From: Eric Leblond <eric@regit.org>
Date: Tue, 19 Nov 2019 16:21:10 +0000 (+0100)
Subject: source-pcap-file: honor bpf filter on command line
X-Git-Tag: suricata-5.0.1~86
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=54d362066211c2db0efdbd1daaade7c3f214b5f0;p=thirdparty%2Fsuricata.git

source-pcap-file: honor bpf filter on command line

When a BPF filter is given on the command line when reading a
pcap file, the BPF filter is not honored.

The regression has been introduced in:

commit 3ab9120821e2b5cbc5925470bcfa5bcfb53f246b
Author: Dana Helwig <dana.helwig@protectwise.com>
Date:   Thu Apr 27 11:17:16 2017 -0600

    source-pcap-file: Pcap Directory Mode (Feature #2222)

Reported-By: Tim Colin <tcolin@et.esiea.fr>
---

diff --git a/src/source-pcap-file.c b/src/source-pcap-file.c
index 61811aa861..035c63e11a 100644
--- a/src/source-pcap-file.c
+++ b/src/source-pcap-file.c
@@ -263,10 +263,9 @@ TmEcode ReceivePcapFileThreadInit(ThreadVars *tv, const void *initdata, void **d
             SCReturnInt(TM_ECODE_OK);
         }
 
+        pv->shared = &ptv->shared;
         status = InitPcapFile(pv);
         if(status == TM_ECODE_OK) {
-            pv->shared = &ptv->shared;
-
             ptv->is_directory = 0;
             ptv->behavior.file = pv;
         } else {