doc: document that that ;, \, " need to be escaped in rules

pull/2428/head
Jason Ish 9 years ago committed by Victor Julien
parent a67c31d4e1
commit 0c6c9784a2

@ -172,6 +172,12 @@ There are specific settings for:
* payloads * payloads
* flows * flows
.. note:: The characters ``;`` and ``"`` have special meaning in the
Suricata rule language and must be escaped when used in a
rule option value. For example::
msg:"Message with semicolon\;";
For more information about these settings, you can click on the For more information about these settings, you can click on the
following headlines: following headlines:

@ -26,10 +26,11 @@ It is a convention that msg is always the first keyword of a signature.
Another example of msg in a signature: Another example of msg in a signature:
.. image:: meta/msg.png
In this example the red, bold-faced part is the msg. In this example the red, bold-faced part is the msg.
.. note:: The following characters must be escaped inside the msg:
``;`` ``\`` ``"``
Sid (signature id) Sid (signature id)
------------------ ------------------

@ -93,6 +93,9 @@ For example::
You see ``content:!”Firefox/3.6.13”;``. This means an alert will be You see ``content:!”Firefox/3.6.13”;``. This means an alert will be
generated if the the used version of Firefox is not 3.6.13. generated if the the used version of Firefox is not 3.6.13.
.. note:: The following characters must be escaped inside the content:
``;`` ``\`` ``"``
Nocase Nocase
------ ------

@ -54,6 +54,9 @@ qualities of pcre as well. These are:
* ``E``: Ignores newline characters at the end of the buffer/payload. * ``E``: Ignores newline characters at the end of the buffer/payload.
* ``G``: Inverts the greediness. * ``G``: Inverts the greediness.
.. note:: The following characters must be escaped inside the content:
``;`` ``\`` ``"``
Suricata's modifiers Suricata's modifiers
~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~

Loading…
Cancel
Save