cookie processing mods

diff --git a/src/service_inspectors/nhttp_inspect/nhttp_enum.h b/src/service_inspectors/nhttp_inspect/nhttp_enum.h
index e5848a2ab2310d53c28ab1cfee104c34693e6905..d768374780f4ea4e917de42ddd776a02c371087e 100644 (file)
--- a/src/service_inspectors/nhttp_inspect/nhttp_enum.h
+++ b/src/service_inspectors/nhttp_inspect/nhttp_enum.h
@@ -146,6 +146,7 @@ enum Infraction
     INF_CHUNK_BAD_END,
     INF_PARTIAL_START,
     INF_CHUNK_WHITESPACE,
+    INF_HEAD_NAME_WHITESPACE,
     INF__MAX_VALUE
 };
 
@@ -226,6 +227,7 @@ enum EventSid
     EVENT_URI_BAD_PORT,
     EVENT_BROKEN_CHUNK,
     EVENT_CHUNK_WHITESPACE,
+    EVENT_HEAD_NAME_WHITESPACE,
     EVENT__MAX_VALUE
 };
 

diff --git a/src/service_inspectors/nhttp_inspect/nhttp_head_norm.cc b/src/service_inspectors/nhttp_inspect/nhttp_head_norm.cc
index 37e47897106e29e5484ed9c4f5ceccfd54687a8b..3c21b555c74b821bd1f78a1a3a49c21d1b4dc8f8 100644 (file)
--- a/src/service_inspectors/nhttp_inspect/nhttp_head_norm.cc
+++ b/src/service_inspectors/nhttp_inspect/nhttp_head_norm.cc
@@ -131,8 +131,7 @@ void HeaderNormalizer::normalize(const HeaderId head_id, const int count, Scratc
         {
             *working++ = ',';
             data_length++;
-            while (header_name_id[++curr_match] != head_id)
-                ;
+            while (header_name_id[++curr_match] != head_id);
         }
         int32_t growth = derive_header_content(header_value[curr_match].start,
             header_value[curr_match].length, working);

diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_head_shared.cc b/src/service_inspectors/nhttp_inspect/nhttp_msg_head_shared.cc
index cf818b54801e32f3040d9176e904c04e65e4551f..c6685c36ab724f39683bec541c6bfc98a2ed7a69 100644 (file)
--- a/src/service_inspectors/nhttp_inspect/nhttp_msg_head_shared.cc
+++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_head_shared.cc
@@ -171,18 +171,32 @@ void NHttpMsgHeadShared::parse_header_lines()
 
 void NHttpMsgHeadShared::derive_header_name_id(int index)
 {
-    // Normalize header field name to lower case for matching purposes
+    const int32_t& length = header_name[index].length;
+    const uint8_t*& buffer = header_name[index].start;
+
+    // Normalize header field name to lower case and remove LWS for matching purposes
+    int32_t lower_length = 0;
     uint8_t* lower_name;
-    if ((lower_name = scratch_pad.request(header_name[index].length)) == nullptr)
+    if ((lower_name = scratch_pad.request(length)) == nullptr)
     {
         infractions += INF_NO_SCRATCH;
         header_name_id[index] = HEAD__INSUFMEMORY;
         return;
     }
-    norm_to_lower(header_name[index].start, header_name[index].length, lower_name, infractions,
-        events, nullptr);
-    header_name_id[index] = (HeaderId)str_to_code(lower_name, header_name[index].length,
-        header_list);
+    for (int32_t k=0; k < length; k++)
+    {
+        if (!is_sp_tab[buffer[k]])
+        {
+            lower_name[lower_length++] = ((buffer[k] < 'A') || (buffer[k] > 'Z')) ?
+                buffer[k] : buffer[k] - ('A' - 'a');
+        }
+        else
+        {
+            infractions += INF_HEAD_NAME_WHITESPACE;
+            events.create_event(EVENT_HEAD_NAME_WHITESPACE);
+        }
+    }
+    header_name_id[index] = (HeaderId)str_to_code(lower_name, lower_length, header_list);
 }
 
 NHttpMsgHeadShared::NormalizedHeader* NHttpMsgHeadShared::get_header_node(HeaderId header_id) const

diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_head_shared.h b/src/service_inspectors/nhttp_inspect/nhttp_msg_head_shared.h
index d0d6c32483e0abda66ffb48ad5d61909b08cabaa..8f3b491f0ad76f711a63d2d700d9e9cf12364dcd 100644 (file)
--- a/src/service_inspectors/nhttp_inspect/nhttp_msg_head_shared.h
+++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_head_shared.h
@@ -59,6 +59,7 @@ protected:
     static const HeaderNormalizer NORMALIZER_NIL;
     static const HeaderNormalizer NORMALIZER_BASIC;
     static const HeaderNormalizer NORMALIZER_CAT;
+    static const HeaderNormalizer NORMALIZER_COOKIE;
     static const HeaderNormalizer NORMALIZER_NOREPEAT;
     static const HeaderNormalizer NORMALIZER_DECIMAL;
     static const HeaderNormalizer NORMALIZER_TRANSCODE;

diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_section.cc b/src/service_inspectors/nhttp_inspect/nhttp_msg_section.cc
index e68ff5f146560b8381680d70d2a54431ce3f6663..ef4e7ea1fcf53b223cb37bfc30a276c1fd40105b 100644 (file)
--- a/src/service_inspectors/nhttp_inspect/nhttp_msg_section.cc
+++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_section.cc
@@ -98,6 +98,10 @@ const Field& NHttpMsgSection::get_legacy(unsigned buffer_id)
         return (body != nullptr) ? body->get_detect_data() : Field::FIELD_NULL;
       }
     case HTTP_BUFFER_COOKIE:
+    case HTTP_BUFFER_RAW_COOKIE:
+    // FIXIT-M when real cookie normalization is implemented these need to become separate cases.
+    // Currently "normalization" is aggregation of multiple cookies. That is correct for raw
+    // cookies and all there is for normalized cookies.
       {
         NHttpMsgHeadShared* header = transaction->get_latest_header(source_id);
         if (header == nullptr)
@@ -115,22 +119,6 @@ const Field& NHttpMsgSection::get_legacy(unsigned buffer_id)
         NHttpMsgRequest* request = transaction->get_request();
         return (request != nullptr) ? request->get_method() : Field::FIELD_NULL;
       }
-    case HTTP_BUFFER_RAW_COOKIE:
-      {
-        NHttpMsgHeadShared* header = transaction->get_latest_header(source_id);
-        if (header == nullptr)
-            return Field::FIELD_NULL;
-        HeaderId cookie_head = (source_id == SRC_CLIENT) ? HEAD_COOKIE : HEAD_SET_COOKIE;
-        // FIXIT-M there can be multiple cookie header in one message.
-        for (int k=0; k < header->get_num_headers(); k++)
-        {
-            if (header->get_header_name_id(k) == cookie_head)
-            {
-                return header->get_header_value(k);
-            }
-        }
-        return Field::FIELD_NULL;
-      }
     case HTTP_BUFFER_RAW_HEADER:
       {
         NHttpMsgHeadShared* header = transaction->get_latest_header(source_id);

diff --git a/src/service_inspectors/nhttp_inspect/nhttp_normalizers.cc b/src/service_inspectors/nhttp_inspect/nhttp_normalizers.cc
index 87877f31bdccc6cb5ff7ef55f732503738c9aa76..681ca0a1904f054db96f0c54b5753aa781f8aa7f 100644 (file)
--- a/src/service_inspectors/nhttp_inspect/nhttp_normalizers.cc
+++ b/src/service_inspectors/nhttp_inspect/nhttp_normalizers.cc
@@ -103,7 +103,7 @@ int32_t norm_remove_lws(const uint8_t* in_buf, int32_t in_length, uint8_t* out_b
     int32_t length = 0;
     for (int32_t k = 0; k < in_length; k++)
     {
-        if ((in_buf[k] != ' ') && (in_buf[k] != '\t'))
+        if (!is_sp_tab[in_buf[k]])
             out_buf[length++] = in_buf[k];
     }
     return length;

diff --git a/src/service_inspectors/nhttp_inspect/nhttp_tables.cc b/src/service_inspectors/nhttp_inspect/nhttp_tables.cc
index 2cc61fcdd4715ec50ff81b6113fabb3a85ce3171..203f08c6ba1dec9a997e0fbdf780849fc9eb2d6a 100644 (file)
--- a/src/service_inspectors/nhttp_inspect/nhttp_tables.cc
+++ b/src/service_inspectors/nhttp_inspect/nhttp_tables.cc
@@ -172,6 +172,9 @@ const HeaderNormalizer NHttpMsgHeadShared::NORMALIZER_BASIC
 const HeaderNormalizer NHttpMsgHeadShared::NORMALIZER_CAT
 { NORM_FIELD, true, norm_remove_lws, nullptr, nullptr, nullptr, nullptr, nullptr };
 
+const HeaderNormalizer NHttpMsgHeadShared::NORMALIZER_COOKIE
+{ NORM_FIELD, true, nullptr, nullptr, nullptr, nullptr, nullptr, nullptr };
+
 const HeaderNormalizer NHttpMsgHeadShared::NORMALIZER_DECIMAL
 { NORM_INT64, false, norm_decimal_integer, nullptr, nullptr, nullptr, nullptr, nullptr };
 
@@ -194,8 +197,8 @@ const HeaderNormalizer* const NHttpMsgHeadShared::header_norms[HEAD__MAX_VALUE]
     [HEAD_DATE] = &NORMALIZER_BASIC,
     [HEAD_PRAGMA] = &NORMALIZER_BASIC,
     [HEAD_TRAILER] = &NORMALIZER_BASIC,
-    [HEAD_COOKIE] = &NORMALIZER_BASIC,
-    [HEAD_SET_COOKIE] = &NORMALIZER_BASIC,
+    [HEAD_COOKIE] = &NORMALIZER_COOKIE,
+    [HEAD_SET_COOKIE] = &NORMALIZER_COOKIE,
     [HEAD_TRANSFER_ENCODING] = &NORMALIZER_TRANSCODE,
     [HEAD_UPGRADE] = &NORMALIZER_BASIC,
     [HEAD_VIA] = &NORMALIZER_BASIC,