minor changes to http

diff --git a/src/service_inspectors/http_inspect/hi_client_norm.cc b/src/service_inspectors/http_inspect/hi_client_norm.cc
index dd26e200588de7df624e9de16ddd10d3665828a0..8fb3be321e47fb170df1cf301ebfc31296726662 100644 (file)
--- a/src/service_inspectors/http_inspect/hi_client_norm.cc
+++ b/src/service_inspectors/http_inspect/hi_client_norm.cc
@@ -299,6 +299,9 @@ int hi_client_norm(HI_SESSION *session)
     if(ClientReq->header_norm && session->server_conf->normalize_headers)
     {
         session->norm_flags &= ~HI_BODY;
+        // FIXIT-M the usefulness  of this one size fits all normalization is questionable.
+        // A specific issue is that a header such as "Referer: http://www.foo.com/home" will trigger multislash
+        // normalization and alert.
         iRet = hi_norm_uri(session, HeaderBuf, &iHeaderBufSize,
                        RawHeaderBuf, iRawHeaderBufSize, &encodeType);
         if (iRet == HI_NONFATAL_ERR)

diff --git a/src/service_inspectors/http_inspect/hi_main.cc b/src/service_inspectors/http_inspect/hi_main.cc
index db444383dee85bc3010a41a296bd0251712c22d9..ece0114f9d98c1f1a63ec4df8e983dbc8f5e53dc 100644 (file)
--- a/src/service_inspectors/http_inspect/hi_main.cc
+++ b/src/service_inspectors/http_inspect/hi_main.cc
@@ -1147,7 +1147,7 @@ void FreeHttpSessionData(void *data)
 
     if( hsd->fd_state != 0 )
     {
-        File_Decomp_StopFree(hsd->fd_state);   // Stop & Stop &  Free fd session object
+        File_Decomp_StopFree(hsd->fd_state);
         hsd->fd_state = NULL;                  // ...just for good measure
     }
 }

diff --git a/src/service_inspectors/http_inspect/hi_ui_config.h b/src/service_inspectors/http_inspect/hi_ui_config.h
index b1a2c1683f71da263ad1bee6d878be0a345ea4bb..c118d115d387c39eabbe0c4ef36c2b5fe9c8a566 100644 (file)
--- a/src/service_inspectors/http_inspect/hi_ui_config.h
+++ b/src/service_inspectors/http_inspect/hi_ui_config.h
@@ -163,8 +163,6 @@ struct HTTPINSPECT_CONF
     char extract_gzip;
     unsigned long file_decomp_modes;
 
-/* NOTE:  The XFF_BUILTING_NAMES value must match the code in snort_httpinspect.c that
-          adds the builtin names to the list. */
 #define HI_UI_CONFIG_XFF_FIELD_NAME  "X-Forwarded-For"
 #define HI_UI_CONFIG_TCI_FIELD_NAME  "True-Client-IP"
 #define XFF_BUILTIN_NAMES            (2)