From: Russ Combs (rucombs) <rucombs@cisco.com>
Date: Wed, 4 Nov 2015 16:22:27 +0000 (-0500)
Subject: Merge pull request #115 in SNORT/snort3 from crc/http_fsm to master
X-Git-Tag: 3.0.0-233~745
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=f2873c1aaa66ffcd1cfac13bea54a7e90be75753;p=thirdparty%2Fsnort3.git

Merge pull request #115 in SNORT/snort3 from crc/http_fsm to master

Squashed commit of the following:

commit aaeb8f42aad8f68661adeb8db8a7e735d2fbe767
Author: Russ Combs <rucombs@cisco.com>
Date:   Wed Nov 4 09:03:42 2015 -0500

    fix version fail transitions

commit e1334262958ca7ef3b8c734ca23592a22ab5cdcc
Author: Russ Combs <rucombs@cisco.com>
Date:   Tue Nov 3 08:17:22 2015 -0500

    http_inspect updated to allow bare spaces in uri
---

diff --git a/src/service_inspectors/http_inspect/hi_stream_splitter.cc b/src/service_inspectors/http_inspect/hi_stream_splitter.cc
index a5e499e11..faae1d909 100644
--- a/src/service_inspectors/http_inspect/hi_stream_splitter.cc
+++ b/src/service_inspectors/http_inspect/hi_stream_splitter.cc
@@ -224,7 +224,7 @@ typedef struct
 #define Q0 (P3+3)
 #define Q1 (Q0+12)
 #define Q2 (Q1+6)
-#define Q3 (Q2+8)
+#define Q3 (Q2+9)
 
 #define R2 (Q3+3)
 #define R3 (R2+5)
@@ -311,9 +311,7 @@ static const HiRule hi_rule[] =
     { Q0+10, Q0+10, Q0+11, ACT_NOP, TOKS },
     { Q0+11, Q1+ 0, Q3+ 2, ACT_NOP, LWSS },
 
-    // check tokens before eol to determine version
-    // 2 tokens is a 0.9 SimpleRequest (1 line header)
-    // this gets URI
+    // this gets required URI / next token
     { Q1+ 0, R8+ 0, Q1+ 1, ACT_NOP, EOLS },
     { Q1+ 1, Q1+ 0, Q1+ 2, ACT_NOP, LWSS },
     { Q1+ 2, Q1+ 3, Q1+ 3, ACT_NOP, ANYS },
@@ -321,17 +319,18 @@ static const HiRule hi_rule[] =
     { Q1+ 4, Q2+ 0, Q1+ 5, ACT_NOP, LWSS },
     { Q1+ 5, Q1+ 3, Q1+ 3, ACT_NOP, ANYS },
 
-    // 3 tokens is >= 1.0 (1 or more header lines)
-    // this gets version
+    // this gets version, allowing extra tokens
+    // if start line doesn't end with version,
+    // assume 0.9 SimpleRequest (1 line header)
     { Q2+ 0, R8+ 0, Q2+ 1, ACT_V09, EOLS },
     { Q2+ 1, Q2+ 0, Q2+ 2, ACT_NOP, LWSS },
-    // TBD allow unescaped space in URI; alert later
-    { Q2+ 2, Q2+ 3, Q3+ 0, ACT_NOP, "H"  },
-    { Q2+ 3, Q2+ 4, Q3+ 2, ACT_NOP, "TTP/1." },
+    { Q2+ 2, Q2+ 3, Q2+ 8, ACT_NOP, "H"  },
+    { Q2+ 3, Q2+ 4, Q2+ 8, ACT_NOP, "TTP/1." },
     { Q2+ 4, Q2+ 6, Q2+ 5, ACT_V10, "0"  },
-    { Q2+ 5, Q2+ 6, Q3+ 2, ACT_V11, "1"  },
+    { Q2+ 5, Q2+ 6, Q2+ 8, ACT_V11, "1"  },
     { Q2+ 6, R2+ 0, Q2+ 7, ACT_REQ, EOLS },
-    { Q2+ 7, Q2+ 6, Q3+ 2, ACT_NOP, LWSS },
+    { Q2+ 7, Q2+ 6, Q2+ 8, ACT_NOP, LWSS },
+    { Q2+ 8, Q2+ 0, Q2+ 0, ACT_NOP, ANYS },
 
     // resync state
     { Q3+ 0, Q0   , Q3+ 1, ACT_NOP, LWSS },