From: Eric Leblond <eric@regit.org>
Date: Tue, 11 Jun 2019 22:43:47 +0000 (+0200)
Subject: af-packet: xdp pinned maps need to be read
X-Git-Tag: suricata-5.0.0-rc1~281
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7df30070660014c062b252ada1697037a389daac;p=thirdparty%2Fsuricata.git

af-packet: xdp pinned maps need to be read
---

diff --git a/src/runmode-af-packet.c b/src/runmode-af-packet.c
index 13625295d3..480c833f3b 100644
--- a/src/runmode-af-packet.c
+++ b/src/runmode-af-packet.c
@@ -473,6 +473,19 @@ static void *ParseAFPConfig(const char *iface)
             SCLogConfig("Using bypass kernel functionality for AF_PACKET (iface %s)",
                     aconf->iface);
             aconf->flags |= AFP_XDPBYPASS;
+            /* if maps are pinned we need to read them at start */
+            if (aconf->ebpf_t_config.flags & EBPF_PINNED_MAPS) {
+                RunModeEnablesBypassManager();
+                struct ebpf_timeout_config *ebt = SCCalloc(1, sizeof(struct ebpf_timeout_config));
+                if (ebt == NULL) {
+                    SCLogError(SC_ERR_MEM_ALLOC, "Flow bypass alloc error");
+                } else {
+                    memcpy(ebt, &(aconf->ebpf_t_config), sizeof(struct ebpf_timeout_config));
+                    BypassedFlowManagerRegisterCheckFunc(NULL,
+                            EBPFCheckBypassedFlowCreate,
+                            (void *)ebt);
+                }
+            }
             BypassedFlowManagerRegisterUpdateFunc(EBPFUpdateFlow, NULL);
         }
 #else