]> git.ipfire.org Git - thirdparty/suricata.git/commitdiff
doc: update doc for HTTP file.data to server
authorPhilippe Antoine <pantoine@oisf.net>
Thu, 10 Nov 2022 12:17:49 +0000 (13:17 +0100)
committerVictor Julien <vjulien@oisf.net>
Thu, 10 Nov 2022 13:42:44 +0000 (15:42 +0200)
Ticket: #4144

Completes e587f6792afdb863cbe57e972bd395443f23d9d9

doc/userguide/rules/http-keywords.rst

index ba5227c37c10abfe5d4ebd5dda7e6dafd56042e0..e583a32e11f797e9e0550b5f7f901400bb65ef26 100644 (file)
@@ -43,6 +43,7 @@ http.accept_lang               http_accept_lang (*)     Request
 http.accept_enc                http_accept_enc (*)      Request
 http.referer                   http_referer (*)         Request
 http.connection                http_connection (*)      Request
+file.data                      file_data (*)            Both
 http.content_type              http_content_type (*)    Both
 http.content_len               http_content_len (*)     Both
 http.start                     http_start (*)           Both
@@ -66,7 +67,7 @@ http.cookie                    http_cookie              Both
 http.response_body             http_server_body         Response
 http.server                    N/A                      Response
 http.location                  N/A                      Response
-file.data                      file_data (*)            Response
+file.data                      file_data (*)            Both
 http.content_type              http_content_type (*)    Both
 http.content_len               http_content_len (*)     Both
 http.start                     http_start (*)           Both
@@ -728,6 +729,8 @@ file.data
 
 With ``file.data``, the HTTP response body is inspected, just like
 with ``http.response_body``. The ``file.data`` keyword is a sticky buffer.
+``file.data`` also works for HTTP request body and can be used in other
+protocols than HTTP1.
 
 Example::