commandline: add alert-queue expand failure option

For testing purposes. Meant to simulate a reallocation failure when
dynamically growing the alert queue in DetectEngineThreadCtx, so we can
check that Suri's behavior doesn't break under such circumstances.

Task #5319

(cherry picked from commit 58928b249d3b5b9740bc7d35cd392c265097648c)

diff --git a/src/detect-engine-alert.c b/src/detect-engine-alert.c
index 7bff58bc076ad410c0a0c90cac0ac557ab5adbcd..760a449d520fc210b0abd3844dfa89f363f397da 100644 (file)
--- a/src/detect-engine-alert.c
+++ b/src/detect-engine-alert.c
@@ -27,6 +27,10 @@
 #include "flow.h"
 #include "flow-private.h"
 
+#ifdef DEBUG
+#include "util-exception-policy.h"
+#endif
+
 #include "util-profiling.h"
 #include "util-validate.h"
 
@@ -229,6 +233,10 @@ void AlertQueueFree(DetectEngineThreadCtx *det_ctx)
  */
 static uint16_t AlertQueueExpand(DetectEngineThreadCtx *det_ctx)
 {
+#ifdef DEBUG
+    if (unlikely(g_eps_is_alert_queue_fail_mode))
+        return det_ctx->alert_queue_capacity;
+#endif
     uint16_t new_cap = det_ctx->alert_queue_capacity * 2;
     void *tmp_queue = SCRealloc(det_ctx->alert_queue, (size_t)(sizeof(PacketAlert) * new_cap));
     if (unlikely(tmp_queue == NULL)) {

diff --git a/src/suricata.c b/src/suricata.c
index bb7e929f28210a82f7f1cdb872b019be1653a479..203679b75312642e3d6d1a5876df7a8ee7fbfa62 100644 (file)
--- a/src/suricata.c
+++ b/src/suricata.c
@@ -1303,6 +1303,7 @@ static TmEcode ParseCommandLine(int argc, char** argv, SCInstance *suri)
         {"simulate-packet-tcp-reassembly-memcap", required_argument, 0, 0},
         {"simulate-packet-tcp-ssn-memcap", required_argument, 0, 0},
         {"simulate-packet-defrag-memcap", required_argument, 0, 0},
+        {"simulate-alert-queue-realloc-failure", 0, 0, 0},
 
         {NULL, 0, NULL, 0}
     };

diff --git a/src/util-exception-policy.c b/src/util-exception-policy.c
index 6f4dd5e5f2b03b1e2be1462f33469b426a4dec15..9b828c69255adc6775d4caddc9b5d382b9c50150 100644 (file)
--- a/src/util-exception-policy.c
+++ b/src/util-exception-policy.c
@@ -123,6 +123,7 @@ uint64_t g_eps_stream_ssn_memcap = UINT64_MAX;
 uint64_t g_eps_stream_reassembly_memcap = UINT64_MAX;
 uint64_t g_eps_flow_memcap = UINT64_MAX;
 uint64_t g_eps_defrag_memcap = UINT64_MAX;
+bool g_eps_is_alert_queue_fail_mode = false;
 
 /* 1: parsed, 0: not for us, -1: error */
 int ExceptionSimulationCommandlineParser(const char *name, const char *arg)
@@ -176,6 +177,8 @@ int ExceptionSimulationCommandlineParser(const char *name, const char *arg)
             return TM_ECODE_FAILED;
         }
         g_eps_defrag_memcap = pkt_num;
+    } else if (strcmp(name, "simulate-alert-queue-realloc-failure") == 0) {
+        g_eps_is_alert_queue_fail_mode = true;
     } else {
         // not for us
         return 0;

diff --git a/src/util-exception-policy.h b/src/util-exception-policy.h
index 7fd782cabacb6e957f6afdde05f1762d279c532a..093a93924c5f5eeaf016039b4cec6c585a3655c8 100644 (file)
--- a/src/util-exception-policy.h
+++ b/src/util-exception-policy.h
@@ -43,6 +43,7 @@ extern uint64_t g_eps_stream_ssn_memcap;
 extern uint64_t g_eps_stream_reassembly_memcap;
 extern uint64_t g_eps_flow_memcap;
 extern uint64_t g_eps_defrag_memcap;
+extern bool g_eps_is_alert_queue_fail_mode;
 #endif
 
 int ExceptionSimulationCommandlineParser(const char *name, const char *arg);