prevent repeated small chunk length alerts from hi

diff --git a/ChangeLog b/ChangeLog
index 8c035c1deb11f72bbb5ce88da328fb6c4a30beb2..4954e4e566ed91f778ff5e1ab62acfbee4346ed6 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -19,6 +19,8 @@
 -- changed doc to use "legacy" instead of "classic"
 -- restricted reload to basic modules and inspectors only
 -- commented out snort.process() and snort.reload_hosts() for alpha 1
+-- codec fix from Josh
+-- prevent repeated small chunk length alerts from HI
 
 126
 -- pulled latest from tom

diff --git a/src/service_inspectors/http_inspect/hi_client.cc b/src/service_inspectors/http_inspect/hi_client.cc
index dc86b688c8b5ce4774145decde1e72c2795eadcd..9cf7b83fb9a1cae897b10607ca68ad1e55b85f09 100644 (file)
--- a/src/service_inspectors/http_inspect/hi_client.cc
+++ b/src/service_inspectors/http_inspect/hi_client.cc
@@ -139,6 +139,7 @@ int CheckChunkEncoding(HI_SESSION *session, const u_char *start, const u_char *e
     uint32_t iDataLen = 0;
     uint32_t chunkBytesCopied = 0;
     uint8_t stateless_chunk_count = 0;
+    bool alerted = false;
 
     if(!start || !end)
         return HI_INVALID_ARG;
@@ -224,7 +225,11 @@ int CheckChunkEncoding(HI_SESSION *session, const u_char *start, const u_char *e
                         (*chunk_count)++;
                         if ( *chunk_count >= session->server_conf->small_chunk_length.num )
                         {
-                            SnortEventqAdd(gid, sid);
+                            if ( !alerted )
+                            {
+                                SnortEventqAdd(gid, sid);
+                                alerted = true;
+                            }
                             *chunk_count = 0;
                         }
                     }