From: Josh <jrosenba@cisco.com>
Date: Tue, 17 Jun 2014 13:58:49 +0000 (-0400)
Subject: adding http_inspect_server preprocessor
X-Git-Tag: 3.0.0-233~1476^2~1^2~2
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=17effb7e85b52e1938738e9728ffe8600a74cf13;p=thirdparty%2Fsnort3.git

adding http_inspect_server preprocessor
---

diff --git a/src/service_inspectors/http_inspect/hi_module.cc b/src/service_inspectors/http_inspect/hi_module.cc
index 990718f9f..6a50f39a6 100644
--- a/src/service_inspectors/http_inspect/hi_module.cc
+++ b/src/service_inspectors/http_inspect/hi_module.cc
@@ -367,10 +367,10 @@ static const Parameter hi_server_params[] =
     { "u_encode", Parameter::PT_BOOL, nullptr, "false",
       "decode %uXXXX character sequences" },
 
-    { "unicode_map", Parameter::PT_TABLE, hi_umap_params, nullptr,
-      "help" },
+//    { "unicode_map", Parameter::PT_TABLE, hi_umap_params, nullptr,
+//      "help" },
 
-    { "unlimited_decompress", Parameter::PT_INT, nullptr, "false",
+    { "unlimited_decompress", Parameter::PT_BOOL, nullptr, "false",
       "decompress across multiple packets" },
 
     { "utf_8", Parameter::PT_BOOL, nullptr, "true",
diff --git a/src/service_inspectors/http_inspect/hi_ui_config.h b/src/service_inspectors/http_inspect/hi_ui_config.h
index 79f2bc752..d5a8d7347 100644
--- a/src/service_inspectors/http_inspect/hi_ui_config.h
+++ b/src/service_inspectors/http_inspect/hi_ui_config.h
@@ -160,7 +160,7 @@ struct HTTPINSPECT_CONF
     char enable_xff;
     char log_uri;
     char log_hostname;
-    char unlimited_decompress;
+    bool unlimited_decompress;
     char extract_gzip;
 
    /* Support Extended ascii codes in the URI */
diff --git a/tools/snort2lua/CMakeLists.txt b/tools/snort2lua/CMakeLists.txt
index 2d0d72217..fe516ff23 100644
--- a/tools/snort2lua/CMakeLists.txt
+++ b/tools/snort2lua/CMakeLists.txt
@@ -15,6 +15,7 @@ add_executable(snort2lua
     init_state.cc
     snort2lua_util.h
     snort2lua_util.cc
+    conversion_state.h
 )
 
 target_link_libraries( snort2lua
diff --git a/tools/snort2lua/conversion_state.h b/tools/snort2lua/conversion_state.h
index 870184899..104b32aba 100644
--- a/tools/snort2lua/conversion_state.h
+++ b/tools/snort2lua/conversion_state.h
@@ -25,6 +25,7 @@
 #include <string>
 #include <fstream>
 #include <sstream>
+#include <cctype>
 
 #include "converter.h"
  
@@ -86,6 +87,45 @@ protected:
         return false;
     }
 
+    // parse adn add a curly bracketed list to the table
+    inline bool parse_bracketed_byte_list(std::string list_name, std::stringstream& stream)
+    {
+        std::string elem;
+        bool retval = true;
+
+        if(!(stream >> elem) || (elem != "{"))
+            return false;
+
+        while (stream >> elem && elem != "}")
+        {
+            int dig;
+
+            if (std::isdigit(elem[0]))
+                dig = std::stoi(elem, nullptr, 0);
+            else if (elem.size() == 1)
+                dig = (int)elem[0];
+            else
+                dig = -1;
+
+            if (0 <= dig && dig <= 255)
+            {
+                std::stringstream tmp;
+                tmp << "0x" << std::hex << dig;
+                retval = converter->add_list_to_table(list_name, tmp.str()) && retval;
+
+            }
+            else
+            {
+                converter->add_comment_to_table("Unable to convert " + elem +
+                        "!!  The element must be a single charachter or number between 0 - 255 inclusive");
+                retval = false;
+            }
+        }
+
+        return retval;
+    }
+
+
 private:
 
 };
diff --git a/tools/snort2lua/data/cv_var.cc b/tools/snort2lua/data/cv_var.cc
index aa623602a..d96979dd4 100644
--- a/tools/snort2lua/data/cv_var.cc
+++ b/tools/snort2lua/data/cv_var.cc
@@ -116,6 +116,7 @@ std::ostream& operator<<( std::ostream& out, const Variable &var)
         {
             if ( 0 < length && length + s.size() > var.max_line_length )
             {
+                util::rtrim(tmp_str);
                 tmp_str += "\n" + whitespace + "    ";
                 length = 4 + whitespace.size();
             }
diff --git a/tools/snort2lua/preprocessor_states/CMakeLists.txt b/tools/snort2lua/preprocessor_states/CMakeLists.txt
index 5da406723..a35c842f3 100644
--- a/tools/snort2lua/preprocessor_states/CMakeLists.txt
+++ b/tools/snort2lua/preprocessor_states/CMakeLists.txt
@@ -2,6 +2,7 @@
 add_library(preprocessor_states
     pps_arpspoof.cc
     pps_http_inspect.cc
+    pps_http_inspect_server.cc
     pps_smtp.cc
     pps_normalizers.cc
     pps_sfportscan.cc
diff --git a/tools/snort2lua/preprocessor_states/pps_ftp_telnet_protocol.cc b/tools/snort2lua/preprocessor_states/pps_ftp_telnet_protocol.cc
index 5ba491956..ef5d90540 100644
--- a/tools/snort2lua/preprocessor_states/pps_ftp_telnet_protocol.cc
+++ b/tools/snort2lua/preprocessor_states/pps_ftp_telnet_protocol.cc
@@ -284,7 +284,7 @@ bool Telnet::convert(std::stringstream& data_stream)
 
     while(data_stream >> keyword)
     {
-        bool tmpval;
+        bool tmpval = true;
         if(!keyword.compare("ayt_attack_thresh"))
         {
             if(data_stream >> i_val)
diff --git a/tools/snort2lua/preprocessor_states/pps_http_inspect.cc b/tools/snort2lua/preprocessor_states/pps_http_inspect.cc
index 5ab10bc05..7756e094f 100644
--- a/tools/snort2lua/preprocessor_states/pps_http_inspect.cc
+++ b/tools/snort2lua/preprocessor_states/pps_http_inspect.cc
@@ -38,26 +38,17 @@ public:
 
 private:
     bool add_decode_option(std::string opt_name,  std::stringstream& stream);
-    bool missing_arg_error(std::string error_string);
 };
 
 } // namespace
 
 
-bool HttpInspect::missing_arg_error(std::string arg)
-{
-    converter->add_comment_to_table("snort.conf missing argument for " + arg);
-    return false;
-}
-
 HttpInspect::HttpInspect(Converter* cv)  : ConversionState(cv)
 {}
 
 bool HttpInspect::convert(std::stringstream& data_stream)
 {
     std::string keyword;
-    std::string s_value;
-    int i_value;
 
     // using this to keep track of any errors.  I want to convert as much 
     // as possible while being aware something went wrong
@@ -116,17 +107,21 @@ bool HttpInspect::convert(std::stringstream& data_stream)
         else if(!keyword.compare("iis_unicode_map"))
         {
             std::string codemap;
-            if( (data_stream >> s_value) &&
-                (data_stream >> i_value))
+            int code_page;
+
+            if( (data_stream >> codemap) &&
+                (data_stream >> code_page))
             {
                 converter->open_table("unicode_map");
-                converter->add_option_to_table("map_file", s_value);
-                converter->add_option_to_table("code_page", i_value);
+                converter->add_option_to_table("map_file", codemap);
+                converter->add_option_to_table("code_page", code_page);
                 converter->close_table();
             }
             else
             {
-                retval = missing_arg_error("iis_unicode_map <filename> <codemap>");
+                converter->add_comment_to_table("snort.conf missing argument for "
+                    "iis_unicode_map <filename> <codemap>");
+                retval = false;
             }
         }
 
@@ -154,7 +149,8 @@ bool HttpInspect::add_decode_option(std::string opt_name,  std::stringstream& st
     }
     else
     {
-        missing_arg_error(opt_name + " <int>");
+        converter->add_comment_to_table("snort.conf missing argument for " +
+            opt_name + " <int>");
         return false;
     }
 }
diff --git a/tools/snort2lua/preprocessor_states/pps_http_inspect_server.cc b/tools/snort2lua/preprocessor_states/pps_http_inspect_server.cc
index c2af23f56..db8283d51 100644
--- a/tools/snort2lua/preprocessor_states/pps_http_inspect_server.cc
+++ b/tools/snort2lua/preprocessor_states/pps_http_inspect_server.cc
@@ -36,240 +36,273 @@ public:
     virtual bool convert(std::stringstream& data_stream);
 
 private:
-    missing_arge_error(std::string arg);
+    static int binding_id;
 };
 
 } // namespace
 
-bool HttpInspectServer::missing_arg_error(std::string arg)
+
+#if 0
+
+    { "profile", Parameter::PT_ENUM, profiles, "none",
+      "set defaults appropriate for selected server" },
+
+#endif
+
+int HttpInspectServer::binding_id = 0;
+
+bool HttpInspectServer::convert(std::stringstream& data_stream)
 {
-    converter->add_comment_to_table("snort.conf missing argument for " + arg);
-    return false;
-}
+    std::string keyword;
+    bool retval = true;
 
+    if(!(data_stream >> keyword) || keyword.compare("server"))
+    {
+        return false;
+    }
 
-#if 0
+    if(!(data_stream >> keyword))
+        return false;
 
-#* ports { [port] [port] . . . } *
-#* iis_unicode_map [file (located in config dir)] [codemap (integer)] *
-#* extended_response_inspection *
-#* enable_cookie *
-#* inspect_gzip *
-#* unlimited_decompress *
-#* decompress_swf { deflate lzma } *
-#* decompress_pdf { deflate } *
-#* normalize_javascript *
-#* max_javascript_whitespaces [positive integer] *
-#* enable_xff *
-#* server_flow_depth [integer] *
-#* flow_depth [integer] *  (to be deprecated)
-#* client_flow_depth [integer] *
-#* post_depth [integer] *
-#* ascii [yes/no] *
-#* extended_ascii_uri *
-#* utf_8 [yes/no] *
-#* u_encode [yes/no] *
-#* bare_byte [yes/no] *
-#* iis_unicode [yes/no] *
-#* double_decode [yes/no] *
-#* non_rfc_char { [byte] [0x00] . . . } *
-#* multi_slash [yes/no] *
-#* iis_backslash [yes/no] *
-#* directory [yes/no] *
-#* apache_whitespace [yes/no] *
-#* iis_delimiter [yes/no] *
-#* chunk_length [non-zero positive integer] *
-#* small_chunk_length { <chunk size> <consecutive chunks> } *
-#* no_pipeline_req *
-#* non_strict *
-#* allow_proxy_use *
-#* no_alerts *
-#* oversize_dir_length [non-zero positive integer] *
-#* inspect_uri_only *
-#* max_header_length [positive integer] *
-#* max_spaces [positive integer] *
-#* webroot *
-#* tab_uri_delimiter *
-#* normalize_headers *
-#* normalize_cookies *
-#* normalize_utf *
-#* max_headers [positive integer] *
-#*http_methods { <CMD1> <CMD2> } *
-#* log_uri *
-#* log_hostname *
-#-- Profile Breakout --
-#* http_client_body *
-#* http_cookie *
-#* http_raw_cookie *
-#* http_header *
-#* http_raw_header *
-#* http_method *
-#* http_uri *
-#* http_raw_uri *
-#* http_stat_code *
-#* http_stat_msg *
-#* http_encode *
-
-
-    { "allow_proxy_use", Parameter::PT_BOOL, nullptr, "false",
-      "don't alert on proxy use for this server" },
-
-    { "apache_whitespace", Parameter::PT_BOOL, nullptr, "true",
-      "don't alert if tab is used in lieu of space characters" },
-
-    { "ascii", Parameter::PT_BOOL, nullptr, "true",
-      "enable decoding ASCII like %2f to /" },
-
-    { "bare_byte", Parameter::PT_BOOL, nullptr, "false",
-      "decode non-standard, non-ASCII character encodings" },
-
-    { "chunk_length", Parameter::PT_INT, "1:", "500000",
-      "alert on chunk lengths greater than specified" },
-
-    { "client_flow_depth", Parameter::PT_INT, "-1:1460", "300",
-      "raw request payload to inspect" },
-
-    { "directory", Parameter::PT_BOOL, nullptr, "true",
-      "normalize . and .. sequences out of URI" },
-
-    { "double_decode", Parameter::PT_BOOL, nullptr, "false",
-      "iis specific extra decoding" },
-
-    { "enable_cookies", Parameter::PT_BOOL, nullptr, "false",
-      "extract cookies" },
-
-    { "enable_xff", Parameter::PT_BOOL, nullptr, "false",
-      "log True-Client-IP and X-Forwarded-For headers with unified2 alerts as extra data" },
-
-    { "extended_ascii_uri", Parameter::PT_BOOL, nullptr, "false",
-      "help" },
-
-    { "extended_response_inspection", Parameter::PT_BOOL, nullptr, "false",
-      "extract resonse headers" },
-
-    { "http_methods", Parameter::PT_STRING, nullptr, nullptr,
-      "request methods allowed in addition to GET and POST" },
-
-    { "iis_backslash", Parameter::PT_BOOL, nullptr, "false",
-      "normalize directory slashes" },
-
-    { "iis_delimiter", Parameter::PT_BOOL, nullptr, "true",
-      "allow use of non-standard delimiter" },
-
-    { "iis_unicode", Parameter::PT_BOOL, nullptr, "false",
-      "enable unicode code point mapping using unicode_map settings" },
-
-    { "iis_unicode_map", Parameter::PT_TABLE, hi_umap_params, nullptr,
-      "help" },
-
-    { "inspect_gzip", Parameter::PT_BOOL, nullptr, "false",
-      "enable gzip decompression of compressed bodies" },
-
-    { "inspect_uri_only", Parameter::PT_BOOL, nullptr, "false",
-      "disable all detection except for uricontent" },
+    if(!keyword.compare("default"))
+    {
+        converter->open_table("http_server");
+    }
+    else
+    {
+        converter->open_table("http_server_" + std::to_string(binding_id));
+        binding_id++;
+        // CREATE A BINDING HERE!!
+    }
 
-    { "log_hostname", Parameter::PT_BOOL, nullptr, "false",
-      "enable logging of Hostname with unified2 alerts as extra data" },
+    // parse the file configuration
+    while(data_stream >> keyword)
+    {
+        bool tmpval = true;
 
-    { "log_uri", Parameter::PT_BOOL, nullptr, "false",
-      "enable logging of URI with unified2 alerts as extra data" },
+        if (!keyword.compare("extended_response_inspection"))
+            tmpval = converter->add_option_to_table("extended_response_inspection", true);
 
-    { "max_header_length", Parameter::PT_INT, "0:65535", "0",
-      "maximum allowed client request header field" },
+        else if (!keyword.compare("allow_proxy_use"))
+            tmpval = converter->add_option_to_table("allow_proxy_use", true);
 
-    { "max_headers", Parameter::PT_INT, "0:1024", "0",
-      "maximum allowd client request headers" },
+        else if (!keyword.compare("inspect_gzip"))
+            tmpval = converter->add_option_to_table("inspect_gzip", true);
 
-    { "max_spaces", Parameter::PT_INT, "0:65535", "200",
-      "help" },
+        else if (!keyword.compare("unlimited_decompress"))
+            tmpval = converter->add_option_to_table("unlimited_decompress", true);
 
-    { "multi_slash", Parameter::PT_BOOL, nullptr, "true",
-      "normalize out consecutive slashes in URI" },
+        else if (!keyword.compare("normalize_javascript"))
+            tmpval = converter->add_option_to_table("normalize_javascript", true);
 
-    { "no_pipeline_req", Parameter::PT_BOOL, nullptr, "false",
-      "don't inspect pipelined requests after first (still does general detection)" },
+        else if (!keyword.compare("enable_xff"))
+            tmpval = converter->add_option_to_table("enable_xff", true);
 
-    { "non_rfc_chars", Parameter::PT_BIT_LIST, "255", "false",
-      "alert on given non-RFC chars being present in the URI" },
+        else if (!keyword.compare("extended_ascii_uri"))
+            tmpval = converter->add_option_to_table("extended_ascii_uri", true);
 
-    { "non_strict", Parameter::PT_BOOL, nullptr, "true",
-      "allows HTTP 0.9 processing" },
+        else if (!keyword.compare("non_strict"))
+            tmpval = converter->add_option_to_table("non_strict", true);
 
-    { "normalize_cookies", Parameter::PT_BOOL, nullptr, "false",
-      "help" },
+        else if (!keyword.compare("inspect_uri_only"))
+            tmpval = converter->add_option_to_table("inspect_uri_only", true);
 
-    { "normalize_headers", Parameter::PT_BOOL, nullptr, "false",
-      "help" },
+        else if (!keyword.compare("tab_uri_delimiter"))
+            tmpval = converter->add_option_to_table("tab_uri_delimiter", true);
 
-    { "normalize_javascript", Parameter::PT_BOOL, nullptr, "false",
-      "normalize javascript between <script> tags" },
+        else if (!keyword.compare("normalize_headers"))
+            tmpval = converter->add_option_to_table("normalize_headers", true);
 
-    { "max_javascript_whitespaces", Parameter::PT_INT, "0:", "200",
-      "maximum number of consecutive whitespaces" },
+        else if (!keyword.compare("normalize_utf"))
+            tmpval = converter->add_option_to_table("normalize_utf", true);
 
-    { "normalize_utf", Parameter::PT_BOOL, nullptr, "false",
-      "help" },
+        else if (!keyword.compare("log_uri"))
+            tmpval = converter->add_option_to_table("log_uri", true);
 
-    { "oversize_dir_length", Parameter::PT_INT, "0:", "0",
-      "alert if a URL has a directory longer than this limit" },
+        else if (!keyword.compare("normalize_cookies"))
+            tmpval = converter->add_option_to_table("normalize_cookies", true);
 
-    { "post_depth", Parameter::PT_INT, "-1:65535", "-1",
-      "amount of POST data to inspect" },
+        else if (!keyword.compare("log_hostname"))
+            tmpval = converter->add_option_to_table("log_hostname", true);
 
-    { "profile", Parameter::PT_ENUM, profiles, "none",
-      "set defaults appropriate for selected server" },
+        else if (!keyword.compare("no_pipeline_req"))
+            tmpval = converter->add_option_to_table("no_pipeline_req", true);
 
-    { "server_flow_depth", Parameter::PT_INT, "-1:65535", "300",
-      "response payload to inspect; includes headers with extended_response_inspection" },
+        else if (!keyword.compare("ascii"))
+            tmpval = parse_yn_bool_option("ascii", data_stream);
 
-    { "small_chunk_count", Parameter::PT_INT, "0:255", "0",
-      "alert if more than this limit of consecutive chunks are below small_chunk_length" },
+        else if (!keyword.compare("utf_8"))
+            tmpval = parse_yn_bool_option("utf_8", data_stream);
 
-    { "small_chunk_length", Parameter::PT_INT, "0:255", "0",
-      "alert if more than small_chunk_count consecutive chunks below this limit" },
+        else if (!keyword.compare("u_encode"))
+            tmpval = parse_yn_bool_option("u_encode", data_stream);
 
-    { "tab_uri_delimiter", Parameter::PT_BOOL, nullptr, "false",
-      "help" },
+        else if (!keyword.compare("bare_byte"))
+            tmpval = parse_yn_bool_option("bare_byte", data_stream);
 
-    { "u_encode", Parameter::PT_BOOL, nullptr, "false",
-      "decode %uXXXX character sequences" },
+        else if (!keyword.compare("iis_unicode"))
+            tmpval = parse_yn_bool_option("iis_unicode", data_stream);
 
-    { "unicode_map", Parameter::PT_TABLE, hi_umap_params, nullptr,
-      "help" },
+        else if (!keyword.compare("double_decode"))
+            tmpval = parse_yn_bool_option("double_decode", data_stream);
 
-    { "unlimited_decompress", Parameter::PT_INT, nullptr, "false",
-      "decompress across multiple packets" },
+        else if (!keyword.compare("multi_slash"))
+            tmpval = parse_yn_bool_option("multi_slash", data_stream);
 
-    { "utf_8", Parameter::PT_BOOL, nullptr, "true",
-      "decode UTF-8 unicode sequences in URI" },
+        else if (!keyword.compare("iis_backslash"))
+            tmpval = parse_yn_bool_option("iis_backslash", data_stream);
 
-    { "webroot", Parameter::PT_BOOL, nullptr, "true",
-      "alert on directory traversals past the top level (web server root)" },
+        else if (!keyword.compare("directory"))
+            tmpval = parse_yn_bool_option("directory", data_stream);
 
-    { "whitespace_chars", Parameter::PT_BIT_LIST, "255", "false",
-      "help" },
-#endif
+        else if (!keyword.compare("apache_whitespace"))
+            tmpval = parse_yn_bool_option("apache_whitespace", data_stream);
 
-bool HttpInspectServer::convert(std::stringstream& data_stream)
-{
-    std::string keyword;
+        else if (!keyword.compare("iis_delimiter"))
+            tmpval = parse_yn_bool_option("iis_delimiter", data_stream);
 
-    if(data_stream >> keyword)
-    {
-        const ConvertMap* map = util::find_map(output_api, keyword);
-        if (map)
+        else if (!keyword.compare("webroot"))
+            tmpval = parse_yn_bool_option("webroot", data_stream);
+
+        else if (!keyword.compare("max_javascript_whitespaces"))
+            tmpval = parse_int_option("max_javascript_whitespaces", data_stream);
+
+        else if (!keyword.compare("server_flow_depth"))
+            tmpval = parse_int_option("server_flow_depth", data_stream);
+
+        else if (!keyword.compare("client_flow_depth"))
+            tmpval = parse_int_option("client_flow_depth", data_stream);
+
+        else if (!keyword.compare("post_depth"))
+            tmpval = parse_int_option("post_depth", data_stream);
+
+        else if (!keyword.compare("chunk_length"))
+            tmpval = parse_int_option("chunk_length", data_stream);
+
+        else if (!keyword.compare("oversize_dir_length"))
+            tmpval = parse_int_option("oversize_dir_length", data_stream);
+
+        else if (!keyword.compare("max_header_length"))
+            tmpval = parse_int_option("max_header_length", data_stream);
+
+        else if (!keyword.compare("max_spaces"))
+            tmpval = parse_int_option("max_spaces", data_stream);
+
+        else if (!keyword.compare("max_headers"))
+            tmpval = parse_int_option("max_headers", data_stream);
+
+        else if (!keyword.compare("no_alerts"))
+            converter->add_deprecated_comment("no_alerts");
+
+        else if (!keyword.compare("http_methods"))
+            tmpval = parse_curly_bracket_list("http_methods", data_stream);
+
+        else if (!keyword.compare("whitespace_chars"))
+            tmpval = parse_bracketed_byte_list("whitespace_chars", data_stream);
+
+        else if (!keyword.compare("non_rfc_char"))
         {
-            converter->set_state(map->ctor(converter));
-            return true;
+            converter->add_deprecated_comment("non_rfc_char", "non_rfc_chars");
+            parse_bracketed_byte_list("non_rfc_chars", data_stream);
+        }
+
+        else if (!keyword.compare("enable_cookie"))
+        {
+            tmpval = converter->add_option_to_table("enable_cookies", true);
+            converter->add_deprecated_comment("enable_cookie", "enable_cookies");
         }
-    }
 
-    return false;    
+        else if (!keyword.compare("flow_depth"))
+        {
+            converter->add_deprecated_comment("flow_depth", "server_flow_depth");
+            tmpval = parse_int_option("server_flow_depth", data_stream);
+        }
+
+        else if (!keyword.compare("small_chunk_length"))
+        {
+            std::string bracket;
+            int length;
+            int consec_chunks;
+
+            if(!(data_stream >> bracket) || bracket.compare("{") ||
+                    !(data_stream >> length) ||
+                    !(data_stream >> consec_chunks) ||
+                    !(data_stream >> bracket) || bracket.compare("}"))
+            {
+                tmpval = false;
+            }
+            else
+            {
+                converter->open_table("small_chunk_length");
+                converter->add_option_to_table("size", length);
+                converter->add_option_to_table("count", consec_chunks);
+                converter->close_table();
+            }
+        }
+
+        else if (!keyword.compare("iis_unicode_map"))
+        {
+            std::string map_file;
+            int code_page;
+
+            if( (data_stream >> map_file) &&
+                (data_stream >> code_page))
+            {
+                converter->open_table("iis_unicode_map");
+                tmpval = converter->add_option_to_table("map_file", map_file);
+                tmpval = converter->add_option_to_table("code_page", code_page) && tmpval;
+                converter->close_table();
+            }
+            else
+            {
+                converter->add_comment_to_table("snort.conf missing argument for "
+                    "iis_unicode_map <filename> <codemap>");
+                tmpval = false;
+            }
+        }
 
-    data_stream.setstate(std::basic_ios<char>::eofbit);
-    return true;    
+        else if (!keyword.compare("profile"))
+        {
+            if (data_stream >> keyword)
+            {
+                tmpval = converter->add_option_to_table("profile", keyword);
+            }
+            else
+            {
+                converter->add_comment_to_table("Unable to convert keyword 'profile'");
+                tmpval = false;
+            }
+        }
+
+        else if (!keyword.compare("ports"))
+        {
+            converter->add_deprecated_comment("ports", "bindings");
+            converter->add_comment_to_table("check bindings table for port information");
+            // add commented list for now
+            std::string tmp = "";
+            while (data_stream >> keyword && keyword != "}")
+                tmp += " " + keyword;
+            tmpval = converter->add_option_to_table("--ports", tmp + "}");
+        }
+
+        else
+          tmpval = false;
+
+        retval = retval && tmpval;
+    }
+
+    return retval;
 }
 
+#if 0
+// check in confg
+
+
+#* decompress_swf { deflate lzma } *
+#* decompress_pdf { deflate } *
+
+#endif
+
 /**************************
  *******  A P I ***********
  **************************/
diff --git a/tools/snort2lua/preprocessor_states/preprocessor_api.cc b/tools/snort2lua/preprocessor_states/preprocessor_api.cc
index 9db516654..39cf71b97 100644
--- a/tools/snort2lua/preprocessor_states/preprocessor_api.cc
+++ b/tools/snort2lua/preprocessor_states/preprocessor_api.cc
@@ -28,6 +28,7 @@ extern const ConvertMap *bo_map;
 extern const ConvertMap *ftptelnet_map;
 extern const ConvertMap *ftptelnet_protocol_map;
 extern const ConvertMap *httpinspect_map;
+extern const ConvertMap *httpinspect_server_map;
 extern const ConvertMap *normalizer_icmp4_map;
 extern const ConvertMap *normalizer_icmp6_map;
 extern const ConvertMap *normalizer_ip4_map;
@@ -43,6 +44,7 @@ const std::vector<const ConvertMap*> preprocessor_api =
     bo_map,
     ftptelnet_map,
     httpinspect_map,
+    httpinspect_server_map,
     ftptelnet_protocol_map,
     normalizer_icmp4_map,
     normalizer_icmp6_map,