From: Mike Stepanek (mstepane) <mstepane@cisco.com>
Date: Fri, 12 Jun 2020 17:16:16 +0000 (+0000)
Subject: Merge pull request #2253 in SNORT/snort3 from ~KATHARVE/snort3:h2i_infraction_fix... 
X-Git-Tag: 3.0.1-5~13
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1d45083d8a414a0557a64922029124047aaf250a;p=thirdparty%2Fsnort3.git

Merge pull request #2253 in SNORT/snort3 from ~KATHARVE/snort3:h2i_infraction_fix to master

Squashed commit of the following:

commit 5a681a75529c10aef7f6efd802f91e7673ec4ff5
Author: Katura Harvey <katharve@cisco.com>
Date:   Tue Jun 9 12:32:36 2020 -0400

    http2_inspect: fix hpack infractions
---

diff --git a/src/service_inspectors/http2_inspect/http2_data_frame.cc b/src/service_inspectors/http2_inspect/http2_data_frame.cc
index 06dd661ca..c4ae5d36b 100644
--- a/src/service_inspectors/http2_inspect/http2_data_frame.cc
+++ b/src/service_inspectors/http2_inspect/http2_data_frame.cc
@@ -99,3 +99,11 @@ void Http2DataFrame::update_stream_state()
             assert(false);
     }
 }
+
+#ifdef REG_TEST
+void Http2DataFrame::print_frame(FILE* output)
+{
+    fprintf(output, "Data frame\n");
+    Http2Frame::print_frame(output);
+}
+#endif
diff --git a/src/service_inspectors/http2_inspect/http2_data_frame.h b/src/service_inspectors/http2_inspect/http2_data_frame.h
index 5ee0d9997..b16db7c75 100644
--- a/src/service_inspectors/http2_inspect/http2_data_frame.h
+++ b/src/service_inspectors/http2_inspect/http2_data_frame.h
@@ -38,6 +38,10 @@ public:
     friend Http2Frame* Http2Frame::new_frame(const uint8_t*, const int32_t, const uint8_t*,
         const int32_t, Http2FlowData*, HttpCommon::SourceId, Http2Stream* stream);
 
+#ifdef REG_TEST
+    void print_frame(FILE* output) override;
+#endif
+
 private:
     Http2DataFrame(const uint8_t* header_buffer, const int32_t header_len,
         const uint8_t* data_buffer, const int32_t data_len, Http2FlowData* ssn_data,
diff --git a/src/service_inspectors/http2_inspect/http2_flow_data.cc b/src/service_inspectors/http2_inspect/http2_flow_data.cc
index 0a559b58a..89d8d0551 100644
--- a/src/service_inspectors/http2_inspect/http2_flow_data.cc
+++ b/src/service_inspectors/http2_inspect/http2_flow_data.cc
@@ -46,7 +46,10 @@ Http2FlowData::Http2FlowData(Flow* flow_) :
     FlowData(inspector_id),
     flow(flow_),
     hi((HttpInspect*)(flow->assistant_gadget)),
-    hpack_decoder{Http2HpackDecoder(this, SRC_CLIENT), Http2HpackDecoder(this, SRC_SERVER)}
+    hpack_decoder { Http2HpackDecoder(this, SRC_CLIENT, events[SRC_CLIENT],
+                        infractions[SRC_CLIENT]),
+                    Http2HpackDecoder(this, SRC_SERVER, events[SRC_SERVER],
+                        infractions[SRC_SERVER]) }
 {
     if (hi != nullptr)
     {
diff --git a/src/service_inspectors/http2_inspect/http2_flow_data.h b/src/service_inspectors/http2_inspect/http2_flow_data.h
index 974f2d050..53608c229 100644
--- a/src/service_inspectors/http2_inspect/http2_flow_data.h
+++ b/src/service_inspectors/http2_inspect/http2_flow_data.h
@@ -103,6 +103,11 @@ protected:
 
     // 0 element refers to client frame, 1 element refers to server frame
 
+    // There is currently one infraction and one event object per flow per direction. This may
+    // change in the future.
+    Http2Infractions* const infractions[2] = { new Http2Infractions, new Http2Infractions };
+    Http2EventGen* const events[2] = { new Http2EventGen, new Http2EventGen };
+
     // Stream ID of the frame currently being read in and processed
     uint32_t current_stream[2] = { Http2Enums::NO_STREAM_ID, Http2Enums::NO_STREAM_ID };
     // At any given time there may be different streams going in each direction. But only one of
@@ -151,11 +156,6 @@ protected:
     uint8_t padding_octets_in_frame[2] = { 0, 0 };
     bool get_padding_len[2] = { false, false };
 
-    // These will eventually be moved over to the frame/stream object, as they are moved to the
-    // transaction in NHI. Also as in NHI accessor methods will need to be added.
-    Http2Infractions* infractions[2] = { new Http2Infractions, new Http2Infractions };
-    Http2EventGen* events[2] = { new Http2EventGen, new Http2EventGen };
-
 #ifdef REG_TEST
     static uint64_t instance_count;
     uint64_t seq_num;
diff --git a/src/service_inspectors/http2_inspect/http2_headers_frame.cc b/src/service_inspectors/http2_inspect/http2_headers_frame.cc
index 07098c605..a3b60dc05 100644
--- a/src/service_inspectors/http2_inspect/http2_headers_frame.cc
+++ b/src/service_inspectors/http2_inspect/http2_headers_frame.cc
@@ -74,8 +74,7 @@ Http2HeadersFrame::Http2HeadersFrame(const uint8_t* header_buffer, const int32_t
 
     // Decode headers
     if (!hpack_decoder.decode_headers((data.start() + hpack_headers_offset), data.length() -
-        hpack_headers_offset, decoded_headers, start_line_generator,
-        session_data->events[source_id], session_data->infractions[source_id]))
+        hpack_headers_offset, decoded_headers, start_line_generator))
     {
         session_data->frame_type[source_id] = FT__ABORT;
         error_during_decode = true;
@@ -247,7 +246,7 @@ void Http2HeadersFrame::update_stream_state()
 void Http2HeadersFrame::print_frame(FILE* output)
 {
     if (!trailer)
-        fprintf(output, "\nHeaders frame\n");
+        fprintf(output, "Headers frame\n");
     else
         fprintf(output, "Trailing Headers frame\n");
     if (error_during_decode)
diff --git a/src/service_inspectors/http2_inspect/http2_hpack.cc b/src/service_inspectors/http2_inspect/http2_hpack.cc
index 5afa143c0..c58c13482 100644
--- a/src/service_inspectors/http2_inspect/http2_hpack.cc
+++ b/src/service_inspectors/http2_inspect/http2_hpack.cc
@@ -94,7 +94,7 @@ bool Http2HpackDecoder::decode_indexed_name(const uint8_t* encoded_header_buffer
 
     if (!entry)
     {
-        infractions += INF_HPACK_INDEX_OUT_OF_BOUNDS;
+        *infractions += INF_HPACK_INDEX_OUT_OF_BOUNDS;
         events->create_event(EVENT_MISFORMATTED_HTTP2);
         return false;
     }
@@ -199,7 +199,7 @@ bool Http2HpackDecoder::decode_literal_header_line(const uint8_t* encoded_header
         // table exceeds the Snort hard-coded limit of 512
         if (!decode_table.add_index(name, value))
         {
-            infractions += INF_DYNAMIC_TABLE_OVERFLOW;
+            *infractions += INF_DYNAMIC_TABLE_OVERFLOW;
             events->create_event(EVENT_DYNAMIC_TABLE_OVERFLOW);
             return false;
         }
@@ -226,14 +226,14 @@ bool Http2HpackDecoder::decode_indexed_header(const uint8_t* encoded_header_buff
 
     if (!entry)
     {
-        infractions += INF_HPACK_INDEX_OUT_OF_BOUNDS;
+        *infractions += INF_HPACK_INDEX_OUT_OF_BOUNDS;
         events->create_event(EVENT_MISFORMATTED_HTTP2);
         return false;
     }
 
     if (entry->value.length() <= 0)
     {
-        infractions += INF_LOOKUP_EMPTY_VALUE;
+        *infractions += INF_LOOKUP_EMPTY_VALUE;
         events->create_event(EVENT_MISFORMATTED_HTTP2);
     }
 
@@ -353,8 +353,7 @@ bool Http2HpackDecoder::decode_header_line(const uint8_t* encoded_header_buffer,
 // get_start_line() and get_decoded_headers() to generate and obtain these fields.
 bool Http2HpackDecoder::decode_headers(const uint8_t* encoded_headers,
     const uint32_t encoded_headers_length, uint8_t* decoded_headers,
-    Http2StartLine *start_line_generator, Http2EventGen* stream_events,
-    Http2Infractions* stream_infractions)
+    Http2StartLine *start_line_generator)
 {
     uint32_t total_bytes_consumed = 0;
     uint32_t line_bytes_consumed = 0;
@@ -362,8 +361,6 @@ bool Http2HpackDecoder::decode_headers(const uint8_t* encoded_headers,
     bool success = true;
     start_line = start_line_generator;
     decoded_headers_size = 0;
-    events = stream_events;
-    infractions = stream_infractions;
     pseudo_headers_fragment_size = 0;
     decode_error = false;
 
diff --git a/src/service_inspectors/http2_inspect/http2_hpack.h b/src/service_inspectors/http2_inspect/http2_hpack.h
index 54a56a6f4..ce554d981 100644
--- a/src/service_inspectors/http2_inspect/http2_hpack.h
+++ b/src/service_inspectors/http2_inspect/http2_hpack.h
@@ -35,11 +35,11 @@ class Http2StartLine;
 class Http2HpackDecoder
 {
 public:
-    Http2HpackDecoder(Http2FlowData* flow_data, HttpCommon::SourceId src_id) :
-        decode_table(flow_data, src_id) { }
+    Http2HpackDecoder(Http2FlowData* flow_data, HttpCommon::SourceId src_id,
+        Http2EventGen* const _events, Http2Infractions* const _infractions) :
+        events(_events), infractions(_infractions), decode_table(flow_data, src_id) { }
     bool decode_headers(const uint8_t* encoded_headers, const uint32_t encoded_headers_length,
-        uint8_t* decoded_headers, Http2StartLine* start_line,
-        Http2EventGen* stream_events, Http2Infractions* stream_infractions);
+        uint8_t* decoded_headers, Http2StartLine* start_line);
     bool write_decoded_headers(const uint8_t* in_buffer, const uint32_t in_length,
         uint8_t* decoded_header_buffer, uint32_t decoded_header_length, uint32_t& bytes_written);
     bool decode_header_line(const uint8_t* encoded_header_buffer,
@@ -76,8 +76,8 @@ private:
     uint32_t decoded_headers_size;
     uint32_t pseudo_headers_fragment_size;
     bool decode_error;
-    Http2EventGen* events;
-    Http2Infractions* infractions;
+    Http2EventGen* const events;
+    Http2Infractions* const infractions;
 
     static Http2HpackIntDecode decode_int7;
     static Http2HpackIntDecode decode_int6;
diff --git a/src/service_inspectors/http2_inspect/http2_hpack_int_decode.cc b/src/service_inspectors/http2_inspect/http2_hpack_int_decode.cc
index c595d2992..289698cc0 100644
--- a/src/service_inspectors/http2_inspect/http2_hpack_int_decode.cc
+++ b/src/service_inspectors/http2_inspect/http2_hpack_int_decode.cc
@@ -36,8 +36,8 @@ Http2HpackIntDecode::Http2HpackIntDecode(uint8_t prefix) : prefix_mask(((uint16_
 }
 
 bool Http2HpackIntDecode::translate(const uint8_t* in_buff, const uint32_t in_len,
-    uint32_t& bytes_consumed, uint64_t& result, Http2EventGen* events,
-    Http2Infractions* infractions) const
+    uint32_t& bytes_consumed, uint64_t& result, Http2EventGen* const events,
+    Http2Infractions* const infractions) const
 {
     bytes_consumed = 0;
     result = 0;
diff --git a/src/service_inspectors/http2_inspect/http2_hpack_int_decode.h b/src/service_inspectors/http2_inspect/http2_hpack_int_decode.h
index 372ac591d..f4ae9732a 100644
--- a/src/service_inspectors/http2_inspect/http2_hpack_int_decode.h
+++ b/src/service_inspectors/http2_inspect/http2_hpack_int_decode.h
@@ -35,7 +35,7 @@ class Http2HpackIntDecode
 public:
     Http2HpackIntDecode(uint8_t prefix);
     bool translate(const uint8_t* in_buff, const uint32_t in_len, uint32_t& bytes_consumed,
-        uint64_t& result, Http2EventGen* events, Http2Infractions* infractions) const;
+        uint64_t& result, Http2EventGen* const events, Http2Infractions* const infractions) const;
 
 private:
     const uint8_t prefix_mask;
diff --git a/src/service_inspectors/http2_inspect/http2_hpack_string_decode.cc b/src/service_inspectors/http2_inspect/http2_hpack_string_decode.cc
index d8e03da99..7dabf1428 100644
--- a/src/service_inspectors/http2_inspect/http2_hpack_string_decode.cc
+++ b/src/service_inspectors/http2_inspect/http2_hpack_string_decode.cc
@@ -38,7 +38,7 @@ static const uint8_t min_decode_len[HUFFMAN_LOOKUP_MAX + 1] =
 
 bool Http2HpackStringDecode::translate(const uint8_t* in_buff, const uint32_t in_len,
     uint32_t& bytes_consumed, uint8_t* out_buff, const uint32_t out_len, uint32_t& bytes_written,
-    Http2EventGen* events, Http2Infractions* infractions) const
+    Http2EventGen* const events, Http2Infractions* const infractions) const
 {
     bytes_consumed = 0;
     bytes_written = 0;
@@ -77,7 +77,7 @@ bool Http2HpackStringDecode::translate(const uint8_t* in_buff, const uint32_t in
 
 bool Http2HpackStringDecode::get_string(const uint8_t* in_buff, const uint32_t encoded_len,
     uint32_t& bytes_consumed, uint8_t* out_buff, const uint32_t out_len, uint32_t& bytes_written,
-    Http2EventGen* events, Http2Infractions* infractions) const
+    Http2EventGen* const events, Http2Infractions* const infractions) const
 {
     if (encoded_len > out_len)
     {
@@ -141,7 +141,7 @@ bool Http2HpackStringDecode::get_next_byte(const uint8_t* in_buff, const uint32_
 
 bool Http2HpackStringDecode::get_huffman_string(const uint8_t* in_buff, const uint32_t encoded_len,
     uint32_t& bytes_consumed, uint8_t* out_buff, const uint32_t out_len, uint32_t& bytes_written,
-    Http2EventGen* events, Http2Infractions* infractions) const
+    Http2EventGen* const events, Http2Infractions* const infractions) const
 {
     const uint32_t last_encoded_byte = bytes_consumed + encoded_len;
     uint8_t byte;
diff --git a/src/service_inspectors/http2_inspect/http2_hpack_string_decode.h b/src/service_inspectors/http2_inspect/http2_hpack_string_decode.h
index 8bc29727d..7869ec377 100644
--- a/src/service_inspectors/http2_inspect/http2_hpack_string_decode.h
+++ b/src/service_inspectors/http2_inspect/http2_hpack_string_decode.h
@@ -33,15 +33,15 @@ public:
     Http2HpackStringDecode() : decode7(7) { }
     bool translate(const uint8_t* in_buff, const uint32_t in_len, uint32_t& bytes_consumed,
         uint8_t* out_buff, const uint32_t out_len, uint32_t& bytes_written,
-        Http2EventGen* events, Http2Infractions* infractions) const;
+        Http2EventGen* const events, Http2Infractions* const infractions) const;
 
 private:
     bool get_string(const uint8_t* in_buff, const uint32_t encoded_len, uint32_t& bytes_consumed,
-        uint8_t* out_buff, const uint32_t out_len, uint32_t& bytes_written, Http2EventGen* events,
-        Http2Infractions* infractions) const;
+        uint8_t* out_buff, const uint32_t out_len, uint32_t& bytes_written, Http2EventGen* const
+        events, Http2Infractions* const infractions) const;
     bool get_huffman_string(const uint8_t* in_buff, const uint32_t encoded_len,
         uint32_t& bytes_consumed, uint8_t* out_buff, const uint32_t out_len, uint32_t&
-        bytes_written, Http2EventGen* events, Http2Infractions* infractions) const;
+        bytes_written, Http2EventGen* const events, Http2Infractions* const infractions) const;
     bool get_next_byte(const uint8_t* in_buff, const uint32_t last_byte,
         uint32_t& bytes_consumed, uint8_t& cur_bit, uint8_t match_len, uint8_t& byte,
         bool& another_search) const;
diff --git a/src/service_inspectors/http2_inspect/http2_inspect.cc b/src/service_inspectors/http2_inspect/http2_inspect.cc
index 607910d65..cfc889052 100644
--- a/src/service_inspectors/http2_inspect/http2_inspect.cc
+++ b/src/service_inspectors/http2_inspect/http2_inspect.cc
@@ -38,6 +38,8 @@ using namespace snort;
 using namespace HttpCommon;
 using namespace Http2Enums;
 
+static void print_flow_issues(FILE*, Http2Infractions* const, Http2EventGen* const);
+
 Http2Inspect::Http2Inspect(const Http2ParaList* params_) : params(params_)
 {
 #ifdef REG_TEST
@@ -154,6 +156,8 @@ void Http2Inspect::eval(Packet* p)
             printf("Finished processing section from test %" PRIi64 "\n",
                 HttpTestManager::get_test_number());
         }
+        print_flow_issues(HttpTestManager::get_output_file(), session_data->infractions[source_id],
+            session_data->events[source_id]);
     }
 #endif
 }
@@ -173,3 +177,9 @@ void Http2Inspect::clear(Packet* p)
     stream->clear_frame();
 }
 
+static void print_flow_issues(FILE* output, Http2Infractions* const infractions,
+    Http2EventGen* const events)
+{
+    fprintf(output, "Infractions: %016" PRIx64 ", Events: %016" PRIx64 "\n\n",
+        infractions->get_raw(), events->get_raw());
+}
diff --git a/src/service_inspectors/http2_inspect/http2_request_line.cc b/src/service_inspectors/http2_inspect/http2_request_line.cc
index 18edd85dd..ebfd22630 100644
--- a/src/service_inspectors/http2_inspect/http2_request_line.cc
+++ b/src/service_inspectors/http2_inspect/http2_request_line.cc
@@ -60,7 +60,7 @@ void Http2RequestLine::process_pseudo_header_name(const uint8_t* const& name, ui
         value_coming = SCHEME;
     else
     {
-        infractions += INF_INVALID_PSEUDO_HEADER;
+        *infractions += INF_INVALID_PSEUDO_HEADER;
         events->create_event(EVENT_INVALID_HEADER);
         value_coming = HEADER__INVALID;
     }
@@ -100,7 +100,7 @@ bool Http2RequestLine::generate_start_line()
     {
         if (method.length() <= 0)
         {
-            infractions += INF_PSEUDO_HEADER_URI_FORM_MISMATCH;
+            *infractions += INF_PSEUDO_HEADER_URI_FORM_MISMATCH;
             events->create_event(EVENT_REQUEST_WITHOUT_REQUIRED_FIELD);
             return false;
         }
@@ -127,14 +127,14 @@ bool Http2RequestLine::generate_start_line()
         // FIXIT-L May want to be more lenient than RFC on generating start line
         if (authority.length() <= 0)
         {
-            infractions += INF_PSEUDO_HEADER_URI_FORM_MISMATCH;
+            *infractions += INF_PSEUDO_HEADER_URI_FORM_MISMATCH;
             events->create_event(EVENT_REQUEST_WITHOUT_REQUIRED_FIELD);
             return false;
         }
         // Should not have a scheme or path
         if ( scheme.length() > 0 or path.length() > 0)
         {
-            infractions += INF_PSEUDO_HEADER_URI_FORM_MISMATCH;
+            *infractions += INF_PSEUDO_HEADER_URI_FORM_MISMATCH;
             events->create_event(EVENT_INVALID_HEADER);
         }
         start_line_length = method.length() + authority.length() + http_version_length +
@@ -202,7 +202,7 @@ bool Http2RequestLine::generate_start_line()
     else
     {
         // FIXIT-L May want to be more lenient than RFC on generating start line
-        infractions += INF_PSEUDO_HEADER_URI_FORM_MISMATCH;
+        *infractions += INF_PSEUDO_HEADER_URI_FORM_MISMATCH;
         events->create_event(EVENT_MISFORMATTED_HTTP2);
         return false;
     }
diff --git a/src/service_inspectors/http2_inspect/http2_request_line.h b/src/service_inspectors/http2_inspect/http2_request_line.h
index f83f08898..db76a765b 100644
--- a/src/service_inspectors/http2_inspect/http2_request_line.h
+++ b/src/service_inspectors/http2_inspect/http2_request_line.h
@@ -34,10 +34,11 @@ public:
     bool generate_start_line() override;
 
     friend Http2StartLine* Http2StartLine::new_start_line_generator(HttpCommon::SourceId source_id,
-        Http2EventGen* events, Http2Infractions* infractions);
+        Http2EventGen* const events, Http2Infractions* const infractions);
 
 private:
-    Http2RequestLine(Http2EventGen* evs, Http2Infractions* infrs) : Http2StartLine(evs, infrs) { }
+    Http2RequestLine(Http2EventGen* const evs, Http2Infractions* const infrs) :
+        Http2StartLine(evs, infrs) { }
 
     Field method;
     Field path;
diff --git a/src/service_inspectors/http2_inspect/http2_settings_frame.cc b/src/service_inspectors/http2_inspect/http2_settings_frame.cc
index 943350c2d..bee617999 100644
--- a/src/service_inspectors/http2_inspect/http2_settings_frame.cc
+++ b/src/service_inspectors/http2_inspect/http2_settings_frame.cc
@@ -119,7 +119,7 @@ void Http2SettingsFrame::handle_update(uint16_t id, uint32_t value)
 #ifdef REG_TEST
 void Http2SettingsFrame::print_frame(FILE* output)
 {
-    fprintf(output, "Settings frame:");
+    fprintf(output, "\nSettings frame:");
 
     if (bad_frame)
         fprintf(output, " Error in settings frame.");
@@ -130,7 +130,6 @@ void Http2SettingsFrame::print_frame(FILE* output)
 
     fprintf(output, "\n");
     Http2Frame::print_frame(output);
-    fprintf(output, "\n");
 }
 #endif
 
diff --git a/src/service_inspectors/http2_inspect/http2_start_line.cc b/src/service_inspectors/http2_inspect/http2_start_line.cc
index 7b9dc9be8..aeb99056d 100644
--- a/src/service_inspectors/http2_inspect/http2_start_line.cc
+++ b/src/service_inspectors/http2_inspect/http2_start_line.cc
@@ -42,7 +42,7 @@ Http2StartLine::~Http2StartLine()
 }
 
 Http2StartLine* Http2StartLine::new_start_line_generator(SourceId source_id,
-        Http2EventGen* events, Http2Infractions* infractions)
+    Http2EventGen* const events, Http2Infractions* const infractions)
 {
     if (source_id == SRC_CLIENT)
         return new Http2RequestLine(events, infractions);
@@ -54,7 +54,7 @@ void Http2StartLine::process_pseudo_header_precheck()
 {
     if (finalized)
     {
-        infractions += INF_PSEUDO_HEADER_AFTER_REGULAR_HEADER;
+        *infractions += INF_PSEUDO_HEADER_AFTER_REGULAR_HEADER;
         events->create_event(EVENT_INVALID_HEADER);
     }
 }
diff --git a/src/service_inspectors/http2_inspect/http2_start_line.h b/src/service_inspectors/http2_inspect/http2_start_line.h
index ea68fc2a4..0ffeceb0b 100644
--- a/src/service_inspectors/http2_inspect/http2_start_line.h
+++ b/src/service_inspectors/http2_inspect/http2_start_line.h
@@ -37,7 +37,7 @@ class Http2StartLine
 {
 public:
     static Http2StartLine* new_start_line_generator(HttpCommon::SourceId source_id,
-        Http2EventGen* events, Http2Infractions* infractions);
+        Http2EventGen* const events, Http2Infractions* const infractions);
 
     virtual ~Http2StartLine();
 
@@ -45,21 +45,22 @@ public:
 
     const Field* get_start_line();
     virtual void process_pseudo_header_name(const uint8_t* const& name, uint32_t length) = 0;
-    virtual void process_pseudo_header_value(const uint8_t* const& value, const uint32_t length) = 0;
+    virtual void process_pseudo_header_value(const uint8_t* const& value, const uint32_t length) =
+        0;
     bool finalize();
     bool is_finalized() { return finalized; }
     bool is_pseudo_value() { return value_coming != Http2Enums::HEADER__NONE; }
     bool is_pseudo_name(const uint8_t* const& name) { return name[0] == ':'; }
 
 protected:
-    Http2StartLine(Http2EventGen* events, Http2Infractions* infractions)   : events(events),
-        infractions(infractions) { }
+    Http2StartLine(Http2EventGen* const events, Http2Infractions* const infractions) :
+        events(events), infractions(infractions) { }
 
     void process_pseudo_header_precheck();
     virtual bool generate_start_line() = 0;
 
-    Http2EventGen* events;
-    Http2Infractions* infractions;
+    Http2EventGen* const events;
+    Http2Infractions* const infractions;
     bool finalized = false;
     uint32_t start_line_length = 0;
     uint8_t *start_line_buffer = nullptr;
diff --git a/src/service_inspectors/http2_inspect/http2_status_line.cc b/src/service_inspectors/http2_inspect/http2_status_line.cc
index 12f6f4630..6b5998431 100644
--- a/src/service_inspectors/http2_inspect/http2_status_line.cc
+++ b/src/service_inspectors/http2_inspect/http2_status_line.cc
@@ -45,7 +45,7 @@ void Http2StatusLine::process_pseudo_header_name(const uint8_t* const& name, uin
         value_coming = STATUS;
     else
     {
-        infractions += INF_INVALID_PSEUDO_HEADER;
+        *infractions += INF_INVALID_PSEUDO_HEADER;
         events->create_event(EVENT_INVALID_HEADER);
         value_coming = HEADER__INVALID;
     }
@@ -70,7 +70,7 @@ bool Http2StatusLine::generate_start_line()
 
     if (status.length() <= 0)
     {
-        infractions += INF_RESPONSE_WITHOUT_STATUS;
+        *infractions += INF_RESPONSE_WITHOUT_STATUS;
         events->create_event(EVENT_RESPONSE_WITHOUT_STATUS);
         return false;
     }
diff --git a/src/service_inspectors/http2_inspect/http2_status_line.h b/src/service_inspectors/http2_inspect/http2_status_line.h
index df1def7bb..2ef5dad96 100644
--- a/src/service_inspectors/http2_inspect/http2_status_line.h
+++ b/src/service_inspectors/http2_inspect/http2_status_line.h
@@ -33,10 +33,11 @@ public:
     bool generate_start_line() override;
 
     friend Http2StartLine* Http2StartLine::new_start_line_generator(HttpCommon::SourceId source_id,
-        Http2EventGen* events, Http2Infractions* infractions);
+        Http2EventGen* const events, Http2Infractions* const infractions);
 
 private:
-    Http2StatusLine(Http2EventGen* evs, Http2Infractions* infrs) : Http2StartLine(evs, infrs) { }
+    Http2StatusLine(Http2EventGen* const evs, Http2Infractions* const infrs) :
+        Http2StartLine(evs, infrs) { }
 
     Field status;