From: rcombs <rcombs@sq18.sfeng.sourcefire.com>
Date: Wed, 29 Oct 2014 11:16:57 +0000 (-0400)
Subject: alert_fast new lines and stream is-paf? tweaks
X-Git-Tag: 3.0.0-233~1312
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ca9e55e91dc89a02a20991f805704cd674a360cb;p=thirdparty%2Fsnort3.git

alert_fast new lines and stream is-paf? tweaks
---

diff --git a/ChangeLog b/ChangeLog
index 290ada10d..0037b2c99 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -39,6 +39,8 @@
 -- changed builtin rules to rev:1; priority:3;
 -- update from Josh to fix codec FPs
 -- added REG_TEST support for -N (ignored) and -A console (alert_fast)
+-- tweaked alert_fast whitespace
+-- fixed stream is-paf? bug
 
 125
 -- discovered can't catch exceptions thrown from Lua to C++; need to
diff --git a/src/log/log_text.cc b/src/log/log_text.cc
index 63c22ca5b..86a7cb8e6 100644
--- a/src/log/log_text.cc
+++ b/src/log/log_text.cc
@@ -2044,7 +2044,7 @@ void PrintEapolPkt(FILE * fp, Packet * p)
         PrintNetData(fp, p->pkt, p->pkth->caplen, p);
     }
 
-    fprintf(fp, "=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+\n\n");
+    fprintf(fp, "%s\n", SEPARATOR);
 }
 
 /*
diff --git a/src/loggers/alert_fast.cc b/src/loggers/alert_fast.cc
index 9109ef62c..d2e222ad5 100644
--- a/src/loggers/alert_fast.cc
+++ b/src/loggers/alert_fast.cc
@@ -201,25 +201,25 @@ static void LogReassembly(const Packet* p)
     switch ( p->pseudo_type )
     {
     case PSEUDO_PKT_SMB_SEG:
-        TextLog_Print(fast_log, "\n%s\n", "SMB desegmented packet");
+        TextLog_Print(fast_log, "%s\n", "SMB desegmented packet");
         break;
     case PSEUDO_PKT_DCE_SEG:
-        TextLog_Print(fast_log, "\n%s\n", "DCE/RPC desegmented packet");
+        TextLog_Print(fast_log, "%s\n", "DCE/RPC desegmented packet");
         break;
     case PSEUDO_PKT_DCE_FRAG:
-        TextLog_Print(fast_log, "\n%s\n", "DCE/RPC defragmented packet");
+        TextLog_Print(fast_log, "%s\n", "DCE/RPC defragmented packet");
         break;
     case PSEUDO_PKT_SMB_TRANS:
-        TextLog_Print(fast_log, "\n%s\n", "SMB Transact reassembled packet");
+        TextLog_Print(fast_log, "%s\n", "SMB Transact reassembled packet");
         break;
     case PSEUDO_PKT_DCE_RPKT:
-        TextLog_Print(fast_log, "\n%s\n", "DCE/RPC reassembled packet");
+        TextLog_Print(fast_log, "%s\n", "DCE/RPC reassembled packet");
         break;
     case PSEUDO_PKT_TCP:
-        TextLog_Print(fast_log, "\n%s\n", "Stream reassembled packet");
+        TextLog_Print(fast_log, "%s\n", "Stream reassembled packet");
         break;
     case PSEUDO_PKT_IP:
-        TextLog_Print(fast_log, "\n%s\n", "Frag reassembled packet");
+        TextLog_Print(fast_log, "%s\n", "Frag reassembled packet");
         break;
     default:
         // FIXTHIS do we get here for portscan or sdf?
@@ -302,6 +302,7 @@ void FastLogger::alert(Packet *p, const char *msg, Event *event)
 
     if(packet)
     {
+        TextLog_NewLine(fast_log);
 #ifdef REG_TEST
         LogReassembly(p);
 #endif
diff --git a/src/stream/tcp/tcp_session.cc b/src/stream/tcp/tcp_session.cc
index b852837b2..b02254455 100644
--- a/src/stream/tcp/tcp_session.cc
+++ b/src/stream/tcp/tcp_session.cc
@@ -364,7 +364,10 @@ static inline uint32_t SegsToFlush (const StreamTracker* st, unsigned max)
 
 static inline bool DataToFlush (const StreamTracker* st)
 {
-    if ( st->flush_policy )
+    if ( 
+        st->flush_policy == STREAM_FLPOLICY_ON_DATA ||
+        st->splitter->is_paf()
+    )
         return ( SegsToFlush(st, 1) > 0 );
 
     return ( SegsToFlush(st, 2) > 1 );  // FIXIT-L return false?