diff --git a/src/detect-pcre.c b/src/detect-pcre.c index d8dcf4230f..36209eee32 100644 --- a/src/detect-pcre.c +++ b/src/detect-pcre.c @@ -1071,6 +1071,17 @@ static int DetectPcreSetup (DetectEngineCtx *de_ctx, Signature *s, char *regexst if (pd == NULL) goto error; + if (pd->flags & DETECT_PCRE_HTTP_CLIENT_BODY && s->init_flags & SIG_FLAG_INIT_FLOW + && s->flags & SIG_FLAG_TOCLIENT && !(s->flags & SIG_FLAG_TOSERVER)) { + SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "Can't use pcre /P with flow:from_server or flow:to_client"); + goto error; + } + if ((pd->flags & DETECT_PCRE_URI || pd->flags & DETECT_PCRE_HTTP_RAW_URI) + && s->init_flags & SIG_FLAG_INIT_FLOW && s->flags & SIG_FLAG_TOCLIENT && !(s->flags & SIG_FLAG_TOSERVER)) { + SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "Can't use pcre /U or /I with flow:from_server or flow:to_client"); + goto error; + } + /* check pcre modifiers against the signature alproto. In case they conflict * chuck out invalid signature */ switch (s->alproto) {