Feature #3464: suricata-verify: Add unix-socket support - Suricata - Open Information Security Foundation

Actions

Copy link

Feature #3464

open

suricata-verify: Add unix-socket support

Added by Shivani Bhardwaj almost 6 years ago. Updated 8 days ago.

Status:

In Review

Priority:

Low

Assignee:

Philippe Antoine

Target version:

Effort:

Difficulty:

Label:

Description

suricata-verify should be able to test unix-socket commands.

Actions

Copy link

Updated by Victor Julien almost 6 years ago

Priority changed from Normal to Low

I wonder if we should split this ticket in 2:

1. be able to run the standard tests in unix socket (so instead of running suricata -r ... set up unix socket and run through suricatasc)
2. add special support for adding tests that interact with unix socket to test issues like #3448

Actions

Copy link

Updated by Shivani Bhardwaj about 5 years ago

Assignee changed from Shivani Bhardwaj to Community Ticket

Actions

Copy link

Updated by Shivani Bhardwaj almost 5 years ago

Relevant conversation:

Victor Julien
In shell you would start suri to go into the background suricata .... & and then issue the commands, where you capture suri's PID so you can kill it after you're done.

But I think this isn't as nice as an error in the script can easily leave suri running.

Shivani Bhardwaj
I see. We could probably have a blanket try..except..finally block which makes sure that suri is killed (how barbaric!) even if there was an exception. Would it still miss any cases?

Victor Julien
That sounds sane to me. We'd first issue a shutdown over unix socket, and if suri is still running after that do a force kill and fail the test.

Actions

Copy link

Updated by Jason Ish over 4 years ago

Assignee changed from Community Ticket to Jason Ish

Actions

Copy link

Updated by Jason Ish 5 months ago

Status changed from Assigned to New
Assignee changed from Jason Ish to OISF Dev

Assigning back to OISF Dev just to avoid the appearance that I might be working on this which I'm not. I might in the future, but not on my radar right now.

Actions

Copy link

Updated by Philippe Antoine about 1 month ago

Assignee changed from OISF Dev to Philippe Antoine

Create test for https://github.com/OISF/suricata/pull/14296

Actions

Copy link

Updated by Philippe Antoine 8 days ago

Philippe Antoine wrote in #note-6:

Create test for https://github.com/OISF/suricata/pull/14296

Just need to
- launch suricata --unix-socket
- wait for log Engine started
- run suricatasc -c "add-hostbit fe80:0000:0000:0000:6600:6aff:fe5b:8f4a test 60"
- get no ASAN crash but {"message":"hostbit added","return":"OK"} (must use a rule like alert icmp any any -> any any (itype:8; hostbits:isset,test,dst; sid:2;) )
- kill suricata