handle failed pcap_agent more gracefully in second request

capme/.inc/callback.php

@@ -336,6 +336,9 @@ function cliscript($cmd, $pwd) {
 	if (preg_match("/^ERROR: Connection failed$/", $line)) {
 		invalidCallback("ERROR: Connection to sguild failed!");
 	}
+	if (preg_match("/^DEBUG: $/", $line)) {
+		invalidCallback("ERROR: No data was returned. Check pcap_agent service.");
+	}
     	// To handle large pcaps more gracefully, we only render the first $maxtranscriptbytes.
 	$transcriptbytes += strlen($line);
 	if ($transcriptbytes <= $maxtranscriptbytes) {

debian/changelog

@@ -1,3 +1,9 @@
+securityonion-capme (20121213-0ubuntu0securityonion55) trusty; urgency=medium
+
+  * handle failed pcap_agent more gracefully in second request 
+
+ -- Doug Burks <doug.burks@gmail.com>  Mon, 30 May 2016 20:03:09 -0400
+
 securityonion-capme (20121213-0ubuntu0securityonion54) trusty; urgency=medium
 
   * handle failed pcap_agent more gracefully

debian/patches/handle-failed-pcap_agent-more-gracefully-in-second-request

@@ -0,0 +1,37 @@
+Description: <short summary of the patch>
+ TODO: Put a short summary on the line above and replace this paragraph
+ with a longer explanation of this change. Complete the meta-information
+ with other relevant fields (see below for details). To make it easier, the
+ information below has been extracted from the changelog. Adjust it or drop
+ it.
+ .
+ securityonion-capme (20121213-0ubuntu0securityonion55) trusty; urgency=medium
+ .
+   * handle failed pcap_agent more gracefully in second request
+Author: Doug Burks <doug.burks@gmail.com>
+
+---
+The information above should follow the Patch Tagging Guidelines, please
+checkout http://dep.debian.net/deps/dep3/ to learn about the format. Here
+are templates for supplementary fields that you might want to add:
+
+Origin: <vendor|upstream|other>, <url of original patch>
+Bug: <url in upstream bugtracker>
+Bug-Debian: http://bugs.debian.org/<bugnumber>
+Bug-Ubuntu: https://launchpad.net/bugs/<bugnumber>
+Forwarded: <no|not-needed|url proving that it has been forwarded>
+Reviewed-By: <name and email of someone who approved the patch>
+Last-Update: <YYYY-MM-DD>
+
+--- securityonion-capme-20121213.orig/capme/.inc/callback.php
++++ securityonion-capme-20121213/capme/.inc/callback.php
+@@ -336,6 +336,9 @@ if ($err == 1) {
+ 	if (preg_match("/^ERROR: Connection failed$/", $line)) {
+ 		invalidCallback("ERROR: Connection to sguild failed!");
+ 	}
++	if (preg_match("/^DEBUG: $/", $line)) {
++		invalidCallback("ERROR: No data was returned. Check pcap_agent service.");
++	}
+     	// To handle large pcaps more gracefully, we only render the first $maxtranscriptbytes.
+ 	$transcriptbytes += strlen($line);
+ 	if ($transcriptbytes <= $maxtranscriptbytes) {

debian/patches/series

@@ -42,3 +42,4 @@ include-filename-parameter-for-pivoting-from-Squert
 more-informative-error-message-when-failing-on-non-tcp-traffic
 add-check-for-active-pcap_agent-to-functions.php
 handle-failed-pcap_agent-more-gracefully
+handle-failed-pcap_agent-more-gracefully-in-second-request