From 0c00f28ebcf168e4712f23d49c27508c27f6e774 Mon Sep 17 00:00:00 2001 From: Jason Ish Date: Wed, 19 Oct 2022 13:07:56 -0600 Subject: [PATCH] afpacket/netmap: warn about mixed ips, ids/tap deprecation Suricata already logs if AF_PACKET or Netmap are running in a mixed IPS and IDS/TAP mode. As the behavior is undefined when these modes are mixed, it is best to deprecate and to not allow this behavior. For now warn that it will be unsupported and fail in Suricata 8. Ticket: 5587 --- src/runmode-af-packet.c | 4 +++- src/runmode-netmap.c | 4 +++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/src/runmode-af-packet.c b/src/runmode-af-packet.c index f2500d3d3b..006e0a4cc0 100644 --- a/src/runmode-af-packet.c +++ b/src/runmode-af-packet.c @@ -738,7 +738,9 @@ int AFPRunModeIsIPS() } if (has_ids && has_ips) { - SCLogInfo("AF_PACKET mode using IPS and IDS mode"); + SCLogWarning(SC_ERR_INVALID_ARGUMENT, + "AF_PACKET using both IPS and TAP/IDS mode, this will not " + "be allowed in Suricata 8 due to undefined behavior. See ticket #5588."); for (ldev = 0; ldev < nlive; ldev++) { const char *live_dev = LiveGetDeviceName(ldev); if (live_dev == NULL) { diff --git a/src/runmode-netmap.c b/src/runmode-netmap.c index 5aa4128c88..a4f22b7c40 100644 --- a/src/runmode-netmap.c +++ b/src/runmode-netmap.c @@ -373,7 +373,9 @@ int NetmapRunModeIsIPS() } if (has_ids && has_ips) { - SCLogInfo("Netmap mode using IPS and IDS mode"); + SCLogWarning(SC_ERR_INVALID_ARGUMENT, + "Netmap using both IPS and TAP/IDS mode, this will not be " + "allowed in Suricata 8 due to undefined behavior. See ticket #5588."); for (ldev = 0; ldev < nlive; ldev++) { const char *live_dev = LiveGetDeviceName(ldev); if (live_dev == NULL) { -- 2.47.2