Actions
Bug #5765
closed
JF
JF
exceptions: midstream flows are dropped if midstream=true && stream.midstream-policy=drop-flow
Bug #5765:
exceptions: midstream flows are dropped if midstream=true && stream.midstream-policy=drop-flow
Description
We understand that setting stream.midstream=true would mean there's an interest in accepting
midstream flows.
Having the engine drop packets or flows via the exception policy for midstream flows seems
counterintuitive, in such cases, then.
Current behavior:
If stream.midstream=true and stream.midstream-policy=drop-flow (or drop-packet), midstream flows will be dropped.
Expected behavior:
- If stream.midstream=true, Suricata will warn about the conflicting settings and ignore the
midstream exception policy.
Actions