From: Tom Peters Date: Mon, 6 Oct 2014 14:27:30 +0000 (-0400) Subject: Merge branch 'master' of /nfs/home/rucombs/Snort++ X-Git-Tag: 3.0.0-233~1397 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b77e18922926bb38ea3021b776c03af5ed2848ba;p=thirdparty%2Fsnort3.git Merge branch 'master' of /nfs/home/rucombs/Snort++ --- b77e18922926bb38ea3021b776c03af5ed2848ba diff --cc src/service_inspectors/nhttp_inspect/nhttp_tables.cc index 85536b5f2,c2ee0d143..9f46e2493 --- a/src/service_inspectors/nhttp_inspect/nhttp_tables.cc +++ b/src/service_inspectors/nhttp_inspect/nhttp_tables.cc @@@ -245,59 -244,61 +245,59 @@@ const HeaderNormalizer* const NHttpMsgH #pragma clang diagnostic pop #endif -const int32_t NHttpMsgHeadShared::num_norms = HEAD__MAXVALUE-1; - const RuleMap NHttpModule::nhttp_events[] = { - { EVENT_ASCII, "(nhttp_inspect) ascii encoding" }, - { EVENT_DOUBLE_DECODE, "(nhttp_inspect) double decoding attack" }, - { EVENT_U_ENCODE, "(nhttp_inspect) u encoding" }, - { EVENT_BARE_BYTE, "(nhttp_inspect) bare byte unicode encoding" }, - { EVENT_OBSOLETE_1, "(nhttp_inspect) obsolete event--should not appear" }, - { EVENT_UTF_8, "(nhttp_inspect) utf-8 encoding" }, - { EVENT_IIS_UNICODE, "(nhttp_inspect) iis unicode codepoint encoding" }, - { EVENT_MULTI_SLASH, "(nhttp_inspect) multi_slash encoding" }, - { EVENT_IIS_BACKSLASH, "(nhttp_inspect) iis backslash evasion" }, - { EVENT_SELF_DIR_TRAV, "(nhttp_inspect) self directory traversal" }, - { EVENT_DIR_TRAV, "(nhttp_inspect) directory traversal" }, - { EVENT_APACHE_WS, "(nhttp_inspect) apache whitespace (tab)" }, - { EVENT_IIS_DELIMITER, "(nhttp_inspect) non-rfc http delimiter" }, - { EVENT_NON_RFC_CHAR, "(nhttp_inspect) non-rfc defined char" }, - { EVENT_OVERSIZE_DIR, "(nhttp_inspect) oversize request-uri directory" }, - { EVENT_LARGE_CHUNK, "(nhttp_inspect) oversize chunk encoding" }, - { EVENT_PROXY_USE, "(nhttp_inspect) unauthorized proxy use detected" }, - { EVENT_WEBROOT_DIR, "(nhttp_inspect) webroot directory traversal" }, - { EVENT_LONG_HDR, "(nhttp_inspect) long header" }, - { EVENT_MAX_HEADERS, "(nhttp_inspect) max header fields" }, - { EVENT_MULTIPLE_CONTLEN, "(nhttp_inspect) multiple content length" }, - { EVENT_CHUNK_SIZE_MISMATCH, "(nhttp_inspect) chunk size mismatch detected" }, - { EVENT_INVALID_TRUEIP, "(nhttp_inspect) invalid ip in true-client-ip/xff header" }, - { EVENT_MULTIPLE_HOST_HDRS, "(nhttp_inspect) multiple host hdrs detected" }, - { EVENT_LONG_HOSTNAME, "(nhttp_inspect) hostname exceeds 255 characters" }, - { EVENT_EXCEEDS_SPACES, "(nhttp_inspect) header parsing space saturation" }, - { EVENT_CONSECUTIVE_SMALL_CHUNKS, "(nhttp_inspect) client consecutive small chunk sizes" }, - { EVENT_UNBOUNDED_POST, "(nhttp_inspect) post w/o content-length or chunks" }, - { EVENT_MULTIPLE_TRUEIP_IN_SESSION, "(nhttp_inspect) multiple true ips in a session" }, - { EVENT_BOTH_TRUEIP_XFF_HDRS, "(nhttp_inspect) both true_client_ip and xff hdrs present" }, - { EVENT_UNKNOWN_METHOD, "(nhttp_inspect) unknown method" }, - { EVENT_SIMPLE_REQUEST, "(nhttp_inspect) simple request" }, - { EVENT_UNESCAPED_SPACE_URI, "(nhttp_inspect) unescaped space in http uri" }, - { EVENT_PIPELINE_MAX, "(nhttp_inspect) too many pipelined requests" }, - { EVENT_ANOM_SERVER, "(nhttp_inspect) anomalous http server on undefined http port" }, - { EVENT_INVALID_STATCODE, "(nhttp_inspect) invalid status code in http response" }, - { EVENT_NO_CONTLEN, "(nhttp_inspect) no content-length or transfer-encoding in http response" }, - { EVENT_UTF_NORM_FAIL, "(nhttp_inspect) http response has utf charset which failed to normalize" }, - { EVENT_UTF7, "(nhttp_inspect) http response has utf-7 charset" }, - { EVENT_DECOMPR_FAILED, "(nhttp_inspect) http response gzip decompression failed" }, - { EVENT_CONSECUTIVE_SMALL_CHUNKS_S, "(nhttp_inspect) server consecutive small chunk sizes" }, - { EVENT_MSG_SIZE_EXCEPTION, "(nhttp_inspect) invalid content-length or chunk size" }, - { EVENT_JS_OBFUSCATION_EXCD, "(nhttp_inspect) javascript obfuscation levels exceeds 1" }, - { EVENT_JS_EXCESS_WS, "(nhttp_inspect) javascript whitespaces exceeds max allowed" }, - { EVENT_MIXED_ENCODINGS, "(nhttp_inspect) multiple encodings within javascript obfuscated data" }, - { EVENT_SWF_ZLIB_FAILURE, "(nhttp_inspect) SWF file zlib decompression failure" }, - { EVENT_SWF_LZMA_FAILURE, "(nhttp_inspect) SWF file LZMA decompression failure" }, - { EVENT_PDF_DEFL_FAILURE, "(nhttp_inspect) PDF file deflate decompression failure" }, - { EVENT_PDF_UNSUP_COMP_TYPE, "(nhttp_inspect) PDF file unsupported compression type" }, - { EVENT_PDF_CASC_COMP, "(nhttp_inspect) PDF file cascaded compression" }, - { EVENT_PDF_PARSE_FAILURE, "(nhttp_inspect) PDF file parse failure" }, + { EVENT_ASCII, "ascii encoding" }, + { EVENT_DOUBLE_DECODE, "double decoding attack" }, + { EVENT_U_ENCODE, "u encoding" }, + { EVENT_BARE_BYTE, "bare byte unicode encoding" }, + { EVENT_OBSOLETE_1, "obsolete event--should not appear" }, + { EVENT_UTF_8, "UTF-8 encoding" }, + { EVENT_IIS_UNICODE, "IIS unicode codepoint encoding" }, + { EVENT_MULTI_SLASH, "multi_slash encoding" }, + { EVENT_IIS_BACKSLASH, "IIS backslash evasion" }, + { EVENT_SELF_DIR_TRAV, "self directory traversal" }, + { EVENT_DIR_TRAV, "directory traversal" }, + { EVENT_APACHE_WS, "apache whitespace (tab)" }, + { EVENT_IIS_DELIMITER, "non-RFC http delimiter" }, + { EVENT_NON_RFC_CHAR, "non-RFC defined char" }, + { EVENT_OVERSIZE_DIR, "oversize request-uri directory" }, + { EVENT_LARGE_CHUNK, "oversize chunk encoding" }, + { EVENT_PROXY_USE, "unauthorized proxy use detected" }, + { EVENT_WEBROOT_DIR, "webroot directory traversal" }, + { EVENT_LONG_HDR, "long header" }, + { EVENT_MAX_HEADERS, "max header fields" }, + { EVENT_MULTIPLE_CONTLEN, "multiple content length" }, + { EVENT_CHUNK_SIZE_MISMATCH, "chunk size mismatch detected" }, + { EVENT_INVALID_TRUEIP, "invalid IP in true-client-IP/XFF header" }, + { EVENT_MULTIPLE_HOST_HDRS, "multiple host hdrs detected" }, + { EVENT_LONG_HOSTNAME, "hostname exceeds 255 characters" }, + { EVENT_EXCEEDS_SPACES, "header parsing space saturation" }, + { EVENT_CONSECUTIVE_SMALL_CHUNKS, "client consecutive small chunk sizes" }, + { EVENT_UNBOUNDED_POST, "post w/o content-length or chunks" }, + { EVENT_MULTIPLE_TRUEIP_IN_SESSION, "multiple true ips in a session" }, + { EVENT_BOTH_TRUEIP_XFF_HDRS, "both true-client-IP and XFF hdrs present" }, + { EVENT_UNKNOWN_METHOD, "unknown method" }, + { EVENT_SIMPLE_REQUEST, "simple request" }, + { EVENT_UNESCAPED_SPACE_URI, "unescaped space in HTTP URI" }, + { EVENT_PIPELINE_MAX, "too many pipelined requests" }, + { EVENT_ANOM_SERVER, "anomalous http server on undefined HTTP port" }, + { EVENT_INVALID_STATCODE, "invalid status code in HTTP response" }, + { EVENT_NO_CONTLEN, "no content-length or transfer-encoding in HTTP response" }, + { EVENT_UTF_NORM_FAIL, "HTTP response has UTF charset which failed to normalize" }, + { EVENT_UTF7, "HTTP response has UTF-7 charset" }, + { EVENT_DECOMPR_FAILED, "HTTP response gzip decompression failed" }, + { EVENT_CONSECUTIVE_SMALL_CHUNKS_S, "server consecutive small chunk sizes" }, + { EVENT_MSG_SIZE_EXCEPTION, "invalid content-length or chunk size" }, + { EVENT_JS_OBFUSCATION_EXCD, "javascript obfuscation levels exceeds 1" }, + { EVENT_JS_EXCESS_WS, "javascript whitespaces exceeds max allowed" }, + { EVENT_MIXED_ENCODINGS, "multiple encodings within javascript obfuscated data" }, + { EVENT_SWF_ZLIB_FAILURE, "SWF file zlib decompression failure" }, + { EVENT_SWF_LZMA_FAILURE, "SWF file LZMA decompression failure" }, + { EVENT_PDF_DEFL_FAILURE, "PDF file deflate decompression failure" }, + { EVENT_PDF_UNSUP_COMP_TYPE, "PDF file unsupported compression type" }, + { EVENT_PDF_CASC_COMP, "PDF file cascaded compression" }, + { EVENT_PDF_PARSE_FAILURE, "PDF file parse failure" }, { 0, nullptr } };