af-packet: warn if defrag not suitable for mode

AF_PACKET defrag should not be used for inline modes. Its possible that
a packet received could be larger than can be set when defrag is
enabled, so warn if disabled for inline use.

Likewise, warn if defrag is disabled for IDS use, or non-inline mode.

Ticket: #7458
(cherry picked from commit 808502d5cac0681e17859ed1aef9be8f508c4b13)

diff --git a/src/runmode-af-packet.c b/src/runmode-af-packet.c
index 87469dacd3fb0e84772aa5fe30aee85980cd78b7..9991f108d19ac3cb9923b1ea8a6131f1d2f0c513 100644 (file)
--- a/src/runmode-af-packet.c
+++ b/src/runmode-af-packet.c
@@ -758,6 +758,19 @@ finalize:
         aconf->flags |= AFP_SOCK_PROTECT;
         aconf->flags |= AFP_NEED_PEER;
     }
+
+    /* Warn if inline and defrag is enabled. */
+    if (aconf->copy_mode != AFP_COPY_MODE_NONE && aconf->cluster_type & PACKET_FANOUT_FLAG_DEFRAG) {
+        SCLogWarning(
+                "%s: AF_PACKET defrag is not recommended for inline use, please disable", iface);
+    }
+
+    /* Warn if not inline and defrag is disabled. */
+    if (aconf->copy_mode == AFP_COPY_MODE_NONE && cluster_type == PACKET_FANOUT_HASH &&
+            ((aconf->cluster_type & PACKET_FANOUT_FLAG_DEFRAG) == 0)) {
+        SCLogWarning("%s: AF_PACKET defrag is recommended for IDS cluster_flow", iface);
+    }
+
     return aconf;
 }