From: Russ Combs <rucombs@cisco.com>
Date: Fri, 22 May 2015 15:58:03 +0000 (-0400)
Subject: tom: new_http_inspect parsing and event handling updates
X-Git-Tag: 3.0.0-233~970
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=416e5fc6225aa527e145d8ee26fa96164edbbb57;p=thirdparty%2Fsnort3.git

tom: new_http_inspect parsing and event handling updates
---

diff --git a/.gitignore b/.gitignore
index 6056410cf..4f9144a35 100644
--- a/.gitignore
+++ b/.gitignore
@@ -47,6 +47,7 @@ doc/snort2lua_cmds.txt
 doc/snort_manual.chunked/
 doc/snort_manual.html
 doc/snort_manual.pdf
+doc/snort_manual.text
 doc/snort_manual.tgz
 doc/snort_manual.xml
 doc/version.txt
@@ -59,6 +60,8 @@ m4/
 missing
 snort
 snort.pc
+src/framework/api_options.h
+src/framework/stamp-h2
 src/snort
 src/tags
 src/test/suite_decl.h
diff --git a/ChangeLog b/ChangeLog
index 4a475aaac..2d1cd00ae 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+Pending - build 154
+
+-- new_http_inspect parsing and event handling updates
+
 15/05/22 - build 153
 
 -- new_http_inspect parsing updates
diff --git a/src/service_inspectors/nhttp_inspect/nhttp_enum.h b/src/service_inspectors/nhttp_inspect/nhttp_enum.h
index cc4cdf80f..0df6822bf 100644
--- a/src/service_inspectors/nhttp_inspect/nhttp_enum.h
+++ b/src/service_inspectors/nhttp_inspect/nhttp_enum.h
@@ -131,6 +131,7 @@ enum Infraction
     INF_STATUS_WS,
     INF_STATUS_TAB,
     INF_URI_SPACE,
+    INF_TOO_LONG_HEADER,
 };
 
 // Formats for output from a header normalization function
@@ -204,6 +205,7 @@ enum EventSid
     EVENT_IMPROPER_WS,
     EVENT_BAD_VERS,
     EVENT_UNKNOWN_VERS,
+    EVENT_BAD_HEADER,
     EVENT_MAXVALUE
 };
 
diff --git a/src/service_inspectors/nhttp_inspect/nhttp_infractions.h b/src/service_inspectors/nhttp_inspect/nhttp_infractions.h
index eabab65af..b32df3f5b 100644
--- a/src/service_inspectors/nhttp_inspect/nhttp_infractions.h
+++ b/src/service_inspectors/nhttp_inspect/nhttp_infractions.h
@@ -38,7 +38,7 @@ public:
         { infractions |= rhs.infractions; return *this; }
     friend NHttpInfractions operator+(NHttpInfractions lhs, const NHttpInfractions& rhs)
         { lhs += rhs; return lhs; }
-    friend bool operator&&(const NHttpInfractions& lhs, const NHttpInfractions& rhs)
+    friend bool operator&(const NHttpInfractions& lhs, const NHttpInfractions& rhs)
         { return (lhs.infractions & rhs.infractions) != 0; }
 
     // The following method is for convenience of debug and test output only! The 64-bit
diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_head_shared.cc b/src/service_inspectors/nhttp_inspect/nhttp_msg_head_shared.cc
index 6acc83f83..dbbbb99c2 100644
--- a/src/service_inspectors/nhttp_inspect/nhttp_msg_head_shared.cc
+++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_head_shared.cc
@@ -54,22 +54,31 @@ void NHttpMsgHeadShared::parse_header_block()
     int32_t bytes_used = 0;
     num_headers = 0;
     int num_seps;
+    // session_data->num_head_lines is computed without consideration of wrapping and may overstate
+    // actual number of headers. Rely on num_headers which is calculated correctly.
     header_line = new Field[session_data->num_head_lines[source_id]];
     while (bytes_used < msg_text.length)
     {
         header_line[num_headers].start = msg_text.start + bytes_used;
         header_line[num_headers].length = find_header_end(header_line[num_headers].start,
-            msg_text.length - bytes_used, &num_seps);
+            msg_text.length - bytes_used, num_seps);
         assert(num_headers < session_data->num_head_lines[source_id]);
+        if (header_line[num_headers].length > MAX_HEADER_LENGTH)
+        {
+            infractions += INF_TOO_LONG_HEADER;
+            events.create_event(EVENT_LONG_HDR);
+        }
         bytes_used += header_line[num_headers++].length + num_seps;
-        if (num_headers >= MAXHEADERS)
+        if (num_headers >= MAX_HEADERS)
         {
             break;
         }
     }
     if (bytes_used < msg_text.length)
     {
+        // FIXIT-M eventually need to separate max header alert from internal maximum
         infractions += INF_TOO_MANY_HEADERS;
+        events.create_event(EVENT_MAX_HEADERS);
     }
 }
 
@@ -80,37 +89,38 @@ void NHttpMsgHeadShared::parse_header_block()
 // The final header in the block will not be terminated by CRLF (splitter design) but will
 // terminate at the end of the buffer. length is returned.
 //
-// Bare LF without CR is accepted as the terminator unless preceded by backslash character. FIXIT-L
-// this does not consider whether \LF is contained within a quoted string and perhaps this should
-// be revisited. The current approach errs in the direction of not incorrectly dividing a single
-// header into two headers.
-//
-// FIXIT-M any abuse of backslashes in headers should be a preprocessor alert.
+// Bare LF without CR is accepted as the terminator.
 
-uint32_t NHttpMsgHeadShared::find_header_end(const uint8_t* buffer, int32_t length, int* const
-    num_seps)
+uint32_t NHttpMsgHeadShared::find_header_end(const uint8_t* buffer, int32_t length, int& num_seps)
 {
-    for (int32_t k=0; k < length-1; k++)
+    // k=1 because the splitter would not give us a header consisting solely of LF.
+    for (int32_t k=1; k < length; k++)
     {
-        if ((buffer[k] != '\\') && (buffer[k+1] == '\n'))
+        if (buffer[k] == '\n')
         {
-            if ((k+2 >= length) || ((buffer[k+2] != ' ') && (buffer[k+2] != '\t')))
+            // Check for wrapping
+            if ((k+1 == length) || !is_sp_tab[buffer[k+1]])
             {
-                *num_seps = (buffer[k] == '\r') ? 2 : 1;
-                return k + 2 - *num_seps;
+                num_seps = (buffer[k-1] == '\r') ? 2 : 1;
+                if (num_seps == 1)
+                {
+                    infractions += INF_LF_WITHOUT_CR;
+                    events.create_event(EVENT_IIS_DELIMITER);
+                }
+                return k + 1 - num_seps;
             }
         }
     }
-    *num_seps = 0;
+    num_seps = 0;
     return length;
 }
 
 // Divide header field lines into field name and field value
 void NHttpMsgHeadShared::parse_header_lines()
 {
-    header_name = new Field[session_data->num_head_lines[source_id]];
-    header_value = new Field[session_data->num_head_lines[source_id]];
-    header_name_id = new HeaderId[session_data->num_head_lines[source_id]];
+    header_name = new Field[num_headers];
+    header_value = new Field[num_headers];
+    header_name_id = new HeaderId[num_headers];
 
     int colon;
     for (int k=0; k < num_headers; k++)
@@ -130,6 +140,7 @@ void NHttpMsgHeadShared::parse_header_lines()
         else
         {
             infractions += INF_BAD_HEADER;
+            events.create_event(EVENT_BAD_HEADER);
         }
     }
 }
@@ -153,17 +164,10 @@ void NHttpMsgHeadShared::derive_header_name_id(int index)
 const Field& NHttpMsgHeadShared::get_header_value_norm(NHttpEnums::HeaderId header_id)
 {
     header_norms[header_id]->normalize(header_id, header_count[header_id], scratch_pad,
-        infractions,
-        header_name_id, header_value, num_headers, header_value_norm[header_id]);
+        infractions, header_name_id, header_value, num_headers, header_value_norm[header_id]);
     return header_value_norm[header_id];
 }
 
-void NHttpMsgHeadShared::gen_events()
-{
-    if (infractions && INF_TOO_MANY_HEADERS)
-        events.create_event(EVENT_MAX_HEADERS);
-}
-
 void NHttpMsgHeadShared::print_headers(FILE* output)
 {
     char title_buf[100];
diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_head_shared.h b/src/service_inspectors/nhttp_inspect/nhttp_msg_head_shared.h
index b8c668704..cecb53a87 100644
--- a/src/service_inspectors/nhttp_inspect/nhttp_msg_head_shared.h
+++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_head_shared.h
@@ -35,7 +35,6 @@ public:
     ~NHttpMsgHeadShared();
 
     void analyze() override;
-    void gen_events() override;
 
     int32_t get_num_headers() const { return num_headers; }
     const Field& get_headers() const { return msg_text; }
@@ -68,14 +67,15 @@ protected:
     static const StrCode trans_code_list[];
 
     void parse_header_block();
-    static uint32_t find_header_end(const uint8_t* buffer, int32_t length, int* const num_seps);
+    uint32_t find_header_end(const uint8_t* buffer, int32_t length, int& num_seps);
     void parse_header_lines();
     void derive_header_name_id(int index);
 
     void print_headers(FILE* output);
 
     // All of these are indexed by the relative position of the header field in the message
-    static const int MAXHEADERS = 200;  // I'm an arbitrary number. FIXIT-L
+    static const int MAX_HEADERS = 200;  // I'm an arbitrary number. FIXIT-L
+    static const int MAX_HEADER_LENGTH = 4096; // Based on max cookie size of some browsers
     int32_t num_headers = NHttpEnums::STAT_NOTCOMPUTE;
     Field* header_line = nullptr;
     Field* header_name = nullptr;
diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_header.cc b/src/service_inspectors/nhttp_inspect/nhttp_msg_header.cc
index 41064aa52..1f4f7cbb7 100644
--- a/src/service_inspectors/nhttp_inspect/nhttp_msg_header.cc
+++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_header.cc
@@ -39,7 +39,6 @@ NHttpMsgHeader::NHttpMsgHeader(const uint8_t* buffer, const uint16_t buf_size,
 
 void NHttpMsgHeader::gen_events()
 {
-    NHttpMsgHeadShared::gen_events();
     if (header_count[HEAD_CONTENT_LENGTH] > 1)
         events.create_event(EVENT_MULTIPLE_CONTLEN);
 }
diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_request.cc b/src/service_inspectors/nhttp_inspect/nhttp_msg_request.cc
index 63990ea89..59b624d31 100644
--- a/src/service_inspectors/nhttp_inspect/nhttp_msg_request.cc
+++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_request.cc
@@ -104,7 +104,7 @@ const Field& NHttpMsgRequest::get_uri_norm_legacy()
 
 void NHttpMsgRequest::gen_events()
 {
-    if (infractions && INF_BAD_REQ_LINE)
+    if (infractions & INF_BAD_REQ_LINE)
         return;
 
     if ((start_line.start[method.length] == '\t') ||
@@ -145,27 +145,27 @@ void NHttpMsgRequest::gen_events()
         events.create_event(EVENT_UNKNOWN_METHOD);
 
     // URI character encoding events
-    if (uri && (uri->get_uri_infractions() && INF_URI_PERCENT_ASCII))
+    if (uri && (uri->get_uri_infractions() & INF_URI_PERCENT_ASCII))
         events.create_event(EVENT_ASCII);
-    if (uri && (uri->get_uri_infractions() && INF_URI_PERCENT_UCODE))
+    if (uri && (uri->get_uri_infractions() & INF_URI_PERCENT_UCODE))
         events.create_event(EVENT_U_ENCODE);
-    if (uri && (uri->get_uri_infractions() && INF_URI_8BIT_CHAR))
+    if (uri && (uri->get_uri_infractions() & INF_URI_8BIT_CHAR))
         events.create_event(EVENT_BARE_BYTE);
-    if (uri && (uri->get_uri_infractions() && INF_URI_PERCENT_UTF8))
+    if (uri && (uri->get_uri_infractions() & INF_URI_PERCENT_UTF8))
         events.create_event(EVENT_UTF_8);
-    if (uri && (uri->get_uri_infractions() && INF_URI_BAD_CHAR))
+    if (uri && (uri->get_uri_infractions() & INF_URI_BAD_CHAR))
         events.create_event(EVENT_NON_RFC_CHAR);
 
     // URI path events
-    if (uri && (uri->get_path_infractions() && INF_URI_MULTISLASH))
+    if (uri && (uri->get_path_infractions() & INF_URI_MULTISLASH))
         events.create_event(EVENT_MULTI_SLASH);
-    if (uri && (uri->get_path_infractions() && INF_URI_BACKSLASH))
+    if (uri && (uri->get_path_infractions() & INF_URI_BACKSLASH))
         events.create_event(EVENT_IIS_BACKSLASH);
-    if (uri && (uri->get_path_infractions() && INF_URI_SLASH_DOT))
+    if (uri && (uri->get_path_infractions() & INF_URI_SLASH_DOT))
         events.create_event(EVENT_SELF_DIR_TRAV);
-    if (uri && (uri->get_path_infractions() && INF_URI_SLASH_DOT_DOT))
+    if (uri && (uri->get_path_infractions() & INF_URI_SLASH_DOT_DOT))
         events.create_event(EVENT_DIR_TRAV);
-    if (uri && (uri->get_path_infractions() && INF_URI_ROOT_TRAV))
+    if (uri && (uri->get_path_infractions() & INF_URI_ROOT_TRAV))
         events.create_event(EVENT_WEBROOT_DIR);
 }
 
@@ -210,7 +210,7 @@ void NHttpMsgRequest::print_section(FILE* output)
 void NHttpMsgRequest::update_flow()
 {
     // The following logic to determine body type is by no means the last word on this topic.
-    if (infractions && INF_BAD_REQ_LINE)
+    if (infractions & INF_BAD_REQ_LINE)
     {
         session_data->type_expected[source_id] = SEC_ABORT;
         session_data->half_reset(source_id);
diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_status.cc b/src/service_inspectors/nhttp_inspect/nhttp_msg_status.cc
index ff4ad6425..8c4655d9f 100644
--- a/src/service_inspectors/nhttp_inspect/nhttp_msg_status.cc
+++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_status.cc
@@ -105,7 +105,7 @@ void NHttpMsgStatus::derive_status_code_num()
 
 void NHttpMsgStatus::gen_events()
 {
-    if (infractions && INF_BAD_STAT_LINE)
+    if (infractions & INF_BAD_STAT_LINE)
         return;
 
     if (status_code.start > start_line.start + 9)
@@ -156,7 +156,7 @@ void NHttpMsgStatus::print_section(FILE* output)
 void NHttpMsgStatus::update_flow()
 {
     // The following logic to determine body type is by no means the last word on this topic.
-    if (infractions && INF_BAD_STAT_LINE)
+    if (infractions & INF_BAD_STAT_LINE)
     {
         session_data->type_expected[source_id] = SEC_ABORT;
         session_data->half_reset(source_id);
diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_trailer.cc b/src/service_inspectors/nhttp_inspect/nhttp_msg_trailer.cc
index 4d2a3b819..829157a72 100644
--- a/src/service_inspectors/nhttp_inspect/nhttp_msg_trailer.cc
+++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_trailer.cc
@@ -29,8 +29,7 @@
 using namespace NHttpEnums;
 
 NHttpMsgTrailer::NHttpMsgTrailer(const uint8_t* buffer, const uint16_t buf_size,
-    NHttpFlowData* session_data_,
-    SourceId source_id_, bool buf_owner) :
+    NHttpFlowData* session_data_, SourceId source_id_, bool buf_owner) :
     NHttpMsgHeadShared(buffer, buf_size, session_data_, source_id_, buf_owner)
 {
     transaction->set_trailer(this, source_id);
@@ -38,7 +37,6 @@ NHttpMsgTrailer::NHttpMsgTrailer(const uint8_t* buffer, const uint16_t buf_size,
 
 void NHttpMsgTrailer::gen_events()
 {
-    NHttpMsgHeadShared::gen_events();
 }
 
 void NHttpMsgTrailer::print_section(FILE* output)
diff --git a/src/service_inspectors/nhttp_inspect/nhttp_tables.cc b/src/service_inspectors/nhttp_inspect/nhttp_tables.cc
index e29d5121f..31c946204 100644
--- a/src/service_inspectors/nhttp_inspect/nhttp_tables.cc
+++ b/src/service_inspectors/nhttp_inspect/nhttp_tables.cc
@@ -308,6 +308,7 @@ const RuleMap NHttpModule::nhttp_events[] =
     { EVENT_IMPROPER_WS,                "Illegal extra whitespace in start line" },
     { EVENT_BAD_VERS,                   "Corrupted HTTP version" },
     { EVENT_UNKNOWN_VERS,               "Unknown HTTP version" },
+    { EVENT_BAD_HEADER,                 "Format error in HTTP header" },
     { 0, nullptr }
 };
 
diff --git a/src/service_inspectors/nhttp_inspect/nhttp_test_msgs.txt b/src/service_inspectors/nhttp_inspect/nhttp_test_msgs.txt
index e318d4fa2..60437fa56 100644
--- a/src/service_inspectors/nhttp_inspect/nhttp_test_msgs.txt
+++ b/src/service_inspectors/nhttp_inspect/nhttp_test_msgs.txt
@@ -589,13 +589,59 @@ HTTP/2.0 200 OK\r\nContent-type: text/plain\r\nTransfer-Encoding: gzip, identity
 HTTP/2.0 200 OK\r\nContent-type: text/plain\r\nTransfer-Encoding: gzip\r\nTransfer-Encoding: identity\r\nTransfer-Encoding: compress\r\nTransfer-Encoding: deflate
 \r\nTransfer-Encoding: foo\r\nTransfer-Encoding: chunked\r\n\r\n
 
+@5008
+@break
+@request
+GET /max/header/request/200/is/ok HTTP/1.1\r\n
+h0:val\r\nh1:val\r\nh2:val\r\nh3:val\r\nh4:val\r\nh5:val\r\nh6:val\r\nh7:val\r\nh8:val\r\nh9:val\r\n
+h0:val\r\nh1:val\r\nh2:val\r\nh3:val\r\nh4:val\r\nh5:val\r\nh6:val\r\nh7:val\r\nh8:val\r\nh9:val\r\n
+h0:val\r\nh1:val\r\nh2:val\r\nh3:val\r\nh4:val\r\nh5:val\r\nh6:val\r\nh7:val\r\nh8:val\r\nh9:val\r\n
+h0:val\r\nh1:val\r\nh2:val\r\nh3:val\r\nh4:val\r\nh5:val\r\nh6:val\r\nh7:val\r\nh8:val\r\nh9:val\r\n
+h0:val\r\nh1:val\r\nh2:val\r\nh3:val\r\nh4:val\r\nh5:val\r\nh6:val\r\nh7:val\r\nh8:val\r\nh9:val\r\n
+h0:val\r\nh1:val\r\nh2:val\r\nh3:val\r\nh4:val\r\nh5:val\r\nh6:val\r\nh7:val\r\nh8:val\r\nh9:val\r\n
+h0:val\r\nh1:val\r\nh2:val\r\nh3:val\r\nh4:val\r\nh5:val\r\nh6:val\r\nh7:val\r\nh8:val\r\nh9:val\r\n
+h0:val\r\nh1:val\r\nh2:val\r\nh3:val\r\nh4:val\r\nh5:val\r\nh6:val\r\nh7:val\r\nh8:val\r\nh9:val\r\n
+h0:val\r\nh1:val\r\nh2:val\r\nh3:val\r\nh4:val\r\nh5:val\r\nh6:val\r\nh7:val\r\nh8:val\r\nh9:val\r\n
+h0:val\r\nh1:val\r\nh2:val\r\nh3:val\r\nh4:val\r\nh5:val\r\nh6:val\r\nh7:val\r\nh8:val\r\nh9:val\r\n
+h0:val\r\nh1:val\r\nh2:val\r\nh3:val\r\nh4:val\r\nh5:val\r\nh6:val\r\nh7:val\r\nh8:val\r\nh9:val\r\n
+h0:val\r\nh1:val\r\nh2:val\r\nh3:val\r\nh4:val\r\nh5:val\r\nh6:val\r\nh7:val\r\nh8:val\r\nh9:val\r\n
+h0:val\r\nh1:val\r\nh2:val\r\nh3:val\r\nh4:val\r\nh5:val\r\nh6:val\r\nh7:val\r\nh8:val\r\nh9:val\r\n
+h0:val\r\nh1:val\r\nh2:val\r\nh3:val\r\nh4:val\r\nh5:val\r\nh6:val\r\nh7:val\r\nh8:val\r\nh9:val\r\n
+h0:val\r\nh1:val\r\nh2:val\r\nh3:val\r\nh4:val\r\nh5:val\r\nh6:val\r\nh7:val\r\nh8:val\r\nh9:val\r\n
+h0:val\r\nh1:val\r\nh2:val\r\nh3:val\r\nh4:val\r\nh5:val\r\nh6:val\r\nh7:val\r\nh8:val\r\nh9:val\r\n
+h0:val\r\nh1:val\r\nh2:val\r\nh3:val\r\nh4:val\r\nh5:val\r\nh6:val\r\nh7:val\r\nh8:val\r\nh9:val\r\n
+h0:val\r\nh1:val\r\nh2:val\r\nh3:val\r\nh4:val\r\nh5:val\r\nh6:val\r\nh7:val\r\nh8:val\r\nh9:val\r\n
+h0:val\r\nh1:val\r\nh2:val\r\nh3:val\r\nh4:val\r\nh5:val\r\nh6:val\r\nh7:val\r\nh8:val\r\nh9:val\r\n
+h0:val\r\nh1:val\r\nh2:val\r\nh3:val\r\nh4:val\r\nh5:val\r\nh6:val\r\nh7:val\r\nh8:val\r\nh9:val\r\n
+\r\n
 
 # ***********************************************************************************************
 # Invalid headers without body
-# @6001
-@break
-@request
-
+@6001
+@break
+@request
+GET /max/header/request/201/is/too/much HTTP/1.1\r\n
+h0:val\r\nh1:val\r\nh2:val\r\nh3:val\r\nh4:val\r\nh5:val\r\nh6:val\r\nh7:val\r\nh8:val\r\nh9:val\r\n
+h0:val\r\nh1:val\r\nh2:val\r\nh3:val\r\nh4:val\r\nh5:val\r\nh6:val\r\nh7:val\r\nh8:val\r\nh9:val\r\n
+h0:val\r\nh1:val\r\nh2:val\r\nh3:val\r\nh4:val\r\nh5:val\r\nh6:val\r\nh7:val\r\nh8:val\r\nh9:val\r\n
+h0:val\r\nh1:val\r\nh2:val\r\nh3:val\r\nh4:val\r\nh5:val\r\nh6:val\r\nh7:val\r\nh8:val\r\nh9:val\r\n
+h0:val\r\nh1:val\r\nh2:val\r\nh3:val\r\nh4:val\r\nh5:val\r\nh6:val\r\nh7:val\r\nh8:val\r\nh9:val\r\n
+h0:val\r\nh1:val\r\nh2:val\r\nh3:val\r\nh4:val\r\nh5:val\r\nh6:val\r\nh7:val\r\nh8:val\r\nh9:val\r\n
+h0:val\r\nh1:val\r\nh2:val\r\nh3:val\r\nh4:val\r\nh5:val\r\nh6:val\r\nh7:val\r\nh8:val\r\nh9:val\r\n
+h0:val\r\nh1:val\r\nh2:val\r\nh3:val\r\nh4:val\r\nh5:val\r\nh6:val\r\nh7:val\r\nh8:val\r\nh9:val\r\n
+h0:val\r\nh1:val\r\nh2:val\r\nh3:val\r\nh4:val\r\nh5:val\r\nh6:val\r\nh7:val\r\nh8:val\r\nh9:val\r\n
+h0:val\r\nh1:val\r\nh2:val\r\nh3:val\r\nh4:val\r\nh5:val\r\nh6:val\r\nh7:val\r\nh8:val\r\nh9:val\r\n
+h0:val\r\nh1:val\r\nh2:val\r\nh3:val\r\nh4:val\r\nh5:val\r\nh6:val\r\nh7:val\r\nh8:val\r\nh9:val\r\n
+h0:val\r\nh1:val\r\nh2:val\r\nh3:val\r\nh4:val\r\nh5:val\r\nh6:val\r\nh7:val\r\nh8:val\r\nh9:val\r\n
+h0:val\r\nh1:val\r\nh2:val\r\nh3:val\r\nh4:val\r\nh5:val\r\nh6:val\r\nh7:val\r\nh8:val\r\nh9:val\r\n
+h0:val\r\nh1:val\r\nh2:val\r\nh3:val\r\nh4:val\r\nh5:val\r\nh6:val\r\nh7:val\r\nh8:val\r\nh9:val\r\n
+h0:val\r\nh1:val\r\nh2:val\r\nh3:val\r\nh4:val\r\nh5:val\r\nh6:val\r\nh7:val\r\nh8:val\r\nh9:val\r\n
+h0:val\r\nh1:val\r\nh2:val\r\nh3:val\r\nh4:val\r\nh5:val\r\nh6:val\r\nh7:val\r\nh8:val\r\nh9:val\r\n
+h0:val\r\nh1:val\r\nh2:val\r\nh3:val\r\nh4:val\r\nh5:val\r\nh6:val\r\nh7:val\r\nh8:val\r\nh9:val\r\n
+h0:val\r\nh1:val\r\nh2:val\r\nh3:val\r\nh4:val\r\nh5:val\r\nh6:val\r\nh7:val\r\nh8:val\r\nh9:val\r\n
+h0:val\r\nh1:val\r\nh2:val\r\nh3:val\r\nh4:val\r\nh5:val\r\nh6:val\r\nh7:val\r\nh8:val\r\nh9:val\r\n
+h0:val\r\nh1:val\r\nh2:val\r\nh3:val\r\nh4:val\r\nh5:val\r\nh6:val\r\nh7:val\r\nh8:val\r\nh9:val\r\n
+h0:val\r\n\r\n
 
 # ***********************************************************************************************
 # Valid Content-Length and body
diff --git a/src/service_inspectors/nhttp_inspect/nhttp_uri_norm.cc b/src/service_inspectors/nhttp_inspect/nhttp_uri_norm.cc
index b97f412fd..5255f32fb 100644
--- a/src/service_inspectors/nhttp_inspect/nhttp_uri_norm.cc
+++ b/src/service_inspectors/nhttp_inspect/nhttp_uri_norm.cc
@@ -26,8 +26,7 @@
 using namespace NHttpEnums;
 
 void UriNormalizer::normalize(const Field& input, Field& result, bool do_path,
-    ScratchPad& scratch_pad,
-    NHttpInfractions& infractions)
+    ScratchPad& scratch_pad, NHttpInfractions& infractions)
 {
     if (result.length != STAT_NOTCOMPUTE)
         return;
diff --git a/src/service_inspectors/nhttp_inspect/nhttp_uri_norm.h b/src/service_inspectors/nhttp_inspect/nhttp_uri_norm.h
index 539dfe5d0..41dea8683 100644
--- a/src/service_inspectors/nhttp_inspect/nhttp_uri_norm.h
+++ b/src/service_inspectors/nhttp_inspect/nhttp_uri_norm.h
@@ -39,12 +39,12 @@ private:
     static bool path_check(const uint8_t* in_buf, int32_t in_length,
         NHttpInfractions& infractions);
 
-    static int32_t norm_char_clean(const uint8_t*, int32_t, uint8_t*, NHttpInfractions&, const
-    void* not_used);
-    static int32_t norm_backslash(const uint8_t*, int32_t, uint8_t*, NHttpInfractions&, const
-    void* not_used);
-    static int32_t norm_path_clean(const uint8_t*, int32_t, uint8_t*, NHttpInfractions&, const
-    void* not_used);
+    static int32_t norm_char_clean(const uint8_t*, int32_t, uint8_t*, NHttpInfractions&,
+        const void* not_used);
+    static int32_t norm_backslash(const uint8_t*, int32_t, uint8_t*, NHttpInfractions&,
+        const void* not_used);
+    static int32_t norm_path_clean(const uint8_t*, int32_t, uint8_t*, NHttpInfractions&,
+        const void* not_used);
 };
 
 #endif