flow-timeout: Use yaml config value for CAPTURE_BYPASSED flow

Instead of non configurable constant FLOW_BYPASSED_TIMEOUT

Ticket: #8014
pull/14187/head
Amir Boussejra 3 weeks ago committed by Victor Julien
parent 772bd9ca53
commit 56c8db6cb6

@ -62,8 +62,6 @@
#define FLOW_IPPROTO_ICMP_EMERG_NEW_TIMEOUT 10
#define FLOW_IPPROTO_ICMP_EMERG_EST_TIMEOUT 100
#define FLOW_BYPASSED_TIMEOUT 100
enum {
FLOW_PROTO_TCP = 0,
FLOW_PROTO_UDP,
@ -119,7 +117,7 @@ static inline uint32_t FlowGetFlowTimeoutDirect(
break;
#ifdef CAPTURE_OFFLOAD
case FLOW_STATE_CAPTURE_BYPASSED:
timeout = FLOW_BYPASSED_TIMEOUT;
timeout = flow_timeouts[protomap].bypassed_timeout;
break;
#endif
case FLOW_STATE_LOCAL_BYPASSED:
@ -169,7 +167,7 @@ static inline uint32_t FlowGetTimeoutPolicy(const Flow *f)
break;
#ifdef CAPTURE_OFFLOAD
case FLOW_STATE_CAPTURE_BYPASSED:
timeout = FLOW_BYPASSED_TIMEOUT;
timeout = flow_timeouts[f->protomap].bypassed_timeout;
break;
#endif
case FLOW_STATE_LOCAL_BYPASSED:

@ -415,8 +415,10 @@ void FlowHandlePacketUpdate(Flow *f, Packet *p, ThreadVars *tv, DecodeThreadVars
}
#ifdef CAPTURE_OFFLOAD
} else {
FlowProtoTimeoutPtr flow_timeouts = SC_ATOMIC_GET(flow_timeouts);
/* still seeing packet, we downgrade to local bypass */
if (SCTIME_SECS(p->ts) - SCTIME_SECS(f->lastts) > FLOW_BYPASSED_TIMEOUT / 2) {
if (SCTIME_SECS(p->ts) - SCTIME_SECS(f->lastts) >
flow_timeouts[f->protomap].bypassed_timeout / 2) {
SCLogDebug("Downgrading flow to local bypass");
f->lastts = p->ts;
FlowUpdateState(f, FLOW_STATE_LOCAL_BYPASSED);

Loading…
Cancel
Save