inliniac/suricata — pull request #1130 by regit (2014-09-19 15:38:25+00:00)
Title: af-packet: force suricata in IPS mode when needed

AF_PACKET is not setting the engine mode to IPS when some
interfaces are peered and use IPS mode. This is due to the
fact, it is possible to peer 2 interfaces and run an IPS on
them and have a third one that is running in normal IDS mode.

In fact this choice is the bad one as unwanted side effect is
that there is no drop log and that stream inline is not used.

To fix that, this patch puts suricata in IPS mode as soon as
there is two interfaces in IPS mode. And it displays a error
message to warn user that the accuracy of detection on IDS only
interfaces will be low.

Redmine ticket: https://redmine.openinfosecfoundation.org/issues/1284

PR builds:
- PR build: https://buildbot.openinfosecfoundation.org/builders/regit/builds/13
- PR pcaps: https://buildbot.openinfosecfoundation.org/builders/regit-pcap/builds/11