|
|
@ -198,6 +198,14 @@ int DetectHttpClientBodySetup(DetectEngineCtx *de_ctx, Signature *s, char *arg)
|
|
|
|
return -1;
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
if (((DetectContentData *)sm->ctx)->flags & DETECT_CONTENT_FAST_PATTERN)
|
|
|
|
|
|
|
|
{
|
|
|
|
|
|
|
|
SCLogWarning(SC_WARN_COMPATIBILITY,
|
|
|
|
|
|
|
|
"http_client_body cannot be used with \"fast_pattern\" currently."
|
|
|
|
|
|
|
|
"Unsetting fast_pattern on this modifier. Signature ==> %s", s->sig_str);
|
|
|
|
|
|
|
|
((DetectContentData *)sm->ctx)->flags &= ~DETECT_CONTENT_FAST_PATTERN;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
/* http_client_body should not be used with the rawbytes rule */
|
|
|
|
/* http_client_body should not be used with the rawbytes rule */
|
|
|
|
if ( ((DetectContentData *)sm->ctx)->flags & DETECT_CONTENT_RAWBYTES) {
|
|
|
|
if ( ((DetectContentData *)sm->ctx)->flags & DETECT_CONTENT_RAWBYTES) {
|
|
|
|
SCLogError(SC_ERR_INVALID_SIGNATURE, "http_client_body rule can not "
|
|
|
|
SCLogError(SC_ERR_INVALID_SIGNATURE, "http_client_body rule can not "
|
|
|
|