detect: update text for nocase used with http.host

Signed-off-by: jason taylor <jtfas90@gmail.com>

diff --git a/src/detect-http-host.c b/src/detect-http-host.c
index ea8bf6d37ec05bcaf99f161964320a5f1c591390..94ef91b47a3eccd73eebe147eb2f87f3ed2a8fb0 100644 (file)
--- a/src/detect-http-host.c
+++ b/src/detect-http-host.c
@@ -184,11 +184,11 @@ static bool DetectHttpHostValidateCallback(const Signature *s, const char **sige
         if (sm->type == DETECT_CONTENT) {
             DetectContentData *cd = (DetectContentData *)sm->ctx;
             if (cd->flags & DETECT_CONTENT_NOCASE) {
-                *sigerror = "http_host keyword "
-                        "specified along with \"nocase\". "
-                        "Since the hostname buffer we match against "
-                        "is actually lowercase.  So having a "
-                        "nocase is redundant.";
+                *sigerror = "http.host keyword "
+                            "specified along with \"nocase\". "
+                            "The hostname buffer is normalized "
+                            "to lowercase, specifying "
+                            "nocase is redundant.";
                 SCLogWarning(SC_WARN_POOR_RULE, "rule %u: %s", s->id, *sigerror);
                 return false;
             } else {
@@ -199,10 +199,9 @@ static bool DetectHttpHostValidateCallback(const Signature *s, const char **sige
                 }
                 if (u != cd->content_len) {
                     *sigerror = "A pattern with "
-                            "uppercase chars detected for http_host.  "
-                            "Since the hostname buffer we match against "
-                            "is lowercase only, please specify a "
-                            "lowercase pattern.";
+                                "uppercase chararacters detected for http.host. "
+                                "The hostname buffer is normalized to lowercase, "
+                                "please specify a lowercase pattern.";
                     SCLogWarning(SC_WARN_POOR_RULE, "rule %u: %s", s->id, *sigerror);
                     return false;
                 }