pcap-file: treat the case of unsupported pcap link

In unix socket mode, Suricata was stopping processing pcap files
when a pcap file with an unsupported datalink was treated. This
patch updates error handling to allow Suricata to treat other
pcap files.

diff --git a/src/source-pcap-file.c b/src/source-pcap-file.c
index c626e80bd3ca137dd4e52cf708f2ffe31f97a5c6..98b9d0414b968b649a7789db6881d4d238169c53 100644 (file)
--- a/src/source-pcap-file.c
+++ b/src/source-pcap-file.c
@@ -288,7 +288,14 @@ TmEcode ReceivePcapFileThreadInit(ThreadVars *tv, void *initdata, void **data) {
             SCLogError(SC_ERR_UNIMPLEMENTED, "datalink type %" PRId32 " not "
                       "(yet) supported in module PcapFile.\n", pcap_g.datalink);
             SCFree(ptv);
-            SCReturnInt(TM_ECODE_FAILED);
+            if (! RunModeUnixSocketIsActive()) {
+                SCReturnInt(TM_ECODE_FAILED);
+            } else {
+                pcap_close(pcap_g.pcap_handle);
+                pcap_g.pcap_handle = NULL;
+                UnixSocketPcapFile(TM_ECODE_DONE);
+                SCReturnInt(TM_ECODE_DONE);
+            }
     }
 
     ptv->tv = tv;