Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

backport 6.x: doc: update file.data keyword documentation v1 6563 #9862

Closed
wants to merge 1 commit into from
Closed

backport 6.x: doc: update file.data keyword documentation v1 6563 #9862

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 21 additions & 0 deletions doc/userguide/rules/file-keywords.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,27 @@ Suricata comes with several rule keywords to match on various file
properties. They depend on properly configured
:doc:`../file-extraction/file-extraction`.

file.data
---------

The ``file.data`` sticky buffer matches on contents of files that are
seen in flows that Suricata evaluates. The various payload keywords can
be used (e.g. ``startswith``, ``nocase`` and ``bsize``) with ``file.data``.

Example::

alert smtp any any -> any any (msg:"smtp app layer file.data example"; \
file.data; content:"example file content"; sid:1; rev:1)

alert http any any -> any any (msg:"http app layer file.data example"; \
file.data; content:"example file content"; sid:2; rev:1)

alert tcp any any -> any any (msg:"tcp file.data example"; \
file.data; content:"example file content"; sid:4; rev:1)

**Note** file_data is the legacy notation but can still be used.


file.name
---------

Expand Down
1 change: 1 addition & 0 deletions doc/userguide/rules/http-keywords.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -787,3 +787,4 @@ Notes
pattern '<html' is absent from the first inspected chunk.

- ``file_data`` can also be used with SMTP
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A bit confused wrt why this was left here, but removed from 7 and 8 documentation.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It looks like I missed this part when I was fixing up the cherry-pick conflicts (I also apparently forgot the -x). I can get this fixed up.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see, thanks! I'll leave the decision to Victor in this, but IMHO a fixup works.

- Refer to :doc:`file-keywords` for additional information.
2 changes: 1 addition & 1 deletion src/detect-file-data.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,7 +88,7 @@ void DetectFiledataRegister(void)
sigmatch_table[DETECT_FILE_DATA].name = "file.data";
sigmatch_table[DETECT_FILE_DATA].alias = "file_data";
sigmatch_table[DETECT_FILE_DATA].desc = "make content keywords match on file data";
sigmatch_table[DETECT_FILE_DATA].url = "/rules/http-keywords.html#file-data";
sigmatch_table[DETECT_FILE_DATA].url = "/rules/file-keywords.html#file-data";
sigmatch_table[DETECT_FILE_DATA].Setup = DetectFiledataSetup;
#ifdef UNITTESTS
sigmatch_table[DETECT_FILE_DATA].RegisterTests = DetectFiledataRegisterTests;
Expand Down
Loading