Project

General

Profile

Actions

Bug #8014

open

Timeouts of FLOW_STATE_CAPTURE_BYPASSED is harcoded using constant FLOW_BYPASSED_TIMEOUT and not the yaml configurable value

Added by Amir Boussejra 2 days ago. Updated 2 days ago.

Status:
In Review
Priority:
Normal
Target version:
Affected Versions:
Effort:
low
Difficulty:
Label:

Description

On monitoring my bpf map `flow_table_v4`, I realized the timeouts did not follow the yaml configuration I had in the `suricata.yaml` config

```
flow-timeouts:
default:
emergency-established: 100
emergency-new: 10
established: 300
new: 30
bypassed: 5
emergency-bypassed: 5
```

I realised it was because the function used to get the flow timeouts `FlowGetTimeoutPolicy` and `FlowGetFlowTimeoutDirect` were not using the config value but a hardcoded constant (which is FLOW_STATE_CAPTURE_BYPASSED`) in the case of a `FLOW_STATE_CAPTURE_BYPASSED`.

We could apply this diff to use the `flow-timeouts.bypassed` config value:

Not sure if this patch is okey or if we want to add a config field  `flow-timeouts.capture-bypassed` to distinguish timeout between `local_bypass` vs `capture_bypass`.

I can push the above patch if you want.


Files

clipboard-202510221433-jdgnd.png (86.6 KB) clipboard-202510221433-jdgnd.png Amir Boussejra, 10/22/2025 12:33 PM
Actions #1

Updated by Victor Julien 2 days ago

  • Status changed from New to In Review
  • Assignee set to Amir Boussejra
  • Target version changed from TBD to 9.0.0-beta1

https://github.com/OISF/suricata/pull/14119

Thanks for looking into this @Aboussejra. I think the single option is fine for now, unless you see a compelling reason to split it out?

Actions #2

Updated by Amir Boussejra 2 days ago

You are welcome @Victor Julien !

No I think the single option is fine too !

Actions

Also available in: Atom PDF