From: David Wharton Date: Mon, 20 Feb 2017 13:29:59 +0000 (-0500) Subject: doc: specify buffers that can be used for fast_pattern X-Git-Tag: suricata-4.0.0-beta1~288 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1bf7ded224bacace8b7779d76a738c8976e55f58;p=thirdparty%2Fsuricata.git doc: specify buffers that can be used for fast_pattern Updated notes on the following buffers indicating that they can be used for fast_pattern: tls_cert_subject tls_cert_issuer tls_sni --- diff --git a/doc/userguide/rules/tls-keywords.rst b/doc/userguide/rules/tls-keywords.rst index 3f371f571b..e8220c6487 100644 --- a/doc/userguide/rules/tls-keywords.rst +++ b/doc/userguide/rules/tls-keywords.rst @@ -15,6 +15,8 @@ Examples:: ``tls_cert_subject`` is a 'Sticky buffer'. +``tls_cert_subject`` can be used as ``fast_pattern``. + tls_cert_issuer --------------- @@ -27,6 +29,8 @@ Examples:: ``tls_cert_issuer`` is a 'Sticky buffer'. +``tls_cert_issuer`` can be used as ``fast_pattern``. + tls_sni ------- @@ -39,6 +43,8 @@ Examples:: ``tls_sni`` is a 'Sticky buffer'. +``tls_sni`` can be used as ``fast_pattern``. + tls_cert_notbefore ------------------