transform/subslice: Add subslice transform #14297

jlucovsky · 2025-11-09T15:02:06Z

The subslice transform creates a slice of the input buffer.

Specify the subslice desired -- nbytes is optional:
subslice: [offset <,nbytes>]

offset: Specifies the starting offset for the new subslice. When negative, it expresses how far from the end of the input buffer to begin.

nbytes: Specifies the size of the subslice. When negative, specifies the byte count preceding the offset to include.

When nbytes is not specified, the size of the subslice will be the size of the input buffer - offset.

Examples:
subslice[1] - The subslice will be a copy of the input
buffer but omit the input buffer's first byte
"This is Suricata" -> "his is Suricata"
subslice[0, 13] - The slice is created from the first 13 bytes
of the input buffer
"This is Suricata" -> "This is Suric"
subslice[10, -5] - This is the same as subslice[5, 5]
"This is Suricata" -> "is Su"
subslice[-3] - The subslice will be the last 3 bytes of the
input buffer.
"This is Suricata" -> "ata"

Link to ticket: https://redmine.openinfosecfoundation.org/issues/7672

Describe changes:

Add subslice transform and unit tests
Document subslice transform, with examples

Provide values to any of the below to override the defaults.

To use a Suricata-Verify or Suricata-Update pull request,
link to the pull request in the respective _BRANCH variable.
Leave unused overrides blank or remove.

SV_REPO=
SV_BRANCH=OISF/suricata-verify#2749
SU_REPO=
SU_BRANCH=

codecov · 2025-11-09T15:44:08Z

Codecov Report

❌ Patch coverage is 93.20388% with 14 lines in your changes missing coverage. Please review.
✅ Project coverage is 84.16%. Comparing base (6bd3605) to head (0d33592).

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #14297      +/-   ##
==========================================
- Coverage   84.17%   84.16%   -0.01%     
==========================================
  Files        1012     1013       +1     
  Lines      261868   262074     +206     
==========================================
+ Hits       220421   220587     +166     
- Misses      41447    41487      +40

Flag	Coverage Δ
fuzzcorpus	`63.28% <13.55%> (-0.04%)`	⬇️
livemode	`18.74% <13.55%> (-0.04%)`	⬇️
pcap	`44.61% <13.55%> (-0.03%)`	⬇️
suricata-verify	`64.95% <83.76%> (+0.03%)`	⬆️
unittests	`59.24% <73.17%> (+0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

suricata-qa · 2025-11-09T17:30:03Z

WARNING:

field	baseline	test	%
	SURI_TLPR1_stats_chk
.uptime	654	629	96.18%

Pipeline = 28419

catenacyber · 2025-11-10T12:05:35Z

This looks cool. Why a draft ?

The subslice transform creates a slice of the input buffer. Specify the subslice desired -- nbytes is optional: subslice: [offset <,nbytes>] offset: Specifies the starting offset for the new subslice. When negative, expresses how far from the end of the input buffer to begin. nbytes: Specifies the size of the subslice. When negative, specifies the byte count preceding the offset to include. When nbytes is not specified, the size of the subslice will be the size of the input buffer - offset. Examples: subslice[1] - The subslice will be a copy of the input buffer but omit the input buffer's first byte "This is Suricata" -> "his is Suricata" subslice[0, 13] - The slice is created from the first 13 bytes of the input buffer "This is Suricata" -> "This is Suric" subslice[10, -5] - The subslice is created starting at offset 10 and continuing to 5 bytes before the end. This is the same as subslice[5, 5] "This is Suricata" -> "is Su" subslice[-3] - The subslice will be the last 3 bytes of the input buffer. "This is Suricata" -> "ata"

jlucovsky · 2025-11-10T14:35:07Z

This looks cool. Why a draft ?

I don't have the doc ready and wanted to do a CI run in the meantime

catenacyber · 2025-11-10T14:40:36Z

This looks cool. Why a draft ?

I don't have the doc ready and wanted to do a CI run in the meantime

Ok, so you see you need some clippy fixes ;-)

suricata-qa · 2025-11-11T09:05:02Z

Information: QA ran without warnings.

Pipeline = 28436

catenacyber · 2025-11-13T08:49:29Z

rust/src/detect/transforms/subslice.rs

+        desc: b"create a subslice from the current buffer\0".as_ptr() as *const libc::c_char,
+        url: b"/rules/transforms.html#subslice\0".as_ptr() as *const libc::c_char,
+        Setup: Some(subslice_setup),
+        flags: SIGMATCH_OPTIONAL_OPT,


Does it make sense without an option ? Should it not be required_opt ?

good point ... i'll set that field to 0

catenacyber · 2025-11-13T08:50:40Z

rust/src/detect/transforms/subslice.rs

+
+    // This works because the structure is flat
+    // Once variables are really implemented, we should investigate if the structure should own
+    // its serialization or just borrow it to a caller


I am not sure this is stable over rust versions

I think DetectTransformSubsliceData should be made repr(C)

catenacyber · 2025-11-13T08:52:09Z

rust/src/detect/transforms/subslice.rs

+    input: &[u8], output: &mut [u8], ctx: &DetectTransformSubsliceData,
+) -> u32 {
+    let Some(slice) = subslice_apply(input, ctx) else {
+        return 0;


Where are we about handling transforms errors ?

catenacyber · 2025-11-13T08:57:26Z

rust/src/detect/transforms/subslice.rs

+    let mut end = match ctx.end {
+        None => len,
+        Some(e) if e < 0 => {
+            let abs_end = start + e;


subslice: [offset <,nbytes>]
nbytes: Specifies the size of the subslice. When negative, specifies the byte count preceding the offset to include.
subslice[10, -5] - This is the same as subslice[5, 5]

This looks weird to me

I would not expect negative nbytes to change the offset
I would expect negative nbytes to be take until end of buffer expect last 5 bytes...

understood ... i'll revisit this.

Generally speaking, I guess the python way to subslice feels good.
But I concede Suricata is more about offset+nbytes

catenacyber · 2025-11-13T08:58:40Z

rust/src/detect/transforms/subslice.rs

+
+    match parts.as_slice() {
+        [start] => {
+            let start = start.parse::<isize>().ok()?;


Should we reject start=0 ?

Why? That would mean starting the subslice at the first byte.

Meaning the subspace is the whole slice, so not interesting, right ?

catenacyber · 2025-11-13T08:59:13Z

rust/src/detect/transforms/subslice.rs

+        }
+        [start, end] => {
+            let start = start.parse::<isize>().ok()?;
+            let end = end.parse::<isize>().ok()?;


Should we reject end=0 ?

Good point. I'll do that.

In general enforce end > start?

start and end should be better named offset and nbytes if I understand correctly

catenacyber

Looks nice, left some questions.
Doc is still missing ;-)

victorjulien · 2025-11-13T15:37:52Z

rust/src/detect/transforms/subslice.rs

+            let start = start.parse::<isize>().ok()?;
+            Some(DetectTransformSubsliceData { start, end: None })
+        }
+        [start, end] => {


think it's the first time I see this bracket notation, what does it do?

I understand it is a slice of 2 elements, and so, we can name them

jlucovsky force-pushed the 7672/1 branch from c73c328 to 0d33592 Compare November 10, 2025 14:33

jlucovsky marked this pull request as ready for review November 11, 2025 13:22

jlucovsky requested review from jasonish and victorjulien as code owners November 11, 2025 13:22

catenacyber reviewed Nov 13, 2025

View reviewed changes

catenacyber requested changes Nov 13, 2025

View reviewed changes

victorjulien reviewed Nov 13, 2025

View reviewed changes

transform/subslice: Add subslice transform #14297

Are you sure you want to change the base?

transform/subslice: Add subslice transform #14297

Conversation

jlucovsky commented Nov 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Provide values to any of the below to override the defaults.

Uh oh!

codecov bot commented Nov 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

suricata-qa commented Nov 9, 2025

Uh oh!

catenacyber commented Nov 10, 2025

Uh oh!

jlucovsky commented Nov 10, 2025

Uh oh!

catenacyber commented Nov 10, 2025

Uh oh!

suricata-qa commented Nov 11, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

catenacyber left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

4 participants

jlucovsky commented Nov 9, 2025 •

edited

Loading

codecov bot commented Nov 9, 2025 •

edited

Loading