From: Victor Julien <vjulien@oisf.net>
Date: Tue, 16 Apr 2024 13:07:46 +0000 (+0200)
Subject: ips: check for livedev.use-for-tracking
X-Git-Tag: suricata-7.0.5~12
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=04b8a7abbe06967680dc929412502d8a9f4114e6;p=thirdparty%2Fsuricata.git

ips: check for livedev.use-for-tracking

For the capture methods that support livedev and IPS,
livedev.use-for-tracking is not supported.

This setting causes major flow tracking issues, as both sides of
a flow would be tracked in different flows.

This patch disables the livedev.use-for-tracking setting if it
is set to true. A warning will be issued.

Ticket: #6726.
(cherry picked from commit 08841f27ffc1b0e06d2d08d9336a73032261c78c)
---

diff --git a/src/runmodes.c b/src/runmodes.c
index 348adfa25d..d4b57df5e8 100644
--- a/src/runmodes.c
+++ b/src/runmodes.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 2007-2022 Open Information Security Foundation
+/* Copyright (C) 2007-2024 Open Information Security Foundation
  *
  * You can copy, redistribute or modify this Program under the terms of
  * the GNU General Public License version 2 as published by the Free
@@ -70,6 +70,7 @@
 #include "counters.h"
 
 #include "suricata-plugin.h"
+#include "util-device.h"
 
 int debuglog_enabled = 0;
 int threading_set_cpu_affinity = FALSE;
@@ -408,6 +409,14 @@ void RunModeEngineIsIPS(int capture_mode, const char *runmode, const char *captu
 
     if (mode->RunModeIsIPSEnabled != NULL) {
         mode->RunModeIsIPSEnabled();
+
+        if (EngineModeIsIPS()) {
+            extern uint16_t g_livedev_mask;
+            if (g_livedev_mask != 0 && LiveGetDeviceCount() > 0) {
+                SCLogWarning("disabling livedev.use-for-tracking with IPS mode. See ticket #6726.");
+                g_livedev_mask = 0;
+            }
+        }
     }
 }