From: Russ Combs <rucombs@cisco.com>
Date: Mon, 17 Nov 2014 20:40:40 +0000 (-0500)
Subject: initial integration of hosts into binder
X-Git-Tag: 3.0.0-233~1212
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=93c9ef9bd4d09295f771a7e4ea1d71260420780e;p=thirdparty%2Fsnort3.git

initial integration of hosts into binder
---

diff --git a/ChangeLog b/ChangeLog
index bab84f61f..e7b603e65 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -35,6 +35,7 @@
 -- update from josh
 -- ensure stream normalizations get proper header iff needed
 -- fixed stream_reassemble.direction
+-- initial integration of hosts into binder
 
 127
 -- REG_TEST out logging tcp options for rebuilt packets to match snort bug
diff --git a/doc/start.txt b/doc/start.txt
index 38b1baabc..a1ca1d5d1 100644
--- a/doc/start.txt
+++ b/doc/start.txt
@@ -13,7 +13,7 @@ Required:
 
 * LuaJIT from http://luajit.org for configuration and scripting.
 
-* pcap from http://www.tcpdump.org for tcpdump logging.
+* pcap from http://www.tcpdump.org for tcpdump style logging.
 
 * pcre from http://www.pcre.org for regular expression pattern matching.
 
@@ -33,11 +33,12 @@ Optional:
 
 * Optionally built features are listed in the reference section.
 
-* You should build Snort++ with --prefix $install_dir where install_dir is
-  something you can easily delete.
+* You should build Snort++ with an install prefix so that you can easily
+  delete older versions.
 
 * To build with autotools, the usual ./configure, make, make install from
-  the top level directory will suffice.
+  the top level directory will suffice.  If you don't have ./configure,
+  then autoreconf -isvf must be done first.
 
 * To build with Cmake and make, first create a separate directory for the
   build and cd into that directory.  Then:
@@ -69,8 +70,8 @@ Optional:
 
 === Using Lua
 
-* Snort++ needs a lua conf.  use $install_dir/conf/snort.lua, like -c
-   $install_dir/conf/snort.lua.
+* Snort++ needs a lua conf.  You can use $install_dir/conf/snort.lua, like
+  -c $install_dir/conf/snort.lua.
 
 * lua/snort.lua is always the latest working example configuration.
 
diff --git a/src/detection/detect.cc b/src/detection/detect.cc
index d7c499c98..0e27ecd90 100644
--- a/src/detection/detect.cc
+++ b/src/detection/detect.cc
@@ -59,7 +59,6 @@
 #include "detection_util.h"
 #include "managers/inspector_manager.h"
 #include "managers/event_manager.h"
-#include "target_based/sftarget_protocol_reference.h"
 #include "detection_defines.h"
 #include "protocols/ip.h"
 #include "sfip/sf_ipvar.h"
@@ -468,19 +467,8 @@ bail:
 
     if (!(mode & (CHECK_SRC_PORT | CHECK_DST_PORT)))
     {
-        DEBUG_WRAP(
-            DebugMessage(DEBUG_ATTRIBUTE, "detect.c: CheckAddrPort..."
-                "target-based-protocol=%d,ignoring ports\n",
-                GetProtocolReference(p)););
         return 1;
     }
-    else
-    {
-        DEBUG_WRAP(
-            DebugMessage(DEBUG_ATTRIBUTE, "detect.c: CheckAddrPort..."
-                "target-based-protocol=%d,not ignoring ports\n",
-                GetProtocolReference(p)););
-    }
 
     /* check the packet port against the rule port */
     if( !PortObjectHasPort(po,pkt_port) )
@@ -691,19 +679,8 @@ int CheckSrcPortEqual(Packet *p, RuleTreeNode *rtn_idx,
     /* Check if attributes provided match earlier */
     if (check_ports == 0)
     {
-        DEBUG_WRAP(
-            DebugMessage(DEBUG_ATTRIBUTE, "detect.c: CheckSrcPortEq..."
-                "target-based-protocol=%d,ignoring ports\n",
-                GetProtocolReference(p)););
         return fp_list->next->RuleHeadFunc(p, rtn_idx, fp_list->next, check_ports);
     }
-    else
-    {
-        DEBUG_WRAP(
-            DebugMessage(DEBUG_ATTRIBUTE, "detect.c: CheckSrcPortEq..."
-                "target-based-protocol=%d,not ignoring ports\n",
-                GetProtocolReference(p)););
-    }
     if( PortObjectHasPort(rtn_idx->src_portobject,p->ptrs.sp) )
     {
         DEBUG_WRAP(DebugMessage(DEBUG_DETECT, "  SP match!\n"););
@@ -725,19 +702,8 @@ int CheckSrcPortNotEq(Packet *p, RuleTreeNode *rtn_idx,
     /* Check if attributes provided match earlier */
     if (check_ports == 0)
     {
-        DEBUG_WRAP(
-            DebugMessage(DEBUG_ATTRIBUTE, "detect.c: CheckSrcPortNotEq..."
-                "target-based-protocol=%d,ignoring ports\n",
-                GetProtocolReference(p)););
         return fp_list->next->RuleHeadFunc(p, rtn_idx, fp_list->next, check_ports);
     }
-    else
-    {
-        DEBUG_WRAP(
-            DebugMessage(DEBUG_ATTRIBUTE, "detect.c: CheckSrcPortNotEq..."
-                "target-based-protocol=%d,not ignoring ports\n",
-                GetProtocolReference(p)););
-    }
     if( !PortObjectHasPort(rtn_idx->src_portobject,p->ptrs.sp) )
     {
         DEBUG_WRAP(DebugMessage(DEBUG_DETECT, "  !SP match!\n"););
@@ -759,19 +725,8 @@ int CheckDstPortEqual(Packet *p, RuleTreeNode *rtn_idx,
     /* Check if attributes provided match earlier */
     if (check_ports == 0)
     {
-        DEBUG_WRAP(
-            DebugMessage(DEBUG_ATTRIBUTE, "detect.c: CheckDstPortEq..."
-            "target-based-protocol=%d,ignoring ports\n",
-            GetProtocolReference(p)););
         return fp_list->next->RuleHeadFunc(p, rtn_idx, fp_list->next, check_ports);
     }
-    else
-    {
-        DEBUG_WRAP(
-            DebugMessage(DEBUG_ATTRIBUTE, "detect.c: CheckDstPortEq..."
-            "target-based-protocol=%d,not ignoring ports\n",
-            GetProtocolReference(p)););
-    }
     if( PortObjectHasPort(rtn_idx->dst_portobject,p->ptrs.dp) )
     {
         DEBUG_WRAP(DebugMessage(DEBUG_DETECT, " DP match!\n"););
@@ -793,19 +748,8 @@ int CheckDstPortNotEq(Packet *p, RuleTreeNode *rtn_idx,
     /* Check if attributes provided match earlier */
     if (check_ports == 0)
     {
-        DEBUG_WRAP(
-            DebugMessage(DEBUG_ATTRIBUTE, "detect.c: CheckDstPortNotEq..."
-            "target-based-protocol=%d,ignoring ports\n",
-            GetProtocolReference(p)););
         return fp_list->next->RuleHeadFunc(p, rtn_idx, fp_list->next, check_ports);
     }
-    else
-    {
-        DEBUG_WRAP(
-            DebugMessage(DEBUG_ATTRIBUTE, "detect.c: CheckDstPortNotEq..."
-            "target-based-protocol=%d,not ignoring ports\n",
-            GetProtocolReference(p)););
-    }
     if( !PortObjectHasPort(rtn_idx->dst_portobject,p->ptrs.dp) )
     {
         DEBUG_WRAP(DebugMessage(DEBUG_DETECT, " !DP match!\n"););
diff --git a/src/detection/fpcreate.cc b/src/detection/fpcreate.cc
index 65a0cd09c..c17eebe8f 100644
--- a/src/detection/fpcreate.cc
+++ b/src/detection/fpcreate.cc
@@ -54,7 +54,6 @@
 #include "utils/stats.h"
 #include "treenodes.h"
 #include "parser.h"
-#include "target_based/sftarget_reader.h"
 #include "framework/mpse.h"
 #include "framework/ips_option.h"
 #include "managers/mpse_manager.h"
@@ -104,8 +103,6 @@ static const char* const pm_type_strings[PM_TYPE__MAX] =
 #define LOCAL_DEBUG
 */
 
-#include "target_based/sftarget_protocol_reference.h"
-
 static sopg_table_t * ServicePortGroupTableNew(void)
 {
     return (sopg_table_t *)SnortAlloc(sizeof(sopg_table_t));
@@ -2504,8 +2501,6 @@ int fpCreateFastPacketDetection(SnortConfig *sc)
     if (fpDetectGetDebugPrintRuleGroupBuildDetails(fp))
         LogMessage("Rule Maps Done....\n");
 
-    if (IsAdaptiveConfigured()
-            || fpDetectGetDebugPrintFastPatterns(fp))
     {
         if (fpDetectGetDebugPrintRuleGroupBuildDetails(fp))
             LogMessage("Creating Service Based Rule Maps....\n");
diff --git a/src/detection/fpcreate.h b/src/detection/fpcreate.h
index 091344325..d8306b1e6 100644
--- a/src/detection/fpcreate.h
+++ b/src/detection/fpcreate.h
@@ -38,18 +38,10 @@
 
 #include "hash/sfghash.h"
 #include "pcrm.h"
+#include "target_based/sftarget_protocol_reference.h"
 
 struct SnortConfig;
 
-/*
- *  Max Number of Protocols Supported by Rules in fpcreate.c
- *  for tcp,udp,icmp,ip ... this is an array dimesnion used to
- *  map protocol-ordinals to port_groups ...
- */
-/* This is now defined in sftarget_protocol_refererence.h"
- * #define MAX_PROTOCOL_ORDINAL 8192 */
-#include "target_based/sftarget_protocol_reference.h"
-
 /*
  *  This controls how many fast pattern match contents may be
  *  used/retrieved per rule in fpcreate.c.
diff --git a/src/detection/fpdetect.cc b/src/detection/fpdetect.cc
index a1679d289..227ff3d91 100644
--- a/src/detection/fpdetect.cc
+++ b/src/detection/fpdetect.cc
@@ -64,8 +64,6 @@
 #include "packet_io/active.h"
 #include "ips_options/ips_content.h"
 #include "stream/stream_api.h"
-#include "target_based/sftarget_protocol_reference.h"
-#include "target_based/sftarget_reader.h"
 #include "utils/sflsq.h"
 #include "ppm.h"
 #include "detection_util.h"
@@ -1241,10 +1239,9 @@ static inline int fpEvalHeaderUdp(Packet *p, OTNX_MATCH_DATA *omd)
 {
     PORT_GROUP *src = NULL, *dst = NULL, *gen = NULL;
 
-    if (IsAdaptiveConfigured())
     {
         /* Check for a service/protocol ordinal for this packet */
-        int16_t proto_ordinal = GetProtocolReference(p);
+        int16_t proto_ordinal = p->flow->s5_state.application_protocol;
 
         DEBUG_WRAP( DebugMessage(DEBUG_ATTRIBUTE,"proto_ordinal=%d\n",proto_ordinal););
 
@@ -1314,9 +1311,8 @@ static inline int fpEvalHeaderTcp(Packet *p, OTNX_MATCH_DATA *omd)
 {
     PORT_GROUP *src = NULL, *dst = NULL, *gen = NULL;
 
-    if (IsAdaptiveConfigured())
     {
-        int16_t proto_ordinal = GetProtocolReference(p);
+        int16_t proto_ordinal = p->flow->s5_state.application_protocol;
 
         DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, "proto_ordinal=%d\n", proto_ordinal););
 
diff --git a/src/detection/signature.cc b/src/detection/signature.cc
index 3e9773b91..33a8d0b29 100644
--- a/src/detection/signature.cc
+++ b/src/detection/signature.cc
@@ -32,9 +32,6 @@
 #include "snort.h"
 #include "parser.h"
 
-#include "target_based/sftarget_protocol_reference.h"
-#include "parser.h"
-
 /* for eval and free functions */
 #include "ips_options/ips_content.h"
 
diff --git a/src/file_api/file_service.cc b/src/file_api/file_service.cc
index a82dbfced..b44055662 100644
--- a/src/file_api/file_service.cc
+++ b/src/file_api/file_service.cc
@@ -52,9 +52,6 @@
 #include "detection_util.h"
 #include "service_inspectors/http_inspect/hi_main.h" // FIXIT-M bad dependency; use inspector::get_buf()
 
-#include "target_based/sftarget_protocol_reference.h"
-#include "target_based/sftarget_reader.h"
-
 static bool file_type_id_enabled = false;  // STATIC
 static bool file_signature_enabled = false;
 static bool file_processing_initiated = false;
@@ -1031,7 +1028,6 @@ static void print_file_stats(int exiting)
     }
     LogMessage("   %12s:           " FMTu64("-10") " \n", "Total",verdicts_total);
 
-    if (IsAdaptiveConfigured())
     {
         LogMessage("\nFiles processed by protocol IDs:\n");
         for (i = 0; i < MAX_PROTOCOL_ORDINAL; i++)
diff --git a/src/flow/flow.h b/src/flow/flow.h
index 389946523..6917fcf08 100644
--- a/src/flow/flow.h
+++ b/src/flow/flow.h
@@ -258,10 +258,12 @@ public:  // FIXIT-M privatize if possible
     uint16_t client_port;
     uint16_t server_port;
 
+    uint16_t ssn_policy;
     uint16_t session_state;
-    uint8_t  handler[SE_MAX];
 
+    uint8_t  handler[SE_MAX];
     uint8_t  response_count;
+
     uint8_t  inner_client_ttl, inner_server_ttl;
     uint8_t  outer_client_ttl, outer_server_ttl;
 };
diff --git a/src/flow/session.h b/src/flow/session.h
index 6ecaff27e..c737a2503 100644
--- a/src/flow/session.h
+++ b/src/flow/session.h
@@ -1,6 +1,6 @@
 /****************************************************************************
  *
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+ * Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
  * Copyright (C) 2013-2013 Sourcefire, Inc.
  *
  * This program is free software; you can redistribute it and/or modify
diff --git a/src/main/modules.cc b/src/main/modules.cc
index b43b12ff9..46a0c562e 100644
--- a/src/main/modules.cc
+++ b/src/main/modules.cc
@@ -1717,11 +1717,11 @@ bool RuleStateModule::end(const char*, int idx, SnortConfig* sc)
 // FIXIT-L these are cloned from ip_module.cc and tcp_module.cc
 
 #define ip_policies \
-    "first | linux | bsd | bsd_right |last | windows | solaris"
+    "unknown | first | linux | bsd | bsd_right |last | windows | solaris"
 
 #define tcp_policies \
-    "first | last | bsd | linux | old-linux | windows | win-2003 | vista " \
-    "solaris | hpux | hpux10 | irix | macos"
+    "unknown | first | last | bsd | linux | old-linux | windows | win-2003 | " \
+    "vista | solaris | hpux | hpux10 | irix | macos"
 
 static const Parameter service_params[] =
 {
@@ -1780,15 +1780,11 @@ bool HostsModule::set(const char*, Value& v, SnortConfig*)
 
     else if ( v.is("frag_policy") )
     {
-        strncpy(host->hostInfo.fragPolicyName, v.get_string(),
-            sizeof(host->hostInfo.fragPolicyName));
-        host->hostInfo.fragPolicy = v.get_long() + 1;
+        host->hostInfo.fragPolicy = v.get_long();
     }
     else if ( v.is("tcp_policy") )
     {
-        strncpy(host->hostInfo.streamPolicyName, v.get_string(),
-            sizeof(host->hostInfo.streamPolicyName));
-        host->hostInfo.streamPolicy = v.get_long() + 1;
+        host->hostInfo.streamPolicy = v.get_long();
     }
     else if ( v.is("name") )
         app->protocol = AddProtocolReference(v.get_string());
diff --git a/src/main/snort.cc b/src/main/snort.cc
index 84e279afa..5490657b4 100644
--- a/src/main/snort.cc
+++ b/src/main/snort.cc
@@ -106,11 +106,11 @@ using namespace std;
 #include "time/periodic.h"
 #include "parser/config_file.h"
 #include "parser/cmd_line.h"
-#include "target_based/sftarget_reader.h"
 #include "stream/stream_api.h"
 #include "stream/stream.h"
 #include "actions/act_replace.h"
 #include "filters/detection_filter.h"
+#include "target_based/sftarget_reader.h"
 
 #ifdef INTEL_SOFT_CPM
 #include "search/intel_soft_cpm.h"
diff --git a/src/managers/inspector_manager.cc b/src/managers/inspector_manager.cc
index f34fadabf..3054b4fc9 100644
--- a/src/managers/inspector_manager.cc
+++ b/src/managers/inspector_manager.cc
@@ -315,6 +315,8 @@ void InspectorManager::delete_policy (InspectionPolicy* pi)
     pi->framework_policy = nullptr;
 }
 
+// FIXIT-L allowing lookup by name or type or key is kinda hinky
+// would be helpful to have specific lookups
 static PHInstance* get_instance(
     FrameworkPolicy* fp, const char* keyword, bool dflt_only = false)
 {
diff --git a/src/network_inspectors/binder/binder.cc b/src/network_inspectors/binder/binder.cc
index 0bf416cd2..5ada24728 100644
--- a/src/network_inspectors/binder/binder.cc
+++ b/src/network_inspectors/binder/binder.cc
@@ -24,6 +24,7 @@ using namespace std;
 #include "binding.h"
 #include "bind_module.h"
 #include "flow/flow.h"
+#include "flow/session.h"
 #include "framework/inspector.h"
 #include "framework/plug_data.h"
 #include "stream/stream_splitter.h"
@@ -40,6 +41,9 @@ using namespace std;
 #include "main/snort.h"
 #include "main/policy.h"
 #include "parser/parser.h"
+#include "target_based/sftarget_data.h"
+#include "target_based/sftarget_protocol_reference.h"
+#include "target_based/sftarget_reader.h"
 
 THREAD_LOCAL ProfileStats bindPerfStats;
 
@@ -159,7 +163,7 @@ bool Binding::check_all(const Flow* flow) const
     if ( !check_vlan(flow) )
         return false;
 
-    // FIXIT-H need to check role and addr/ports relative to it
+    // FIXIT-M need to check role and addr/ports relative to it
     if ( !check_addr(flow) )
         return false;
 
@@ -185,6 +189,7 @@ static void set_session(Flow* flow, const char* key)
 
     if ( pin )
     {
+        // FIXIT-M need to set ssn client and server independently
         flow->set_client(pin);
         flow->set_server(pin);
         flow->clouseau = nullptr;
@@ -198,6 +203,18 @@ static void set_session(Flow* flow)
     flow->clouseau = nullptr;
 }
 
+static Inspector* get_gadget(Flow* flow, const HostAttributeEntry* host)
+{
+    stream.set_application_protocol_id_from_host_entry(flow, host, SSN_DIR_SERVER);
+
+    if ( !flow->s5_state.application_protocol )
+        return nullptr;
+
+    const char* s = get_protocol_name(flow->s5_state.application_protocol);
+
+    return InspectorManager::get_inspector(s);
+}
+
 //-------------------------------------------------------------------------
 // stuff stuff
 //-------------------------------------------------------------------------
@@ -222,9 +239,9 @@ struct Stuff
 
     bool update(Binding*);
 
-    void apply_action(Flow*);
-    void apply_session(Flow*);
-    void apply_service(Flow*);
+    bool apply_action(Flow*);
+    void apply_session(Flow*, const HostAttributeEntry*);
+    void apply_service(Flow*, const HostAttributeEntry*);
 };
 
 bool Stuff::update(Binding* pb)
@@ -260,26 +277,27 @@ bool Stuff::update(Binding* pb)
     return false;
 }
 
-void Stuff::apply_action(Flow* flow)
+bool Stuff::apply_action(Flow* flow)
 {
     switch ( action )
     {
     case BA_BLOCK:
         stream.drop_traffic(flow, SSN_DIR_BOTH);
         flow->set_state(Flow::BLOCK);
-        return;
+        return false;
 
     case BA_ALLOW:
         flow->set_state(Flow::ALLOW);
-        return;
+        return false;
 
-    case BA_INSPECT:
-        flow->set_state(Flow::INSPECT);
+    default:
         break;
     }
+    flow->set_state(Flow::INSPECT);
+    return true;
 }
 
-void Stuff::apply_session(Flow* flow)
+void Stuff::apply_session(Flow* flow, const HostAttributeEntry* host)
 {
     if ( server )
     {
@@ -292,10 +310,12 @@ void Stuff::apply_session(Flow* flow)
 
         return;
     }
+
     switch ( flow->protocol )
     {
     case PktType::IP:
         set_session(flow, INS_IP);
+        flow->ssn_policy = host ? host->hostInfo.fragPolicy : 0;
         break;
 
     case PktType::ICMP:
@@ -304,6 +324,7 @@ void Stuff::apply_session(Flow* flow)
 
     case PktType::TCP:
         set_session(flow, INS_TCP);
+        flow->ssn_policy = host ? host->hostInfo.streamPolicy : 0;
         break;
 
     case PktType::UDP:
@@ -315,11 +336,14 @@ void Stuff::apply_session(Flow* flow)
     }
 }
 
-void Stuff::apply_service(Flow* flow)
+void Stuff::apply_service(Flow* flow, const HostAttributeEntry* host)
 {
     if ( data )
         flow->set_data(data);
 
+    if ( host && !gadget )
+        gadget = get_gadget(flow, host);
+
     if ( gadget )
         flow->set_gadget(gadget);
 
@@ -509,13 +533,16 @@ Inspector* Binder::find_gadget(Flow* flow)
 void Binder::apply(Flow* flow, Stuff& stuff)
 {
     // setup action
-    stuff.apply_action(flow);
+    if ( !stuff.apply_action(flow) )
+        return;
+
+    const HostAttributeEntry* host = SFAT_LookupHostEntryByIP(&flow->server_ip);
 
     // setup session
-    stuff.apply_session(flow);
+    stuff.apply_session(flow, host);
 
     // setup service
-    stuff.apply_service(flow);
+    stuff.apply_service(flow, host);
 }
 
 //-------------------------------------------------------------------------
diff --git a/src/parser/config_file.cc b/src/parser/config_file.cc
index b4e36ff49..8287269ed 100644
--- a/src/parser/config_file.cc
+++ b/src/parser/config_file.cc
@@ -52,7 +52,6 @@
 #include "ips_options/ips_flowbits.h"
 #include "file_api/file_service_config.h"
 #include "packet_io/sfdaq.h"
-#include "target_based/sftarget_reader.h"
 #include "managers/event_manager.h"
 #include "detection/detect.h"
 #include "sfip/sf_ip.h"
diff --git a/src/parser/parse_rule.cc b/src/parser/parse_rule.cc
index e719ef28e..2a24a1167 100644
--- a/src/parser/parse_rule.cc
+++ b/src/parser/parse_rule.cc
@@ -74,7 +74,6 @@
 #include "managers/so_manager.h"
 #include "config_file.h"
 #include "keywords.h"
-#include "target_based/sftarget_reader.h"
 
 #define SRC  0
 #define DST  1
diff --git a/src/parser/parser.cc b/src/parser/parser.cc
index b8ec94fc5..9bbeea788 100644
--- a/src/parser/parser.cc
+++ b/src/parser/parser.cc
@@ -81,7 +81,6 @@
 #include "parse_rule.h"
 #include "parse_stream.h"
 #include "vars.h"
-#include "target_based/sftarget_reader.h"
 
 static unsigned parse_errors = 0;
 static unsigned parse_warnings = 0;
diff --git a/src/parser/vars.cc b/src/parser/vars.cc
index eff77dc66..03e6047fc 100644
--- a/src/parser/vars.cc
+++ b/src/parser/vars.cc
@@ -69,7 +69,6 @@
 #include "framework/ips_option.h"
 #include "config_file.h"
 #include "keywords.h"
-#include "target_based/sftarget_reader.h"
 
 //-------------------------------------------------------------------------
 // var node stuff
diff --git a/src/sfip/sfip_t.h b/src/sfip/sfip_t.h
index 6a4fbe4a1..32bd79f50 100644
--- a/src/sfip/sfip_t.h
+++ b/src/sfip/sfip_t.h
@@ -77,7 +77,7 @@ struct sfip_t {
 #undef inet_ntoa
 #endif
 
-SO_PUBLIC char *sfip_to_str(const sfip_t *ip);
+SO_PUBLIC char *sfip_to_str(const sfip_t*);
 #define sfip_ntoa(x) sfip_to_str(x)
 #define inet_ntoa sfip_ntoa
 
diff --git a/src/stream/ip/ip_defrag.cc b/src/stream/ip/ip_defrag.cc
index bc5b679c2..a8d7fc5e8 100644
--- a/src/stream/ip/ip_defrag.cc
+++ b/src/stream/ip/ip_defrag.cc
@@ -680,40 +680,6 @@ static int FragHandleIPOptions(FragTracker *ft,
     return 1;
 }
 
-int FragGetPolicy(Packet *p, FragEngine *engine)
-{
-    int frag_policy;
-    /* Not caching this host_entry in the frag tracker so we can
-     * swap the table out after processing this packet if we need
-     * to.  */
-    HostAttributeEntry *host_entry;
-
-    if (!IsAdaptiveConfigured())
-        return engine->frag_policy;
-
-    host_entry = SFAT_LookupHostEntryByDst(p);
-
-    if (host_entry && (isFragPolicySet(host_entry) == POLICY_SET))
-    {
-        frag_policy = getFragPolicy(host_entry);
-
-        if (frag_policy != SFAT_UNKNOWN_FRAG_POLICY)
-        {
-            DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
-                "FragGetPolicy: Policy Map Entry: %d(%s)\n",
-                frag_policy, frag_policy_names[frag_policy]););
-
-            return frag_policy;
-        }
-    }
-
-    DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
-        "FragGetPolicy: Using configured default %d(%s)\n",
-        engine->frag_policy, frag_policy_names[engine->frag_policy]););
-
-    return engine->frag_policy;
-}
-
 /** checks for tiny fragments and raises appropriate alarm
  *
  * @param p Current packet to insert
@@ -1187,82 +1153,6 @@ static void release_tracker(FragTracker* ft)
     t_stats.trackers_released++;
 }
 
-int fragGetApplicationProtocolId(Packet *p)
-{
-    FragTracker *ft;
-    /* Not caching this host_entry in the frag tracker so we can
-     * swap the table out after processing this packet if we need
-     * to.  */
-    HostAttributeEntry *host_entry = NULL;
-    uint16_t src_port = 0;
-    uint16_t dst_port = 0;
-
-    if ( !p->flow || p->flow->protocol != PktType::IP )
-    {
-        return 0;
-    }
-
-    /* Must be a rebuilt frag... */
-    if (!(p->packet_flags & PKT_REBUILT_FRAG))
-    {
-        return 0;
-    }
-
-    ft = &((IpSession*)p->flow->session)->tracker;
-
-    if (ft->application_protocol != 0)
-    {
-        return ft->application_protocol;
-    }
-
-    switch (p->type())
-    {
-    case PktType::TCP:
-        ft->ipprotocol = protocolReferenceTCP;
-        src_port = p->ptrs.sp;
-        dst_port = p->ptrs.dp;
-        break;
-    case PktType::UDP:
-        ft->ipprotocol = protocolReferenceUDP;
-        src_port = p->ptrs.sp;
-        dst_port = p->ptrs.dp;
-        break;
-    case PktType::ICMP:
-        ft->ipprotocol = protocolReferenceICMP;
-        break;
-    default:
-        break;
-    }
-
-    host_entry = SFAT_LookupHostEntryBySrc(p);
-    if (host_entry)
-    {
-        ft->application_protocol = getApplicationProtocolId(host_entry,
-                                    ft->ipprotocol,
-                                    src_port,
-                                    SFAT_SERVICE);
-        if (ft->application_protocol != 0)
-        {
-            return ft->application_protocol;
-        }
-    }
-
-    host_entry = SFAT_LookupHostEntryByDst(p);
-    if (host_entry)
-    {
-        ft->application_protocol = getApplicationProtocolId(host_entry,
-                                    ft->ipprotocol,
-                                    dst_port,
-                                    SFAT_SERVICE);
-        if (ft->application_protocol != 0)
-        {
-            return ft->application_protocol;
-        }
-    }
-
-    return ft->application_protocol;
-}
-
 //-------------------------------------------------------------------------
 // Defrag methods
 //-------------------------------------------------------------------------
@@ -2314,7 +2204,7 @@ int Defrag::new_tracker(Packet *p, FragTracker* ft)
     ft->ip_options_data = NULL;
     ft->copied_ip_options_len = 0;
     ft->ordinal = 0;
-    ft->frag_policy = FragGetPolicy(p, &engine);
+    ft->frag_policy = p->flow->ssn_policy ? p->flow->ssn_policy : engine.frag_policy;
     ft->engine = &engine;
 
     /*
diff --git a/src/stream/ip/ip_session.h b/src/stream/ip/ip_session.h
index 38163b033..996ee3029 100644
--- a/src/stream/ip/ip_session.h
+++ b/src/stream/ip/ip_session.h
@@ -75,7 +75,7 @@ class IpSession : public Session
 public:
     IpSession(Flow*);
 
-    bool setup (Packet*) override;
+    bool setup(Packet*) override;
     int process(Packet*) override;
     void clear() override;
 
diff --git a/src/stream/stream.h b/src/stream/stream.h
index cf041f6d7..4b9b66687 100644
--- a/src/stream/stream.h
+++ b/src/stream/stream.h
@@ -1,6 +1,6 @@
 /****************************************************************************
  *
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+ * Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
  * Copyright (C) 2005-2013 Sourcefire, Inc.
  *
  * This program is free software; you can redistribute it and/or modify
@@ -30,17 +30,14 @@
 #include <sys/types.h>
 #include <netinet/in.h>
 
-#include "target_based/sftarget_protocol_reference.h"
 #include "framework/counts.h"
 #include "utils/bitop_funcs.h"
 #include "framework/inspector.h"
-
 #include "snort_types.h"
 #include "snort.h"
 #include "detect.h"
 #include "stream/stream_api.h"
-
-#include "target_based/sftarget_hostentry.h"
+#include "target_based/sftarget_protocol_reference.h"
 
 //#define DEBUG_STREAM5 DEBUG
 
@@ -107,7 +104,7 @@ struct Stream5Config
 };
 
 #if 0
-FIXIT-1 delete?
+FIXIT-M delete?
 typedef struct {
     PegCount  filtered;
     PegCount  inspected;
diff --git a/src/stream/stream_api.cc b/src/stream/stream_api.cc
index a20fadfac..064094eab 100644
--- a/src/stream/stream_api.cc
+++ b/src/stream/stream_api.cc
@@ -58,7 +58,6 @@
 #include "target_based/sftarget_protocol_reference.h"
 #include "target_based/sftarget_hostentry.h"
 
-
 Stream stream;  // FIXIT-L global for SnortContext
 
 Stream::Stream()
@@ -386,7 +385,7 @@ int Stream::set_application_protocol_id_expected(
 }
 
 void Stream::set_application_protocol_id_from_host_entry(
-    Flow* flow, HostAttributeEntry *host_entry, int direction)
+    Flow* flow, const HostAttributeEntry *host_entry, int direction)
 {
     int16_t application_protocol;
 
@@ -406,13 +405,13 @@ void Stream::set_application_protocol_id_from_host_entry(
     {
         application_protocol = getApplicationProtocolId(
             host_entry, flow->s5_state.ipprotocol,
-            ntohs(flow->server_port), SFAT_SERVICE);
+            flow->server_port, SFAT_SERVICE);
     }
     else
     {
         application_protocol = getApplicationProtocolId(
             host_entry, flow->s5_state.ipprotocol,
-            ntohs(flow->client_port), SFAT_SERVICE);
+            flow->client_port, SFAT_SERVICE);
 
         if ( application_protocol &&
             (flow->s5_state.session_flags & SSNFLAG_MIDSTREAM) )
@@ -442,9 +441,6 @@ int16_t Stream::get_application_protocol_id(Flow* flow)
     if (flow->s5_state.application_protocol != 0)
         return flow->s5_state.application_protocol;
 
-    if (!IsAdaptiveConfigured())
-        return flow->s5_state.application_protocol;
-
     if (flow->s5_state.ipprotocol == 0)
     {
         set_ip_protocol(flow);
@@ -483,9 +479,6 @@ int16_t Stream::set_application_protocol_id(Flow* flow, int16_t id)
     if (!flow)
         return 0;
 
-    if (!IsAdaptiveConfigured())
-        return 0;
-
     if (flow->s5_state.application_protocol != id)
     {
         flow->s5_state.application_protocol = id;
@@ -495,7 +488,7 @@ int16_t Stream::set_application_protocol_id(Flow* flow, int16_t id)
         set_ip_protocol(flow);
 
     SFAT_UpdateApplicationProtocol(
-        &flow->server_ip, ntohs(flow->server_port),
+        &flow->server_ip, flow->server_port,
         flow->s5_state.ipprotocol, id);
 
     return id;
diff --git a/src/stream/stream_api.h b/src/stream/stream_api.h
index 5dc67cb62..fde7277b9 100644
--- a/src/stream/stream_api.h
+++ b/src/stream/stream_api.h
@@ -300,7 +300,7 @@ public:
     void update_direction(Flow*, char dir, const sfip_t *ip, uint16_t port);
 
     static void set_application_protocol_id_from_host_entry(
-        Flow *lwssn, struct _HostAttributeEntry *host_entry, int direction);
+        Flow*, const struct HostAttributeEntry*, int direction);
 
     static uint32_t set_session_flags(Flow*, uint32_t flags);
     static uint32_t get_session_flags(Flow*);
diff --git a/src/stream/tcp/stream_paf.cc b/src/stream/tcp/stream_paf.cc
index c22dbdf09..40b95d197 100644
--- a/src/stream/tcp/stream_paf.cc
+++ b/src/stream/tcp/stream_paf.cc
@@ -51,7 +51,6 @@
 #include "snort.h"
 #include "stream/stream.h"
 #include "stream/stream_api.h"
-#include "target_based/sftarget_protocol_reference.h"
 
 //--------------------------------------------------------------------
 // private state
diff --git a/src/stream/tcp/stream_tcp.h b/src/stream/tcp/stream_tcp.h
index c2be54408..291b5cbf0 100644
--- a/src/stream/tcp/stream_tcp.h
+++ b/src/stream/tcp/stream_tcp.h
@@ -25,7 +25,6 @@
 #include "flow/flow.h"
 #include "stream/stream_api.h"
 #include "protocols/packet.h"
-#include "target_based/sftarget_protocol_reference.h"
 #include "framework/bits.h"
 
 struct StreamTcpConfig
diff --git a/src/stream/tcp/tcp_session.cc b/src/stream/tcp/tcp_session.cc
index 9bb11556b..a6976e30f 100644
--- a/src/stream/tcp/tcp_session.cc
+++ b/src/stream/tcp/tcp_session.cc
@@ -2415,30 +2415,6 @@ int Stream5FlushListener(Packet *p, Flow *lwssn)
     return flushed;
 }
 
-void TcpSession::restart(Packet* p)
-{
-    StreamTracker* talker, * listener;
-    TcpSession* tcpssn = (TcpSession*)p->flow->session;
-
-    if ( p->packet_flags & PKT_FROM_SERVER )
-    {
-        talker = &tcpssn->server;
-        listener = &tcpssn->client;
-    }
-    else
-    {
-        talker = &tcpssn->client;
-        listener = &tcpssn->server;
-    }
-
-    // FIXTHIS-H on data / on ack must be based on flush policy
-    if ( p->dsize > 0 )
-        CheckFlushPolicyOnData(this, talker, listener, p);
-
-    if ( p->ptrs.tcph->is_ack() )
-        CheckFlushPolicyOnAck(this, talker, listener, p);
-}
-
 int Stream5FlushTalker(Packet *p, Flow *lwssn)
 {
     StreamTracker *talker = NULL;
@@ -4116,69 +4092,24 @@ static int ProcessTcpData(
     return S5_UNALIGNED;
 }
 
-uint16_t StreamGetPolicy(
-    Flow *lwssn, StreamTcpConfig *config, int direction)
-{
-    uint16_t policy_id;
-    /* Not caching this host_entry in the frag tracker so we can
-     * swap the table out after processing this packet if we need
-     * to.  */
-    HostAttributeEntry *host_entry = NULL;
-    int ssn_dir;
-
-    if (!IsAdaptiveConfigured())
-        return config->policy;
-
-    if (direction == FROM_CLIENT)
-    {
-        host_entry = SFAT_LookupHostEntryByIP(&lwssn->server_ip);
-        ssn_dir = SSN_DIR_SERVER;
-    }
-    else
-    {
-        host_entry = SFAT_LookupHostEntryByIP(&lwssn->client_ip);
-        ssn_dir = SSN_DIR_CLIENT;
-    }
-    if (host_entry && (isStreamPolicySet(host_entry) == POLICY_SET))
-    {
-        policy_id = getStreamPolicy(host_entry);
-
-        if (policy_id != SFAT_UNKNOWN_STREAM_POLICY)
-        {
-            STREAM5_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
-                "StreamGetPolicy: Policy Map Entry: %d(%s)\n",
-                policy_id, reassembly_policy_names[policy_id]););
-
-            /* Since we've already done the lookup, try to get the
-             * application protocol id with that host_entry. */
-            stream.set_application_protocol_id_from_host_entry(lwssn, host_entry, ssn_dir);
-            return policy_id;
-        }
-    }
-
-    STREAM5_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
-        "StreamGetPolicy: Using configured default %d(%s)\n",
-        config->policy, reassembly_policy_names[config->policy]););
-
-    return config->policy;
-}
-
 void SetTcpReassemblyPolicy(StreamTracker *st)
 {
     st->reassembly_policy = GetTcpReassemblyPolicy(st->os_policy);
 }
 
-static void SetOSPolicy(TcpSession *tcpssn)
+static void SetOSPolicy(Flow* flow, TcpSession *tcpssn)
 {
-    if (tcpssn->client.os_policy == 0)
+    if ( !tcpssn->client.os_policy )
     {
-        tcpssn->client.os_policy = StreamGetPolicy(tcpssn->flow, tcpssn->client.config, FROM_SERVER);
+        tcpssn->client.os_policy = flow->ssn_policy ? flow->ssn_policy :
+            tcpssn->client.config->policy;
         SetTcpReassemblyPolicy(&tcpssn->client);
     }
 
-    if (tcpssn->server.os_policy == 0)
+    if ( !tcpssn->server.os_policy )
     {
-        tcpssn->server.os_policy = StreamGetPolicy(tcpssn->flow, tcpssn->server.config, FROM_CLIENT);
+        tcpssn->server.os_policy = flow->ssn_policy ? flow->ssn_policy :
+            tcpssn->server.config->policy;
         SetTcpReassemblyPolicy(&tcpssn->server);
     }
 }
@@ -4300,7 +4231,7 @@ static void NewTcpSession(
         if (lwssn->s5_state.session_flags & SSNFLAG_RESET)
             lwssn->s5_state.session_flags &= ~SSNFLAG_RESET;
 
-        SetOSPolicy(tmp);
+        SetOSPolicy(lwssn, tmp);
 
         if ( (lwssn->s5_state.session_flags & SSNFLAG_CLIENT_SWAP) &&
             !(lwssn->s5_state.session_flags & SSNFLAG_CLIENT_SWAPPED) )
@@ -5056,8 +4987,7 @@ static int ProcessTcp(
     if ((p->dsize) && p->ptrs.tcph->is_syn())
     {
         /* MacOS accepts data on SYN, so don't alert if policy is MACOS */
-        if (StreamGetPolicy(lwssn, config, FROM_CLIENT) !=
-            STREAM_POLICY_MACOS)
+        if ( talker->os_policy != STREAM_POLICY_MACOS)
         {
             if ( Normalize_IsEnabled(NORM_TCP_TRIM) )
             {
@@ -6672,6 +6602,30 @@ void TcpSession::clear()
         TcpSessionClear(flow, this, 1);
 }
 
+void TcpSession::restart(Packet* p)
+{
+    StreamTracker* talker, * listener;
+    TcpSession* tcpssn = (TcpSession*)p->flow->session;
+
+    if ( p->packet_flags & PKT_FROM_SERVER )
+    {
+        talker = &tcpssn->server;
+        listener = &tcpssn->client;
+    }
+    else
+    {
+        talker = &tcpssn->client;
+        listener = &tcpssn->server;
+    }
+
+    // FIXTHIS-H on data / on ack must be based on flush policy
+    if ( p->dsize > 0 )
+        CheckFlushPolicyOnData(this, talker, listener, p);
+
+    if ( p->ptrs.tcph->is_ack() )
+        CheckFlushPolicyOnAck(this, talker, listener, p);
+}
+
 void TcpSession::update_direction(
     char dir, const sfip_t *ip, uint16_t port)
 {
diff --git a/src/target_based/sftarget_data.h b/src/target_based/sftarget_data.h
index 8a45c33fe..439264ace 100644
--- a/src/target_based/sftarget_data.h
+++ b/src/target_based/sftarget_data.h
@@ -66,30 +66,23 @@ typedef ApplicationEntry ApplicationList;
 #define HOST_INFO_VERSION 3
 #define HOST_INFO_FRAG_POLICY 4
 #define HOST_INFO_STREAM_POLICY 5
-#define POLICY_SET 1
-#define POLICY_NOT_SET 0
-typedef struct _HostInfo
-{
-    char streamPolicyName[16];
-    char fragPolicyName[16];
-
-    uint16_t streamPolicy;
-    uint16_t fragPolicy;
 
-    char streamPolicySet;
-    char fragPolicySet;
-} HostInfo;
+struct HostInfo
+{
+    uint8_t streamPolicy;
+    uint8_t fragPolicy;
+};
 
 #define SFAT_SERVICE 1
 #define SFAT_CLIENT 2
-typedef struct _HostAttributeEntry
+
+struct HostAttributeEntry
 {
     sfip_t ipAddr;
-
     HostInfo hostInfo;
     ApplicationList *services;
     ApplicationList *clients;
-} HostAttributeEntry;
+};
 
 int SFAT_AddHost(HostAttributeEntry*);
 int SFAT_AddService(HostAttributeEntry*, ApplicationEntry*);
diff --git a/src/target_based/sftarget_hostentry.cc b/src/target_based/sftarget_hostentry.cc
index d27d96c14..1686ba1da 100644
--- a/src/target_based/sftarget_hostentry.cc
+++ b/src/target_based/sftarget_hostentry.cc
@@ -25,7 +25,7 @@
 
 #include "sftarget_hostentry.h"
 
-int hasService(HostAttributeEntry *host_entry,
+int hasService(const HostAttributeEntry *host_entry,
                int ipprotocol,
                int protocol,
                int application)
@@ -61,7 +61,7 @@ int hasService(HostAttributeEntry *host_entry,
     return SFTARGET_NOMATCH;
 }
 
-int hasClient(HostAttributeEntry *host_entry,
+int hasClient(const HostAttributeEntry *host_entry,
                int ipprotocol,
                int protocol,
                int application)
@@ -97,7 +97,7 @@ int hasClient(HostAttributeEntry *host_entry,
     return SFTARGET_NOMATCH;
 }
 
-int hasProtocol(HostAttributeEntry *host_entry,
+int hasProtocol(const HostAttributeEntry *host_entry,
                int ipprotocol,
                int protocol,
                int application)
@@ -115,47 +115,23 @@ int hasProtocol(HostAttributeEntry *host_entry,
     return ret;
 }
 
-char isFragPolicySet(HostAttributeEntry *host_entry)
-{
-    if (host_entry && host_entry->hostInfo.fragPolicySet)
-    {
-        return POLICY_SET;
-    }
-    return POLICY_NOT_SET;
-}
-
-char isStreamPolicySet(HostAttributeEntry *host_entry)
-{
-    if (host_entry && host_entry->hostInfo.streamPolicySet)
-    {
-        return POLICY_SET;
-    }
-    return POLICY_NOT_SET;
-}
-
-uint16_t getFragPolicy(HostAttributeEntry *host_entry)
+uint16_t getFragPolicy(const HostAttributeEntry *host_entry)
 {
     if (!host_entry)
         return SFAT_UNKNOWN_FRAG_POLICY;
 
-    if (!host_entry->hostInfo.fragPolicySet)
-        return SFAT_UNKNOWN_FRAG_POLICY;
-
     return host_entry->hostInfo.fragPolicy;
 }
 
-uint16_t getStreamPolicy(HostAttributeEntry *host_entry)
+uint16_t getStreamPolicy(const HostAttributeEntry *host_entry)
 {
     if (!host_entry)
         return SFAT_UNKNOWN_STREAM_POLICY;
 
-    if (!host_entry->hostInfo.streamPolicySet)
-        return SFAT_UNKNOWN_STREAM_POLICY;
-
     return host_entry->hostInfo.streamPolicy;
 }
 
-int getApplicationProtocolId(HostAttributeEntry *host_entry,
+int getApplicationProtocolId(const HostAttributeEntry *host_entry,
                int ipprotocol,
                uint16_t port,
                char direction)
diff --git a/src/target_based/sftarget_hostentry.h b/src/target_based/sftarget_hostentry.h
index c4d934ae9..043559672 100644
--- a/src/target_based/sftarget_hostentry.h
+++ b/src/target_based/sftarget_hostentry.h
@@ -34,33 +34,32 @@
 
 /* API for HostAttributeEntry 'class' */
 
-int hasService(HostAttributeEntry *hostEntry,
+int hasService(const HostAttributeEntry *hostEntry,
                int ipprotocol,
                int protocol,
                int application);
-int hasClient(HostAttributeEntry *hostEntry,
+int hasClient(const HostAttributeEntry *hostEntry,
                int ipprotocol,
                int protocol,
                int application);
-int hasProtocol(HostAttributeEntry *hostEntry,
+int hasProtocol(const HostAttributeEntry *hostEntry,
                int ipprotocol,
                int protocol,
                int application);
 
-int getProtocol(HostAttributeEntry *hostEntry,
+int getProtocol(const HostAttributeEntry *hostEntry,
                int ipprotocol,
                uint16_t port);
 
-int getApplicationProtocolId(HostAttributeEntry *host_entry,
+int getApplicationProtocolId(const HostAttributeEntry *host_entry,
                int ipprotocol,
                uint16_t port,
                char direction);
 
 #define SFAT_UNKNOWN_STREAM_POLICY 0
-uint16_t getStreamPolicy(HostAttributeEntry *host_entry);
-char isStreamPolicySet(HostAttributeEntry *host_entry);
+uint16_t getStreamPolicy(const HostAttributeEntry *host_entry);
 #define SFAT_UNKNOWN_FRAG_POLICY 0
-uint16_t getFragPolicy(HostAttributeEntry *host_entry);
-char isFragPolicySet(HostAttributeEntry *host_entry);
+uint16_t getFragPolicy(const HostAttributeEntry *host_entry);
+
+#endif
 
-#endif /* SFTARGET_HOSTENTRY_H */
diff --git a/src/target_based/sftarget_protocol_reference.cc b/src/target_based/sftarget_protocol_reference.cc
index 81156ac34..2e1718e78 100644
--- a/src/target_based/sftarget_protocol_reference.cc
+++ b/src/target_based/sftarget_protocol_reference.cc
@@ -25,6 +25,10 @@
 
 #include "sftarget_protocol_reference.h"
 
+#include <string>
+#include <vector>
+using namespace std;
+
 #include "hash/sfghash.h"
 #include "util.h"
 #include "snort_debug.h"
@@ -46,6 +50,16 @@ int16_t protocolReferenceICMP;
 static SFGHASH *proto_reference_table = NULL;  // STATIC
 static int16_t protocol_number = 1;
 
+static vector<string> id_map;
+
+const char* get_protocol_name(uint16_t id)
+{
+    if ( id >= id_map.size() )
+        id = 0;
+
+    return id_map[id].c_str();
+}
+
 /* XXX XXX Probably need to do this during swap time since the
  * proto_reference_table is accessed during runtime */
 int16_t AddProtocolReference(const char *protocol)
@@ -65,6 +79,11 @@ int16_t AddProtocolReference(const char *protocol)
         return reference->ordinal;
     }
 
+    if ( protocol_number == 1 )
+        id_map.push_back("unknown");
+
+    id_map.push_back(protocol);
+
     reference = (SFTargetProtocolReference*)SnortAlloc(sizeof(SFTargetProtocolReference));
     reference->ordinal = protocol_number++;
     if (protocol_number > MAX_PROTOCOL_ORDINAL)
diff --git a/src/target_based/sftarget_protocol_reference.h b/src/target_based/sftarget_protocol_reference.h
index 5fa72bf69..fcfc721cd 100644
--- a/src/target_based/sftarget_protocol_reference.h
+++ b/src/target_based/sftarget_protocol_reference.h
@@ -37,6 +37,7 @@ extern int16_t protocolReferenceICMP;
 void InitializeProtocolReferenceTable(void);
 void FreeProtoocolReferenceTable(void);
 
+const char* get_protocol_name(uint16_t id);
 int16_t AddProtocolReference(const char *protocol);
 SO_PUBLIC int16_t FindProtocolReference(const char *protocol);
 
diff --git a/src/target_based/sftarget_reader.cc b/src/target_based/sftarget_reader.cc
index 95a0877c4..e4bf30476 100644
--- a/src/target_based/sftarget_reader.cc
+++ b/src/target_based/sftarget_reader.cc
@@ -183,11 +183,8 @@ int SFAT_AddApplicationData(HostAttributeEntry* host, ApplicationEntry* app)
 
     if ((app->fields & required_fields) != required_fields)
     {
-        sfip_t host_addr;
-        sfip_set_ip(&host_addr, &host->ipAddr);
-        host_addr.ip32[0] = ntohl(host_addr.ip32[0]);
         ParseError("Missing required field in Service attribute table for host %s",
-            inet_ntoa(&host_addr));
+            inet_ntoa(&host->ipAddr));
     }
     AppendApplicationData(&host->services, app);
 
@@ -199,22 +196,21 @@ void PrintHostAttributeEntry(HostAttributeEntry *host)
 {
     ApplicationEntry *app;
     int i = 0;
-    sfip_t host_addr;
 
     if (!host)
         return;
 
-    sfip_set_ip(&host_addr, &host->ipAddr);
-    host_addr.ip32[0] = ntohl(host_addr.ip32[0]);
-
     DebugMessage(DEBUG_ATTRIBUTE, "Host IP: %s/%d\n",
-            inet_ntoa(&host_addr),
-            host->ipAddr.bits
-            );
-    DebugMessage(DEBUG_ATTRIBUTE, "\tPolicy Information: frag:%s (%s %u) stream: %s (%s %u)\n",
-            host->hostInfo.fragPolicyName, host->hostInfo.fragPolicySet ? "set":"unset", host->hostInfo.fragPolicy,
-            host->hostInfo.streamPolicyName, host->hostInfo.streamPolicySet ? "set":"unset", host->hostInfo.streamPolicy);
+        inet_ntoa(&host->ipAddr),
+        host->ipAddr.bits);
+
+    DebugMessage(DEBUG_ATTRIBUTE,
+        "\tPolicy Information: frag:%s (%u) stream: %s (%u)\n",
+        "look-me-up", host->hostInfo.fragPolicy,
+        "look-me-up", host->hostInfo.streamPolicy);
+
     DebugMessage(DEBUG_ATTRIBUTE, "\tServices:\n");
+
     for (i=0, app = host->services; app; app = app->next,i++)
     {
         DebugMessage(DEBUG_ATTRIBUTE, "\tService #%d:\n", i);
@@ -293,24 +289,11 @@ int SFAT_AddHostEntryToMap(HostAttributeEntry* host)
 HostAttributeEntry *SFAT_LookupHostEntryByIP(const sfip_t *ipAddr)
 {
     HostAttributeEntry *host = NULL;
-    sfip_t local_ipAddr;
 
     if ( !curr_cfg )
         return NULL;
 
-    sfip_set_ip(&local_ipAddr, ipAddr);
-    if (local_ipAddr.family == AF_INET)
-    {
-        local_ipAddr.ip32[0] = ntohl(local_ipAddr.ip32[0]);
-    }
-
-    host = (HostAttributeEntry*)sfrt_lookup(&local_ipAddr, curr_cfg->lookupTable);
-
-    if (host)
-    {
-        /* Set the policy values for Frag & Stream if not already set */
-        //TODO: SetTargetBasedPolicy(host);
-    }
+    host = (HostAttributeEntry*)sfrt_lookup((void*)ipAddr, curr_cfg->lookupTable);
 
     return host;
 }
@@ -380,27 +363,14 @@ tTargetBasedConfig* SFAT_Swap()
     return curr_cfg;
 }
 
-int IsAdaptiveConfigured()
-{
-    if ( curr_cfg || next_cfg )
-        return 1;
-
-    return 0;
-}
-
 void SFAT_UpdateApplicationProtocol(sfip_t *ipAddr, uint16_t port, uint16_t protocol, uint16_t id)
 {
     HostAttributeEntry *host_entry;
     ApplicationEntry *service;
-    sfip_t local_ipAddr;
     unsigned service_count = 0;
     int rval;
 
-    sfip_set_ip(&local_ipAddr, ipAddr);
-    if (local_ipAddr.family == AF_INET)
-        local_ipAddr.ip32[0] = ntohl(local_ipAddr.ip32[0]);
-
-    host_entry = (HostAttributeEntry*)sfrt_lookup(&local_ipAddr, curr_cfg->lookupTable);
+    host_entry = (HostAttributeEntry*)sfrt_lookup(ipAddr, curr_cfg->lookupTable);
 
     if (!host_entry)
     {
@@ -408,9 +378,10 @@ void SFAT_UpdateApplicationProtocol(sfip_t *ipAddr, uint16_t port, uint16_t prot
             return;
 
         host_entry = (HostAttributeEntry*)SnortAlloc(sizeof(*host_entry));
-        sfip_set_ip(&host_entry->ipAddr, &local_ipAddr);
-        if ((rval = sfrt_insert(&local_ipAddr, (unsigned char)local_ipAddr.bits, host_entry,
-                                RT_FAVOR_SPECIFIC, curr_cfg->lookupTable)) != RT_SUCCESS)
+        sfip_set_ip(&host_entry->ipAddr, ipAddr);
+
+        if ((rval = sfrt_insert(ipAddr, (unsigned char)ipAddr->bits, host_entry,
+            RT_FAVOR_SPECIFIC, curr_cfg->lookupTable)) != RT_SUCCESS)
         {
             FreeHostEntry(host_entry);
             return;
diff --git a/src/target_based/sftarget_reader.h b/src/target_based/sftarget_reader.h
index 28154c28d..1938e5a8f 100644
--- a/src/target_based/sftarget_reader.h
+++ b/src/target_based/sftarget_reader.h
@@ -63,8 +63,5 @@ tTargetBasedConfig* SFAT_GetConfig();
 void SFAT_SetConfig(tTargetBasedConfig*);
 void SFAT_Free(tTargetBasedConfig*);
 
-/* Returns whether this has been configured */
-int IsAdaptiveConfigured();
-
-#endif /* SFTARGET_READER_H */
+#endif
 
diff --git a/src/utils/util.cc b/src/utils/util.cc
index 6ea4b17bf..bfea29a76 100644
--- a/src/utils/util.cc
+++ b/src/utils/util.cc
@@ -59,7 +59,6 @@
 #include "ppm.h"
 #include "packet_io/active.h"
 #include "packet_time.h"
-#include "target_based/sftarget_reader.h"
 #include "stream/stream.h"
 
 #ifdef PATH_MAX