From: Eric Leblond <eric@regit.org>
Date: Wed, 31 Jul 2019 22:02:30 +0000 (+0200)
Subject: doc: fix geoip syntax
X-Git-Tag: suricata-5.0.0-rc1~152
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c01cadbade090bf99c6470b5be0b4b14fa71446a;p=thirdparty%2Fsuricata.git

doc: fix geoip syntax

Spaces are not allowed before country code.
---

diff --git a/doc/userguide/rules/header-keywords.rst b/doc/userguide/rules/header-keywords.rst
index bae2865876..d516fa2152 100644
--- a/doc/userguide/rules/header-keywords.rst
+++ b/doc/userguide/rules/header-keywords.rst
@@ -142,11 +142,11 @@ API of MaxMind.
 
 The syntax of geoip::
 
-  geoip: src, RU;
-  geoip: both, CN, RU;
-  geoip: dst, CN, RU, IR;
-  geoip: both, US, CA, UK;
-  geoip: any, CN, IR;
+  geoip: src,RU;
+  geoip: both,CN,RU;
+  geoip: dst,CN,RU,IR;
+  geoip: both,US,CA,UK;
+  geoip: any,CN,IR;
 
 So, you can see you can use the following to make clear on which
 direction you would like to match::