From 04b8a7abbe06967680dc929412502d8a9f4114e6 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Tue, 16 Apr 2024 15:07:46 +0200 Subject: [PATCH] ips: check for livedev.use-for-tracking For the capture methods that support livedev and IPS, livedev.use-for-tracking is not supported. This setting causes major flow tracking issues, as both sides of a flow would be tracked in different flows. This patch disables the livedev.use-for-tracking setting if it is set to true. A warning will be issued. Ticket: #6726. (cherry picked from commit 08841f27ffc1b0e06d2d08d9336a73032261c78c) --- src/runmodes.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/src/runmodes.c b/src/runmodes.c index 348adfa25d..d4b57df5e8 100644 --- a/src/runmodes.c +++ b/src/runmodes.c @@ -1,4 +1,4 @@ -/* Copyright (C) 2007-2022 Open Information Security Foundation +/* Copyright (C) 2007-2024 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free @@ -70,6 +70,7 @@ #include "counters.h" #include "suricata-plugin.h" +#include "util-device.h" int debuglog_enabled = 0; int threading_set_cpu_affinity = FALSE; @@ -408,6 +409,14 @@ void RunModeEngineIsIPS(int capture_mode, const char *runmode, const char *captu if (mode->RunModeIsIPSEnabled != NULL) { mode->RunModeIsIPSEnabled(); + + if (EngineModeIsIPS()) { + extern uint16_t g_livedev_mask; + if (g_livedev_mask != 0 && LiveGetDeviceCount() > 0) { + SCLogWarning("disabling livedev.use-for-tracking with IPS mode. See ticket #6726."); + g_livedev_mask = 0; + } + } } } -- 2.47.2