[Snort-devel] stream5 prune_log_max fix

Gregory S Thomas greg.thomas at ...3372...
Tue Feb 19 20:40:35 EST 2013


The documentation (snort-2.9.4/doc/README.stream5) says that setting prune_log_max to 0 disables the messages, but this does not work.  The source code implements it correctly in one place (snort-2.9.4/src/preprocessors/Stream5/snort_stream5_session.c):

  558     if (prune_log_max
  559             && ((old_mem_in_use - mem_in_use ) > prune_log_max))

but not in the second place (snort-2.9.4/src/preprocessors/Stream5/snort_stream5_tcp.c):

4582 #define POST_SESSION_CLEANUP(delete_reason) \
4583     if ((old_mem_in_use - mem_in_use ) > s5_global_eval_config->prune_log_max) \

Changing the code as shown below appears to fix the problem:

4583     if (s5_global_eval_config->prune_log_max && ((old_mem_in_use - mem_in_use ) > s5_global_eval_config->prune_log_max)) \

Please consider incorporating this fix into a future version of snort.

Thanks,

Greg Thomas




More information about the Snort-devel mailing list