more diverse content matching in different languages) using the plugin system, there is no direct or nice way to have a custom content matcher.
Therefore it would be nice to add an extra callback in DetectEngineContentInspectionInternal to call into plugin code that will detect the content, in this way we're not limited to lua or limitations of the other matchers.

Our current solution is registering a custom transformer which essentially does the detection on which we then run a regular content match, but there are obvious problems with this, for example it only works on sticky buffers

Actions

Also available in: Atom PDF