From: Russ Combs <rucombs@cisco.com>
Date: Fri, 15 May 2015 14:51:46 +0000 (-0400)
Subject: carter - fixed config error for inspection of rebuilt packets
X-Git-Tag: 3.0.0-233~976
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=02070a4612a3d3b19e2fe8a8cb33f162c3f0265e;p=thirdparty%2Fsnort3.git

carter - fixed config error for inspection of rebuilt packets
---

diff --git a/src/detection/fpcreate.cc b/src/detection/fpcreate.cc
index f7ba74019..8e3e6e34f 100644
--- a/src/detection/fpcreate.cc
+++ b/src/detection/fpcreate.cc
@@ -807,12 +807,12 @@ void fpSetDebugMode(FastPatternConfig* fp)
 }
 
 /*
-**  Revert the detection engine back to not inspecting packets
+**  Enable or disable inspecting packets
 **  that are going to be rebuilt.
 */
-void fpSetStreamInsert(FastPatternConfig* fp)
+void fpSetStreamInsert(FastPatternConfig* fp, bool enable)
 {
-    fp->inspect_stream_insert = 0;
+    fp->inspect_stream_insert = enable;
 }
 
 /*
diff --git a/src/detection/fpcreate.h b/src/detection/fpcreate.h
index eccfe880f..ace694289 100644
--- a/src/detection/fpcreate.h
+++ b/src/detection/fpcreate.h
@@ -151,7 +151,7 @@ int prmFindRuleGroupIcmp(PORT_RULE_MAP*, int, PORT_GROUP**, PORT_GROUP**);
 int fpSetDetectSearchMethod(FastPatternConfig*, const char*);
 void fpSetDetectSearchOpt(FastPatternConfig*, int flag);
 void fpSetDebugMode(FastPatternConfig*);
-void fpSetStreamInsert(FastPatternConfig*);
+void fpSetStreamInsert(FastPatternConfig*, bool enable);
 void fpSetMaxQueueEvents(FastPatternConfig*, unsigned int);
 void fpDetectSetSplitAnyAny(FastPatternConfig*, int);
 void fpSetMaxPatternLen(FastPatternConfig*, unsigned int);
diff --git a/src/main/modules.cc b/src/main/modules.cc
index 052ac05a8..4d0160b9d 100644
--- a/src/main/modules.cc
+++ b/src/main/modules.cc
@@ -213,8 +213,8 @@ static const Parameter search_engine_params[] =
     { "max_queue_events", Parameter::PT_INT, nullptr, "5",
       "maximum number of matching fast pattern states to queue per packet" },
 
-    { "no_stream_inserts", Parameter::PT_BOOL, nullptr, "false",
-      "don't inspect reassembled payload - good for performance, bad for detection" },
+    { "inspect_stream_inserts", Parameter::PT_BOOL, nullptr, "true",
+      "inspect reassembled payload - disabling is good for performance, bad for detection" },
 
     { "search_method", Parameter::PT_STRING, nullptr, "ac_bnfa_q",
       "set fast pattern algorithm - choose available search engine" },
@@ -289,8 +289,8 @@ bool SearchEngineModule::set(const char*, Value& v, SnortConfig* sc)
     else if ( v.is("max_queue_events") )
         fpSetMaxQueueEvents(fp, v.get_long());
 
-    else if ( v.is("no_stream_inserts") )
-        fpSetStreamInsert(fp);
+    else if ( v.is("inspect_stream_inserts") )
+        fpSetStreamInsert(fp, v.get_bool());
 
     else if ( v.is("search_method") )
     {