From: Tom Peters <thopeter@cisco.com>
Date: Fri, 5 Dec 2014 17:03:22 +0000 (-0500)
Subject: file_data output and some FIXIT comments
X-Git-Tag: 3.0.0-233~1100^2~2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f50850ddc5f90b0632f121dfe4007e4e315d3ad9;p=thirdparty%2Fsnort3.git

file_data output and some FIXIT comments
---

diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_header.cc b/src/service_inspectors/nhttp_inspect/nhttp_msg_header.cc
index 541bad177..eb937e32f 100644
--- a/src/service_inspectors/nhttp_inspect/nhttp_msg_header.cc
+++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_header.cc
@@ -77,6 +77,7 @@ void NHttpMsgHeader::update_flow() {
         session_data->half_reset(SRC_SERVER);
     }
     // If there is a Transfer-Encoding header, see if the last of the encoded values is "chunked".
+    // FIXIT-L do something with Transfer-Encoding header with chunked present but not last.
     else if ((get_header_value_norm(HEAD_TRANSFER_ENCODING).length > 0)                     &&
              ((*(int64_t *)(get_header_value_norm(HEAD_TRANSFER_ENCODING).start + 
              (get_header_value_norm(HEAD_TRANSFER_ENCODING).length - 8))) == TRANSCODE_CHUNKED) ) {
diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_section.cc b/src/service_inspectors/nhttp_inspect/nhttp_msg_section.cc
index d1c464c1b..0596f3c4b 100644
--- a/src/service_inspectors/nhttp_inspect/nhttp_msg_section.cc
+++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_section.cc
@@ -61,6 +61,9 @@ void NHttpMsgSection::print_message_wrapup(FILE *output) const {
     for (int i=0; i < HTTP_BUFFER_MAX; i++) {
         if ((1 << i) & http_mask) Field(http_buffer[i].length, http_buffer[i].buf).print(output, http_buffer_name[i]);
     }
+    if (g_file_data.len > 0) {
+        Field(g_file_data.len, g_file_data.data).print(output, "file_data");
+    }
     fprintf(output, "\n");
     session_data->show(output);
     fprintf(output, "\n");
@@ -126,9 +129,3 @@ void NHttpMsgSection::legacy_cookie(NHttpMsgHeadShared* header, SourceId source_
     }
 }
 
-
-
-
-
-
-
diff --git a/src/service_inspectors/nhttp_inspect/nhttp_splitter.cc b/src/service_inspectors/nhttp_inspect/nhttp_splitter.cc
index 553f5a803..6b87265ee 100644
--- a/src/service_inspectors/nhttp_inspect/nhttp_splitter.cc
+++ b/src/service_inspectors/nhttp_inspect/nhttp_splitter.cc
@@ -144,6 +144,7 @@ ScanResult NHttpChunkSplitter::split(const uint8_t* buffer, uint32_t length) {
         return SCAN_FOUND;
     }
     for (uint32_t k = 0; k < length; k++) {
+    // FIXIT-M learn to support white space before chunk header extension semicolon
         if (buffer[k] == '\n') {
             if (octets_seen + k == num_crlf) {
                 // \r\n or \n leftover from previous chunk