From f30989e8c92032574eb522b6f4d73eba15aa4694 Mon Sep 17 00:00:00 2001 From: Amir Boussejra Date: Tue, 28 Oct 2025 13:49:43 +0100 Subject: [PATCH] flow-timeout: Use yaml config value for CAPTURE_BYPASSED flow Instead of non configurable constant FLOW_BYPASSED_TIMEOUT Ticket: #8014 (cherry picked from commit 56c8db6cb6c00e7661d7bde1d6efd50782d24258) --- src/flow-private.h | 6 ++---- src/flow.c | 4 +++- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/src/flow-private.h b/src/flow-private.h index ebd4e11961..a7a4a011b5 100644 --- a/src/flow-private.h +++ b/src/flow-private.h @@ -62,8 +62,6 @@ #define FLOW_IPPROTO_ICMP_EMERG_NEW_TIMEOUT 10 #define FLOW_IPPROTO_ICMP_EMERG_EST_TIMEOUT 100 -#define FLOW_BYPASSED_TIMEOUT 100 - enum { FLOW_PROTO_TCP = 0, FLOW_PROTO_UDP, @@ -119,7 +117,7 @@ static inline uint32_t FlowGetFlowTimeoutDirect( break; #ifdef CAPTURE_OFFLOAD case FLOW_STATE_CAPTURE_BYPASSED: - timeout = FLOW_BYPASSED_TIMEOUT; + timeout = flow_timeouts[protomap].bypassed_timeout; break; #endif case FLOW_STATE_LOCAL_BYPASSED: @@ -169,7 +167,7 @@ static inline uint32_t FlowGetTimeoutPolicy(const Flow *f) break; #ifdef CAPTURE_OFFLOAD case FLOW_STATE_CAPTURE_BYPASSED: - timeout = FLOW_BYPASSED_TIMEOUT; + timeout = flow_timeouts[f->protomap].bypassed_timeout; break; #endif case FLOW_STATE_LOCAL_BYPASSED: diff --git a/src/flow.c b/src/flow.c index 70777a1ecd..154cda66f6 100644 --- a/src/flow.c +++ b/src/flow.c @@ -414,8 +414,10 @@ void FlowHandlePacketUpdate(Flow *f, Packet *p, ThreadVars *tv, DecodeThreadVars } #ifdef CAPTURE_OFFLOAD } else { + FlowProtoTimeoutPtr flow_timeouts = SC_ATOMIC_GET(flow_timeouts); /* still seeing packet, we downgrade to local bypass */ - if (SCTIME_SECS(p->ts) - SCTIME_SECS(f->lastts) > FLOW_BYPASSED_TIMEOUT / 2) { + if (SCTIME_SECS(p->ts) - SCTIME_SECS(f->lastts) > + flow_timeouts[f->protomap].bypassed_timeout / 2) { SCLogDebug("Downgrading flow to local bypass"); f->lastts = p->ts; FlowUpdateState(f, FLOW_STATE_LOCAL_BYPASSED);