runmodes: Determine engine's copy-mode as early as possible

Configuration and behavior of HTP app layer depends on the copy
mode of Suricata engine. Copy mode was set after the app layer setup.
Decision of engine's copy mode operation is now made earlier.

Ticket: #5706

diff --git a/src/suricata.c b/src/suricata.c
index 934817365fe676c54e8229bf0a853daf776b100b..a3e43ab7528ff7169d710848f362e3c73c7f9130 100644 (file)
--- a/src/suricata.c
+++ b/src/suricata.c
@@ -2640,6 +2640,11 @@ int PostConfLoadedSetup(SCInstance *suri)
 
     MacSetRegisterFlowStorage();
 
+    LiveDeviceFinalize(); // must be after EBPF extension registration
+
+    RunModeEngineIsIPS(
+            suricata.run_mode, suricata.runmode_custom_mode, suricata.capture_plugin_name);
+
     AppLayerSetup();
 
     /* Suricata will use this umask if provided. By default it will use the
@@ -2745,11 +2750,6 @@ int PostConfLoadedSetup(SCInstance *suri)
 
     DecodeGlobalConfig();
 
-    LiveDeviceFinalize();
-
-    RunModeEngineIsIPS(
-            suricata.run_mode, suricata.runmode_custom_mode, suricata.capture_plugin_name);
-
     /* hostmode depends on engine mode being set */
     PostConfLoadedSetupHostMode();