|
|
|
|
@ -102,14 +102,16 @@ static int DetectFiledataSetup (DetectEngineCtx *de_ctx, Signature *s, char *str
|
|
|
|
|
|
|
|
|
|
if (s->alproto == ALPROTO_HTTP && (s->init_flags & SIG_FLAG_INIT_FLOW) &&
|
|
|
|
|
(s->flags & SIG_FLAG_TOSERVER) && !(s->flags & SIG_FLAG_TOCLIENT)) {
|
|
|
|
|
SCLogError(SC_ERR_INVALID_SIGNATURE, "Can't use file_data with flow:to_server or from_client with http.");
|
|
|
|
|
return -1;
|
|
|
|
|
SCLogError(SC_ERR_INVALID_SIGNATURE, "Can't use file_data with "
|
|
|
|
|
"flow:to_server or flow:from_client with http.");
|
|
|
|
|
return -1;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (s->alproto == ALPROTO_SMTP && (s->init_flags & SIG_FLAG_INIT_FLOW) &&
|
|
|
|
|
!(s->flags & SIG_FLAG_TOSERVER) && (s->flags & SIG_FLAG_TOCLIENT)) {
|
|
|
|
|
SCLogError(SC_ERR_INVALID_SIGNATURE, "Can't use file_data with flow:to_client or from_server with smtp.");
|
|
|
|
|
return -1;
|
|
|
|
|
SCLogError(SC_ERR_INVALID_SIGNATURE, "Can't use file_data with "
|
|
|
|
|
"flow:to_client or flow:from_server with smtp.");
|
|
|
|
|
return -1;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
s->list = DETECT_SM_LIST_FILEDATA;
|
|
|
|
|
|