From: Juliana Fajardini <jufajardini@oisf.net>
Date: Tue, 28 Jun 2022 20:06:50 +0000 (-0300)
Subject: source/pcap: fix infinite loop if interface goes down
X-Git-Tag: suricata-7.0.0-beta1~427
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2544be4672215d8c86c68f0d03c8fd88f498f1d2;p=thirdparty%2Fsuricata.git

source/pcap: fix infinite loop if interface goes down

When in live-pcap mode, if the sniffed interface went down and up again,
Suri would enter an infinite and keep running, while not registering new
events. This fixes that behavior by allowing Suri to retry to open the
pcap in case of a retry on an already activated capture
('PCAP_ERROR_ACTIVATED').

This change is based on Zhiyuan Liao's work.

Bug #3846
---

diff --git a/src/source-pcap.c b/src/source-pcap.c
index 2ffbf33d5e..97b2085cdc 100644
--- a/src/source-pcap.c
+++ b/src/source-pcap.c
@@ -208,7 +208,7 @@ static int PcapTryReopen(PcapThreadVars *ptv)
     ptv->pcap_state = PCAP_STATE_DOWN;
 
     int pcap_activate_r = pcap_activate(ptv->pcap_handle);
-    if (pcap_activate_r != 0) {
+    if (pcap_activate_r != 0 && pcap_activate_r != PCAP_ERROR_ACTIVATED) {
         return pcap_activate_r;
     }