Merge pull request #1176 in SNORT/snort3 from nhttp100 to master

Squashed commit of the following:

commit c8d2432a201502c7c477b3106ce617a0a5d2f4c3
Author: Tom Peters <thopeter@cisco.com>
Date:   Tue Apr 3 13:58:03 2018 -0400

    http_inspect: know more Content-Encodings by name

diff --git a/src/service_inspectors/http_inspect/http_enum.h b/src/service_inspectors/http_inspect/http_enum.h
index e4622c2c659b3376e36cffdb6bba1eb499ba58b8..77e63a022517997ffd11242e13ce8c57656f993b 100644 (file)
--- a/src/service_inspectors/http_inspect/http_enum.h
+++ b/src/service_inspectors/http_inspect/http_enum.h
@@ -242,7 +242,9 @@ enum CharAction { CHAR_NORMAL=2, CHAR_PERCENT, CHAR_PATH, CHAR_EIGHTBIT, CHAR_SU
 // Content codings
 enum Contentcoding { CONTENTCODE__OTHER=1, CONTENTCODE_GZIP, CONTENTCODE_DEFLATE,
     CONTENTCODE_COMPRESS, CONTENTCODE_EXI, CONTENTCODE_PACK200_GZIP, CONTENTCODE_X_GZIP,
-    CONTENTCODE_X_COMPRESS, CONTENTCODE_IDENTITY, CONTENTCODE_CHUNKED };
+    CONTENTCODE_X_COMPRESS, CONTENTCODE_IDENTITY, CONTENTCODE_CHUNKED, CONTENTCODE_BR,
+    CONTENTCODE_BZIP2, CONTENTCODE_LZMA, CONTENTCODE_PEERDIST, CONTENTCODE_SDCH,
+    CONTENTCODE_XPRESS, CONTENTCODE_XZ };
 
 enum EventSid
 {

diff --git a/src/service_inspectors/http_inspect/http_msg_header.cc b/src/service_inspectors/http_inspect/http_msg_header.cc
index 5ab32b6240e555fb4673544490ea4583c203a98c..63190753bbc9b589717627272fdf59162c780ccb 100644 (file)
--- a/src/service_inspectors/http_inspect/http_msg_header.cc
+++ b/src/service_inspectors/http_inspect/http_msg_header.cc
@@ -394,13 +394,6 @@ void HttpMsgHeader::setup_encoding_decompression()
         case CONTENTCODE_DEFLATE:
             compression = CMP_DEFLATE;
             break;
-        case CONTENTCODE_COMPRESS:
-        case CONTENTCODE_EXI:
-        case CONTENTCODE_PACK200_GZIP:
-        case CONTENTCODE_X_COMPRESS:
-            add_infraction(INF_UNSUPPORTED_ENCODING);
-            create_event(EVENT_UNSUPPORTED_ENCODING);
-            break;
         case CONTENTCODE_IDENTITY:
             break;
         case CONTENTCODE_CHUNKED:
@@ -408,9 +401,15 @@ void HttpMsgHeader::setup_encoding_decompression()
             create_event(EVENT_CONTENT_ENCODING_CHUNKED);
             break;
         case CONTENTCODE__OTHER:
+            // The ones we never heard of
             add_infraction(INF_UNKNOWN_ENCODING);
             create_event(EVENT_UNKNOWN_ENCODING);
             break;
+        default:
+            // The ones we know by name but don't support
+            add_infraction(INF_UNSUPPORTED_ENCODING);
+            create_event(EVENT_UNSUPPORTED_ENCODING);
+            break;
         }
     }
 

diff --git a/src/service_inspectors/http_inspect/http_tables.cc b/src/service_inspectors/http_inspect/http_tables.cc
index 0273ffcac527f7c2dd3363976a2b5145a3616072..3fcf95fb13a0a88bad5191c1502599ba275ee330 100644 (file)
--- a/src/service_inspectors/http_inspect/http_tables.cc
+++ b/src/service_inspectors/http_inspect/http_tables.cc
@@ -150,6 +150,13 @@ const StrCode HttpMsgHeadShared::content_code_list[] =
     { CONTENTCODE_X_COMPRESS,    "x-compress" },
     { CONTENTCODE_IDENTITY,      "identity" },
     { CONTENTCODE_CHUNKED,       "chunked" },
+    { CONTENTCODE_BR,            "br" },
+    { CONTENTCODE_BZIP2,         "bzip2" },
+    { CONTENTCODE_LZMA,          "lzma" },
+    { CONTENTCODE_PEERDIST,      "peerdist" },
+    { CONTENTCODE_SDCH,          "sdch" },
+    { CONTENTCODE_XPRESS,        "xpress" },
+    { CONTENTCODE_XZ,            "xz" },
     { 0,                         nullptr }
 };