From 03c21bfaa88f628368db06844157c5118e96387f Mon Sep 17 00:00:00 2001 From: Lukas Sismis Date: Wed, 28 Dec 2022 11:49:02 +0700 Subject: [PATCH] runmodes: Determine engine's copy-mode as early as possible Configuration and behavior of HTP app layer depends on the copy mode of Suricata engine. Copy mode was set after the app layer setup. Decision of engine's copy mode operation is now made earlier. Ticket: #5706 --- src/suricata.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/src/suricata.c b/src/suricata.c index 934817365f..a3e43ab752 100644 --- a/src/suricata.c +++ b/src/suricata.c @@ -2640,6 +2640,11 @@ int PostConfLoadedSetup(SCInstance *suri) MacSetRegisterFlowStorage(); + LiveDeviceFinalize(); // must be after EBPF extension registration + + RunModeEngineIsIPS( + suricata.run_mode, suricata.runmode_custom_mode, suricata.capture_plugin_name); + AppLayerSetup(); /* Suricata will use this umask if provided. By default it will use the @@ -2745,11 +2750,6 @@ int PostConfLoadedSetup(SCInstance *suri) DecodeGlobalConfig(); - LiveDeviceFinalize(); - - RunModeEngineIsIPS( - suricata.run_mode, suricata.runmode_custom_mode, suricata.capture_plugin_name); - /* hostmode depends on engine mode being set */ PostConfLoadedSetupHostMode();