From 354d0b2a5c5ae81ab3ea79b742175eb189dd8f68 Mon Sep 17 00:00:00 2001
From: Philippe Antoine <pantoine@oisf.net>
Date: Thu, 5 Mar 2026 10:04:26 +0100
Subject: [PATCH] doc/stream: explain absent reassembly.depth means unlimited

Ticket: 8343
---
 doc/userguide/configuration/suricata-yaml.rst | 6 ++++--
 src/stream-tcp.c                              | 1 +
 suricata.yaml.in                              | 3 ++-
 3 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/doc/userguide/configuration/suricata-yaml.rst b/doc/userguide/configuration/suricata-yaml.rst
index cd707a83c3..7006c2803b 100644
--- a/doc/userguide/configuration/suricata-yaml.rst
+++ b/doc/userguide/configuration/suricata-yaml.rst
@@ -1387,8 +1387,10 @@ is hit: 'drop-flow', 'drop-packet', 'pass-flow', 'pass-packet',  'bypass',
 'reject', or 'ignore'.
 
 Reassembling a stream is an expensive operation. With the option depth
-you can control how far into a stream reassembly is done. By default
-this is 1MB. This setting can be overridden per stream by the protocol
+you can control how far into a stream reassembly is done. The default
+provided suricata.yaml is set to 1MB, but if the field is absent from the
+configuration, value 0 (meaning "unlimited") is used.
+This setting can be overridden per stream by the protocol
 parsers that do file extraction.
 
 Inspection of reassembled data is done in chunks. The size of these
diff --git a/src/stream-tcp.c b/src/stream-tcp.c
index 4aefef9177..b5d7435a94 100644
--- a/src/stream-tcp.c
+++ b/src/stream-tcp.c
@@ -735,6 +735,7 @@ void StreamTcpInitConfig(bool quiet)
             exit(EXIT_FAILURE);
         }
     } else {
+        SCLogNotice("stream.reassembly.depth set to unlimited by default");
         stream_config.reassembly_depth = 0;
     }
 
diff --git a/suricata.yaml.in b/suricata.yaml.in
index e6bd26d6a2..63962b9263 100644
--- a/suricata.yaml.in
+++ b/suricata.yaml.in
@@ -1662,8 +1662,9 @@ flow-timeouts:
 #     memcap-policy: ignore     # The exception policy value can be "drop-flow",
 #                               # "pass-flow", "bypass", "drop-packet", "pass-packet",
 #                               # "reject" or "ignore" default is "ignore"
-#     depth: 1 MiB               # Can be specified in KiB, MiB, GiB.  Just a number
+#     depth: 1 MiB              # Can be specified in KiB, MiB, GiB.  Just a number
 #                               # indicates it's in bytes.
+#                               # if the field is absent, value 0 (meaning "unlimited") is used
 #     toserver-chunk-size: 2560 # inspect raw stream in chunks of at least
 #                               # this size.  Can be specified in KiB, MiB, GiB.
 #                               # Just a number indicates it's in bytes.