From df4beb60548aaec87b61d3a116afb333a7f01ec9 Mon Sep 17 00:00:00 2001 From: Arne Welzel Date: Wed, 29 Mar 2023 15:38:28 +0200 Subject: [PATCH] af_packet: AF_Packet: Use negative socket_fd for error indication Technically, socket() can return 0, so shouldn't use it as an indication of a non existent / closed socket. I'm not 100% sure about the Close() contract here: If something goes haywire with a packet source Zeek calls FatalError without calling Close() nor properly destructing the PktSrc. Oh yikes. --- src/iosource/af_packet/src/AF_Packet.cc | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/src/iosource/af_packet/src/AF_Packet.cc b/src/iosource/af_packet/src/AF_Packet.cc index 05441d6e74..aa649f5491 100644 --- a/src/iosource/af_packet/src/AF_Packet.cc +++ b/src/iosource/af_packet/src/AF_Packet.cc @@ -34,6 +34,9 @@ AF_PacketSource::AF_PacketSource(const std::string& path, bool is_live) props.path = path; props.is_live = is_live; + socket_fd = -1; + rx_ring = nullptr; + checksum_mode = zeek::BifConst::AF_Packet::checksum_validation_mode->AsEnum(); } @@ -225,13 +228,15 @@ uint32_t AF_PacketSource::GetFanoutMode(bool defrag) } void AF_PacketSource::Close() - { - if ( ! socket_fd ) - return; + { + if ( socket_fd < 0 ) + return; - delete rx_ring; - close(socket_fd); - socket_fd = 0; + delete rx_ring; + rx_ring = nullptr; + + close(socket_fd); + socket_fd = -1; Closed(); }