alert_fast new lines and stream is-paf? tweaks

diff --git a/ChangeLog b/ChangeLog
index 290ada10dffc87495031f99407e098bbfa1d1161..0037b2c9950a8d5186acf5ca131c910faa8baf65 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -39,6 +39,8 @@
 -- changed builtin rules to rev:1; priority:3;
 -- update from Josh to fix codec FPs
 -- added REG_TEST support for -N (ignored) and -A console (alert_fast)
+-- tweaked alert_fast whitespace
+-- fixed stream is-paf? bug
 
 125
 -- discovered can't catch exceptions thrown from Lua to C++; need to

diff --git a/src/log/log_text.cc b/src/log/log_text.cc
index 63c22ca5bfb48635a695919f18ef97d9c7d9ca84..86a7cb8e6bb2de107790c1b23bca9396dd34ecc8 100644 (file)
--- a/src/log/log_text.cc
+++ b/src/log/log_text.cc
@@ -2044,7 +2044,7 @@ void PrintEapolPkt(FILE * fp, Packet * p)
         PrintNetData(fp, p->pkt, p->pkth->caplen, p);
     }
 
-    fprintf(fp, "=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+\n\n");
+    fprintf(fp, "%s\n", SEPARATOR);
 }
 
 /*

diff --git a/src/loggers/alert_fast.cc b/src/loggers/alert_fast.cc
index 9109ef62c6c666b9328e0f217112f02842c29b7c..d2e222ad5f8a114cbb33b929b201213fff6ae35b 100644 (file)
--- a/src/loggers/alert_fast.cc
+++ b/src/loggers/alert_fast.cc
@@ -201,25 +201,25 @@ static void LogReassembly(const Packet* p)
     switch ( p->pseudo_type )
     {
     case PSEUDO_PKT_SMB_SEG:
-        TextLog_Print(fast_log, "\n%s\n", "SMB desegmented packet");
+        TextLog_Print(fast_log, "%s\n", "SMB desegmented packet");
         break;
     case PSEUDO_PKT_DCE_SEG:
-        TextLog_Print(fast_log, "\n%s\n", "DCE/RPC desegmented packet");
+        TextLog_Print(fast_log, "%s\n", "DCE/RPC desegmented packet");
         break;
     case PSEUDO_PKT_DCE_FRAG:
-        TextLog_Print(fast_log, "\n%s\n", "DCE/RPC defragmented packet");
+        TextLog_Print(fast_log, "%s\n", "DCE/RPC defragmented packet");
         break;
     case PSEUDO_PKT_SMB_TRANS:
-        TextLog_Print(fast_log, "\n%s\n", "SMB Transact reassembled packet");
+        TextLog_Print(fast_log, "%s\n", "SMB Transact reassembled packet");
         break;
     case PSEUDO_PKT_DCE_RPKT:
-        TextLog_Print(fast_log, "\n%s\n", "DCE/RPC reassembled packet");
+        TextLog_Print(fast_log, "%s\n", "DCE/RPC reassembled packet");
         break;
     case PSEUDO_PKT_TCP:
-        TextLog_Print(fast_log, "\n%s\n", "Stream reassembled packet");
+        TextLog_Print(fast_log, "%s\n", "Stream reassembled packet");
         break;
     case PSEUDO_PKT_IP:
-        TextLog_Print(fast_log, "\n%s\n", "Frag reassembled packet");
+        TextLog_Print(fast_log, "%s\n", "Frag reassembled packet");
         break;
     default:
         // FIXTHIS do we get here for portscan or sdf?
@@ -302,6 +302,7 @@ void FastLogger::alert(Packet *p, const char *msg, Event *event)
 
     if(packet)
     {
+        TextLog_NewLine(fast_log);
 #ifdef REG_TEST
         LogReassembly(p);
 #endif

diff --git a/src/stream/tcp/tcp_session.cc b/src/stream/tcp/tcp_session.cc
index b852837b280177c8f0e1a3c3eb9eb352167b0ba1..b02254455bce62c212659dff6660c7747dc22f9a 100644 (file)
--- a/src/stream/tcp/tcp_session.cc
+++ b/src/stream/tcp/tcp_session.cc
@@ -364,7 +364,10 @@ static inline uint32_t SegsToFlush (const StreamTracker* st, unsigned max)
 
 static inline bool DataToFlush (const StreamTracker* st)
 {
-    if ( st->flush_policy )
+    if ( 
+        st->flush_policy == STREAM_FLPOLICY_ON_DATA ||
+        st->splitter->is_paf()
+    )
         return ( SegsToFlush(st, 1) > 0 );
 
     return ( SegsToFlush(st, 2) > 1 );  // FIXIT-L return false?