ips: check for livedev.use-for-tracking

For the capture methods that support livedev and IPS,
livedev.use-for-tracking is not supported.

This setting causes major flow tracking issues, as both sides of
a flow would be tracked in different flows.

This patch disables the livedev.use-for-tracking setting if it
is set to true. A warning will be issued.

Ticket: #6726.
(cherry picked from commit 08841f27ffc1b0e06d2d08d9336a73032261c78c)

diff --git a/src/runmodes.c b/src/runmodes.c
index 348adfa25d43c968bff60aef56fc4d091e4c8f90..d4b57df5e8bf05a12cb3ee7457341866499d33ff 100644 (file)
--- a/src/runmodes.c
+++ b/src/runmodes.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 2007-2022 Open Information Security Foundation
+/* Copyright (C) 2007-2024 Open Information Security Foundation
  *
  * You can copy, redistribute or modify this Program under the terms of
  * the GNU General Public License version 2 as published by the Free
@@ -70,6 +70,7 @@
 #include "counters.h"
 
 #include "suricata-plugin.h"
+#include "util-device.h"
 
 int debuglog_enabled = 0;
 int threading_set_cpu_affinity = FALSE;
@@ -408,6 +409,14 @@ void RunModeEngineIsIPS(int capture_mode, const char *runmode, const char *captu
 
     if (mode->RunModeIsIPSEnabled != NULL) {
         mode->RunModeIsIPSEnabled();
+
+        if (EngineModeIsIPS()) {
+            extern uint16_t g_livedev_mask;
+            if (g_livedev_mask != 0 && LiveGetDeviceCount() > 0) {
+                SCLogWarning("disabling livedev.use-for-tracking with IPS mode. See ticket #6726.");
+                g_livedev_mask = 0;
+            }
+        }
     }
 }