From: Tom Peters (thopeter) Date: Thu, 20 Jan 2022 22:08:58 +0000 (+0000) Subject: Pull request #3240: http_inspect: correct comment regarding header splitting rules X-Git-Tag: 3.1.21.0~3 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=49789b58516de4f472d402a3e038f1abb454b91f;p=thirdparty%2Fsnort3.git Pull request #3240: http_inspect: correct comment regarding header splitting rules Merge in SNORT/snort3 from ~THOPETER/snort3:nhttp161 to master Squashed commit of the following: commit a45b01a2e7310d59c53a00c12d6c2077188fc80e Author: Tom Peters Date: Wed Jan 19 17:21:04 2022 -0500 http_inspect: correct comment regarding header splitting rules --- diff --git a/src/service_inspectors/http_inspect/http_cutter.cc b/src/service_inspectors/http_inspect/http_cutter.cc index f96f5b19e..22057be21 100644 --- a/src/service_inspectors/http_inspect/http_cutter.cc +++ b/src/service_inspectors/http_inspect/http_cutter.cc @@ -185,11 +185,12 @@ HttpStartCutter::ValidationResult HttpStatusCutter::validate(uint8_t octet, ScanResult HttpHeaderCutter::cut(const uint8_t* buffer, uint32_t length, HttpInfractions* infractions, HttpEventGen* events, uint32_t, bool, HttpEnums::H2BodyState) { - // Header separators: leading \r\n, leading \n, nonleading \r\n\r\n, nonleading \n\r\n, - // nonleading \r\n\n, and nonleading \n\n. The separator itself becomes num_excess which is - // discarded during reassemble(). + // Header separators: leading \r\n, leading \n, leading \r\r\n, nonleading \r\n\r\n, nonleading + // \n\r\n, nonleading \r\r\n, nonleading \r\n\n, and nonleading \n\n. The separator itself + // becomes num_excess which is discarded during reassemble(). // \r without \n can (improperly) end the start line or a header line, but not the entire // header block. + // The leading cases work as described because the initial state is ONE. for (uint32_t k = 0; k < length; k++) { switch (state)