commandline: add alert-queue expand failure option

For testing purposes. Meant to simulate a reallocation failure when
dynamically growing the alert queue in DetectEngineThreadCtx, so we can
check that Suri's behavior doesn't break under such circumstances.

Task #5319

diff --git a/src/detect-engine-alert.c b/src/detect-engine-alert.c
index e51d70c9c10081476138e4b4f74c75eb4a053836..5ba5ae630ddfdde4918900dcc272131911437d47 100644 (file)
--- a/src/detect-engine-alert.c
+++ b/src/detect-engine-alert.c
@@ -27,6 +27,10 @@
 #include "flow.h"
 #include "flow-private.h"
 
+#ifdef DEBUG
+#include "util-exception-policy.h"
+#endif
+
 #include "util-profiling.h"
 
 /** tag signature we use for tag alerts */
@@ -224,6 +228,10 @@ void AlertQueueFree(DetectEngineThreadCtx *det_ctx)
  */
 static uint16_t AlertQueueExpand(DetectEngineThreadCtx *det_ctx)
 {
+#ifdef DEBUG
+    if (unlikely(g_eps_is_alert_queue_fail_mode))
+        return det_ctx->alert_queue_capacity;
+#endif
     uint16_t new_cap = det_ctx->alert_queue_capacity * 2;
     void *tmp_queue = SCRealloc(det_ctx->alert_queue, (size_t)(sizeof(PacketAlert) * new_cap));
     if (unlikely(tmp_queue == NULL)) {

diff --git a/src/suricata.c b/src/suricata.c
index 14a65e0fcb65988114271294ec97e043d4ceaa87..094b2c885acbfe34c15ea528e3dbbbe28cfcb4be 100644 (file)
--- a/src/suricata.c
+++ b/src/suricata.c
@@ -1363,6 +1363,7 @@ static TmEcode ParseCommandLine(int argc, char** argv, SCInstance *suri)
         {"simulate-packet-tcp-reassembly-memcap", required_argument, 0, 0},
         {"simulate-packet-tcp-ssn-memcap", required_argument, 0, 0},
         {"simulate-packet-defrag-memcap", required_argument, 0, 0},
+        {"simulate-alert-queue-realloc-failure", 0, 0, 0},
 
         {NULL, 0, NULL, 0}
     };

diff --git a/src/util-exception-policy.c b/src/util-exception-policy.c
index 9afddaee42ada2356e3ff568a51b233a670986f8..da51fbd31af87bca120d0e5c3223170688542927 100644 (file)
--- a/src/util-exception-policy.c
+++ b/src/util-exception-policy.c
@@ -124,6 +124,7 @@ uint64_t g_eps_stream_ssn_memcap = UINT64_MAX;
 uint64_t g_eps_stream_reassembly_memcap = UINT64_MAX;
 uint64_t g_eps_flow_memcap = UINT64_MAX;
 uint64_t g_eps_defrag_memcap = UINT64_MAX;
+bool g_eps_is_alert_queue_fail_mode = false;
 
 /* 1: parsed, 0: not for us, -1: error */
 int ExceptionSimulationCommandlineParser(const char *name, const char *arg)
@@ -177,6 +178,8 @@ int ExceptionSimulationCommandlineParser(const char *name, const char *arg)
             return TM_ECODE_FAILED;
         }
         g_eps_defrag_memcap = pkt_num;
+    } else if (strcmp(name, "simulate-alert-queue-realloc-failure") == 0) {
+        g_eps_is_alert_queue_fail_mode = true;
     } else {
         // not for us
         return 0;

diff --git a/src/util-exception-policy.h b/src/util-exception-policy.h
index 7fd782cabacb6e957f6afdde05f1762d279c532a..093a93924c5f5eeaf016039b4cec6c585a3655c8 100644 (file)
--- a/src/util-exception-policy.h
+++ b/src/util-exception-policy.h
@@ -43,6 +43,7 @@ extern uint64_t g_eps_stream_ssn_memcap;
 extern uint64_t g_eps_stream_reassembly_memcap;
 extern uint64_t g_eps_flow_memcap;
 extern uint64_t g_eps_defrag_memcap;
+extern bool g_eps_is_alert_queue_fail_mode;
 #endif
 
 int ExceptionSimulationCommandlineParser(const char *name, const char *arg);