Bug #5502: Suricata hangs and then exits when the first PCAP processed has 0 packets - Suricata - Open Information Security Foundation

Actions

Copy link

Bug #5502

open

Suricata hangs and then exits when the first PCAP processed has 0 packets

Added by R K about 3 years ago. Updated 4 months ago.

Status:

New

Priority:

Normal

Assignee:

OISF Dev

Target version:

TBD

Affected Versions:

8.0.0

Effort:

Difficulty:

Label:

Description

When I start Suricata and process a PCAP file with 0 packets, the process hangs and quits:

*start suricata*

> suricatasc -c "pcap-file /tmp/packets_no.pcap /tmp/" 
< {"message": "Successfully added file to list", "return": "OK"}

> suricatasc -c pcap-file-list
*no response, process is stuck for 1 minute and then quits with error*

18/8/2022 -- 14:52:35 - <Notice> - This is Suricata version 6.0.4 RELEASE running in SYSTEM mode
18/8/2022 -- 14:53:01 - <Notice> - all 0 packet processing threads, 0 management threads initialized, engine started.
18/8/2022 -- 14:53:38 - <Warning> - [ERRCODE: SC_ERR_PCAP_DISPATCH(20)] - Failed to init pcap file /tmp/packets_no.pcap, skipping
18/8/2022 -- 14:53:38 - <Error> - [ERRCODE: SC_ERR_PCAP_OPEN_OFFLINE(26)] - failed to get first packet timestamp. pcap_next_ex(): -2
18/8/2022 -- 14:53:39 - <Notice> - all 25 packet processing threads, 2 management threads initialized, engine started.
18/8/2022 -- 14:53:39 - <Error> - [ERRCODE: SC_ERR_INVALID_ARGUMENT(13)] - pcap file reader thread failed to initialize
18/8/2022 -- 14:54:40 - <Error> - [ERRCODE: SC_ERR_SHUTDOWN(188)] - unable to get all flow manager threads to shutdown in time

If I start Suricata and process some normal PCAP file first, and later send a PCAP file with 0 packets, it is handled fine and creates an empty report file.

*start suricata*

> suricatasc -c "pcap-file /tmp/packets_yes.pcap /tmp/a/" 
< {"message": "Successfully added file to list", "return": "OK"}

> suricatasc -c "pcap-file /tmp/packets_no.pcap /tmp/b/" 
< {"message": "Successfully added file to list", "return": "OK"}

> suricatasc -c "pcap-file-list" 
< {"message": {"count": 0, "files": []}, "return": "OK"}

* eve.json was written for each PCAP file and suricata process is fine *

Expected behavior:
Scanning a 0-packet PCAP file produces an empty report with no errors.

Actual behavior:
Scanning a 0-packet PCAP file as the first file to a new Suricata process hangs and then quits with error.

Files

packets_no.pcap (24 Bytes) packets_no.pcap

a PCAP file with no packets recorded

R K, 08/18/2022 01:01 PM

Actions

Copy link

Updated by R K about 3 years ago

This is Suricata version 6.0.4 RELEASE
Features: NFQ PCAP_SET_BUFF AF_PACKET HAVE_PACKET_FANOUT LIBCAP_NG LIBNET1.1 HAVE_HTP_URI_NORMALIZE_HOOK PCRE_JIT HAVE_NSS HAVE_LUA HAVE_LUAJIT HAVE_LIBJANSSON TLS TLS_C11 MAGIC RUST
SIMD support: none
Atomic intrinsics: 1 2 4 8 byte(s)
64-bits, Little-endian architecture
GCC version 11.2.0, C version 201112
compiled with _FORTIFY_SOURCE=2
L1 cache line size (CLS)=64
thread local storage method: _Thread_local
compiled with LibHTP v0.5.39, linked against LibHTP v0.5.39

Suricata Configuration: [55/1861]
AF_PACKET support: yes
eBPF support: yes
XDP support: yes
PF_RING support: no
NFQueue support: yes
NFLOG support: yes
IPFW support: no
Netmap support: no
DAG enabled: no
Napatech enabled: no
WinDivert enabled: no

Unix socket enabled:                     yes
  Detection enabled:                       yes

Libmagic support:                        yes
  libnss support:                          yes
  libnspr support:                         yes
  libjansson support:                      yes
  hiredis support:                         yes
  hiredis async with libevent:             yes
  Prelude support:                         no
  PCRE jit:                                yes
  LUA support:                             yes, through luajit
  libluajit:                               yes
  GeoIP2 support:                          yes
  Non-bundled htp:                         yes
  Hyperscan support:                       yes
  Libnet support:                          yes
  liblz4 support:                          yes
  HTTP2 decompression:                     no

Rust support:                            yes
  Rust strict mode:                        no
  Rust compiler path:                      /usr/bin/rustc
  Rust compiler version:                   rustc 1.56.0
  Cargo path:                              /usr/bin/cargo
  Cargo version:                           cargo 1.53.0
  Cargo vendor:                            yes

Python support:                          yes
  Python path:                             /usr/bin/python3
  Python distutils                         yes
  Python yaml                              no
  Install suricatactl:                     yes
  Install suricatasc:                      yes
  Install suricata-update:                 not bundled

Profiling enabled:                       no
  Profiling locks enabled:                 no

Plugin support (experimental):           yes

Development settings:
Coccinelle / spatch: no
Unit tests enabled: no
Debug output enabled: no
Debug validation enabled: no

Generic build parameters:
Installation prefix: /usr
Configuration directory: /etc/suricata/
Log directory: /var/log/suricata/

--prefix                                 /usr
  --sysconfdir                             /etc
  --localstatedir                          /var
  --datarootdir                            /usr/share

Host:                                    x86_64-pc-linux-gnu
  Compiler:                                gcc (exec name) / g++ (real)
  GCC Protect enabled:                     yes
  GCC march native enabled:                no
  GCC Profile enabled:                     no
  Position Independent Executable enabled: no
  CFLAGS                                   -g -O2 -ffile-prefix-map=/build/suricata-B7e7KV/suricata-6.0.4=. -flto=auto -ffat-lto-objects -fstack-protector-strong -Wformat -Werror=format-security -std=c11
-I${srcdir}/../rust/gen -I${srcdir}/../rust/dist
  PCAP_CFLAGS                               -I/usr/include
  SECCFLAGS                                -fstack-protector -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security