Http Inspect Profile changes

diff --git a/lua/snort_defaults.lua b/lua/snort_defaults.lua
index 2ff570e095c09c50be0d898335317fccf5f1d2a6..f9a19901d9afe829767168a536ac9a4d31bce9d0 100644 (file)
--- a/lua/snort_defaults.lua
+++ b/lua/snort_defaults.lua
@@ -219,11 +219,11 @@ all =
     post_depth = -1,
     chunk_length = 500000,
     ascii = true,
-    multiple_slash = true,
+    multi_slash = true,
     directory = true,
     webroot = true,
-    double_decoding = true,
-    u_encoding = true,
+    double_decode = true,
+    u_encode = true,
     bare_byte = true,
     iis_unicode = true,
     iis_backslash = true,
@@ -232,10 +232,11 @@ all =
     non_strict = true,
     normalize_utf = true,
     normalize_javascript = false,
-    max_hdr_len = 0,
+    max_header_length = 0,
     max_headers = 0,
     max_spaces = 200,
-    max_javascript_whitespaces = 200
+    max_javascript_whitespaces = 200,
+    whitespace_chars ='0x9 0xb 0xc 0xd'
 }
 
 apache = 
@@ -246,7 +247,7 @@ apache =
     post_depth = -1,
     chunk_length = 500000,
     ascii = true,
-    multiple_slash = true,
+    multi_slash = true,
     directory = true,
     webroot = true,
     utf_8 = true,
@@ -254,10 +255,11 @@ apache =
     non_strict = true,
     normalize_utf = true,
     normalize_javascript = false,
-    max_hdr_len = 0,
+    max_header_length = 0,
     max_headers = 0,
     max_spaces = 200,
-    max_javascript_whitespaces = 200
+    max_javascript_whitespaces = 200,
+    whitespace_chars ='0x9 0xb 0xc 0xd'
 }
 
 iis = 
@@ -268,11 +270,11 @@ iis =
     post_depth = -1,
     chunk_length = 500000,
     ascii = true,
-    multiple_slash = true,
+    multi_slash = true,
     directory = true,
     webroot = true,
-    double_decoding = false,
-    u_encoding = true,
+    double_decode = false,
+    u_encode = true,
     bare_byte = true,
     iis_unicode = true,
     iis_backslash = true,
@@ -281,10 +283,11 @@ iis =
     non_strict = true,
     normalize_utf = true,
     normalize_javascript = false,
-    max_hdr_len = 0,
+    max_header_length = 0,
     max_headers = 0,
     max_spaces = 200,
-    max_javascript_whitespaces = 200
+    max_javascript_whitespaces = 200,
+    whitespace_chars ='0x9 0xb 0xc 0xd'
 }
 
 iis_40 = 
@@ -295,11 +298,11 @@ iis_40 =
     post_depth = -1,
     chunk_length = 500000,
     ascii = true,
-    multiple_slash = true,
+    multi_slash = true,
     directory = true,
     webroot = true,
-    double_decoding = true,
-    u_encoding = true,
+    double_decode = true,
+    u_encode = true,
     bare_byte = true,
     iis_unicode = true,
     iis_backslash = true,
@@ -308,10 +311,11 @@ iis_40 =
     non_strict = true,
     normalize_utf = true,
     normalize_javascript = false,
-    max_hdr_len = 0,
+    max_header_length = 0,
     max_headers = 0,
     max_spaces = 200,
-    max_javascript_whitespaces = 200
+    max_javascript_whitespaces = 200,
+    whitespace_chars ='0x9 0xb 0xc 0xd'
 }
 
 iis_50 = 
@@ -322,11 +326,11 @@ iis_50 =
     post_depth = -1,
     chunk_length = 500000,
     ascii = true,
-    multiple_slash = true,
+    multi_slash = true,
     directory = true,
     webroot = true,
-    double_decoding = true,
-    u_encoding = true,
+    double_decode = true,
+    u_encode = true,
     bare_byte = true,
     iis_unicode = true,
     iis_backslash = true,
@@ -335,10 +339,11 @@ iis_50 =
     non_strict = true,
     normalize_utf = true,
     normalize_javascript = false,
-    max_hdr_len = 0,
+    max_header_length = 0,
     max_headers = 0,
     max_spaces = 200,
-    max_javascript_whitespaces = 200
+    max_javascript_whitespaces = 200,
+    whitespace_chars ='0x9 0xb 0xc 0xd'
 }
 
 ftp_commands =  -- build from ftp_default_commands

diff --git a/src/service_inspectors/http_inspect/hi_module.cc b/src/service_inspectors/http_inspect/hi_module.cc
index cf5ebaffce487fc7c0deb966141e2735eecbd200..ff787e3e4122c1d6d2ed5d5e24f829b445032360 100644 (file)
--- a/src/service_inspectors/http_inspect/hi_module.cc
+++ b/src/service_inspectors/http_inspect/hi_module.cc
@@ -323,6 +323,9 @@ static const Parameter hi_profile_server_params[] =
     { "normalize_utf", Parameter::PT_BOOL, nullptr, "true",
       "normalize response bodies with UTF content-types" },
 
+    { "normalize_javascript", Parameter::PT_BOOL, nullptr, "true",
+      "normalize javascript between <script> tags" },
+
     { "post_depth", Parameter::PT_INT, "-1:65535", "65495",
       "amount of POST data to inspect" },
 
@@ -392,9 +395,6 @@ static const Parameter hi_server_params[] =
     { "normalize_headers", Parameter::PT_BOOL, nullptr, "false",
       "normalize headers other than cookie similar to URI" },
 
-    { "normalize_javascript", Parameter::PT_BOOL, nullptr, "true",
-      "normalize javascript between <script> tags" },
-
     { "oversize_dir_length", Parameter::PT_INT, "0:", "500",
       "alert if a URL has a directory longer than this limit" },
 

diff --git a/src/service_inspectors/http_inspect/hi_ui_config.h b/src/service_inspectors/http_inspect/hi_ui_config.h
index b02e2800cb3e4ae4721ca7ccbfc51956b1c6ec52..c8c7db3929a9395994499de0882115a6f6360376 100644 (file)
--- a/src/service_inspectors/http_inspect/hi_ui_config.h
+++ b/src/service_inspectors/http_inspect/hi_ui_config.h
@@ -70,6 +70,7 @@ struct HTTPINSPECT_CONF_OPT
  * and debugging information. */
 enum PROFILES
 {
+    HI_NONE,
     HI_ALL,
     HI_APACHE,
     HI_IIS,

diff --git a/tools/snort2lua/preprocessor_states/pps_http_inspect_server.cc b/tools/snort2lua/preprocessor_states/pps_http_inspect_server.cc
index 659be7f9d42efb9a60e9f968552f03f12d23939f..f06f649779967adbacf4e66f953bb511e6271079 100644 (file)
--- a/tools/snort2lua/preprocessor_states/pps_http_inspect_server.cc
+++ b/tools/snort2lua/preprocessor_states/pps_http_inspect_server.cc
@@ -116,7 +116,12 @@ bool HttpInspectServer::convert(std::istringstream& data_stream)
             tmpval = table_api.add_option("unlimited_decompress", true);
 
         else if (!keyword.compare("normalize_javascript"))
+        {
+            table_api.add_diff_option_comment("normalize_javascript", "profile.normalize_javascript");
+            table_api.open_table("profile");
             tmpval = table_api.add_option("normalize_javascript", true);
+            table_api.close_table();
+        }
 
         else if (!keyword.compare("enable_xff"))
             tmpval = table_api.add_option("enable_xff", true);
@@ -423,6 +428,8 @@ bool HttpInspectServer::convert(std::istringstream& data_stream)
 
         else if (!keyword.compare("profile"))
         {
+            table_api.open_table("profile");
+
             if (data_stream >> keyword)
             {
                 tmpval = table_api.add_option("profile", keyword);
@@ -432,6 +439,8 @@ bool HttpInspectServer::convert(std::istringstream& data_stream)
                 data_api.failed_conversion(data_stream, "profile <string>");
                 retval = false;
             }
+
+            table_api.close_table();
         }
 
         else