From 8e9905e0d833858a5053285c8ffe6ed4ed30fc12 Mon Sep 17 00:00:00 2001 From: Juliana Fajardini Date: Thu, 19 Jan 2023 11:18:16 -0300 Subject: [PATCH] exceptions: ignore policy if stream.midstream=true Set the engine to ignore the stream.midstream-policy if stream.midstream is enabled. If we had both stream.midstream AND stream.midstream_policy enabled, this could lead to midstream flows being dropped (or bypassed, or...) instead of being accepted by the engine, as it was probably meant when the user enabled midstream flows. Bug #5765 --- src/stream-tcp.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/stream-tcp.c b/src/stream-tcp.c index e2d0e40dc0..7c13172d33 100644 --- a/src/stream-tcp.c +++ b/src/stream-tcp.c @@ -470,6 +470,11 @@ void StreamTcpInitConfig(bool quiet) stream_config.reassembly_memcap_policy = ExceptionPolicyParse("stream.reassembly.memcap-policy", true); stream_config.midstream_policy = ExceptionPolicyParse("stream.midstream-policy", true); + if (stream_config.midstream && stream_config.midstream_policy != EXCEPTION_POLICY_NOT_SET) { + SCLogWarning("stream.midstream_policy setting conflicting with stream.midstream enabled. " + "Ignoring stream.midstream_policy."); + stream_config.midstream_policy = EXCEPTION_POLICY_NOT_SET; + } if (!quiet) { SCLogConfig("stream.\"inline\": %s",