From 1bf7ded224bacace8b7779d76a738c8976e55f58 Mon Sep 17 00:00:00 2001 From: David Wharton Date: Mon, 20 Feb 2017 08:29:59 -0500 Subject: [PATCH] doc: specify buffers that can be used for fast_pattern Updated notes on the following buffers indicating that they can be used for fast_pattern: tls_cert_subject tls_cert_issuer tls_sni --- doc/userguide/rules/tls-keywords.rst | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/doc/userguide/rules/tls-keywords.rst b/doc/userguide/rules/tls-keywords.rst index 3f371f571b..e8220c6487 100644 --- a/doc/userguide/rules/tls-keywords.rst +++ b/doc/userguide/rules/tls-keywords.rst @@ -15,6 +15,8 @@ Examples:: ``tls_cert_subject`` is a 'Sticky buffer'. +``tls_cert_subject`` can be used as ``fast_pattern``. + tls_cert_issuer --------------- @@ -27,6 +29,8 @@ Examples:: ``tls_cert_issuer`` is a 'Sticky buffer'. +``tls_cert_issuer`` can be used as ``fast_pattern``. + tls_sni ------- @@ -39,6 +43,8 @@ Examples:: ``tls_sni`` is a 'Sticky buffer'. +``tls_sni`` can be used as ``fast_pattern``. + tls_cert_notbefore ------------------