detect-tls-ja3-hash: add warning if nocase is used

diff --git a/src/detect-tls-ja3-hash.c b/src/detect-tls-ja3-hash.c
index 714137fae748e4df82f41c17cfe2286839404d4f..ab9af80fa7b9fe69d66a21b977b2baaa2b2d50be 100644 (file)
--- a/src/detect-tls-ja3-hash.c
+++ b/src/detect-tls-ja3-hash.c
@@ -154,7 +154,14 @@ static _Bool DetectTlsJa3HashValidateCallback(const Signature *s,
         if (sm->type != DETECT_CONTENT)
             continue;
 
-        DetectContentData *cd = (DetectContentData *)sm->ctx;
+        const DetectContentData *cd = (DetectContentData *)sm->ctx;
+
+        if (cd->flags & DETECT_CONTENT_NOCASE) {
+            *sigerror = "ja3_hash should not be used together with "
+                        "nocase, since the rule is automatically "
+                        "lowercased anyway which makes nocase redundant.";
+            SCLogWarning(SC_WARN_POOR_RULE, "rule %u: %s", s->id, *sigerror);
+        }
 
         if (cd->content_len == 32)
             return TRUE;