disallow pcre /P/I/U with flow:to_client/from_svr

diff --git a/src/detect-pcre.c b/src/detect-pcre.c
index d8dcf4230f190b661ce7a50c78bca0ee8d7d91ee..36209eee3296cb8aa8dd76ed9f13a837f9ec3428 100644 (file)
--- a/src/detect-pcre.c
+++ b/src/detect-pcre.c
@@ -1071,6 +1071,17 @@ static int DetectPcreSetup (DetectEngineCtx *de_ctx, Signature *s, char *regexst
     if (pd == NULL)
         goto error;
 
+    if (pd->flags & DETECT_PCRE_HTTP_CLIENT_BODY && s->init_flags & SIG_FLAG_INIT_FLOW
+        && s->flags & SIG_FLAG_TOCLIENT && !(s->flags & SIG_FLAG_TOSERVER)) {
+        SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "Can't use pcre /P with flow:from_server or flow:to_client");
+        goto error;
+    }
+    if ((pd->flags & DETECT_PCRE_URI || pd->flags & DETECT_PCRE_HTTP_RAW_URI)
+        && s->init_flags & SIG_FLAG_INIT_FLOW && s->flags & SIG_FLAG_TOCLIENT && !(s->flags & SIG_FLAG_TOSERVER)) {
+        SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "Can't use pcre /U or /I with flow:from_server or flow:to_client");
+        goto error;
+    }
+
     /* check pcre modifiers against the signature alproto.  In case they conflict
      * chuck out invalid signature */
     switch (s->alproto) {