doc: move more examples to container:: example-rule

Ticket: 8372 And fix another bad rule
4 months ago · e65643909a
parent 72e13c9774
commit e65643909a
7 changed files with 66 additions and 52 deletions
--- a/doc/userguide/rules/dhcp-keywords.rst
+++ b/doc/userguide/rules/dhcp-keywords.rst
@ -18,7 +18,7 @@ The time can be matched exactly, or compared using the _op_ setting::
 dhcp.leasetime:<3   # smaller than 3
 dhcp.leasetime:>=2  # greater or equal than 2

-Signature example::
+.. container:: example-rule

 alert dhcp any any -> any any (msg:"small DHCP lease time (<3)"; dhcp.leasetime:<3; sid:1; rev:1;)

@ -39,7 +39,7 @@ The time can be matched exactly, or compared using the _op_ setting::
 dhcp.rebinding_time:<3   # smaller than 3
 dhcp.rebinding_time:>=2  # greater or equal than 2

-Signature example::
+.. container:: example-rule

 alert dhcp any any -> any any (msg:"small DHCP rebinding time (<3)"; dhcp.rebinding_time:<3; sid:1; rev:1;)

@ -60,6 +60,6 @@ The time can be matched exactly, or compared using the _op_ setting::
 dhcp.renewal_time:<3   # smaller than 3
 dhcp.renewal_time:>=2  # greater or equal than 2

-Signature example::
+.. container:: example-rule

 alert dhcp any any -> any any (msg:"small DHCP renewal time (<3)"; dhcp.renewal_time:<3; sid:1; rev:1;)
--- a/doc/userguide/rules/flow-keywords.rst
+++ b/doc/userguide/rules/flow-keywords.rst
@ -315,9 +315,9 @@ The time can be matched exactly, or compared using the _op_ setting::
 flow.age:<3   # smaller than 3 seconds
 flow.age:>=2  # greater or equal than 2 seconds

-Signature example::
+.. container:: example-rule

- alert tcp any any -> any any (msg:"Flow longer than one hour"; flow.age:>3600; flowbits: isnotset, onehourflow; flowbits: onehourflow, name; sid:1; rev:1;)
+ alert tcp any any -> any any (msg:"Flow longer than one hour"; flow.age:>3600; flowbits: isnotset, onehourflow; flowbits: set, onehourflow; sid:1; rev:1;)

 In this example, we combine `flow.age` and `flowbits` to get an alert on the first packet after the flow's age is older than one hour.

@ -348,7 +348,7 @@ The number of packets can be matched exactly, or compared using the _op_ setting
 flow.pkts:toserver,<3   # smaller than 3
 flow.pkts:either,>=2  # greater than or equal to 2

-Signature example::
+.. container:: example-rule

 alert ip any any -> any any (msg:"Flow has 20 packets in toclient dir"; flow.pkts:toclient,20; sid:1;)

@ -383,7 +383,7 @@ The number of bytes can be matched exactly, or compared using the _op_ setting::
 flow.bytes:toserver,<3   # smaller than 3
 flow.bytes:either,>=2  # greater than or equal to 2

-Signature example::
+.. container:: example-rule

 alert ip any any -> any any (msg:"Flow has less than 2000 bytes in toserver dir"; flow.bytes:toserver,<2000; sid:1;)

@ -413,7 +413,7 @@ Syntax::

 flow.elephant:<direction>

-Signature example::
+.. container:: example-rule

 alert tcp any any -> any any (msg:"Flow is elephant in toserver dir"; flow.elephant:toserver; sid:1;)

--- a/doc/userguide/rules/kerberos-keywords.rst
+++ b/doc/userguide/rules/kerberos-keywords.rst
@ -46,7 +46,7 @@ Syntax::

 krb5_cname; content:"name";

-Signature example::
+.. container:: example-rule

 alert krb5 any any -> any any (msg:"Kerberos 5 des server name"; krb5_cname; content:"des"; sid:4; rev:1;)

@ -71,7 +71,7 @@ Syntax::

 krb5_sname; content:"name";

-Signature example::
+.. container:: example-rule

 alert krb5 any any -> any any (msg:"Kerberos 5 krbtgt server name"; krb5_sname; content:"krbtgt"; sid:5; rev:1;)

@ -92,7 +92,7 @@ Syntax::

 krb5_err_code:<number>

-Signature example::
+.. container:: example-rule

 alert krb5 any any -> any any (msg:"Kerberos 5 error C_PRINCIPAL_UNKNOWN"; krb5_err_code:6; sid:6; rev:1;)

@ -107,7 +107,7 @@ Syntax::

 app-layer-event:krb5.weak_encryption

-Signature example::
+.. container:: example-rule

 alert krb5 any any -> any any (msg:"SURICATA Kerberos 5 weak encryption parameters"; flow:to_client; app-layer-event:krb5.weak_encryption; classtype:protocol-command-decode; sid:2226001; rev:1;)

@ -120,7 +120,7 @@ Syntax::

 app-layer-event:krb5.malformed_data

-Signature example::
+.. container:: example-rule

 alert krb5 any any -> any any (msg:"SURICATA Kerberos 5 malformed request data"; flow:to_server; app-layer-event:krb5.malformed_data; classtype:protocol-command-decode; sid:2226000; rev:1;)

@ -135,8 +135,14 @@ Syntax::

 krb5.ticket_encryption: (!)"weak" or (space or comma)-separated list of integer or string values for an encryption type

-Signature example::
+.. container:: example-rule

 alert krb5 any any -> any any (krb5.ticket_encryption: weak; sid:1;)
+
+.. container:: example-rule
+
 alert krb5 any any -> any any (krb5.ticket_encryption: 23; sid:2;)
+
+.. container:: example-rule
+
 alert krb5 any any -> any any (krb5.ticket_encryption: rc4-hmac,rc4-hmac-exp; sid:3;)
--- a/doc/userguide/rules/smtp-keywords.rst
+++ b/doc/userguide/rules/smtp-keywords.rst
@ -30,7 +30,7 @@ Syntax::

 smtp.helo; content:"localhost";

-Signature example::
+.. container:: example-rule

 alert smtp any any -> any any (msg:"SMTP helo localhost"; smtp.helo; content:"localhost"; sid:2; rev:1;)

@ -49,7 +49,7 @@ Syntax::

 smtp.mail_from; content:"spam";

-Signature example::
+.. container:: example-rule

 alert smtp any any -> any any (msg:"SMTP mail from spam"; smtp.mail_from; content:"spam"; sid:2; rev:1;)

@ -68,7 +68,7 @@ Syntax::

 smtp.rcpt_to; content:"sensitive@target";

-Signature example::
+.. container:: example-rule

 alert smtp any any -> any any (msg:"SMTP rcpt to sensitive"; smtp.rcpt_to; content:"sensitive@target"; sid:2; rev:1;)

--- a/doc/userguide/rules/snmp-keywords.rst
+++ b/doc/userguide/rules/snmp-keywords.rst
@ -18,7 +18,7 @@ The version can be matched exactly, or compared using the _op_ setting::
 snmp.version:<3   # smaller than 3
 snmp.version:>=2  # greater or equal than 2

-Signature example::
+.. container:: example-rule

 alert snmp any any -> any any (msg:"old SNMP version (<3)"; snmp.version:<3; sid:1; rev:1;)

@ -38,7 +38,7 @@ Syntax::

 snmp.community; content:"private";

-Signature example::
+.. container:: example-rule

 alert snmp any any -> any any (msg:"SNMP community private"; snmp.community; content:"private"; sid:2; rev:1;)

@ -58,7 +58,7 @@ Syntax::

 snmp.usm; content:"admin";

-Signature example::
+.. container:: example-rule

 alert snmp any any -> any any (msg:"SNMP usm admin"; snmp.usm; content:"admin"; sid:2; rev:1;)

@ -93,7 +93,7 @@ Syntax::

 snmp.pdu_type:(mode) <number or string>

-Signature example::
+.. container:: example-rule

 alert snmp any any -> any any (msg:"SNMP response"; snmp.pdu_type:2; sid:3; rev:1;)

--- a/doc/userguide/rules/ssh-keywords.rst
+++ b/doc/userguide/rules/ssh-keywords.rst
@ -90,7 +90,7 @@ ssh.hassh

 Match on hassh (md5 of hassh algorithms of client).

-Example::
+.. container:: example-rule

  alert ssh any any -> any any (msg:"match hassh"; \
      ssh.hassh; content:"ec7378c1a92f5a8dde7e8b7a1ddf33d1";\
@ -105,7 +105,7 @@ ssh.hassh.string

 Match on Hassh string (hassh algorithms of client).

-Example::
+.. container:: example-rule

  alert ssh any any -> any any (msg:"match hassh-string"; \
      ssh.hassh.string; content:"none,zlib@openssh.com,zlib"; \
@ -120,7 +120,7 @@ ssh.hassh.server

 Match on hassh (md5 of hassh algorithms of server).

-Example::
+.. container:: example-rule

  alert ssh any any -> any any (msg:"match SSH hash-server"; \
      ssh.hassh.server; content:"b12d2871a1189eff20364cf5333619ee"; \
@ -135,7 +135,7 @@ ssh.hassh.server.string

 Match on hassh string (hassh algorithms of server).

-Example::
+.. container:: example-rule

  alert ssh any any -> any any (msg:"match SSH hash-server-string"; \
      ssh.hassh.server.string; content:"umac-64-etm@openssh.com,umac-128-etm@openssh.com"; \
--- a/doc/userguide/rules/tls-keywords.rst
+++ b/doc/userguide/rules/tls-keywords.rst
@ -72,10 +72,10 @@ tls.cert_serial

 Match on the serial number in a certificate.

-Example::
+.. container:: example-rule

-  alert tls any any -> any any (msg:"match cert serial"; \
-    tls.cert_serial; content:"5C:19:B7:B1:32:3B:1C:A1"; sid:200012;)
+  alert tls any any -> any any (msg:"match cert serial";
+  tls.cert_serial; content:"5C:19:B7:B1:32:3B:1C:A1"; sid:200012;)

 ``tls.cert_serial`` is a 'sticky buffer'.

@ -90,12 +90,12 @@ tls.cert_fingerprint

 Match on the SHA-1 fingerprint of the certificate.

-Example::
+.. container:: example-rule

-  alert tls any any -> any any (msg:"match cert fingerprint"; \
-    tls.cert_fingerprint; \
-    content:"4a:a3:66:76:82:cb:6b:23:bb:c3:58:47:23:a4:63:a7:78:a4:a1:18"; \
-    sid:200023;)
+  alert tls any any -> any any (msg:"match cert fingerprint";
+  tls.cert_fingerprint;
+  content:"4a:a3:66:76:82:cb:6b:23:bb:c3:58:47:23:a4:63:a7:78:a4:a1:18";
+  sid:200023;)

 ``tls.cert_fingerprint`` is a 'sticky buffer'.

@ -143,7 +143,7 @@ tls_cert_notbefore

 Match on the NotBefore field in a certificate.

-Example::
+.. container:: example-rule

  alert tls any any -> any any (msg:"match cert NotBefore"; \
    tls_cert_notbefore:1998-05-01<>2008-05-01; sid:200005;)
@ -153,7 +153,7 @@ tls_cert_notafter

 Match on the NotAfter field in a certificate.

-Example::
+.. container:: example-rule

  alert tls any any -> any any (msg:"match cert NotAfter"; \
    tls_cert_notafter:>2015; sid:200006;)
@ -190,10 +190,10 @@ tls.certs

 Do a "raw" match on each of the certificates in the TLS certificate chain.

-Example::
+.. container:: example-rule

  alert tls any any -> any any (msg:"match bytes in TLS cert"; tls.certs; \
-    content:"|06 09 2a 86|"; sid:200070;)
+    content:"\|06 09 2a 86\|"; sid:200070;)

 ``tls.certs`` is a 'sticky buffer'.

@ -225,14 +225,14 @@ Match version of SSL/TLS record.

 Supported values "sslv2", "sslv3", "tls1.0", "tls1.1", "tls1.2", "tls1.3"

-Example::
+.. container:: example-rule

  alert tls any any -> any any (msg:"match TLSv1.2"; \
    ssl_version:tls1.2; sid:200030;)

 It is also possible to match on several versions at the same time.

-Example::
+.. container:: example-rule

  alert tls any any -> any any (msg:"match SSLv2 and SSLv3"; \
    ssl_version:sslv2,sslv3; sid:200031;)
@ -275,10 +275,10 @@ tls.random

 Matches on the 32 bytes of the TLS random field from the client hello or server hello records.

-Example::
+.. container:: example-rule

  alert tls any any -> any any (msg:"TLS random test"; \
-    tls.random; content:"|9b ce 7a 5e 57 5d 77 02 07 c2 9d be 24 01 cc f0 5d cd e1 d2 a5 86 9c 4a 3e ee 38 db 55 1a d9 bc|"; sid: 200074;)
+    tls.random; content:"\|9b ce 7a 5e 57 5d 77 02 07 c2 9d be 24 01 cc f0 5d cd e1 d2 a5 86 9c 4a 3e ee 38 db 55 1a d9 bc\|"; sid: 200074;)

 ``tls.random`` is a sticky buffer.

@ -287,10 +287,10 @@ tls.random_time

 Matches on the first 4 bytes of the TLS random field from the client hello or server hello records.

-Example::
+.. container:: example-rule

  alert tls any any -> any any (msg:"TLS random_time test"; \
-    tls.random_time; content:"|9b ce 7a 5e|"; sid: 200075;)
+    tls.random_time; content:"\|9b ce 7a 5e\|"; sid: 200075;)

 ``tls.random_time`` is a sticky buffer.

@ -299,10 +299,10 @@ tls.random_bytes

 Matches on the last 28 bytes of the TLS random field from the client hello or server hello records.

-Example::
+.. container:: example-rule

  alert tls any any -> any any (msg:"TLS random_bytes test"; \
-    tls.random_bytes; content:"|57 5d 77 02 07 c2 9d be 24 01 cc f0 5d cd e1 d2 a5 86 9c 4a 3e ee 38 db 55 1a d9 bc|"; sid: 200076;)
+    tls.random_bytes; content:"\|57 5d 77 02 07 c2 9d be 24 01 cc f0 5d cd e1 d2 a5 86 9c 4a 3e ee 38 db 55 1a d9 bc\|"; sid: 200076;)

 ``tls.random_bytes`` is a sticky buffer.

@ -315,29 +315,37 @@ tls.cert_chain_len uses an :ref:`unsigned 32-bit integer <rules-integer-keywords

 tls.cert_chain_len supports `<, >, <>, !` and using an exact value.

-Example::
+.. container:: example-rule

  alert tls any any -> any any (msg:"cert chain exact value"; \
- tls.cert_chain_len:1; classtype:misc-activity; sid:1; rev:1;)
+  tls.cert_chain_len:1; classtype:misc-activity; sid:1; rev:1;)
+
+.. container:: example-rule

  alert tls any any -> any any (msg:"cert chain less than value"; \
- tls.cert_chain_len:<2; classtype:misc-activity; sid:2; rev:1;)
+  tls.cert_chain_len:<2; classtype:misc-activity; sid:2; rev:1;)
+
+.. container:: example-rule

  alert tls any any -> any any (msg:"cert chain greater than value"; \
- tls.cert_chain_len:>0; classtype:misc-activity; sid:2; rev:1;)
+  tls.cert_chain_len:>0; classtype:misc-activity; sid:2; rev:1;)
+
+.. container:: example-rule

  alert tls any any -> any any (msg:"cert chain greater than less than value";\
- tls.cert_chain_len:0<>2; classtype:misc-activity; sid:3; rev:1;)
+  tls.cert_chain_len:0<>2; classtype:misc-activity; sid:3; rev:1;)
+
+.. container:: example-rule

  alert tls any any -> any any (msg:"cert chain not value"; \
- tls.cert_chain_len:!2; classtype:misc-activity; sid:4; rev:1;)
+  tls.cert_chain_len:!2; classtype:misc-activity; sid:4; rev:1;)

 tls.alpn
 --------

 Matches on the ALPN buffers.

-Example::
+.. container:: example-rule

  alert tls any any -> any any (msg:"TLS ALPN test"; \
    tls.alpn; content:"http/1.1"; sid:1;)