From 8fe1094b0c01303ce27769b18a3cfcf9c4460852 Mon Sep 17 00:00:00 2001
From: Eric Leblond <eric@regit.org>
Date: Sun, 24 Jan 2021 22:40:02 +0100
Subject: [PATCH] suricata: avoid at exit crash in nfq mode

When Suricata was build with ebpf support and when it was started
in NFQ mode, it was crashing at exit because it was trying to free
the device extension.

This patch fixes the issue by only trigger the eBPF related code
when Suricata is running in AFP_PACKET mode.

(cherry picked from commit 85327890f5bb3b9521a2dfb8268ace6645d02f72)
---
 src/suricata.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/suricata.c b/src/suricata.c
index 07b8023461..15a84e2f9f 100644
--- a/src/suricata.c
+++ b/src/suricata.c
@@ -2488,8 +2488,10 @@ int PostConfLoadedSetup(SCInstance *suri)
 
     StorageInit();
 #ifdef HAVE_PACKET_EBPF
-    EBPFRegisterExtension();
-    LiveDevRegisterExtension();
+    if (suri->run_mode == RUNMODE_AFP_DEV) {
+        EBPFRegisterExtension();
+        LiveDevRegisterExtension();
+    }
 #endif
     RegisterFlowBypassInfo();
 
-- 
2.47.3