doc/ssh: document hooks

Ticket: 7607

doc/userguide/firewall/firewall-design.rst

@@ -140,6 +140,11 @@ Response (``to_client``) side:
 * ``server_handshake_done``
 * ``server_finished``
 
+ssh
+^^^
+
+Available states are listed in :ref:`ssh-hooks`.
+
 Firewall pipeline
 ~~~~~~~~~~~~~~~~~
 

doc/userguide/lua/libs/ssh.rst

@@ -6,6 +6,14 @@ SSH transaction details are exposes to Lua scripts with the
 
   local ssh = require("suricata.ssh")
 
+For use in rule matching, the rule must **hook** into a SSH
+transaction state. Available states are listed in :ref:`ssh-hooks`.
+For example:
+
+.. container:: example-rule
+
+  alert ssh::example-rule-emphasis:`response_banner_done` any any -> any any (...
+
 Setup
 ^^^^^
 

doc/userguide/rules/ssh-keywords.rst

@@ -5,6 +5,26 @@ SSH Keywords
 Suricata has several rule keywords to match on different elements of SSH
 connections.
 
+.. _ssh-hooks:
+
+Hooks
+-----
+
+The available hooks for SSH are:
+
+Request (``to_server``) side:
+
+* ``request_in_progress``
+* ``request_banner_wait_eol``
+* ``request_banner_done``
+* ``request_finished``
+
+Response (``to_client``) side:
+
+* ``response_in_progress``
+* ``response_banner_wait_eol``
+* ``response_banner_done``
+* ``response_finished``
 
 Frames
 ------