flow: validate emergency timeout settings

Make sure they are below the regular values.

diff --git a/src/flow.c b/src/flow.c
index ca42f73be066c3ac8979915c47a39c2e5779b343..3459b10cfe04c6a9569e5ad5084cef860709e59a 100644 (file)
--- a/src/flow.c
+++ b/src/flow.c
@@ -1024,6 +1024,36 @@ void FlowInitFlowProto(void)
         }
     }
 
+    /* validate and if needed update emergency timeout values */
+    for (int i = 0; i < FLOW_PROTO_MAX; i++) {
+        const FlowProtoTimeout *n = &flow_timeouts_normal[i];
+        FlowProtoTimeout *e = &flow_timeouts_emerg[i];
+
+        if (e->est_timeout > n->est_timeout) {
+            SCLogWarning(SC_WARN_FLOW_EMERGENCY, "emergency timeout value %u for \'established\' "
+                    "must be below regular value %u", e->est_timeout, n->est_timeout);
+            e->est_timeout = n->est_timeout / 10;
+        }
+
+        if (e->new_timeout > n->new_timeout) {
+            SCLogWarning(SC_WARN_FLOW_EMERGENCY, "emergency timeout value %u for \'new\' must be "
+                    "below regular value %u", e->new_timeout, n->new_timeout);
+            e->new_timeout = n->new_timeout / 10;
+        }
+
+        if (e->closed_timeout > n->closed_timeout) {
+            SCLogWarning(SC_WARN_FLOW_EMERGENCY, "emergency timeout value %u for \'closed\' must "
+                    "be below regular value %u", e->closed_timeout, n->closed_timeout);
+            e->closed_timeout = n->closed_timeout / 10;
+        }
+
+        if (e->bypassed_timeout > n->bypassed_timeout) {
+            SCLogWarning(SC_WARN_FLOW_EMERGENCY, "emergency timeout value %u for \'bypassed\' "
+                    "must be below regular value %u", e->bypassed_timeout, n->bypassed_timeout);
+            e->bypassed_timeout = n->bypassed_timeout / 10;
+        }
+    }
+
     return;
 }