From: Tom Peters <thopeter@cisco.com>
Date: Tue, 24 Feb 2015 18:15:20 +0000 (-0500)
Subject: minor changes to http
X-Git-Tag: 3.0.0-233~1038^2~1
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e02424fefa9d7ecf04b797bf0bbb6bce8c3df436;p=thirdparty%2Fsnort3.git

minor changes to http
---

diff --git a/src/service_inspectors/http_inspect/hi_client_norm.cc b/src/service_inspectors/http_inspect/hi_client_norm.cc
index dd26e2005..8fb3be321 100644
--- a/src/service_inspectors/http_inspect/hi_client_norm.cc
+++ b/src/service_inspectors/http_inspect/hi_client_norm.cc
@@ -299,6 +299,9 @@ int hi_client_norm(HI_SESSION *session)
     if(ClientReq->header_norm && session->server_conf->normalize_headers)
     {
         session->norm_flags &= ~HI_BODY;
+        // FIXIT-M the usefulness  of this one size fits all normalization is questionable.
+        // A specific issue is that a header such as "Referer: http://www.foo.com/home" will trigger multislash
+        // normalization and alert.
         iRet = hi_norm_uri(session, HeaderBuf, &iHeaderBufSize,
                        RawHeaderBuf, iRawHeaderBufSize, &encodeType);
         if (iRet == HI_NONFATAL_ERR)
diff --git a/src/service_inspectors/http_inspect/hi_main.cc b/src/service_inspectors/http_inspect/hi_main.cc
index db444383d..ece0114f9 100644
--- a/src/service_inspectors/http_inspect/hi_main.cc
+++ b/src/service_inspectors/http_inspect/hi_main.cc
@@ -1147,7 +1147,7 @@ void FreeHttpSessionData(void *data)
 
     if( hsd->fd_state != 0 )
     {
-        File_Decomp_StopFree(hsd->fd_state);   // Stop & Stop &  Free fd session object
+        File_Decomp_StopFree(hsd->fd_state);
         hsd->fd_state = NULL;                  // ...just for good measure
     }
 }
diff --git a/src/service_inspectors/http_inspect/hi_ui_config.h b/src/service_inspectors/http_inspect/hi_ui_config.h
index b1a2c1683..c118d115d 100644
--- a/src/service_inspectors/http_inspect/hi_ui_config.h
+++ b/src/service_inspectors/http_inspect/hi_ui_config.h
@@ -163,8 +163,6 @@ struct HTTPINSPECT_CONF
     char extract_gzip;
     unsigned long file_decomp_modes;
 
-/* NOTE:  The XFF_BUILTING_NAMES value must match the code in snort_httpinspect.c that
-          adds the builtin names to the list. */
 #define HI_UI_CONFIG_XFF_FIELD_NAME  "X-Forwarded-For"
 #define HI_UI_CONFIG_TCI_FIELD_NAME  "True-Client-IP"
 #define XFF_BUILTIN_NAMES            (2)