detect-tls-cert-serial: add warning if nocase is used

diff --git a/src/detect-tls-cert-serial.c b/src/detect-tls-cert-serial.c
index 17a2e340e15bd02ba101aca8404c2593b143cf7c..3ae70875f782458f140d1168558576ddc3fd13a7 100644 (file)
--- a/src/detect-tls-cert-serial.c
+++ b/src/detect-tls-cert-serial.c
@@ -153,7 +153,14 @@ static _Bool DetectTlsSerialValidateCallback(const Signature *s,
         if (sm->type != DETECT_CONTENT)
             continue;
 
-        DetectContentData *cd = (DetectContentData *)sm->ctx;
+        const DetectContentData *cd = (DetectContentData *)sm->ctx;
+
+        if (cd->flags & DETECT_CONTENT_NOCASE) {
+            *sigerror = "tls_cert_serial should not be used together "
+                        "with nocase, since the rule is automatically "
+                        "uppercased anyway which makes nocase redundant.";
+            SCLogWarning(SC_WARN_POOR_RULE, "rule %u: %s", s->id, *sigerror);
+        }
 
         /* no need to worry about this if the content is short enough */
         if (cd->content_len <= 2)