Bug #4971: flow/bypass: app-layer/stream resources not freed when bypass activated - Suricata - Open Information Security Foundation

Actions

Copy link

Bug #4971

closed

flow/bypass: app-layer/stream resources not freed when bypass activated

Added by Shivani Bhardwaj over 2 years ago. Updated about 2 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Shivani Bhardwaj

Target version:

6.0.5

Affected Versions:

Effort:

Difficulty:

Label:

Description

When a flow bypass is activated, the flow holds on to whatever memory is used in the app-layer and stream. These will finally be freed at the end of the flow. This is not efficient, as after the bypass no code paths will use the app-layer state, transactions or segments.

We might want to hold on to the Tcp session, as this is where TCP packet flags are taken from.

Related issues 1 (0 open — 1 closed)