signature: checks protocol for file.name keyword

By setting the flags as for the filename keyword (not sticky version)
maxenc7 · Oct 7, 2020 · 61d0cd1 · 61d0cd1
1 parent bde0c88
commit 61d0cd1
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 1 deletion.
diff --git a/src/detect-filename.c b/src/detect-filename.c
@@ -349,6 +349,7 @@ static int DetectFilenameSetupSticky(DetectEngineCtx *de_ctx, Signature *s, cons
 {
  if (DetectBufferSetActiveList(s, g_file_name_buffer_id) < 0)
  return -1;
+ s->file_flags |= (FILE_SIG_NEED_FILE | FILE_SIG_NEED_FILENAME);
  return 0;
 }
 
@@ -571,4 +572,4 @@ void DetectFilenameRegisterTests(void)
  UtRegisterTest("DetectFilenameTestParse02", DetectFilenameTestParse02);
  UtRegisterTest("DetectFilenameTestParse03", DetectFilenameTestParse03);
 }
-#endif /* UNITTESTS */
+#endif /* UNITTESTS */
diff --git a/src/detect-parse.c b/src/detect-parse.c
@@ -1857,6 +1857,11 @@ static int SigValidate(DetectEngineCtx *de_ctx, Signature *s)
  "support file matching", AppProtoToString(s->alproto));
  SCReturnInt(0);
  }
+ if (s->alproto == ALPROTO_HTTP2 && (s->file_flags & FILE_SIG_NEED_FILENAME)) {
+ SCLogError(SC_ERR_NO_FILES_FOR_PROTOCOL,
+ "protocol HTTP2 doesn't support file name matching");
+ SCReturnInt(0);
+ }
 
  if (s->alproto == ALPROTO_HTTP) {
  AppLayerHtpNeedFileInspection();