config/af-packet: Warn/replace rollover usage

Issue: 6128

No longer permit rollover/cluster_rollover to be used. Usage will
generate a warning message and cluster_flow will be used instead.
pull/9148/head
Jeff Lucovsky 3 years ago
parent ac8f91f44f
commit b05375f22e

@ -375,7 +375,12 @@ static void *ParseAFPConfig(const char *iface)
SCLogConfig("%s: using round-robin cluster mode for AF_PACKET", aconf->iface);
aconf->cluster_type = PACKET_FANOUT_LB;
cluster_type = PACKET_FANOUT_LB;
} else if (strcmp(tmpctype, "cluster_flow") == 0) {
} else if (strcmp(tmpctype, "cluster_flow") == 0 || strcmp(tmpctype, "cluster_rollover") == 0) {
if (strcmp(tmpctype, "cluster_rollover") == 0) {
SCLogWarning("%s: cluster_rollover deprecated; using \"cluster_flow\" instead. See "
"ticket #6128",
aconf->iface);
}
/* In hash mode, we also ask for defragmentation needed to
* compute the hash */
uint16_t defrag = 0;
@ -400,13 +405,6 @@ static void *ParseAFPConfig(const char *iface)
SCLogConfig("%s: using random based cluster mode for AF_PACKET", aconf->iface);
aconf->cluster_type = PACKET_FANOUT_RND;
cluster_type = PACKET_FANOUT_RND;
} else if (strcmp(tmpctype, "cluster_rollover") == 0) {
SCLogConfig("%s: using rollover based cluster mode for AF_PACKET", aconf->iface);
SCLogWarning("%s: rollover mode is causing severe flow "
"tracking issues, use it at your own risk.",
iface);
aconf->cluster_type = PACKET_FANOUT_ROLLOVER;
cluster_type = PACKET_FANOUT_ROLLOVER;
#ifdef HAVE_PACKET_EBPF
} else if (strcmp(tmpctype, "cluster_ebpf") == 0) {
SCLogInfo("%s: using ebpf based cluster mode for AF_PACKET", aconf->iface);
@ -420,10 +418,11 @@ static void *ParseAFPConfig(const char *iface)
int conf_val = 0;
ConfGetChildValueBoolWithDefault(if_root, if_default, "rollover", &conf_val);
if (conf_val) {
SCLogConfig("%s: Using rollover kernel functionality for AF_PACKET", aconf->iface);
aconf->cluster_type |= PACKET_FANOUT_FLAG_ROLLOVER;
SCLogWarning("%s: rollover option is causing severe flow "
"tracking issues, use it at your own risk.",
SCLogConfig("%s: Rollover requested for AF_PACKET but ignored -- see ticket #6128.",
aconf->iface);
SCLogWarning("%s: rollover option has been deprecated and will be ignored as it can cause "
"severe flow "
"tracking issues; see ticket #6128.",
iface);
}

Loading…
Cancel
Save