From: Hui Cao (huica) <huica@cisco.com>
Date: Thu, 29 Sep 2016 20:29:57 +0000 (-0400)
Subject: Merge pull request #647 in SNORT/snort3 from obfuscation_updates to master
X-Git-Tag: 3.0.0-233~250
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2ea86eea2122ee5346bbaa462c05b986fdf1e395;p=thirdparty%2Fsnort3.git

Merge pull request #647 in SNORT/snort3 from obfuscation_updates to master

Squashed commit of the following:

commit 95db4800e1963f5f20d7a7493e850070561379f4
Author: Victor Roemer <viroemer@cisco.com>
Date:   Thu Sep 29 12:06:23 2016 -0400

    Fix mysteriously disabling obfuscation and offset.
---

diff --git a/src/ips_options/ips_sd_pattern.cc b/src/ips_options/ips_sd_pattern.cc
index 7cce0a0d2..e1d889bc6 100644
--- a/src/ips_options/ips_sd_pattern.cc
+++ b/src/ips_options/ips_sd_pattern.cc
@@ -206,10 +206,9 @@ static int hs_match(unsigned int /*id*/, unsigned long long from,
         if ( !ctx->packet->obfuscator )
             ctx->packet->obfuscator = new Obfuscator();
 
-        uint32_t off = ctx->buf - ctx->start;
         // FIXIT-L Make configurable or don't show any PII partials (0 for user defined??)
-        len = len > 4 ? len - 4 : len;
-        ctx->packet->obfuscator->push(off, len);
+        uint32_t off = ctx->buf + from - ctx->start;
+        ctx->packet->obfuscator->push(off, len - 4);
     }
 
     return 0;
@@ -300,8 +299,6 @@ bool SdPatternModule::begin(const char*, int, SnortConfig*)
 
 bool SdPatternModule::set(const char*, Value& v, SnortConfig* sc)
 {
-    config.obfuscate_pii = false;
-
     if ( v.is("~pattern") )
     {
         config.pii = v.get_string();