From: rcombs <rcombs@sq18.sfeng.sourcefire.com>
Date: Thu, 30 Oct 2014 04:23:23 +0000 (-0400)
Subject: fixed bogus 120:3 alerts
X-Git-Tag: 3.0.0-233~1298^2~3
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=3d9cbead87e9cf63f428944e04563123ebdb5f4a;p=thirdparty%2Fsnort3.git

fixed bogus 120:3 alerts
---

diff --git a/ChangeLog b/ChangeLog
index 3eed8d569..084a996bc 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -47,6 +47,7 @@
 -- tweaked S5_TRACE output
 -- fixed alert_fast to default to not print payload
 -- fixed tcp options log format
+-- fixed bogus 120:3 alerts
 
 125
 -- discovered can't catch exceptions thrown from Lua to C++; need to
diff --git a/src/service_inspectors/http_inspect/hi_server.cc b/src/service_inspectors/http_inspect/hi_server.cc
index ee5dd59c3..3b69287e6 100644
--- a/src/service_inspectors/http_inspect/hi_server.cc
+++ b/src/service_inspectors/http_inspect/hi_server.cc
@@ -44,6 +44,7 @@
 #include "hi_paf.h"
 #include "main/thread.h"
 
+static THREAD_LOCAL bool headers = false;
 static THREAD_LOCAL bool simple_response = false;
 static THREAD_LOCAL uint8_t decompression_buffer[65535];
 static THREAD_LOCAL uint8_t dechunk_buffer[65535];
@@ -788,7 +789,8 @@ static inline int hi_server_extract_body(
             {
                 if(!(sd->resp_state.last_pkt_chunked) && !simple_response)
                 {
-                    SnortEventqAdd(GID_HTTP_SERVER, HI_SERVER_NO_CONTLEN);
+                    if ( headers )
+                        SnortEventqAdd(GID_HTTP_SERVER, HI_SERVER_NO_CONTLEN);
                 }
                 else
                     sd->resp_state.last_pkt_chunked = 0;
@@ -1207,8 +1209,9 @@ static int HttpResponseInspection(HI_SESSION *session, Packet *p, const unsigned
     if(!ServerConf)
         return HI_INVALID_ARG;
 
-
     Server = &(session->server);
+    headers = false;
+
     clearHttpRespBuffer(Server);
 
     seq_num = GET_PKT_SEQ(p);
@@ -1386,6 +1389,7 @@ static int HttpResponseInspection(HI_SESSION *session, Packet *p, const unsigned
         }
         else
         {
+            headers = true;
             simple_response = false;
             p->packet_flags |= PKT_HTTP_DECODE;
             /* This is a next expected packet to be decompressed but the packet is a
diff --git a/src/service_inspectors/service_inspectors.cc b/src/service_inspectors/service_inspectors.cc
index a36fe4ea0..646118ecd 100644
--- a/src/service_inspectors/service_inspectors.cc
+++ b/src/service_inspectors/service_inspectors.cc
@@ -33,9 +33,9 @@ extern const BaseApi* sin_bo;
 extern const BaseApi* sin_ftp_client;
 extern const BaseApi* sin_ftp_server;
 extern const BaseApi* sin_ftp_data;
-#ifndef REG_TEST
+//#ifndef REG_TEST
 extern const BaseApi* sin_nhttp;
-#endif
+//#endif
 extern const BaseApi* sin_rpc_decode;
 extern const BaseApi* sin_telnet;
 extern const BaseApi* sin_wizard;
@@ -51,9 +51,9 @@ const BaseApi* service_inspectors[] =
     sin_ftp_client,
     sin_ftp_server,
     sin_ftp_data,
-#ifndef REG_TEST
+//#ifndef REG_TEST
     sin_nhttp,
-#endif
+//#endif
     sin_rpc_decode,
     sin_telnet,
     sin_wizard,