config/af-packet: Warn/replace rollover usage

Issue: 6128

No longer permit rollover/cluster_rollover to be used. Usage will
generate a warning message and cluster_flow will be used instead.

diff --git a/src/runmode-af-packet.c b/src/runmode-af-packet.c
index 4c777b90e9078083d6802c5105b9a62377e3c281..b45b0dad7ec9485105d8af544823785fbb829b5b 100644 (file)
--- a/src/runmode-af-packet.c
+++ b/src/runmode-af-packet.c
@@ -375,7 +375,12 @@ static void *ParseAFPConfig(const char *iface)
         SCLogConfig("%s: using round-robin cluster mode for AF_PACKET", aconf->iface);
         aconf->cluster_type = PACKET_FANOUT_LB;
         cluster_type = PACKET_FANOUT_LB;
-    } else if (strcmp(tmpctype, "cluster_flow") == 0) {
+    } else if (strcmp(tmpctype, "cluster_flow") == 0 || strcmp(tmpctype, "cluster_rollover") == 0) {
+        if (strcmp(tmpctype, "cluster_rollover") == 0) {
+            SCLogWarning("%s: cluster_rollover deprecated; using \"cluster_flow\" instead. See "
+                         "ticket #6128",
+                    aconf->iface);
+        }
         /* In hash mode, we also ask for defragmentation needed to
          * compute the hash */
         uint16_t defrag = 0;
@@ -400,13 +405,6 @@ static void *ParseAFPConfig(const char *iface)
         SCLogConfig("%s: using random based cluster mode for AF_PACKET", aconf->iface);
         aconf->cluster_type = PACKET_FANOUT_RND;
         cluster_type = PACKET_FANOUT_RND;
-    } else if (strcmp(tmpctype, "cluster_rollover") == 0) {
-        SCLogConfig("%s: using rollover based cluster mode for AF_PACKET", aconf->iface);
-        SCLogWarning("%s: rollover mode is causing severe flow "
-                     "tracking issues, use it at your own risk.",
-                iface);
-        aconf->cluster_type = PACKET_FANOUT_ROLLOVER;
-        cluster_type = PACKET_FANOUT_ROLLOVER;
 #ifdef HAVE_PACKET_EBPF
     } else if (strcmp(tmpctype, "cluster_ebpf") == 0) {
         SCLogInfo("%s: using ebpf based cluster mode for AF_PACKET", aconf->iface);
@@ -420,10 +418,11 @@ static void *ParseAFPConfig(const char *iface)
     int conf_val = 0;
     ConfGetChildValueBoolWithDefault(if_root, if_default, "rollover", &conf_val);
     if (conf_val) {
-        SCLogConfig("%s: Using rollover kernel functionality for AF_PACKET", aconf->iface);
-        aconf->cluster_type |= PACKET_FANOUT_FLAG_ROLLOVER;
-        SCLogWarning("%s: rollover option is causing severe flow "
-                     "tracking issues, use it at your own risk.",
+        SCLogConfig("%s: Rollover requested for AF_PACKET but ignored -- see ticket #6128.",
+                aconf->iface);
+        SCLogWarning("%s: rollover option has been deprecated and will be ignored as it can cause "
+                     "severe flow "
+                     "tracking issues; see ticket #6128.",
                 iface);
     }