changed default atom splitter for service inspectors

diff --git a/src/framework/inspector.cc b/src/framework/inspector.cc
index c634f410067fea33b4af08d5eeb59f9cd5424fec..668a3e1562d4e9265564e18f2e3384dbfb2d1d29 100644 (file)
--- a/src/framework/inspector.cc
+++ b/src/framework/inspector.cc
@@ -23,6 +23,8 @@
 #include <assert.h>
 #include <string.h>
 
+#include "stream/stream_splitter.h"
+
 //-------------------------------------------------------------------------
 // packet handler stuff
 //-------------------------------------------------------------------------
@@ -84,3 +86,11 @@ bool Inspector::get_buf(const char* key, Packet* p, InspectionBuffer& b)
     return get_buf(id, p, b);
 }
 
+StreamSplitter* Inspector::get_splitter(bool to_server)
+{
+    if ( !api || api->type != IT_SERVICE )
+        return nullptr;
+
+    return new AtomSplitter(to_server);
+}
+

diff --git a/src/framework/inspector.h b/src/framework/inspector.h
index c8ce82d82bb4f4aa1f9ae131b380c0823d451de2..e7350f393011401dc858bd11a2d4d9bf1be21ae5 100644 (file)
--- a/src/framework/inspector.h
+++ b/src/framework/inspector.h
@@ -95,8 +95,7 @@ public:
     { return false; };
 
     // IT_SERVICE only
-    virtual class StreamSplitter* get_splitter(bool /*to_server*/)
-    { return nullptr; };
+    virtual class StreamSplitter* get_splitter(bool to_server);
 
     void set_api(const InspectApi* p)
     { api = p; };

diff --git a/src/managers/inspector_manager.cc b/src/managers/inspector_manager.cc
index be4da8e513edd412e505821d71b45ad1cc2124ec..a7ae2d28615c3562a5518f752f40d0b6413b3e86 100644 (file)
--- a/src/managers/inspector_manager.cc
+++ b/src/managers/inspector_manager.cc
@@ -575,12 +575,12 @@ void InspectorManager::execute (Packet* p)
         if ( !flow )
             return;
 
-        if ( flow->clouseau )
+        if ( flow->clouseau && (p->proto_bits & flow->clouseau->get_api()->proto_bits) )
             bumble(p);
 
         // FIXIT BIND need more than one service inspector?
         //::execute(p, fp->service.vec, fp->service.num);
-        if ( flow->gadget )
+        if ( flow->gadget && (p->proto_bits & flow->gadget->get_api()->proto_bits) )
             flow->gadget->eval(p);
     }
     else

diff --git a/src/stream/tcp/stream_tcp.cc b/src/stream/tcp/stream_tcp.cc
index ff05c542ba17241600b596228380ea587790a63c..8320f1f82201794cbd72e8d060bd9ce651ab954f 100644 (file)
--- a/src/stream/tcp/stream_tcp.cc
+++ b/src/stream/tcp/stream_tcp.cc
@@ -44,10 +44,6 @@ public:
 
     void eval(Packet*);
 
-    void pinit();
-    void pterm();
-    void reset();
-
 public:
     StreamTcpConfig* config;
 };
@@ -67,16 +63,6 @@ int StreamTcp::verify_config(SnortConfig* sc)
     return Stream5VerifyTcpConfig(sc, config);
 }
 
-void StreamTcp::pinit()
-{
-    tcp_sinit();
-}
-
-void StreamTcp::pterm()
-{
-    tcp_sterm();
-}
-
 void StreamTcp::show(SnortConfig*)
 {
     if ( config )
@@ -89,10 +75,6 @@ void StreamTcp::eval(Packet*)
     assert(false);
 }
 
-void StreamTcp::reset()
-{
-}
-
 StreamTcpConfig* get_tcp_cfg(Inspector* ins)
 {
     assert(ins);
@@ -125,6 +107,16 @@ Session* tcp_ssn(Flow* lws)
     return new TcpSession(lws);
 }
 
+void tcp_pinit()
+{
+    tcp_sinit();
+}
+
+void tcp_pterm()
+{
+    tcp_sterm();
+}
+
 static const InspectApi tcp_api =
 {
     {
@@ -143,8 +135,8 @@ static const InspectApi tcp_api =
     nullptr, // term
     tcp_ctor,
     tcp_dtor,
-    nullptr, // pinit
-    nullptr, // pterm
+    tcp_pinit,
+    tcp_pterm,
     tcp_ssn,
     tcp_sum,
     tcp_stats,