Bug #4778: flow/bypass: app-layer/stream resources not freed when bypass activated - Suricata - Open Information Security Foundation

Actions

Copy link

Bug #4778

closed

VJ VJ

flow/bypass: app-layer/stream resources not freed when bypass activated

Bug #4778: flow/bypass: app-layer/stream resources not freed when bypass activated

Added by Victor Julien over 4 years ago. Updated about 4 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Victor Julien

Target version:

7.0.0-beta1

Affected Versions:

Effort:

Difficulty:

Label:

Needs backport to 6.0

Description

When a flow bypass is activated, the flow holds on to whatever memory is used in the app-layer and stream. These will finally be freed at the end of the flow. This is not efficient, as after the bypass no code paths will use the app-layer state, transactions or segments.

We might want to hold on to the Tcp session, as this is where TCP packet flags are taken from.

Related issues 2 (0 open — 2 closed)