'RPC_IN_DATA', 'RPC_OUT_DATA', 'RPC_ECHO_DATA'
}
+all =
+{
+ profile_value = 'all',
+ server_flow_depth = 300,
+ client_flow_depth = 300,
+ post_depth = -1,
+ chunk_length = 500000,
+ ascii = true,
+ multiple_slash = true,
+ directory = true,
+ webroot = true,
+ double_decoding = true,
+ u_encoding = true,
+ bare_byte = true,
+ iis_unicode = true,
+ iis_backslash = true,
+ iis_delimiter = true,
+ apache_whitespace = true,
+ non_strict = true,
+ normalize_utf = true,
+ normalize_javascript = false,
+ max_hdr_len = 0,
+ max_headers = 0,
+ max_spaces = 200,
+ max_javascript_whitespaces = 200
+}
+
+apache =
+{
+ profile_value = 'apache',
+ server_flow_depth = 300,
+ client_flow_depth = 300,
+ post_depth = -1,
+ chunk_length = 500000,
+ ascii = true,
+ multiple_slash = true,
+ directory = true,
+ webroot = true,
+ utf_8 = true,
+ apache_whitespace = true,
+ non_strict = true,
+ normalize_utf = true,
+ normalize_javascript = false,
+ max_hdr_len = 0,
+ max_headers = 0,
+ max_spaces = 200,
+ max_javascript_whitespaces = 200
+}
+
+iis =
+{
+ profile_value = 'iis',
+ server_flow_depth = 300,
+ client_flow_depth = 300,
+ post_depth = -1,
+ chunk_length = 500000,
+ ascii = true,
+ multiple_slash = true,
+ directory = true,
+ webroot = true,
+ double_decoding = false,
+ u_encoding = true,
+ bare_byte = true,
+ iis_unicode = true,
+ iis_backslash = true,
+ iis_delimiter = true,
+ apache_whitespace = true,
+ non_strict = true,
+ normalize_utf = true,
+ normalize_javascript = false,
+ max_hdr_len = 0,
+ max_headers = 0,
+ max_spaces = 200,
+ max_javascript_whitespaces = 200
+}
+
+iis_40 =
+{
+ profile_value = 'iis_40',
+ server_flow_depth = 300,
+ client_flow_depth = 300,
+ post_depth = -1,
+ chunk_length = 500000,
+ ascii = true,
+ multiple_slash = true,
+ directory = true,
+ webroot = true,
+ double_decoding = true,
+ u_encoding = true,
+ bare_byte = true,
+ iis_unicode = true,
+ iis_backslash = true,
+ iis_delimiter = true,
+ apache_whitespace = true,
+ non_strict = true,
+ normalize_utf = true,
+ normalize_javascript = false,
+ max_hdr_len = 0,
+ max_headers = 0,
+ max_spaces = 200,
+ max_javascript_whitespaces = 200
+}
+
+iis_50 =
+{
+ profile_value = 'iis_50',
+ server_flow_depth = 300,
+ client_flow_depth = 300,
+ post_depth = -1,
+ chunk_length = 500000,
+ ascii = true,
+ multiple_slash = true,
+ directory = true,
+ webroot = true,
+ double_decoding = true,
+ u_encoding = true,
+ bare_byte = true,
+ iis_unicode = true,
+ iis_backslash = true,
+ iis_delimiter = true,
+ apache_whitespace = true,
+ non_strict = true,
+ normalize_utf = true,
+ normalize_javascript = false,
+ max_hdr_len = 0,
+ max_headers = 0,
+ max_spaces = 200,
+ max_javascript_whitespaces = 200
+}
+
ftp_commands = -- build from ftp_default_commands
{
'ABOR', 'ACCT', 'ADAT', 'ALLO', 'APPE', 'AUTH', 'CCC', 'CDUP', 'CEL',
// different profiles (like above) and use those. rename existing profile
// to profile_type.
-static const Parameter hi_server_params[] =
+static const Parameter hi_profile_server_params[] =
{
- { "allow_proxy_use", Parameter::PT_BOOL, nullptr, "false",
- "don't alert on proxy use for this server" },
-
{ "apache_whitespace", Parameter::PT_BOOL, nullptr, "false",
"don't alert if tab is used in lieu of space characters" },
{ "double_decode", Parameter::PT_BOOL, nullptr, "false",
"iis specific extra decoding" },
+ { "iis_backslash", Parameter::PT_BOOL, nullptr, "false",
+ "normalize directory slashes" },
+
+ { "iis_delimiter", Parameter::PT_BOOL, nullptr, "false",
+ "allow use of non-standard delimiter" },
+
+ { "iis_unicode", Parameter::PT_BOOL, nullptr, "false",
+ "enable unicode code point mapping using unicode_map settings" },
+
+ { "iis_unicode_map", Parameter::PT_TABLE, hi_umap_params, nullptr,
+ "server unicode map configuration" },
+
+ { "max_header_length", Parameter::PT_INT, "0:65535", "750",
+ "maximum allowed client request header field" },
+
+ { "max_headers", Parameter::PT_INT, "0:1024", "100",
+ "maximum allowed client request headers" },
+
+ { "max_spaces", Parameter::PT_INT, "0:65535", "200",
+ "maximum allowed whitespaces when folding" },
+
+ { "multi_slash", Parameter::PT_BOOL, nullptr, "false",
+ "normalize out consecutive slashes in URI" },
+
+ { "non_strict", Parameter::PT_BOOL, nullptr, "true",
+ "allows HTTP 0.9 processing" },
+
+ { "max_javascript_whitespaces", Parameter::PT_INT, "0:", "200",
+ "maximum number of consecutive whitespaces" },
+
+ { "normalize_utf", Parameter::PT_BOOL, nullptr, "true",
+ "normalize response bodies with UTF content-types" },
+
+ { "post_depth", Parameter::PT_INT, "-1:65535", "65495",
+ "amount of POST data to inspect" },
+
+ { "profile_value", Parameter::PT_ENUM, profiles, "none",
+ "set defaults appropriate for selected server" },
+
+ { "server_flow_depth", Parameter::PT_INT, "-1:65535", "0",
+ "response payload to inspect; includes headers with extended_response_inspection" },
+
+ { "u_encode", Parameter::PT_BOOL, nullptr, "true",
+ "decode %uXXXX character sequences" },
+
+ { "utf_8", Parameter::PT_BOOL, nullptr, "false",
+ "decode UTF-8 unicode sequences in URI" },
+
+ { "webroot", Parameter::PT_BOOL, nullptr, "false",
+ "alert on directory traversals past the top level (web server root)" },
+
+ { "whitespace_chars", Parameter::PT_BIT_LIST, "255", nullptr,
+ "allowed white space characters" },
+
+ { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
+};
+
+
+static const Parameter hi_server_params[] =
+{
+ { "allow_proxy_use", Parameter::PT_BOOL, nullptr, "false",
+ "don't alert on proxy use for this server" },
+
{ "enable_cookies", Parameter::PT_BOOL, nullptr, "true",
"extract cookies" },
{ "http_methods", Parameter::PT_STRING, nullptr, default_methods,
"request methods allowed in addition to GET and POST" },
- { "iis_backslash", Parameter::PT_BOOL, nullptr, "false",
- "normalize directory slashes" },
-
- { "iis_delimiter", Parameter::PT_BOOL, nullptr, "false",
- "allow use of non-standard delimiter" },
-
- { "iis_unicode", Parameter::PT_BOOL, nullptr, "false",
- "enable unicode code point mapping using unicode_map settings" },
-
- { "iis_unicode_map", Parameter::PT_TABLE, hi_umap_params, nullptr,
- "server unicode map configuration" },
-
{ "inspect_gzip", Parameter::PT_BOOL, nullptr, "true",
"enable gzip decompression of compressed bodies" },
{ "log_uri", Parameter::PT_BOOL, nullptr, "false",
"enable logging of URI with unified2 alerts as extra data" },
- { "max_header_length", Parameter::PT_INT, "0:65535", "750",
- "maximum allowed client request header field" },
-
- { "max_headers", Parameter::PT_INT, "0:1024", "100",
- "maximum allowed client request headers" },
-
- { "max_spaces", Parameter::PT_INT, "0:65535", "200",
- "maximum allowed whitespaces when folding" },
-
- { "multi_slash", Parameter::PT_BOOL, nullptr, "false",
- "normalize out consecutive slashes in URI" },
-
{ "no_pipeline_req", Parameter::PT_BOOL, nullptr, "false",
"don't inspect pipelined requests after first (still does general detection)" },
{ "non_rfc_chars", Parameter::PT_BIT_LIST, "255", default_non_rfc_chars,
"alert on given non-RFC chars being present in the URI" },
- { "non_strict", Parameter::PT_BOOL, nullptr, "true",
- "allows HTTP 0.9 processing" },
-
{ "normalize_cookies", Parameter::PT_BOOL, nullptr, "false",
"normalize cookies similar to URI" },
{ "normalize_javascript", Parameter::PT_BOOL, nullptr, "true",
"normalize javascript between <script> tags" },
- { "max_javascript_whitespaces", Parameter::PT_INT, "0:", "200",
- "maximum number of consecutive whitespaces" },
-
- { "normalize_utf", Parameter::PT_BOOL, nullptr, "true",
- "normalize response bodies with UTF content-types" },
-
{ "oversize_dir_length", Parameter::PT_INT, "0:", "500",
"alert if a URL has a directory longer than this limit" },
- { "post_depth", Parameter::PT_INT, "-1:65535", "65495",
- "amount of POST data to inspect" },
-
- { "profile", Parameter::PT_ENUM, profiles, "none",
+ { "profile", Parameter::PT_TABLE, hi_profile_server_params, nullptr,
"set defaults appropriate for selected server" },
- { "server_flow_depth", Parameter::PT_INT, "-1:65535", "0",
- "response payload to inspect; includes headers with extended_response_inspection" },
-
{ "small_chunk_count", Parameter::PT_INT, "0:255", "5",
"alert if more than this limit of consecutive chunks are below small_chunk_length" },
{ "tab_uri_delimiter", Parameter::PT_BOOL, nullptr, "false",
"whether a tab not preceded by a space is considered a delimiter or part of URI" },
- { "u_encode", Parameter::PT_BOOL, nullptr, "true",
- "decode %uXXXX character sequences" },
-
{ "unlimited_decompress", Parameter::PT_BOOL, nullptr, "true",
"decompress across multiple packets" },
- { "utf_8", Parameter::PT_BOOL, nullptr, "false",
- "decode UTF-8 unicode sequences in URI" },
-
- { "webroot", Parameter::PT_BOOL, nullptr, "false",
- "alert on directory traversals past the top level (web server root)" },
-
- { "whitespace_chars", Parameter::PT_BIT_LIST, "255", nullptr,
- "allowed white space characters" },
-
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
else if ( v.is("post_depth") )
server->post_depth = v.get_long();
- else if ( v.is("profile") )
+ else if ( v.is("profile_value") )
server->profile = (PROFILES)v.get_long();
else if ( v.is("server_flow_depth") )
return true;
}
-bool HttpServerModule::begin(const char*, int, SnortConfig*)
+bool HttpServerModule::begin(const char*fqn, int, SnortConfig*)
{
if ( !server )
{
server->iis_unicode_map_filename,
server->iis_unicode_codepage);
}
+ else
+ {
+ get_default_unicode_map(
+ server->iis_unicode_map,
+ server->iis_unicode_codepage);
+ }
+
{
Value v(methods.c_str());
std::string tok;
return HI_SUCCESS;
}
-/*
-** NAME
-** hi_ui_set_profile_apache::
-*/
-/**
-** Set an HTTPINSPECT_CONF to mimic apache configuration.
-**
-** This sets a server configuration to imitate an apache web server,
-** and should reduce false positives against systems on which certain
-** attacks or evasions do not work. We hope to still log an event,
-** but one that is less priority.
-**
-** @param ServerConf pointer to structure HTTPINSPECT_CONF
-**
-** @return integer
-**
-** @retval HI_SUCCESS function successful
-** @retval HI_MEM_ALLOC_FAIL memory allocation failed
-*/
-int hi_ui_config_set_profile_apache(HTTPINSPECT_CONF *ServerConf)
-{
- ServerConf->server_flow_depth = 300;
- ServerConf->client_flow_depth = 300;
- ServerConf->post_depth = -1;
-
- ServerConf->non_strict = 1;
-
- ServerConf->chunk_length = 500000;
-
- ServerConf->ascii.on = 1;
-
- ServerConf->multiple_slash.on = 1;
-
- ServerConf->directory.on = 1;
-
- ServerConf->webroot.on = 1;
-
- ServerConf->apache_whitespace.on = 1;
-
- ServerConf->utf_8.on = 1;
-
- ServerConf->normalize_utf = 1;
- ServerConf->normalize_javascript = 0;
-
- ServerConf->whitespace[9] = HI_UI_CONFIG_WS_BEFORE_URI | HI_UI_CONFIG_WS_AFTER_URI; /* horizontal tab */
- ServerConf->whitespace[11] = HI_UI_CONFIG_WS_BEFORE_URI | HI_UI_CONFIG_WS_AFTER_URI; /* vertical tab */
- ServerConf->whitespace[12] = HI_UI_CONFIG_WS_BEFORE_URI | HI_UI_CONFIG_WS_AFTER_URI; /* form feed */
- ServerConf->whitespace[13] = HI_UI_CONFIG_WS_BEFORE_URI | HI_UI_CONFIG_WS_AFTER_URI; /* carriage return */
-
- ServerConf->max_hdr_len = HI_UI_CONFIG_MAX_HDR_DEFAULT;
- ServerConf->max_headers = HI_UI_CONFIG_MAX_HEADERS_DEFAULT;
- ServerConf->max_spaces = HI_UI_CONFIG_MAX_SPACES_DEFAULT;
- ServerConf->max_js_ws = HI_UI_CONFIG_MAX_SPACES_DEFAULT;
-
- return HI_SUCCESS;
-}
-
-/*
-** NAME
-** hi_ui_set_profile_iis::
-*/
-/**
-** Set an HTTPINSPECT_CONF to mimic IIS configuration.
-**
-** This sets a server configuration to imitate an IIS web server,
-** and should reduce false positives against systems on which certain
-** attacks or evasions do not work. We hope to still log an event,
-** but one that is less priority.
-**
-** @param ServerConf pointer to structure HTTPINSPECT_CONF
-**
-** @return integer
-**
-** @retval HI_SUCCESS function successful
-** @retval HI_MEM_ALLOC_FAIL memory allocation failed
-*/
-int hi_ui_config_set_profile_iis(HTTPINSPECT_CONF *ServerConf,
- uint8_t* iis_unicode_map)
-{
- if(iis_unicode_map == NULL)
- {
- return HI_INVALID_ARG;
- }
-
- ServerConf->server_flow_depth = 300;
- ServerConf->client_flow_depth = 300;
- ServerConf->post_depth = -1;
-
- ServerConf->chunk_length = 500000;
-
- ServerConf->iis_unicode_map = iis_unicode_map;
-
- ServerConf->ascii.on = 1;
-
- ServerConf->multiple_slash.on = 1;
-
- ServerConf->directory.on = 1;
-
- ServerConf->webroot.on = 1;
-
- ServerConf->double_decoding.on = 0;
-
- ServerConf->u_encoding.on = 1;
-
- ServerConf->bare_byte.on = 1;
-
- ServerConf->iis_unicode.on = 1;
-
- ServerConf->iis_backslash.on = 1;
-
- ServerConf->iis_delimiter.on = 1;
-
- ServerConf->apache_whitespace.on = 1;
-
- ServerConf->non_strict = 1;
-
- ServerConf->normalize_utf = 1;
- ServerConf->normalize_javascript = 0;
-
- ServerConf->whitespace[9] = HI_UI_CONFIG_WS_BEFORE_URI | HI_UI_CONFIG_WS_AFTER_URI; /* horizontal tab */
- ServerConf->whitespace[11] = HI_UI_CONFIG_WS_BEFORE_URI; /* vertical tab */
- ServerConf->whitespace[12] = HI_UI_CONFIG_WS_BEFORE_URI; /* form feed */
- ServerConf->whitespace[13] = HI_UI_CONFIG_WS_BEFORE_URI; /* carriage return */
-
- ServerConf->max_hdr_len = HI_UI_CONFIG_MAX_HDR_DEFAULT;
- ServerConf->max_headers = HI_UI_CONFIG_MAX_HEADERS_DEFAULT;
- ServerConf->max_spaces = HI_UI_CONFIG_MAX_SPACES_DEFAULT;
- ServerConf->max_js_ws = HI_UI_CONFIG_MAX_SPACES_DEFAULT;
-
- return HI_SUCCESS;
-}
-
-/*
-** NAME
-** hi_ui_set_profile_iis_4or5::
-*/
-/**
-** Double decoding decoding attacks exist for IIS
-** 4.0 and 5.0, but not 5.1 and beyond.
-**
-** This function uses the general IIS setup, hi_ui_config_set_profile_iis,
-** but set the double_decoding flags.
-**/
-
-int hi_ui_config_set_profile_iis_4or5(HTTPINSPECT_CONF *ServerConf,
- uint8_t* iis_unicode_map)
-{
- int ret;
-
- ret = hi_ui_config_set_profile_iis(ServerConf, iis_unicode_map);
-
- ServerConf->double_decoding.on = 1;
-
- return ret;
-}
-
-/*
-** NAME
-** hi_ui_set_profile_all::
-*/
-/**
-** Set an HTTPINSPECT_CONF to catch all attacks and evasions.
-**
-** This basically turns on all the tricks and most of the
-** alerts, so you won't miss anything that HttpInspect does.
-**
-** @param ServerConf pointer to structure HTTPINSPECT_CONF
-**
-** @return integer
-**
-** @retval HI_SUCCESS function successful
-** @retval HI_MEM_ALLOC_FAIL memory allocation failed
-*/
-int hi_ui_config_set_profile_all(HTTPINSPECT_CONF *ServerConf,
- uint8_t* iis_unicode_map)
-{
- if(iis_unicode_map == NULL)
- {
- return HI_INVALID_ARG;
- }
-
- ServerConf->server_flow_depth = 300;
- ServerConf->client_flow_depth = 300;
- ServerConf->post_depth = -1;
-
- ServerConf->chunk_length = 500000;
-
- ServerConf->iis_unicode_map = iis_unicode_map;
-
- ServerConf->ascii.on = 1;
-
- ServerConf->multiple_slash.on = 1;
-
- ServerConf->directory.on = 1;
-
- ServerConf->webroot.on = 1;
-
- ServerConf->double_decoding.on = 1;
-
- ServerConf->u_encoding.on = 1;
-
- ServerConf->bare_byte.on = 1;
-
- ServerConf->iis_unicode.on = 1;
-
- ServerConf->iis_backslash.on = 1;
-
- ServerConf->iis_delimiter.on = 1;
-
- ServerConf->apache_whitespace.on = 1;
-
- ServerConf->non_strict = 1;
-
- ServerConf->normalize_utf = 1;
- ServerConf->normalize_javascript = 0;
-
- ServerConf->whitespace[9] = HI_UI_CONFIG_WS_BEFORE_URI | HI_UI_CONFIG_WS_AFTER_URI; /* horizontal tab */
- ServerConf->whitespace[11] = HI_UI_CONFIG_WS_BEFORE_URI; /* vertical tab */
- ServerConf->whitespace[12] = HI_UI_CONFIG_WS_BEFORE_URI; /* form feed */
- ServerConf->whitespace[13] = HI_UI_CONFIG_WS_BEFORE_URI; /* carriage return */
-
- ServerConf->max_hdr_len = HI_UI_CONFIG_MAX_HDR_DEFAULT;
- ServerConf->max_headers = HI_UI_CONFIG_MAX_HEADERS_DEFAULT;
- ServerConf->max_spaces = HI_UI_CONFIG_MAX_SPACES_DEFAULT;
- ServerConf->max_js_ws = HI_UI_CONFIG_MAX_SPACES_DEFAULT;
-
- return HI_SUCCESS;
-}
-
void HttpInspectCleanupHttpMethodsConf(void *HttpMethods)
{
HTTP_CMD_CONF *HTTPMethods = (HTTP_CMD_CONF *)HttpMethods;
int hi_ui_config_default(HTTPINSPECT_CONF *GlobalConf);
int hi_ui_config_reset_global(HTTPINSPECT_GLOBAL_CONF *GlobalConf);
-int hi_ui_config_set_profile_apache(HTTPINSPECT_CONF *GlobalConf);
-int hi_ui_config_set_profile_iis(HTTPINSPECT_CONF *GlobalConf, uint8_t*);
-int hi_ui_config_set_profile_iis_4or5(HTTPINSPECT_CONF *GlobalConf, uint8_t*);
-int hi_ui_config_set_profile_all(HTTPINSPECT_CONF *GlobalConf, uint8_t*);
void HttpInspectCleanupHttpMethodsConf(void *);
extern int hex_lookup[256];
tmpval = table_api.add_option("extended_ascii_uri", true);
else if (!keyword.compare("non_strict"))
+ {
+ table_api.add_diff_option_comment("non_strict", "profile.non_strict");
+ table_api.open_table("profile");
tmpval = table_api.add_option("non_strict", true);
+ table_api.close_table();
+ }
else if (!keyword.compare("inspect_uri_only"))
tmpval = table_api.add_option("inspect_uri_only", true);
tmpval = table_api.add_option("normalize_headers", true);
else if (!keyword.compare("normalize_utf"))
+ {
+ table_api.add_diff_option_comment("normalize_utf", "profile.normalize_utf");
+ table_api.open_table("profile");
tmpval = table_api.add_option("normalize_utf", true);
+ table_api.close_table();
+ }
else if (!keyword.compare("log_uri"))
tmpval = table_api.add_option("log_uri", true);
tmpval = table_api.add_option("no_pipeline_req", true);
else if (!keyword.compare("ascii"))
+ {
+ table_api.add_diff_option_comment("ascii", "profile.ascii");
+ table_api.open_table("profile");
tmpval = parse_yn_bool_option("ascii", data_stream);
+ table_api.close_table();
+ }
else if (!keyword.compare("utf_8"))
+ {
+ table_api.add_diff_option_comment("utf_8", "profile.utf_8");
+ table_api.open_table("profile");
tmpval = parse_yn_bool_option("utf_8", data_stream);
+ table_api.close_table();
+ }
else if (!keyword.compare("u_encode"))
+ {
+ table_api.add_diff_option_comment("u_encode", "profile.u_encode");
+ table_api.open_table("profile");
tmpval = parse_yn_bool_option("u_encode", data_stream);
+ table_api.close_table();
+ }
else if (!keyword.compare("bare_byte"))
+ {
+ table_api.add_diff_option_comment("bare_byte", "profile.bare_byte");
+ table_api.open_table("profile");
tmpval = parse_yn_bool_option("bare_byte", data_stream);
+ table_api.close_table();
+ }
else if (!keyword.compare("iis_unicode"))
+ {
+ table_api.add_diff_option_comment("iis_unicode", "profile.iis_unicode");
+ table_api.open_table("profile");
tmpval = parse_yn_bool_option("iis_unicode", data_stream);
+ table_api.close_table();
+ }
else if (!keyword.compare("double_decode"))
+ {
+ table_api.add_diff_option_comment("double_decode", "profile.double_decode");
+ table_api.open_table("profile");
tmpval = parse_yn_bool_option("double_decode", data_stream);
+ table_api.close_table();
+ }
else if (!keyword.compare("multi_slash"))
+ {
+ table_api.add_diff_option_comment("multi_slash", "profile.multi_slash");
+ table_api.open_table("profile");
tmpval = parse_yn_bool_option("multi_slash", data_stream);
+ table_api.close_table();
+ }
else if (!keyword.compare("iis_backslash"))
+ {
+ table_api.add_diff_option_comment("iis_backslash", "profile.iis_backslash");
+ table_api.open_table("profile");
tmpval = parse_yn_bool_option("iis_backslash", data_stream);
-
+ table_api.close_table();
+ }
else if (!keyword.compare("directory"))
+ {
+ table_api.add_diff_option_comment("directory", "profile.directory");
+ table_api.open_table("profile");
tmpval = parse_yn_bool_option("directory", data_stream);
+ table_api.close_table();
+ }
else if (!keyword.compare("apache_whitespace"))
+ {
+ table_api.add_diff_option_comment("apache_whitespace", "profile.apache_whitespace");
+ table_api.open_table("profile");
tmpval = parse_yn_bool_option("apache_whitespace", data_stream);
+ table_api.close_table();
+ }
else if (!keyword.compare("iis_delimiter"))
tmpval = parse_yn_bool_option("iis_delimiter", data_stream);
else if (!keyword.compare("webroot"))
+ {
+ table_api.add_diff_option_comment("webroot", "profile.webroot");
+ table_api.open_table("profile");
tmpval = parse_yn_bool_option("webroot", data_stream);
+ table_api.close_table();
+ }
else if (!keyword.compare("max_javascript_whitespaces"))
+ {
+ table_api.add_diff_option_comment("max_javascript_whitespaces", "profile.max_javascript_whitespaces");
+ table_api.open_table("profile");
tmpval = parse_int_option("max_javascript_whitespaces", data_stream);
+ table_api.close_table();
+ }
else if (!keyword.compare("server_flow_depth"))
+ {
+ table_api.add_diff_option_comment("server_flow_depth [-1:65495]", "profile.server_flow_depth [-1:65535]");
+ table_api.open_table("profile");
tmpval = parse_int_option("server_flow_depth", data_stream);
+ table_api.close_table();
+ }
else if (!keyword.compare("client_flow_depth"))
+ {
+ table_api.add_diff_option_comment("client_flow_depth", "profile.client_flow_depth");
+ table_api.open_table("profile");
tmpval = parse_int_option("client_flow_depth", data_stream);
+ table_api.close_table();
+ }
else if (!keyword.compare("chunk_length"))
+ {
+ table_api.add_diff_option_comment("chunk_length", "profile.chunk_length");
+ table_api.open_table("profile");
tmpval = parse_int_option("chunk_length", data_stream);
+ table_api.close_table();
+ }
else if (!keyword.compare("oversize_dir_length"))
tmpval = parse_int_option("oversize_dir_length", data_stream);
else if (!keyword.compare("max_header_length"))
+ {
+ table_api.add_diff_option_comment("max_header_length", "profile.max_header_length");
+ table_api.open_table("profile");
tmpval = parse_int_option("max_header_length", data_stream);
+ table_api.close_table();
+ }
else if (!keyword.compare("max_spaces"))
+ {
+ table_api.add_diff_option_comment("max_spaces", "profile.max_spaces");
+ table_api.open_table("profile");
tmpval = parse_int_option("max_spaces", data_stream);
+ table_api.close_table();
+ }
else if (!keyword.compare("max_headers"))
+ {
+ table_api.add_diff_option_comment("max_headers", "profile.max_headers");
+ table_api.open_table("profile");
tmpval = parse_int_option("max_headers", data_stream);
+ table_api.close_table();
+ }
else if (!keyword.compare("no_alerts"))
table_api.add_deleted_comment("no_alerts");
tmpval = parse_curly_bracket_list("http_methods", data_stream);
else if (!keyword.compare("whitespace_chars"))
+ {
+ table_api.add_diff_option_comment("whitespace_chars", "profile.whitespace_chars");
+ table_api.open_table("profile");
tmpval = parse_bracketed_byte_list("whitespace_chars", data_stream);
+ table_api.close_table();
+ }
else if (!keyword.compare("base36"))
tmpval = eat_option(data_stream);
else if (!keyword.compare("post_depth"))
{
+ table_api.add_diff_option_comment("post_depth [-1:65495]", "profile.post_depth [-1:65535]");
+ table_api.open_table("profile");
tmpval = parse_int_option("post_depth", data_stream);
- table_api.add_diff_option_comment("post_depth [-1:65495]", "post_depth [-1:65535]");
+ table_api.close_table();
}
else if (!keyword.compare("non_rfc_char"))
std::string map_file;
int code_page;
+ table_api.open_table("profile");
+
if( (data_stream >> map_file) &&
(data_stream >> code_page))
{
data_api.failed_conversion(data_stream, "iis_unicode_map <filename> <codemap>");
retval = false;
}
+ table_api.close_table();
}
else if (!keyword.compare("profile"))
projects / thirdparty / snort3.git / commitdiff
