signature: checks protocol for file.name keyword

By setting the flags as for the filename keyword (not sticky version)
pull/4941/head
Philippe Antoine 5 years ago committed by Jason Ish
parent bde0c88984
commit 61d0cd1399

@ -349,6 +349,7 @@ static int DetectFilenameSetupSticky(DetectEngineCtx *de_ctx, Signature *s, cons
{
if (DetectBufferSetActiveList(s, g_file_name_buffer_id) < 0)
return -1;
s->file_flags |= (FILE_SIG_NEED_FILE | FILE_SIG_NEED_FILENAME);
return 0;
}
@ -571,4 +572,4 @@ void DetectFilenameRegisterTests(void)
UtRegisterTest("DetectFilenameTestParse02", DetectFilenameTestParse02);
UtRegisterTest("DetectFilenameTestParse03", DetectFilenameTestParse03);
}
#endif /* UNITTESTS */
#endif /* UNITTESTS */

@ -1857,6 +1857,11 @@ static int SigValidate(DetectEngineCtx *de_ctx, Signature *s)
"support file matching", AppProtoToString(s->alproto));
SCReturnInt(0);
}
if (s->alproto == ALPROTO_HTTP2 && (s->file_flags & FILE_SIG_NEED_FILENAME)) {
SCLogError(SC_ERR_NO_FILES_FOR_PROTOCOL,
"protocol HTTP2 doesn't support file name matching");
SCReturnInt(0);
}
if (s->alproto == ALPROTO_HTTP) {
AppLayerHtpNeedFileInspection();

Loading…
Cancel
Save