rules: SID allocation range is now documented in README.md

directly in the repo, and not in an external wiki

rules/README.md

@@ -1,5 +1,7 @@
 # Suricata Reserved SID Allocations
 
+See https://sidallocation.org/ for more information.
+
 Unless otherwise noted, each component or protocol is allocated 1000
 signature IDs.
 

rules/app-layer-events.rules

@@ -1,6 +1,6 @@
 # App layer event rules
 #
-# SID's fall in the 2260000+ range. See http://doc.emergingthreats.net/bin/view/Main/SidAllocation
+# SID's fall in the 2260000+ range. See rules/README.md
 #
 # These sigs fire at most once per connection.
 #

rules/bittorrent-events.rules

@@ -1,6 +1,6 @@
 # BitTorrent DHT app layer event rules
 #
-# SID's fall in the 2243000+ range. See https://redmine.openinfosecfoundation.org/projects/suricata/wiki/AppLayer
+# SID's fall in the 2243000+ range. See rules/README.md
 #
 # These sigs fire at most once per connection.
 #

rules/decoder-events.rules

@@ -1,5 +1,6 @@
 # Decoder event signatures for Suricata.
-# SID's fall in the 2200000+ range. See http://doc.emergingthreats.net/bin/view/Main/SidAllocation
+# SID's fall in the 2200000+ range. See rules/README.md
+
 alert pkthdr any any -> any any (msg:"SURICATA IPv4 packet too small"; decode-event:ipv4.pkt_too_small; classtype:protocol-command-decode; sid:2200000; rev:2;)
 alert pkthdr any any -> any any (msg:"SURICATA IPv4 header size too small"; decode-event:ipv4.hlen_too_small; classtype:protocol-command-decode; sid:2200001; rev:2;)
 alert pkthdr any any -> any any (msg:"SURICATA IPv4 total length smaller than header size"; decode-event:ipv4.iplen_smaller_than_hlen; classtype:protocol-command-decode; sid:2200002; rev:2;)

rules/dhcp-events.rules

@@ -1,6 +1,6 @@
 # DHCP app-layer event rules.  See
 #
-# https://redmine.openinfosecfoundation.org/projects/suricata/wiki/AppLayer
+# rules/README.md
 # for SID allocation.
 
 alert dhcp any any -> any any (msg:"SURICATA DHCP malformed options"; app-layer-event:dhcp.malformed_options; classtype:protocol-command-decode; sid:2227000; rev:1;)

rules/dnp3-events.rules

@@ -1,7 +1,6 @@
 # DNP3 application decoder event rules.
 #
-# This SIDs fall in the 2270000+ range. See:
-#    http://doc.emergingthreats.net/bin/view/Main/SidAllocation
+# This SIDs fall in the 2270000+ range. See rules/README.md
 
 # Flooded.
 alert dnp3 any any -> any any (msg:"SURICATA DNP3 Request flood detected"; \

rules/enip-events.rules

@@ -1,6 +1,6 @@
 # ENIP app layer event rules
 #
-# SID's fall in the 2223000+ range. See https://redmine.openinfosecfoundation.org/projects/suricata/wiki/AppLayer
+# SID's fall in the 2223000+ range. See rules/README.md
 #
 # These sigs fire at most once per connection.
 #

rules/http-events.rules

@@ -1,6 +1,6 @@
 # HTTP event rules
 #
-# SID's fall in the 2221000+ range. See http://doc.emergingthreats.net/bin/view/Main/SidAllocation
+# SID's fall in the 2221000+ range. See rules/README.md
 #
 # These sigs fire at most once per HTTP transaction.
 #

rules/http2-events.rules

@@ -1,6 +1,6 @@
 # HTTP2 app layer event rules
 #
-# SID's fall in the 2290000+ range. See https://redmine.openinfosecfoundation.org/projects/suricata/wiki/AppLayer
+# SID's fall in the 2290000+ range. See rules/README.md
 #
 # These sigs fire at most once per connection.
 #

rules/ipsec-events.rules

@@ -1,6 +1,6 @@
 # IPsec app layer event rules
 #
-# SID's fall in the 2224000+ range. See https://redmine.openinfosecfoundation.org/projects/suricata/wiki/AppLayer
+# SID's fall in the 2224000+ range. See rules/README.md
 #
 # These sigs fire at most once per connection.
 #

rules/kerberos-events.rules

@@ -1,6 +1,6 @@
 # Kerberos app layer event rules
 #
-# SID's fall in the 2226000+ range. See https://redmine.openinfosecfoundation.org/projects/suricata/wiki/AppLayer
+# SID's fall in the 2226000+ range. See rules/README.md
 #
 # These sigs fire at most once per connection.
 #

rules/mqtt-events.rules

@@ -1,8 +1,6 @@
 # MQTT app-layer event rules.
 #
-# These SIDs fall in the 2228000+ range. See:
-#    http://doc.emergingthreats.net/bin/view/Main/SidAllocation and
-#    https://redmine.openinfosecfoundation.org/projects/suricata/wiki/AppLayer
+# These SIDs fall in the 2228000+ range. See rules/README.md
 
 alert mqtt any any -> any any (msg:"SURICATA MQTT CONNECT not seen before CONNACK"; app-layer-event:mqtt.missing_connect; classtype:protocol-command-decode; sid:2229000; rev:1;)
 alert mqtt any any -> any any (msg:"SURICATA MQTT PUBLISH not seen before PUBACK/PUBREL/PUBREC/PUBCOMP"; app-layer-event:mqtt.missing_publish; classtype:protocol-command-decode; sid:2229001; rev:1;)

rules/nfs-events.rules

@@ -1,6 +1,6 @@
 # NFS app layer event rules
 #
-# SID's fall in the 2223000+ range. See https://redmine.openinfosecfoundation.org/projects/suricata/wiki/AppLayer
+# SID's fall in the 2223000+ range. See rules/README.md
 #
 # These sigs fire at most once per connection.
 #

rules/ntp-events.rules

@@ -1,6 +1,6 @@
 # NTP app layer event rules
 #
-# SID's fall in the 2222000+ range. See https://redmine.openinfosecfoundation.org/projects/suricata/wiki/AppLayer
+# SID's fall in the 2222000+ range. See rules/README.md
 #
 # These sigs fire at most once per connection.
 #

rules/pop3-events.rules

@@ -1,6 +1,6 @@
 # POP3 app-layer event rules
 #
-# SID's fall in the 2236000+ range. See https://redmine.openinfosecfoundation.org/projects/suricata/wiki/AppLayer
+# SID's fall in the 2236000+ range. See rules/README.md
 #
 alert pop3 any any -> any any (msg:"SURICATA POP3 Too many transactions"; app-layer-event:pop3.too_many_transactions; sid:2236000; rev:1;)
 alert pop3 any any -> any any (msg:"SURICATA POP3 Request Too Long"; app-layer-event:pop3.request_too_long; flow:to_server; sid:2236001; rev:1;)

rules/quic-events.rules

@@ -1,8 +1,6 @@
 # QUIC app-layer event rules.
 #
-# These SIDs fall in the 2231000+ range. See:
-#    http://doc.emergingthreats.net/bin/view/Main/SidAllocation and
-#    https://redmine.openinfosecfoundation.org/projects/suricata/wiki/AppLayer
+# These SIDs fall in the 2231000+ range. See rules/README.md
 
 alert quic any any -> any any (msg:"SURICATA QUIC failed decrypt"; app-layer-event:quic.failed_decrypt; classtype:protocol-command-decode; sid:2231000; rev:1;)
 alert quic any any -> any any (msg:"SURICATA QUIC error on data"; app-layer-event:quic.error_on_data; classtype:protocol-command-decode; sid:2231001; rev:1;)

rules/rfb-events.rules

@@ -1,8 +1,6 @@
 # RFB app-layer event rules.
 #
-# These SIDs fall in the 2233000+ range. See:
-#    http://doc.emergingthreats.net/bin/view/Main/SidAllocation and
-#    https://redmine.openinfosecfoundation.org/projects/suricata/wiki/AppLayer
+# These SIDs fall in the 2233000+ range. See rules/README.md
 
 alert rfb any any -> any any (msg:"SURICATA RFB Malformed or unknown message"; app-layer-event:rfb.malformed_message; classtype:protocol-command-decode; sid:2233000; rev:1;)
 alert rfb any any -> any any (msg:"SURICATA RFB Unimplemented security type"; app-layer-event:rfb.unimplemented_security_type; classtype:protocol-command-decode; sid:2233001; rev:1;)

rules/smb-events.rules

@@ -1,6 +1,6 @@
 # SMB app layer event rules
 #
-# SID's fall in the 2225000+ range. See https://redmine.openinfosecfoundation.org/projects/suricata/wiki/AppLayer
+# SID's fall in the 2225000+ range. See rules/README.md
 #
 # These sigs fire at most once per connection.
 #

rules/smtp-events.rules

@@ -1,6 +1,6 @@
 # SMTP event rules
 #
-# SID's fall in the 2220000+ range. See http://doc.emergingthreats.net/bin/view/Main/SidAllocation
+# SID's fall in the 2220000+ range. See rules/README.md
 #
 # These sigs fire at most once per connection.
 #

rules/snmp-events.rules

@@ -1,6 +1,6 @@
 # SNMP app layer event rules
 #
-# SID's fall in the 2238000+ range. See https://redmine.openinfosecfoundation.org/projects/suricata/wiki/AppLayer
+# SID's fall in the 2238000+ range. See rules/README.md
 #
 # These sigs fire at most once per connection.
 #

rules/ssh-events.rules

@@ -1,6 +1,6 @@
 # SSH app layer event rules
 #
-# SID's fall in the 2228000+ range. See https://redmine.openinfosecfoundation.org/projects/suricata/wiki/AppLayer
+# SID's fall in the 2228000+ range. See rules/README.md
 #
 # These sigs fire at most once per connection.
 #

rules/stream-events.rules

@@ -1,6 +1,6 @@
 # Stream events -- rules for matching on TCP stream engine events.
 #
-# SID's fall in the 2210000+ range. See http://doc.emergingthreats.net/bin/view/Main/SidAllocation
+# SID's fall in the 2210000+ range. See rules/README.md
 #
 alert tcp any any -> any any (msg:"SURICATA STREAM 3way handshake with ack in wrong dir"; stream-event:3whs_ack_in_wrong_dir; threshold:type backoff, track by_flow, count 1, multiplier 2; classtype:protocol-command-decode; sid:2210000; rev:3;)
 alert tcp any any -> any any (msg:"SURICATA STREAM 3way handshake async wrong sequence"; stream-event:3whs_async_wrong_seq; threshold:type backoff, track by_flow, count 1, multiplier 2; classtype:protocol-command-decode; sid:2210001; rev:3;)

rules/tls-events.rules

@@ -1,6 +1,6 @@
 # TLS event rules
 #
-# SID's fall in the 2230000+ range. See http://doc.emergingthreats.net/bin/view/Main/SidAllocation
+# SID's fall in the 2230000+ range.
 #
 # These sigs fire at most once per connection.
 #

rules/websocket-events.rules

@@ -1,8 +1,6 @@
 # WebSocket app-layer event rules.
 #
-# These SIDs fall in the 2235000+ range. See:
-#    http://doc.emergingthreats.net/bin/view/Main/SidAllocation and
-#    https://redmine.openinfosecfoundation.org/projects/suricata/wiki/AppLayer
+# These SIDs fall in the 2235000+ range. See rules/README.md
 
 alert websocket any any -> any any (msg:"SURICATA Websocket skipped end of payload"; app-layer-event:websocket.skip_end_of_payload; classtype:protocol-command-decode; sid:2235000; rev:1;)
 alert websocket any any -> any any (msg:"SURICATA Websocket reassembly limit reached"; app-layer-event:websocket.reassembly_limit_reached; classtype:protocol-command-decode; sid:2235001; rev:1;)