From 2501d48ac828b957313552ab10550f038cb68a9a Mon Sep 17 00:00:00 2001 From: Mats Klepsland Date: Sat, 24 Mar 2018 23:07:04 +0100 Subject: [PATCH] detect-tls-cert-serial: add warning if nocase is used --- src/detect-tls-cert-serial.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/src/detect-tls-cert-serial.c b/src/detect-tls-cert-serial.c index 17a2e340e1..3ae70875f7 100644 --- a/src/detect-tls-cert-serial.c +++ b/src/detect-tls-cert-serial.c @@ -153,7 +153,14 @@ static _Bool DetectTlsSerialValidateCallback(const Signature *s, if (sm->type != DETECT_CONTENT) continue; - DetectContentData *cd = (DetectContentData *)sm->ctx; + const DetectContentData *cd = (DetectContentData *)sm->ctx; + + if (cd->flags & DETECT_CONTENT_NOCASE) { + *sigerror = "tls_cert_serial should not be used together " + "with nocase, since the rule is automatically " + "uppercased anyway which makes nocase redundant."; + SCLogWarning(SC_WARN_POOR_RULE, "rule %u: %s", s->id, *sigerror); + } /* no need to worry about this if the content is short enough */ if (cd->content_len <= 2)