carter - fixed config error for inspection of rebuilt packets

diff --git a/src/detection/fpcreate.cc b/src/detection/fpcreate.cc
index f7ba740191affcf8b398e93a73752f93ab22a404..8e3e6e34f7bafbb674854121b7f292c1c9f1eb18 100644 (file)
--- a/src/detection/fpcreate.cc
+++ b/src/detection/fpcreate.cc
@@ -807,12 +807,12 @@ void fpSetDebugMode(FastPatternConfig* fp)
 }
 
 /*
-**  Revert the detection engine back to not inspecting packets
+**  Enable or disable inspecting packets
 **  that are going to be rebuilt.
 */
-void fpSetStreamInsert(FastPatternConfig* fp)
+void fpSetStreamInsert(FastPatternConfig* fp, bool enable)
 {
-    fp->inspect_stream_insert = 0;
+    fp->inspect_stream_insert = enable;
 }
 
 /*

diff --git a/src/detection/fpcreate.h b/src/detection/fpcreate.h
index eccfe880f48f7e1bb8561dc85da6462965c53a0e..ace694289be7eb60ca842ab58845012f5f12c2fb 100644 (file)
--- a/src/detection/fpcreate.h
+++ b/src/detection/fpcreate.h
@@ -151,7 +151,7 @@ int prmFindRuleGroupIcmp(PORT_RULE_MAP*, int, PORT_GROUP**, PORT_GROUP**);
 int fpSetDetectSearchMethod(FastPatternConfig*, const char*);
 void fpSetDetectSearchOpt(FastPatternConfig*, int flag);
 void fpSetDebugMode(FastPatternConfig*);
-void fpSetStreamInsert(FastPatternConfig*);
+void fpSetStreamInsert(FastPatternConfig*, bool enable);
 void fpSetMaxQueueEvents(FastPatternConfig*, unsigned int);
 void fpDetectSetSplitAnyAny(FastPatternConfig*, int);
 void fpSetMaxPatternLen(FastPatternConfig*, unsigned int);

diff --git a/src/main/modules.cc b/src/main/modules.cc
index 052ac05a86bb8c5e4aea30929cb9e29e8e5b707e..4d0160b9dc9d12b2ae72ad4c89e8dd0a610f6ade 100644 (file)
--- a/src/main/modules.cc
+++ b/src/main/modules.cc
@@ -213,8 +213,8 @@ static const Parameter search_engine_params[] =
     { "max_queue_events", Parameter::PT_INT, nullptr, "5",
       "maximum number of matching fast pattern states to queue per packet" },
 
-    { "no_stream_inserts", Parameter::PT_BOOL, nullptr, "false",
-      "don't inspect reassembled payload - good for performance, bad for detection" },
+    { "inspect_stream_inserts", Parameter::PT_BOOL, nullptr, "true",
+      "inspect reassembled payload - disabling is good for performance, bad for detection" },
 
     { "search_method", Parameter::PT_STRING, nullptr, "ac_bnfa_q",
       "set fast pattern algorithm - choose available search engine" },
@@ -289,8 +289,8 @@ bool SearchEngineModule::set(const char*, Value& v, SnortConfig* sc)
     else if ( v.is("max_queue_events") )
         fpSetMaxQueueEvents(fp, v.get_long());
 
-    else if ( v.is("no_stream_inserts") )
-        fpSetStreamInsert(fp);
+    else if ( v.is("inspect_stream_inserts") )
+        fpSetStreamInsert(fp, v.get_bool());
 
     else if ( v.is("search_method") )
     {