From: Jason Ish <jason.ish@oisf.net>
Date: Tue, 1 Apr 2025 21:44:50 +0000 (-0600)
Subject: pcap-log: only allow one instance of pcap-log
X-Git-Tag: suricata-8.0.0-beta1~43
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=cddd3a261f413a38f3052872c75e712bc705011b;p=thirdparty%2Fsuricata.git

pcap-log: only allow one instance of pcap-log

As a global is used to store state, only one instance can be used.

See https://redmine.openinfosecfoundation.org/issues/7640.
---

diff --git a/src/log-pcap.c b/src/log-pcap.c
index 45c6e2aaf1..f426c27029 100644
--- a/src/log-pcap.c
+++ b/src/log-pcap.c
@@ -1343,6 +1343,10 @@ static OutputInitResult PcapLogInitCtx(SCConfNode *conf)
     int en;
     PCRE2_SIZE eo = 0;
 
+    if (g_pcap_data) {
+        FatalError("A pcap-log instance is already active, only one can be enabled.");
+    }
+
     PcapLogData *pl = SCCalloc(1, sizeof(PcapLogData));
     if (unlikely(pl == NULL)) {
         FatalError("Failed to allocate Memory for PcapLogData");