From adb410fa3c92bc57236cccf6b739455765054c46 Mon Sep 17 00:00:00 2001 From: Lukas Sismis Date: Fri, 25 Sep 2026 20:34:34 +0200 Subject: [PATCH] detect/replace: support DPDK IPS mode The replace keyword was only enabled in the NFQ and IPFW runmodes, so in DPDK IPS mode rules with replace only alerted without modifying packets. DPDK packets point directly to the mbuf data, so the modified payload and the recalculated checksums are forwarded as they are. Enable replace for the DPDK runmode when the engine runs in IPS mode. --- doc/userguide/rules/payload-keywords.rst | 3 ++- src/detect-replace.c | 6 ++++++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/doc/userguide/rules/payload-keywords.rst b/doc/userguide/rules/payload-keywords.rst index d6a3c5c40e..60f4133258 100644 --- a/doc/userguide/rules/payload-keywords.rst +++ b/doc/userguide/rules/payload-keywords.rst @@ -898,7 +898,8 @@ Example of the rpc keyword in a rule: replace ------- -The replace content modifier can only be used in IPS. It adjusts +The replace content modifier can only be used in IPS. It is supported +with NFQ, IPFW and DPDK (``copy-mode: ips``). It adjusts network traffic. It changes the content it follows ('abc') into another ('def'), see example: diff --git a/src/detect-replace.c b/src/detect-replace.c index 7fc23e20e2..2b18465a58 100644 --- a/src/detect-replace.c +++ b/src/detect-replace.c @@ -27,6 +27,7 @@ */ #include "suricata-common.h" +#include "suricata.h" #include "runmodes.h" @@ -94,6 +95,11 @@ int DetectReplaceSetup(DetectEngineCtx *de_ctx, Signature *s, const char *replac case RUNMODE_NFQ: case RUNMODE_IPFW: break; + case RUNMODE_DPDK: + if (EngineModeIsIPS()) { + break; + } + // fall through default: SCLogWarning("Can't use 'replace' keyword in non IPS mode: %s", s->sig_str); /* this is a success, having the alert is interesting */