Feature #196 » 0002-Updating-the-http-modifers-that-cannot-be-loaded-wit.patch
| src/detect-http-cookie.c | ||
|---|---|---|
|
#include "flow-util.h"
|
||
|
#include "util-debug.h"
|
||
|
#include "util-error.h"
|
||
|
#include "util-unittest.h"
|
||
|
#include "util-spm.h"
|
||
|
#include "util-print.h"
|
||
| ... | ... | |
|
SigMatch *pm = DetectContentGetLastPattern(s->pmatch_tail);
|
||
|
if (pm == NULL) {
|
||
|
SCLogWarning(SC_ERR_INVALID_SIGNATURE, "fast_pattern found inside "
|
||
|
SCLogWarning(SC_ERR_INVALID_SIGNATURE, "http_cookie found inside "
|
||
|
"the rule, without a content context. Please use a "
|
||
|
"content keyword before using http_cookie");
|
||
|
return -1;
|
||
| ... | ... | |
|
/* http_cookie should not be used with the fast_pattern rule */
|
||
|
if (((DetectContentData *)pm->ctx)->flags & DETECT_CONTENT_FAST_PATTERN) {
|
||
|
SCLogError(SC_ERR_INVALID_SIGNATURE, "http_cookie rule can not "
|
||
|
"be used with the fast_pattern rule keyword");
|
||
|
return -1;
|
||
|
SCLogWarning(SC_WARN_COMPATIBILITY, "http_cookie rule can not "
|
||
|
"be used with the fast_pattern rule keyword. Unsetting fast_pattern"
|
||
|
"here");
|
||
|
((DetectContentData *)pm->ctx)->flags &= ~DETECT_CONTENT_FAST_PATTERN;
|
||
|
/* http_cookie should not be used with the rawbytes rule */
|
||
|
} else if (((DetectContentData *)pm->ctx)->flags & DETECT_CONTENT_RAWBYTES) {
|
||
| src/detect-http-method.c | ||
|---|---|---|
|
/** \todo snort docs only mention rawbytes, not fast_pattern */
|
||
|
if (((DetectContentData *)pm->ctx)->flags & DETECT_CONTENT_FAST_PATTERN)
|
||
|
{
|
||
|
SCLogError(SC_ERR_INVALID_SIGNATURE,
|
||
|
"http_method cannot be used with \"fast_pattern\"");
|
||
|
SCReturnInt(-1);
|
||
|
SCLogWarning(SC_WARN_COMPATIBILITY,
|
||
|
"http_method cannot be used with \"fast_pattern\" currently."
|
||
|
"Unsetting fast_pattern on this modifier.");
|
||
|
((DetectContentData *)pm->ctx)->flags &= ~DETECT_CONTENT_FAST_PATTERN;
|
||
|
} else if (((DetectContentData *)pm->ctx)->flags & DETECT_CONTENT_RAWBYTES)
|
||
|
{
|
||
|
SCLogError(SC_ERR_INVALID_SIGNATURE,
|
||