From 8940a9d32630934ff3a50fa1e1dab1271f2f0348 Mon Sep 17 00:00:00 2001
From: Shivani Bhardwaj <shivanib134@gmail.com>
Date: Tue, 8 Oct 2019 00:02:40 +0530
Subject: [PATCH] afp: nicer error message in case of fanout failure

Use clearer message in case fanout is not supported or cluster_id is
already in use.

Closes redmine ticket #1940.
---
 src/runmode-af-packet.c | 2 +-
 src/source-af-packet.c  | 5 +++--
 src/source-af-packet.h  | 3 ++-
 3 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/src/runmode-af-packet.c b/src/runmode-af-packet.c
index 4e6400b9f5..05761a7882 100644
--- a/src/runmode-af-packet.c
+++ b/src/runmode-af-packet.c
@@ -613,7 +613,7 @@ finalize:
     /* if the number of threads is not 1, we need to first check if fanout
      * functions on this system. */
     if (aconf->threads != 1) {
-        if (AFPIsFanoutSupported() == 0) {
+        if (AFPIsFanoutSupported(aconf->cluster_id) == 0) {
             if (aconf->threads != 0) {
                 SCLogNotice("fanout not supported on this system, falling "
                         "back to 1 capture thread");
diff --git a/src/source-af-packet.c b/src/source-af-packet.c
index e117d36e5c..712fe521ee 100644
--- a/src/source-af-packet.c
+++ b/src/source-af-packet.c
@@ -1995,7 +1995,7 @@ mmap_err:
 /** \brief test if we can use FANOUT. Older kernels like those in
  *         CentOS6 have HAVE_PACKET_FANOUT defined but fail to work
  */
-int AFPIsFanoutSupported(void)
+int AFPIsFanoutSupported(int cluster_id)
 {
 #ifdef HAVE_PACKET_FANOUT
     int fd = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
@@ -2009,7 +2009,8 @@ int AFPIsFanoutSupported(void)
     close(fd);
 
     if (r < 0) {
-        SCLogPerf("fanout not supported by kernel: %s", strerror(errno));
+        SCLogError(SC_ERR_INVALID_VALUE, "fanout not supported by kernel: "
+                "Kernel too old or cluster-id %d already in use.", cluster_id);
         return 0;
     }
     return 1;
diff --git a/src/source-af-packet.h b/src/source-af-packet.h
index af3b36b204..0468e4b2ff 100644
--- a/src/source-af-packet.h
+++ b/src/source-af-packet.h
@@ -186,6 +186,7 @@ TmEcode AFPPeersListCheck(void);
 void AFPPeersListClean(void);
 int AFPGetLinkType(const char *ifname);
 
-int AFPIsFanoutSupported(void);
+int AFPIsFanoutSupported(int cluster_id);
+
 
 #endif /* __SOURCE_AFP_H__ */
-- 
2.47.2