Project

General

Profile

Actions

Bug #1959

closed

Suricata unix socket runs with runmode: autofp when runmode configuration parameter is omitted

Added by Maurizio Abba over 7 years ago. Updated almost 7 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

Whenever you don't set a runmode in the yaml file (or setting runmode: auto) suricata will correctly start runmode unix socket in single mode, but it will then start a single run of a pcap (via RunModeDispatch call, runmode-unix-socket.c:391) using the default runmode for pcap-file, which is autofp.
This will potentially lead to a race condition where a detection thread will hang waiting for another packet while every other thread will shut down.
Furthermore, the behavior is inconsistent with the declaration of --list-runmodes.

Possible fixes:
- use ConfSetFinal in RunModeUnixSocketSingle before registering the background task in order to force the runmode to be set to single
- change function RunModeDispatch in order to add a parameter "run_via_unix_socket"
- add a check in RunModeDispatch, checking the value of RunModeUnixSocketIsActive before actually choosing the runmode (and in case forcing it to single mode)

Actions

Also available in: Atom PDF