source/pcap: fix infinite loop if interface goes down

When in live-pcap mode, if the sniffed interface went down and up again,
Suri would enter an infinite and keep running, while not registering new
events. This fixes that behavior by allowing Suri to retry to open the
pcap in case of a retry on an already activated capture
('PCAP_ERROR_ACTIVATED').

This change is based on Zhiyuan Liao's work.

Bug #3846

(cherry picked from commit 2544be4672215d8c86c68f0d03c8fd88f498f1d2)

diff --git a/src/source-pcap.c b/src/source-pcap.c
index 9e49b40e178edb99ba0c51f8955bb5279dd3c964..90f81f6b7f6b21b44887104e58ab675aaa98810d 100644 (file)
--- a/src/source-pcap.c
+++ b/src/source-pcap.c
@@ -207,7 +207,7 @@ static int PcapTryReopen(PcapThreadVars *ptv)
     ptv->pcap_state = PCAP_STATE_DOWN;
 
     int pcap_activate_r = pcap_activate(ptv->pcap_handle);
-    if (pcap_activate_r != 0) {
+    if (pcap_activate_r != 0 && pcap_activate_r != PCAP_ERROR_ACTIVATED) {
         return pcap_activate_r;
     }