From: Bhagyashree Bantwal <bbantwal@cisco.com>
Date: Thu, 8 Jan 2015 15:57:18 +0000 (-0500)
Subject: Http Inspect Profile changes to Snort++
X-Git-Tag: 3.0.0-233~1092
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a0fd9654492ca2cb2da037dccebeb60cc66b0553;p=thirdparty%2Fsnort3.git

Http Inspect Profile changes to Snort++
---

diff --git a/lua/snort_defaults.lua b/lua/snort_defaults.lua
index d827c3ed9..2ff570e09 100644
--- a/lua/snort_defaults.lua
+++ b/lua/snort_defaults.lua
@@ -211,6 +211,136 @@ http_methods =  -- build from default_http_methods
     'RPC_IN_DATA', 'RPC_OUT_DATA', 'RPC_ECHO_DATA'
 }
 
+all = 
+{
+    profile_value = 'all',
+    server_flow_depth = 300,
+    client_flow_depth = 300,
+    post_depth = -1,
+    chunk_length = 500000,
+    ascii = true,
+    multiple_slash = true,
+    directory = true,
+    webroot = true,
+    double_decoding = true,
+    u_encoding = true,
+    bare_byte = true,
+    iis_unicode = true,
+    iis_backslash = true,
+    iis_delimiter = true,
+    apache_whitespace = true,
+    non_strict = true,
+    normalize_utf = true,
+    normalize_javascript = false,
+    max_hdr_len = 0,
+    max_headers = 0,
+    max_spaces = 200,
+    max_javascript_whitespaces = 200
+}
+
+apache = 
+{
+    profile_value = 'apache',
+    server_flow_depth = 300,
+    client_flow_depth = 300,
+    post_depth = -1,
+    chunk_length = 500000,
+    ascii = true,
+    multiple_slash = true,
+    directory = true,
+    webroot = true,
+    utf_8 = true,
+    apache_whitespace = true,
+    non_strict = true,
+    normalize_utf = true,
+    normalize_javascript = false,
+    max_hdr_len = 0,
+    max_headers = 0,
+    max_spaces = 200,
+    max_javascript_whitespaces = 200
+}
+
+iis = 
+{
+    profile_value = 'iis',
+    server_flow_depth = 300,
+    client_flow_depth = 300,
+    post_depth = -1,
+    chunk_length = 500000,
+    ascii = true,
+    multiple_slash = true,
+    directory = true,
+    webroot = true,
+    double_decoding = false,
+    u_encoding = true,
+    bare_byte = true,
+    iis_unicode = true,
+    iis_backslash = true,
+    iis_delimiter = true,
+    apache_whitespace = true,
+    non_strict = true,
+    normalize_utf = true,
+    normalize_javascript = false,
+    max_hdr_len = 0,
+    max_headers = 0,
+    max_spaces = 200,
+    max_javascript_whitespaces = 200
+}
+
+iis_40 = 
+{
+    profile_value = 'iis_40',
+    server_flow_depth = 300,
+    client_flow_depth = 300,
+    post_depth = -1,
+    chunk_length = 500000,
+    ascii = true,
+    multiple_slash = true,
+    directory = true,
+    webroot = true,
+    double_decoding = true,
+    u_encoding = true,
+    bare_byte = true,
+    iis_unicode = true,
+    iis_backslash = true,
+    iis_delimiter = true,
+    apache_whitespace = true,
+    non_strict = true,
+    normalize_utf = true,
+    normalize_javascript = false,
+    max_hdr_len = 0,
+    max_headers = 0,
+    max_spaces = 200,
+    max_javascript_whitespaces = 200
+}
+
+iis_50 = 
+{
+    profile_value = 'iis_50',
+    server_flow_depth = 300,
+    client_flow_depth = 300,
+    post_depth = -1,
+    chunk_length = 500000,
+    ascii = true,
+    multiple_slash = true,
+    directory = true,
+    webroot = true,
+    double_decoding = true,
+    u_encoding = true,
+    bare_byte = true,
+    iis_unicode = true,
+    iis_backslash = true,
+    iis_delimiter = true,
+    apache_whitespace = true,
+    non_strict = true,
+    normalize_utf = true,
+    normalize_javascript = false,
+    max_hdr_len = 0,
+    max_headers = 0,
+    max_spaces = 200,
+    max_javascript_whitespaces = 200
+}
+
 ftp_commands =  -- build from ftp_default_commands
 {
     'ABOR', 'ACCT', 'ADAT', 'ALLO', 'APPE', 'AUTH', 'CCC', 'CDUP', 'CEL',
diff --git a/src/service_inspectors/http_inspect/hi_module.cc b/src/service_inspectors/http_inspect/hi_module.cc
index 5cdad582c..0710a71ac 100644
--- a/src/service_inspectors/http_inspect/hi_module.cc
+++ b/src/service_inspectors/http_inspect/hi_module.cc
@@ -267,11 +267,8 @@ bool HttpInspectModule::end(const char* fqn, int, SnortConfig*)
 // different profiles (like above) and use those.  rename existing profile
 // to profile_type.
 
-static const Parameter hi_server_params[] =
+static const Parameter hi_profile_server_params[] =
 {
-    { "allow_proxy_use", Parameter::PT_BOOL, nullptr, "false",
-      "don't alert on proxy use for this server" },
-
     { "apache_whitespace", Parameter::PT_BOOL, nullptr, "false",
       "don't alert if tab is used in lieu of space characters" },
 
@@ -294,6 +291,69 @@ static const Parameter hi_server_params[] =
     { "double_decode", Parameter::PT_BOOL, nullptr, "false",
       "iis specific extra decoding" },
 
+    { "iis_backslash", Parameter::PT_BOOL, nullptr, "false",
+      "normalize directory slashes" },
+
+    { "iis_delimiter", Parameter::PT_BOOL, nullptr, "false",
+      "allow use of non-standard delimiter" },
+
+    { "iis_unicode", Parameter::PT_BOOL, nullptr, "false",
+      "enable unicode code point mapping using unicode_map settings" },
+
+    { "iis_unicode_map", Parameter::PT_TABLE, hi_umap_params, nullptr,
+      "server unicode map configuration" },
+
+    { "max_header_length", Parameter::PT_INT, "0:65535", "750",
+      "maximum allowed client request header field" },
+
+    { "max_headers", Parameter::PT_INT, "0:1024", "100",
+      "maximum allowed client request headers" },
+
+    { "max_spaces", Parameter::PT_INT, "0:65535", "200",
+      "maximum allowed whitespaces when folding" },
+
+    { "multi_slash", Parameter::PT_BOOL, nullptr, "false",
+      "normalize out consecutive slashes in URI" },
+
+    { "non_strict", Parameter::PT_BOOL, nullptr, "true",
+      "allows HTTP 0.9 processing" },
+
+    { "max_javascript_whitespaces", Parameter::PT_INT, "0:", "200",
+      "maximum number of consecutive whitespaces" },
+
+    { "normalize_utf", Parameter::PT_BOOL, nullptr, "true",
+      "normalize response bodies with UTF content-types" },
+
+    { "post_depth", Parameter::PT_INT, "-1:65535", "65495",
+      "amount of POST data to inspect" },
+
+    { "profile_value", Parameter::PT_ENUM, profiles, "none",
+      "set defaults appropriate for selected server" },
+
+    { "server_flow_depth", Parameter::PT_INT, "-1:65535", "0",
+      "response payload to inspect; includes headers with extended_response_inspection" },
+
+    { "u_encode", Parameter::PT_BOOL, nullptr, "true",
+      "decode %uXXXX character sequences" },
+
+    { "utf_8", Parameter::PT_BOOL, nullptr, "false",
+      "decode UTF-8 unicode sequences in URI" },
+
+    { "webroot", Parameter::PT_BOOL, nullptr, "false",
+      "alert on directory traversals past the top level (web server root)" },
+
+    { "whitespace_chars", Parameter::PT_BIT_LIST, "255", nullptr,
+      "allowed white space characters" },
+
+    { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
+};
+
+
+static const Parameter hi_server_params[] =
+{
+    { "allow_proxy_use", Parameter::PT_BOOL, nullptr, "false",
+      "don't alert on proxy use for this server" },
+
     { "enable_cookies", Parameter::PT_BOOL, nullptr, "true",
       "extract cookies" },
 
@@ -309,18 +369,6 @@ static const Parameter hi_server_params[] =
     { "http_methods", Parameter::PT_STRING, nullptr, default_methods,
       "request methods allowed in addition to GET and POST" },
 
-    { "iis_backslash", Parameter::PT_BOOL, nullptr, "false",
-      "normalize directory slashes" },
-
-    { "iis_delimiter", Parameter::PT_BOOL, nullptr, "false",
-      "allow use of non-standard delimiter" },
-
-    { "iis_unicode", Parameter::PT_BOOL, nullptr, "false",
-      "enable unicode code point mapping using unicode_map settings" },
-
-    { "iis_unicode_map", Parameter::PT_TABLE, hi_umap_params, nullptr,
-      "server unicode map configuration" },
-
     { "inspect_gzip", Parameter::PT_BOOL, nullptr, "true",
       "enable gzip decompression of compressed bodies" },
 
@@ -333,27 +381,12 @@ static const Parameter hi_server_params[] =
     { "log_uri", Parameter::PT_BOOL, nullptr, "false",
       "enable logging of URI with unified2 alerts as extra data" },
 
-    { "max_header_length", Parameter::PT_INT, "0:65535", "750",
-      "maximum allowed client request header field" },
-
-    { "max_headers", Parameter::PT_INT, "0:1024", "100",
-      "maximum allowed client request headers" },
-
-    { "max_spaces", Parameter::PT_INT, "0:65535", "200",
-      "maximum allowed whitespaces when folding" },
-
-    { "multi_slash", Parameter::PT_BOOL, nullptr, "false",
-      "normalize out consecutive slashes in URI" },
-
     { "no_pipeline_req", Parameter::PT_BOOL, nullptr, "false",
       "don't inspect pipelined requests after first (still does general detection)" },
 
     { "non_rfc_chars", Parameter::PT_BIT_LIST, "255", default_non_rfc_chars,
       "alert on given non-RFC chars being present in the URI" },
 
-    { "non_strict", Parameter::PT_BOOL, nullptr, "true",
-      "allows HTTP 0.9 processing" },
-
     { "normalize_cookies", Parameter::PT_BOOL, nullptr, "false",
       "normalize cookies similar to URI" },
 
@@ -363,24 +396,12 @@ static const Parameter hi_server_params[] =
     { "normalize_javascript", Parameter::PT_BOOL, nullptr, "true",
       "normalize javascript between <script> tags" },
 
-    { "max_javascript_whitespaces", Parameter::PT_INT, "0:", "200",
-      "maximum number of consecutive whitespaces" },
-
-    { "normalize_utf", Parameter::PT_BOOL, nullptr, "true",
-      "normalize response bodies with UTF content-types" },
-
     { "oversize_dir_length", Parameter::PT_INT, "0:", "500",
       "alert if a URL has a directory longer than this limit" },
 
-    { "post_depth", Parameter::PT_INT, "-1:65535", "65495",
-      "amount of POST data to inspect" },
-
-    { "profile", Parameter::PT_ENUM, profiles, "none",
+    { "profile", Parameter::PT_TABLE, hi_profile_server_params, nullptr,
       "set defaults appropriate for selected server" },
 
-    { "server_flow_depth", Parameter::PT_INT, "-1:65535", "0",
-      "response payload to inspect; includes headers with extended_response_inspection" },
-
     { "small_chunk_count", Parameter::PT_INT, "0:255", "5",
       "alert if more than this limit of consecutive chunks are below small_chunk_length" },
 
@@ -390,21 +411,9 @@ static const Parameter hi_server_params[] =
     { "tab_uri_delimiter", Parameter::PT_BOOL, nullptr, "false",
       "whether a tab not preceded by a space is considered a delimiter or part of URI" },
 
-    { "u_encode", Parameter::PT_BOOL, nullptr, "true",
-      "decode %uXXXX character sequences" },
-
     { "unlimited_decompress", Parameter::PT_BOOL, nullptr, "true",
       "decompress across multiple packets" },
 
-    { "utf_8", Parameter::PT_BOOL, nullptr, "false",
-      "decode UTF-8 unicode sequences in URI" },
-
-    { "webroot", Parameter::PT_BOOL, nullptr, "false",
-      "alert on directory traversals past the top level (web server root)" },
-
-    { "whitespace_chars", Parameter::PT_BIT_LIST, "255", nullptr,
-      "allowed white space characters" },
-
     { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
 };
 
@@ -559,7 +568,7 @@ bool HttpServerModule::set(const char*, Value& v, SnortConfig*)
     else if ( v.is("post_depth") )
         server->post_depth = v.get_long();
 
-    else if ( v.is("profile") )
+    else if ( v.is("profile_value") )
         server->profile = (PROFILES)v.get_long();
 
     else if ( v.is("server_flow_depth") )
@@ -595,7 +604,7 @@ bool HttpServerModule::set(const char*, Value& v, SnortConfig*)
     return true;
 }
 
-bool HttpServerModule::begin(const char*, int, SnortConfig*)
+bool HttpServerModule::begin(const char*fqn, int, SnortConfig*)
 {
     if ( !server )
     {
@@ -624,6 +633,13 @@ bool HttpServerModule::end(const char* fqn, int, SnortConfig*)
             server->iis_unicode_map_filename,
             server->iis_unicode_codepage);
     }
+    else
+    {
+        get_default_unicode_map(
+                server->iis_unicode_map,
+                server->iis_unicode_codepage);
+    }
+
     {
         Value v(methods.c_str());
         std::string tok;
diff --git a/src/service_inspectors/http_inspect/hi_ui_config.cc b/src/service_inspectors/http_inspect/hi_ui_config.cc
index 48be839c8..177daa3d0 100644
--- a/src/service_inspectors/http_inspect/hi_ui_config.cc
+++ b/src/service_inspectors/http_inspect/hi_ui_config.cc
@@ -145,235 +145,6 @@ int hi_ui_config_default(HTTPINSPECT_CONF *global_server)
     return HI_SUCCESS;
 }
 
-/*
-**  NAME
-**    hi_ui_set_profile_apache::
-*/
-/**
-**  Set an HTTPINSPECT_CONF to mimic apache configuration.
-**
-**  This sets a server configuration to imitate an apache web server,
-**  and should reduce false positives against systems on which certain
-**  attacks or evasions do not work.  We hope to still log an event,
-**  but one that is less priority.
-**
-**  @param ServerConf pointer to structure HTTPINSPECT_CONF
-**
-**  @return integer
-**
-**  @retval HI_SUCCESS function successful
-**  @retval HI_MEM_ALLOC_FAIL memory allocation failed
-*/
-int hi_ui_config_set_profile_apache(HTTPINSPECT_CONF *ServerConf)
-{
-    ServerConf->server_flow_depth = 300;
-    ServerConf->client_flow_depth = 300;
-    ServerConf->post_depth = -1;
-
-    ServerConf->non_strict = 1;
-
-    ServerConf->chunk_length = 500000;
-
-    ServerConf->ascii.on = 1;
-
-    ServerConf->multiple_slash.on = 1;
-
-    ServerConf->directory.on = 1;
-
-    ServerConf->webroot.on = 1;
-
-    ServerConf->apache_whitespace.on = 1;
-
-    ServerConf->utf_8.on = 1;
-
-    ServerConf->normalize_utf = 1;
-    ServerConf->normalize_javascript = 0;
-
-    ServerConf->whitespace[9] = HI_UI_CONFIG_WS_BEFORE_URI | HI_UI_CONFIG_WS_AFTER_URI;   /* horizontal tab */
-    ServerConf->whitespace[11] = HI_UI_CONFIG_WS_BEFORE_URI | HI_UI_CONFIG_WS_AFTER_URI;  /* vertical tab */
-    ServerConf->whitespace[12] = HI_UI_CONFIG_WS_BEFORE_URI | HI_UI_CONFIG_WS_AFTER_URI;  /* form feed */
-    ServerConf->whitespace[13] = HI_UI_CONFIG_WS_BEFORE_URI | HI_UI_CONFIG_WS_AFTER_URI;  /* carriage return */
-
-    ServerConf->max_hdr_len = HI_UI_CONFIG_MAX_HDR_DEFAULT;
-    ServerConf->max_headers = HI_UI_CONFIG_MAX_HEADERS_DEFAULT;
-    ServerConf->max_spaces = HI_UI_CONFIG_MAX_SPACES_DEFAULT;
-    ServerConf->max_js_ws = HI_UI_CONFIG_MAX_SPACES_DEFAULT;
-
-    return HI_SUCCESS;
-}
-
-/*
-**  NAME
-**    hi_ui_set_profile_iis::
-*/
-/**
-**  Set an HTTPINSPECT_CONF to mimic IIS configuration.
-**
-**  This sets a server configuration to imitate an IIS web server,
-**  and should reduce false positives against systems on which certain
-**  attacks or evasions do not work.  We hope to still log an event,
-**  but one that is less priority.
-**
-**  @param ServerConf pointer to structure HTTPINSPECT_CONF
-**
-**  @return integer
-**
-**  @retval HI_SUCCESS function successful
-**  @retval HI_MEM_ALLOC_FAIL memory allocation failed
-*/
-int hi_ui_config_set_profile_iis(HTTPINSPECT_CONF *ServerConf,
-                                 uint8_t* iis_unicode_map)
-{
-    if(iis_unicode_map == NULL)
-    {
-        return HI_INVALID_ARG;
-    }
-
-    ServerConf->server_flow_depth = 300;
-    ServerConf->client_flow_depth = 300;
-    ServerConf->post_depth = -1;
-
-    ServerConf->chunk_length = 500000;
-
-    ServerConf->iis_unicode_map = iis_unicode_map;
-
-    ServerConf->ascii.on = 1;
-
-    ServerConf->multiple_slash.on = 1;
-
-    ServerConf->directory.on = 1;
-
-    ServerConf->webroot.on = 1;
-
-    ServerConf->double_decoding.on    = 0;
-
-    ServerConf->u_encoding.on         = 1;
-
-    ServerConf->bare_byte.on          = 1;
-
-    ServerConf->iis_unicode.on        = 1;
-
-    ServerConf->iis_backslash.on      = 1;
-
-    ServerConf->iis_delimiter.on      = 1;
-
-    ServerConf->apache_whitespace.on  = 1;
-
-    ServerConf->non_strict = 1;
-
-    ServerConf->normalize_utf = 1;
-    ServerConf->normalize_javascript = 0;
-
-    ServerConf->whitespace[9] = HI_UI_CONFIG_WS_BEFORE_URI | HI_UI_CONFIG_WS_AFTER_URI;   /* horizontal tab */
-    ServerConf->whitespace[11] = HI_UI_CONFIG_WS_BEFORE_URI;  /* vertical tab */
-    ServerConf->whitespace[12] = HI_UI_CONFIG_WS_BEFORE_URI;  /* form feed */
-    ServerConf->whitespace[13] = HI_UI_CONFIG_WS_BEFORE_URI;  /* carriage return */
-
-    ServerConf->max_hdr_len = HI_UI_CONFIG_MAX_HDR_DEFAULT;
-    ServerConf->max_headers = HI_UI_CONFIG_MAX_HEADERS_DEFAULT;
-    ServerConf->max_spaces = HI_UI_CONFIG_MAX_SPACES_DEFAULT;
-    ServerConf->max_js_ws = HI_UI_CONFIG_MAX_SPACES_DEFAULT;
-
-    return HI_SUCCESS;
-}
-
-/*
-**  NAME
-**    hi_ui_set_profile_iis_4or5::
-*/
-/**
-** Double decoding decoding attacks exist for IIS
-** 4.0 and 5.0, but not 5.1 and beyond.
-**
-** This function uses the general IIS setup, hi_ui_config_set_profile_iis,
-** but set the double_decoding flags.
-**/
-
-int hi_ui_config_set_profile_iis_4or5(HTTPINSPECT_CONF *ServerConf,
-                                 uint8_t* iis_unicode_map)
-{
-    int ret;
-
-    ret = hi_ui_config_set_profile_iis(ServerConf, iis_unicode_map);
-
-    ServerConf->double_decoding.on = 1;
-
-    return ret;
-}
-
-/*
-**  NAME
-**    hi_ui_set_profile_all::
-*/
-/**
-**  Set an HTTPINSPECT_CONF to catch all attacks and evasions.
-**
-**  This basically turns on all the tricks and most of the
-**  alerts, so you won't miss anything that HttpInspect does.
-**
-**  @param ServerConf pointer to structure HTTPINSPECT_CONF
-**
-**  @return integer
-**
-**  @retval HI_SUCCESS function successful
-**  @retval HI_MEM_ALLOC_FAIL memory allocation failed
-*/
-int hi_ui_config_set_profile_all(HTTPINSPECT_CONF *ServerConf,
-                                 uint8_t* iis_unicode_map)
-{
-    if(iis_unicode_map == NULL)
-    {
-        return HI_INVALID_ARG;
-    }
-
-    ServerConf->server_flow_depth   = 300;
-    ServerConf->client_flow_depth   = 300;
-    ServerConf->post_depth = -1;
-
-    ServerConf->chunk_length = 500000;
-
-    ServerConf->iis_unicode_map = iis_unicode_map;
-
-    ServerConf->ascii.on = 1;
-
-    ServerConf->multiple_slash.on = 1;
-
-    ServerConf->directory.on = 1;
-
-    ServerConf->webroot.on = 1;
-
-    ServerConf->double_decoding.on    = 1;
-
-    ServerConf->u_encoding.on         = 1;
-
-    ServerConf->bare_byte.on          = 1;
-
-    ServerConf->iis_unicode.on        = 1;
-
-    ServerConf->iis_backslash.on      = 1;
-
-    ServerConf->iis_delimiter.on      = 1;
-
-    ServerConf->apache_whitespace.on     = 1;
-
-    ServerConf->non_strict = 1;
-
-    ServerConf->normalize_utf = 1;
-    ServerConf->normalize_javascript = 0;
-
-    ServerConf->whitespace[9] = HI_UI_CONFIG_WS_BEFORE_URI | HI_UI_CONFIG_WS_AFTER_URI;   /* horizontal tab */
-    ServerConf->whitespace[11] = HI_UI_CONFIG_WS_BEFORE_URI;  /* vertical tab */
-    ServerConf->whitespace[12] = HI_UI_CONFIG_WS_BEFORE_URI;  /* form feed */
-    ServerConf->whitespace[13] = HI_UI_CONFIG_WS_BEFORE_URI;  /* carriage return */
-
-    ServerConf->max_hdr_len = HI_UI_CONFIG_MAX_HDR_DEFAULT;
-    ServerConf->max_headers = HI_UI_CONFIG_MAX_HEADERS_DEFAULT;
-    ServerConf->max_spaces = HI_UI_CONFIG_MAX_SPACES_DEFAULT;
-    ServerConf->max_js_ws = HI_UI_CONFIG_MAX_SPACES_DEFAULT;
-
-    return HI_SUCCESS;
-}
-
 void HttpInspectCleanupHttpMethodsConf(void *HttpMethods)
 {
     HTTP_CMD_CONF *HTTPMethods = (HTTP_CMD_CONF *)HttpMethods;
diff --git a/src/service_inspectors/http_inspect/hi_ui_config.h b/src/service_inspectors/http_inspect/hi_ui_config.h
index 2a5186739..e23f96e30 100644
--- a/src/service_inspectors/http_inspect/hi_ui_config.h
+++ b/src/service_inspectors/http_inspect/hi_ui_config.h
@@ -250,10 +250,6 @@ int hi_ui_config_init_global_conf(HTTPINSPECT_GLOBAL_CONF *GlobalConf);
 int hi_ui_config_default(HTTPINSPECT_CONF *GlobalConf);
 int hi_ui_config_reset_global(HTTPINSPECT_GLOBAL_CONF *GlobalConf);
 
-int hi_ui_config_set_profile_apache(HTTPINSPECT_CONF *GlobalConf);
-int hi_ui_config_set_profile_iis(HTTPINSPECT_CONF *GlobalConf, uint8_t*);
-int hi_ui_config_set_profile_iis_4or5(HTTPINSPECT_CONF *GlobalConf, uint8_t*);
-int hi_ui_config_set_profile_all(HTTPINSPECT_CONF *GlobalConf, uint8_t*);
 void HttpInspectCleanupHttpMethodsConf(void *);
 
 extern int hex_lookup[256];
diff --git a/tools/snort2lua/preprocessor_states/pps_http_inspect_server.cc b/tools/snort2lua/preprocessor_states/pps_http_inspect_server.cc
index db803633a..9cbd18296 100644
--- a/tools/snort2lua/preprocessor_states/pps_http_inspect_server.cc
+++ b/tools/snort2lua/preprocessor_states/pps_http_inspect_server.cc
@@ -126,7 +126,12 @@ bool HttpInspectServer::convert(std::istringstream& data_stream)
             tmpval = table_api.add_option("extended_ascii_uri", true);
 
         else if (!keyword.compare("non_strict"))
+        {
+            table_api.add_diff_option_comment("non_strict", "profile.non_strict");
+            table_api.open_table("profile");
             tmpval = table_api.add_option("non_strict", true);
+            table_api.close_table();
+        }
 
         else if (!keyword.compare("inspect_uri_only"))
             tmpval = table_api.add_option("inspect_uri_only", true);
@@ -138,7 +143,12 @@ bool HttpInspectServer::convert(std::istringstream& data_stream)
             tmpval = table_api.add_option("normalize_headers", true);
 
         else if (!keyword.compare("normalize_utf"))
+        {
+            table_api.add_diff_option_comment("normalize_utf", "profile.normalize_utf");
+            table_api.open_table("profile");
             tmpval = table_api.add_option("normalize_utf", true);
+            table_api.close_table();
+        }
 
         else if (!keyword.compare("log_uri"))
             tmpval = table_api.add_option("log_uri", true);
@@ -153,64 +163,153 @@ bool HttpInspectServer::convert(std::istringstream& data_stream)
             tmpval = table_api.add_option("no_pipeline_req", true);
 
         else if (!keyword.compare("ascii"))
+        {
+            table_api.add_diff_option_comment("ascii", "profile.ascii");
+            table_api.open_table("profile");
             tmpval = parse_yn_bool_option("ascii", data_stream);
+            table_api.close_table();
+        }
 
         else if (!keyword.compare("utf_8"))
+        {
+            table_api.add_diff_option_comment("utf_8", "profile.utf_8");
+            table_api.open_table("profile");
             tmpval = parse_yn_bool_option("utf_8", data_stream);
+            table_api.close_table();
+        }
 
         else if (!keyword.compare("u_encode"))
+        {
+            table_api.add_diff_option_comment("u_encode", "profile.u_encode");
+            table_api.open_table("profile");
             tmpval = parse_yn_bool_option("u_encode", data_stream);
+            table_api.close_table();
+        }
 
         else if (!keyword.compare("bare_byte"))
+        {
+            table_api.add_diff_option_comment("bare_byte", "profile.bare_byte");
+            table_api.open_table("profile");
             tmpval = parse_yn_bool_option("bare_byte", data_stream);
+            table_api.close_table();
+        }
 
         else if (!keyword.compare("iis_unicode"))
+        {
+            table_api.add_diff_option_comment("iis_unicode", "profile.iis_unicode");
+            table_api.open_table("profile");
             tmpval = parse_yn_bool_option("iis_unicode", data_stream);
+            table_api.close_table();
+        }
 
         else if (!keyword.compare("double_decode"))
+        {
+            table_api.add_diff_option_comment("double_decode", "profile.double_decode");
+            table_api.open_table("profile");
             tmpval = parse_yn_bool_option("double_decode", data_stream);
+            table_api.close_table();
+        }
 
         else if (!keyword.compare("multi_slash"))
+        {
+            table_api.add_diff_option_comment("multi_slash", "profile.multi_slash");
+            table_api.open_table("profile");
             tmpval = parse_yn_bool_option("multi_slash", data_stream);
+            table_api.close_table();
+        }
 
         else if (!keyword.compare("iis_backslash"))
+        {
+            table_api.add_diff_option_comment("iis_backslash", "profile.iis_backslash");
+            table_api.open_table("profile");
             tmpval = parse_yn_bool_option("iis_backslash", data_stream);
-
+            table_api.close_table();
+        }
         else if (!keyword.compare("directory"))
+        {
+            table_api.add_diff_option_comment("directory", "profile.directory");
+            table_api.open_table("profile");
             tmpval = parse_yn_bool_option("directory", data_stream);
+            table_api.close_table();
+        }
 
         else if (!keyword.compare("apache_whitespace"))
+        {
+            table_api.add_diff_option_comment("apache_whitespace", "profile.apache_whitespace");
+            table_api.open_table("profile");
             tmpval = parse_yn_bool_option("apache_whitespace", data_stream);
+            table_api.close_table();
+        }
 
         else if (!keyword.compare("iis_delimiter"))
             tmpval = parse_yn_bool_option("iis_delimiter", data_stream);
 
         else if (!keyword.compare("webroot"))
+        {
+            table_api.add_diff_option_comment("webroot", "profile.webroot");
+            table_api.open_table("profile");
             tmpval = parse_yn_bool_option("webroot", data_stream);
+            table_api.close_table();
+        }
 
         else if (!keyword.compare("max_javascript_whitespaces"))
+        {
+            table_api.add_diff_option_comment("max_javascript_whitespaces", "profile.max_javascript_whitespaces");
+            table_api.open_table("profile");
             tmpval = parse_int_option("max_javascript_whitespaces", data_stream);
+            table_api.close_table();
+        }
 
         else if (!keyword.compare("server_flow_depth"))
+        {
+            table_api.add_diff_option_comment("server_flow_depth [-1:65495]", "profile.server_flow_depth [-1:65535]");
+            table_api.open_table("profile");
             tmpval = parse_int_option("server_flow_depth", data_stream);
+            table_api.close_table();
+        }
 
         else if (!keyword.compare("client_flow_depth"))
+        {
+            table_api.add_diff_option_comment("client_flow_depth", "profile.client_flow_depth");
+            table_api.open_table("profile");
             tmpval = parse_int_option("client_flow_depth", data_stream);
+            table_api.close_table();
+        }
 
         else if (!keyword.compare("chunk_length"))
+        {
+            table_api.add_diff_option_comment("chunk_length", "profile.chunk_length");
+            table_api.open_table("profile");
             tmpval = parse_int_option("chunk_length", data_stream);
+            table_api.close_table();
+        }
 
         else if (!keyword.compare("oversize_dir_length"))
             tmpval = parse_int_option("oversize_dir_length", data_stream);
 
         else if (!keyword.compare("max_header_length"))
+        {
+            table_api.add_diff_option_comment("max_header_length", "profile.max_header_length");
+            table_api.open_table("profile");
             tmpval = parse_int_option("max_header_length", data_stream);
+            table_api.close_table();
+        }
 
         else if (!keyword.compare("max_spaces"))
+        {
+            table_api.add_diff_option_comment("max_spaces", "profile.max_spaces");
+            table_api.open_table("profile");
             tmpval = parse_int_option("max_spaces", data_stream);
+            table_api.close_table();
+        }
 
         else if (!keyword.compare("max_headers"))
+        {
+            table_api.add_diff_option_comment("max_headers", "profile.max_headers");
+            table_api.open_table("profile");
             tmpval = parse_int_option("max_headers", data_stream);
+            table_api.close_table();
+        }
 
         else if (!keyword.compare("no_alerts"))
             table_api.add_deleted_comment("no_alerts");
@@ -225,15 +324,22 @@ bool HttpInspectServer::convert(std::istringstream& data_stream)
             tmpval = parse_curly_bracket_list("http_methods", data_stream);
 
         else if (!keyword.compare("whitespace_chars"))
+        {
+            table_api.add_diff_option_comment("whitespace_chars", "profile.whitespace_chars");
+            table_api.open_table("profile");
             tmpval = parse_bracketed_byte_list("whitespace_chars", data_stream);
+            table_api.close_table();
+        }
 
         else if (!keyword.compare("base36"))
             tmpval = eat_option(data_stream);
 
         else if (!keyword.compare("post_depth"))
         {
+            table_api.add_diff_option_comment("post_depth [-1:65495]", "profile.post_depth [-1:65535]");
+            table_api.open_table("profile");
             tmpval = parse_int_option("post_depth", data_stream);
-            table_api.add_diff_option_comment("post_depth [-1:65495]", "post_depth [-1:65535]");
+            table_api.close_table();
         }
 
         else if (!keyword.compare("non_rfc_char"))
@@ -298,6 +404,8 @@ bool HttpInspectServer::convert(std::istringstream& data_stream)
             std::string map_file;
             int code_page;
 
+            table_api.open_table("profile");
+
             if( (data_stream >> map_file) &&
                 (data_stream >> code_page))
             {
@@ -311,6 +419,7 @@ bool HttpInspectServer::convert(std::istringstream& data_stream)
                 data_api.failed_conversion(data_stream, "iis_unicode_map <filename> <codemap>");
                 retval = false;
             }
+            table_api.close_table();
         }
 
         else if (!keyword.compare("profile"))