Suricata

Newly introduced keyword follow a different logic compared to previous one. For example, if we take http_user_agent, it applies on content placed before it. This is the contrary for a keyword like tls_sni. But the information provided by list-keywords are the same:

= tls_sni =
Description: content modifier to match specifically and only on the TLS
SNI buffer
Features: No option,payload inspecting keyword
= http_user_agent =
Description: content modifier to match only on the HTTP User-Agent
header
Features: No option,payload inspecting keyword

Consequence is that user has not enough information to know how to use it.

At minimum I propose we use context setter instead of content modifier