detect: update text for nocase used with http.host

Signed-off-by: jason taylor <jtfas90@gmail.com>
pull/7603/head
jason taylor 3 years ago committed by Victor Julien
parent 34e0a384ad
commit d600a1603c

@ -184,11 +184,11 @@ static bool DetectHttpHostValidateCallback(const Signature *s, const char **sige
if (sm->type == DETECT_CONTENT) { if (sm->type == DETECT_CONTENT) {
DetectContentData *cd = (DetectContentData *)sm->ctx; DetectContentData *cd = (DetectContentData *)sm->ctx;
if (cd->flags & DETECT_CONTENT_NOCASE) { if (cd->flags & DETECT_CONTENT_NOCASE) {
*sigerror = "http_host keyword " *sigerror = "http.host keyword "
"specified along with \"nocase\". " "specified along with \"nocase\". "
"Since the hostname buffer we match against " "The hostname buffer is normalized "
"is actually lowercase. So having a " "to lowercase, specifying "
"nocase is redundant."; "nocase is redundant.";
SCLogWarning(SC_WARN_POOR_RULE, "rule %u: %s", s->id, *sigerror); SCLogWarning(SC_WARN_POOR_RULE, "rule %u: %s", s->id, *sigerror);
return false; return false;
} else { } else {
@ -199,10 +199,9 @@ static bool DetectHttpHostValidateCallback(const Signature *s, const char **sige
} }
if (u != cd->content_len) { if (u != cd->content_len) {
*sigerror = "A pattern with " *sigerror = "A pattern with "
"uppercase chars detected for http_host. " "uppercase chararacters detected for http.host. "
"Since the hostname buffer we match against " "The hostname buffer is normalized to lowercase, "
"is lowercase only, please specify a " "please specify a lowercase pattern.";
"lowercase pattern.";
SCLogWarning(SC_WARN_POOR_RULE, "rule %u: %s", s->id, *sigerror); SCLogWarning(SC_WARN_POOR_RULE, "rule %u: %s", s->id, *sigerror);
return false; return false;
} }

Loading…
Cancel
Save