Suricata

Define how multi-hook rules work in firewall mode.

accept:?? http:??? any any -> any any (http.uri; content:"/index.html"; http.user_agent; content:"Mozilla"; sid:1;)

As in the current single hook rules we specify the explicit hook, one question is how to specify the hook or hooks, and what should happen to the hooks in between (if any).

Should also define what actions are supported, like does accept:hook make sense for multi-hook rules.