fixed bogus 120:3 alerts

diff --git a/ChangeLog b/ChangeLog
index 3eed8d5699a43baf78eae4e2dced350eedb482de..084a996bcc64cd47abdd5144f8083a5a9920b460 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -47,6 +47,7 @@
 -- tweaked S5_TRACE output
 -- fixed alert_fast to default to not print payload
 -- fixed tcp options log format
+-- fixed bogus 120:3 alerts
 
 125
 -- discovered can't catch exceptions thrown from Lua to C++; need to

diff --git a/src/service_inspectors/http_inspect/hi_server.cc b/src/service_inspectors/http_inspect/hi_server.cc
index ee5dd59c310e9048799947e5600da45f0f2a2a3f..3b69287e627eae0416e18013298d6a94d1dcef9f 100644 (file)
--- a/src/service_inspectors/http_inspect/hi_server.cc
+++ b/src/service_inspectors/http_inspect/hi_server.cc
@@ -44,6 +44,7 @@
 #include "hi_paf.h"
 #include "main/thread.h"
 
+static THREAD_LOCAL bool headers = false;
 static THREAD_LOCAL bool simple_response = false;
 static THREAD_LOCAL uint8_t decompression_buffer[65535];
 static THREAD_LOCAL uint8_t dechunk_buffer[65535];
@@ -788,7 +789,8 @@ static inline int hi_server_extract_body(
             {
                 if(!(sd->resp_state.last_pkt_chunked) && !simple_response)
                 {
-                    SnortEventqAdd(GID_HTTP_SERVER, HI_SERVER_NO_CONTLEN);
+                    if ( headers )
+                        SnortEventqAdd(GID_HTTP_SERVER, HI_SERVER_NO_CONTLEN);
                 }
                 else
                     sd->resp_state.last_pkt_chunked = 0;
@@ -1207,8 +1209,9 @@ static int HttpResponseInspection(HI_SESSION *session, Packet *p, const unsigned
     if(!ServerConf)
         return HI_INVALID_ARG;
 
-
     Server = &(session->server);
+    headers = false;
+
     clearHttpRespBuffer(Server);
 
     seq_num = GET_PKT_SEQ(p);
@@ -1386,6 +1389,7 @@ static int HttpResponseInspection(HI_SESSION *session, Packet *p, const unsigned
         }
         else
         {
+            headers = true;
             simple_response = false;
             p->packet_flags |= PKT_HTTP_DECODE;
             /* This is a next expected packet to be decompressed but the packet is a

diff --git a/src/service_inspectors/service_inspectors.cc b/src/service_inspectors/service_inspectors.cc
index a36fe4ea0e61afd7bd018ffd3b12c9137b5a8d20..646118ecd655bc85b586230c82f6f83175535f43 100644 (file)
--- a/src/service_inspectors/service_inspectors.cc
+++ b/src/service_inspectors/service_inspectors.cc
@@ -33,9 +33,9 @@ extern const BaseApi* sin_bo;
 extern const BaseApi* sin_ftp_client;
 extern const BaseApi* sin_ftp_server;
 extern const BaseApi* sin_ftp_data;
-#ifndef REG_TEST
+//#ifndef REG_TEST
 extern const BaseApi* sin_nhttp;
-#endif
+//#endif
 extern const BaseApi* sin_rpc_decode;
 extern const BaseApi* sin_telnet;
 extern const BaseApi* sin_wizard;
@@ -51,9 +51,9 @@ const BaseApi* service_inspectors[] =
     sin_ftp_client,
     sin_ftp_server,
     sin_ftp_data,
-#ifndef REG_TEST
+//#ifndef REG_TEST
     sin_nhttp,
-#endif
+//#endif
     sin_rpc_decode,
     sin_telnet,
     sin_wizard,