dag: Skip over ERF_TYPE_META records

Suricata generates an error on unrecognised ERF types.
Suricata should ignore ERF 'Provenance' records with ERF_TYPE_META.
pull/4679/head
Stephen Donnelly 5 years ago committed by Victor Julien
parent 76582e34c1
commit 47082dd5df

@ -431,16 +431,17 @@ ProcessErfDagRecords(ErfDagThreadVars *ewtn, uint8_t *top, uint32_t *pkts_read)
/* Only support ethernet at this time. */
switch (hdr_type & 0x7f) {
case TYPE_PAD:
case ERF_TYPE_PAD:
case ERF_TYPE_META:
/* Skip. */
continue;
case TYPE_DSM_COLOR_ETH:
case TYPE_COLOR_ETH:
case TYPE_COLOR_HASH_ETH:
case ERF_TYPE_DSM_COLOR_ETH:
case ERF_TYPE_COLOR_ETH:
case ERF_TYPE_COLOR_HASH_ETH:
/* In these types the color value overwrites the lctr
* (drop count). */
break;
case TYPE_ETH:
case ERF_TYPE_ETH:
if (dr->lctr) {
StatsAddUI64(ewtn->tv, ewtn->drops, SCNtohs(dr->lctr));
}

Loading…
Cancel
Save