From 7f98683d45d048b8890c8fc257ee5431963925a8 Mon Sep 17 00:00:00 2001 From: Shivani Bhardwaj Date: Fri, 21 Mar 2025 16:06:58 +0530 Subject: [PATCH] stream: use max-region setting from suricata.yaml 1. Add key (commented) to suricata.yaml 2. Give the configured/default key preference, save a check --- src/util-streaming-buffer.c | 2 +- suricata.yaml.in | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/src/util-streaming-buffer.c b/src/util-streaming-buffer.c index fb9ffe98fd..2b7d3c441f 100644 --- a/src/util-streaming-buffer.c +++ b/src/util-streaming-buffer.c @@ -213,7 +213,7 @@ static StreamingBufferRegion *FindRightEdge(const StreamingBufferConfig *cfg, static inline StreamingBufferRegion *InitBufferRegion( StreamingBuffer *sb, const StreamingBufferConfig *cfg, const uint32_t min_size) { - if (sb->regions == USHRT_MAX || (cfg->max_regions != 0 && sb->regions >= cfg->max_regions)) { + if ((cfg->max_regions != 0 && sb->regions >= cfg->max_regions) || (sb->regions == UINT16_MAX)) { SCLogDebug("max regions reached"); sc_errno = SC_ELIMIT; return NULL; diff --git a/suricata.yaml.in b/suricata.yaml.in index 4d46c2502f..0bd021b096 100644 --- a/suricata.yaml.in +++ b/suricata.yaml.in @@ -1643,6 +1643,9 @@ flow-timeouts: # # is used or when stream-event:reassembly_overlap_different_data; # # is used in a rule. # +# max-regions: 8 # maximum number of concurrent regions per streaming buffer +# # defaults to 8, if no configuration was provided. 0 means no limit. + stream: memcap: 64 MiB #memcap-policy: ignore