stream/tcp: re-enable midstream-policy usage

We were always setting it to ignore, due to bug 5825.

The engine will now issue an initialization error if an invalid value
is passed in the configuration file for midstream exception policy.

'pass-packet' or 'drop-packet' are never valid, as the midstream policy
concerns the whole flow, not making sense for just a packet.

If midstream is enabled, only two actual config values are allowed:
'ignore' and 'pass-flow', both in IDS and in IPS mode. In default mode
('auto' or if no policy is defined), midstream-policy is set to
'ignore'. All other values will lead to initialization error.

In IDS mode, 'drop-flow' will also lead to initialization error.

Part of
Bug #5825
pull/9021/head
Juliana Fajardini 3 years ago committed by Victor Julien
parent e849afbda1
commit 69d3750aaf

@ -469,12 +469,7 @@ void StreamTcpInitConfig(bool quiet)
stream_config.ssn_memcap_policy = ExceptionPolicyParse("stream.memcap-policy", true);
stream_config.reassembly_memcap_policy =
ExceptionPolicyParse("stream.reassembly.memcap-policy", true);
stream_config.midstream_policy = ExceptionPolicyParse("stream.midstream-policy", true);
if (stream_config.midstream && stream_config.midstream_policy != EXCEPTION_POLICY_NOT_SET) {
SCLogWarning("stream.midstream_policy setting conflicting with stream.midstream enabled. "
"Ignoring stream.midstream_policy. Bug #5825.");
stream_config.midstream_policy = EXCEPTION_POLICY_NOT_SET;
}
stream_config.midstream_policy = ExceptionPolicyMidstreamParse(stream_config.midstream);
if (!quiet) {
SCLogConfig("stream.\"inline\": %s",

Loading…
Cancel
Save