From 6b81430bcb2a8b4394f30b17c90b4c3455a69415 Mon Sep 17 00:00:00 2001 From: Eric Leblond Date: Thu, 17 Jan 2013 11:12:27 +0100 Subject: [PATCH] pcap-file: don't kill engine in unix socket mode This patch updates the cleaning code to avoid to exit from suricata in unix socket mode when a invalid pcap is given. --- src/source-pcap-file.c | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-) diff --git a/src/source-pcap-file.c b/src/source-pcap-file.c index 46e9776022..c626e80bd3 100644 --- a/src/source-pcap-file.c +++ b/src/source-pcap-file.c @@ -182,10 +182,16 @@ TmEcode ReceivePcapFileLoop(ThreadVars *tv, void *data, void *slot) if (unlikely(r == -1)) { SCLogError(SC_ERR_PCAP_DISPATCH, "error code %" PRId32 " %s", r, pcap_geterr(pcap_g.pcap_handle)); - - /* in the error state we just kill the engine */ - EngineKill(); - SCReturnInt(TM_ECODE_FAILED); + if (! RunModeUnixSocketIsActive()) { + /* in the error state we just kill the engine */ + EngineKill(); + SCReturnInt(TM_ECODE_FAILED); + } else { + pcap_close(pcap_g.pcap_handle); + pcap_g.pcap_handle = NULL; + UnixSocketPcapFile(TM_ECODE_DONE); + SCReturnInt(TM_ECODE_DONE); + } } else if (unlikely(r == 0)) { SCLogInfo("pcap file end of file reached (pcap err code %" PRId32 ")", r); if (! RunModeUnixSocketIsActive()) { @@ -199,8 +205,15 @@ TmEcode ReceivePcapFileLoop(ThreadVars *tv, void *data, void *slot) break; } else if (ptv->cb_result == TM_ECODE_FAILED) { SCLogError(SC_ERR_PCAP_DISPATCH, "Pcap callback PcapFileCallbackLoop failed"); - EngineKill(); - SCReturnInt(TM_ECODE_FAILED); + if (! RunModeUnixSocketIsActive()) { + EngineKill(); + SCReturnInt(TM_ECODE_FAILED); + } else { + pcap_close(pcap_g.pcap_handle); + pcap_g.pcap_handle = NULL; + UnixSocketPcapFile(TM_ECODE_DONE); + SCReturnInt(TM_ECODE_DONE); + } } SCPerfSyncCountersIfSignalled(tv, 0); }