transform/subslice: Add subslice transform by jlucovsky · Pull Request #14643 · OISF/suricata

jlucovsky · 2026-01-17T13:53:19Z

Continuation of #14625

The subslice transform creates a slice of the input buffer.

Specify the subslice desired -- nbytes and truncate are optional:
        subslice: offset <,nbytes> <,truncate>

offset: Specifies the starting offset for the new subslice. When
negative, expresses how far from the end of the input buffer to begin.
When nbytes is *not* specified, start must be > 0.

nbytes: Specifies the size of the subslice. When negative, specifies the
byte count preceding the offset to include. Nbytes must be > 0.

When nbytes is not specified, the size of the subslice will be the size
of the input buffer - offset.

truncate: Specify behavior when offset + nbytes exceeds buffer length.
When present, trims nbytes such that offset + nbytes equals buffer
length. When not present, an empty buffer is produced.

Examples:
subslice: 1; - The subslice will be a copy of the input
buffer but omit the input buffer's first byte
"This is Suricata" -> "his is Suricata"
subslice: 0, 13; - The slice is created from the first 13 bytes
of the input buffer
"This is Suricata" -> "This is Suric"
subslice: 10, -5; - This is the same as subslice[5, 5]
"This is Suricata" -> "is Su"
subslice: -3; - The subslice will be the last 3 bytes of the
input buffer.
"This is Suricata" -> "ata"

Link to ticket: https://redmine.openinfosecfoundation.org/issues/7672

Describe changes:

Add subslice transform and unit tests
Document subslice transform, with examples

Updates:

Removed support for bracketed values, e.g., [3], [3, 8]`
Changed function DetectTransformSubsliceData to be attributed with repr(C)
Modified handling of negative nbyte values to mean "bytes from the end" .
start=0 is an error unless nbytes is specified
end=0 is always an error.
Corrected clippy issues.
Added configuration variable subslice.truncate to control behavior when offset + nbytes > length
Updated s-v branch.
Fixed s-v failing tests due to default config settings
Rebase
Fixed race condition in unittests wrt global variable
Removed truncate global option and replaced with a per-usage truncate option.
Rebase
Doc update to remove lingering global truncate option.
Removed commit that adjusted asn1 underline characters.
Updated Rust unit tests to eliminate is_some usage.
Removed inadvertent inclusion of Cargo.lock.in

Provide values to any of the below to override the defaults.

To use a Suricata-Verify or Suricata-Update pull request,
link to the pull request in the respective _BRANCH variable.
Leave unused overrides blank or remove.

SV_REPO=
SV_BRANCH=OISF/suricata-verify#2749
SU_REPO=
SU_BRANCH=

Issue: 7672 The subslice transform creates a slice of the input buffer. Specify the subslice desired -- nbytes and truncate are optional: subslice: offset <,nbytes> <,truncate> offset: Specifies the starting offset for the new subslice. When negative, expresses how far from the end of the input buffer to begin. When nbytes is *not* specified, start must be > 0. nbytes: Specifies the size of the subslice. When negative, specifies the byte count preceding the offset to include. Nbytes must be > 0. When nbytes is not specified, the size of the subslice will be the size of the input buffer - offset. truncate: Specify behavior when offset + nbytes exceeds buffer length. When present, trims nbytes such that offset + nbytes equals buffer length. When not present, an empty buffer is produced. Examples: subslice: 1; - The subslice will be a copy of the input buffer but omits the input buffer's first byte "This is Suricata" -> "his is Suricata" subslice: 0, 13; - The slice is created from the first 13 bytes of the input buffer "This is Suricata" -> "This is Suric" subslice: 10, -5; - The subslice is created starting at offset 10 and continues to 5 bytes before the end of the input buffer "This is Suricata" -> "r" subslice: -3; - The subslice will be the last 3 bytes of the input buffer. "This is Suricata" -> "ata"

Add documentation for the subslice transform. Issue: 7672

codecov · 2026-01-17T14:51:00Z

Codecov Report

❌ Patch coverage is 96.11231% with 18 lines in your changes missing coverage. Please review.
✅ Project coverage is 82.37%. Comparing base (c333b28) to head (1be40af).
⚠️ Report is 33 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #14643      +/-   ##
==========================================
+ Coverage   82.11%   82.37%   +0.25%     
==========================================
  Files        1011     1012       +1     
  Lines      262812   267341    +4529     
==========================================
+ Hits       215812   220214    +4402     
- Misses      47000    47127     +127

Flag	Coverage Δ
fuzzcorpus	`60.68% <10.59%> (+0.49%)`	⬆️
livemode	`18.69% <10.59%> (-0.02%)`	⬇️
pcap	`45.17% <10.59%> (+0.57%)`	⬆️
suricata-verify	`65.61% <81.33%> (+0.33%)`	⬆️
unittests	`59.25% <87.22%> (-0.02%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

suricata-qa · 2026-01-17T16:20:02Z

Information: QA ran without warnings.

Pipeline = 29172

suricata-qa · 2026-01-27T19:20:02Z

Information: QA ran without warnings.

Pipeline = 29301

catenacyber

Thanks for the work,

CI : ✅
Code : looking now
Commits segmentation : I would squash but ok
Commit messages : nice
Git ID set : looks fine for me
CLA : you already contributed
Doc update : cool
Redmine ticket : ok
Rustfmt : no rust
Tests : left some comments on SV PR
Dependencies added: none

catenacyber · 2026-01-29T09:24:30Z

doc/userguide/rules/transforms.rst

+    than the input buffer size. When specified, the result will
+    be trimmed as though ``offset + nbyfes == buffer_length``. When
+    not specified [DEFAULT], an empty buffer will be produced on
+    which ``bsize:0`` will match. [OPTIONAL]


Can you explicit more the behavior of truncate when we have negative values ?

Will add discussion.

catenacyber · 2026-01-29T09:25:30Z

suricata.yaml.in

+# The default is to truncate (on). Set to off to not truncate and produce an
+# empty buffer (bsize:0 will match).
+subslice:
+  truncate: on


We do not need this anymore, right ?

Correct. Will remove.

catenacyber · 2026-01-29T09:26:26Z

rust/src/detect/transforms/subslice.rs

+                truncate: true,
+            })
+        }
+        _ => None,


Could you log a friendly error ?

catenacyber · 2026-01-29T09:28:31Z

rust/src/detect/transforms/subslice.rs

+
+    // copy result into output
+    let len = slice.len();
+    output[..len].copy_from_slice(slice);


Does this work in-place ? If input and output are the same pointer/buffer ?

Will research.

catenacyber · 2026-01-29T09:29:19Z

rust/src/detect/transforms/subslice.rs

+    let len = data.len() as isize;
+
+    // Reject impossible offsets
+    if ctx.offset.abs() > len {


even if ctx.truncate ?

This condition catches an offset value (+ or -) that exceeds the length of the buffer.

Suppose the buffer is "This is Suricata" (length 16 chars)

subslice: -17, -3, truncate

Subslice begins before the buffer (does this make sense?)

Subslice terminates 3 chars from the end
Should the transform treat this as though subslice: 0, -3 because truncate was used?

Suppose the buffer is "This is Suricata" (length 16 chars)

I would expect subslice: -17, -truncate to give me the full buffer. Truncate goes both ways : end and beginning
Do you expect differently ?

agreed -- i'll update things.

catenacyber

See inline like

Correct. Will remove.

jlucovsky · 2026-02-04T15:32:59Z

Continued in #14751

jlucovsky added 2 commits January 17, 2026 08:44

doc/subslice: Document the subslice transform

1be40af

Add documentation for the subslice transform. Issue: 7672

jlucovsky requested review from a team, jasonish, jufajardini and victorjulien as code owners January 17, 2026 13:53

jlucovsky mentioned this pull request Jan 17, 2026

transform/subslice: Add subslice transform #14625

Closed

jlucovsky mentioned this pull request Jan 21, 2026

detect/byte_jump: Support bitmask value #14666

Closed

jlucovsky closed this Jan 21, 2026

jlucovsky reopened this Jan 27, 2026

catenacyber reviewed Jan 29, 2026

View reviewed changes

catenacyber requested changes Feb 2, 2026

View reviewed changes

jlucovsky mentioned this pull request Feb 4, 2026

transform/subslice: Add subslice transform #14751

Closed

jlucovsky closed this Feb 4, 2026

Conversation

jlucovsky commented Jan 17, 2026

Provide values to any of the below to override the defaults.

Uh oh!

codecov bot commented Jan 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

suricata-qa commented Jan 17, 2026

Uh oh!

suricata-qa commented Jan 27, 2026

Uh oh!

catenacyber left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

catenacyber left a comment

Choose a reason for hiding this comment

Uh oh!

jlucovsky commented Feb 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

codecov bot commented Jan 17, 2026 •

edited

Loading