From e55390e4e78565c7be0725a36e6dba2ce6868baa Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Mon, 9 Jan 2012 08:58:02 +0100 Subject: [PATCH] Add check to invalidate signatures that inspect raw http headers in the to_client direction (response headers) if libhtp hasn't been patched yet. Also add hack to disable the test for unittests, many tests fail and we'll fix those ASAP. --- src/detect-parse.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/src/detect-parse.c b/src/detect-parse.c index 3f1d343e6f..38a04dac66 100644 --- a/src/detect-parse.c +++ b/src/detect-parse.c @@ -1334,6 +1334,21 @@ static int SigValidate(Signature *s) { } } +#ifndef UNITTESTS /** \todo HACK... this fails 72 unittests, no time to fix them now */ +#ifndef HAVE_HTP_TX_GET_RESPONSE_HEADERS_RAW + if (s->sm_lists[DETECT_SM_LIST_HRHDMATCH] != NULL) { + if ((s->flags & (SIG_FLAG_TOCLIENT|SIG_FLAG_TOSERVER)) == (SIG_FLAG_TOCLIENT|SIG_FLAG_TOSERVER)) { + SCLogError(SC_ERR_INVALID_SIGNATURE,"http_raw_header signature without a flow direction. See issue #389."); + SCReturnInt(0); + } + if (s->flags & SIG_FLAG_TOCLIENT) { + SCLogError(SC_ERR_INVALID_SIGNATURE,"http_raw_header signature with to_client flow direction. See issue #389."); + SCReturnInt(0); + } + } +#endif +#endif + if (s->alproto == ALPROTO_DCERPC) { /* \todo We haven't covered dce rpc cases now. They need special * treatment, since they do allow distance, within without a