From bedb923048d7d6d489179a962d11209a9f3f5db2 Mon Sep 17 00:00:00 2001 From: cccs-rs <62077998+cccs-rs@users.noreply.github.com> Date: Mon, 5 Jul 2021 11:56:21 -0700 Subject: [PATCH 1/2] Update Suricata to 6.0.3 --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 29d0be4..07a3f00 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,7 +1,7 @@ FROM cccs/assemblyline-v4-service-base:latest AS base ENV SERVICE_PATH suricata_.suricata_.Suricata -ENV SURICATA_VERSION 6.0.2 +ENV SURICATA_VERSION 6.0.3 USER root From b381bafa676a5e2a694958691326c435bbec9515 Mon Sep 17 00:00:00 2001 From: cccs-rs <62077998+cccs-rs@users.noreply.github.com> Date: Wed, 7 Jul 2021 04:21:14 -0700 Subject: [PATCH 2/2] raise Recoverable on connection reset --- suricata_/suricata_.py | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/suricata_/suricata_.py b/suricata_/suricata_.py index 911b274..dd0715a 100644 --- a/suricata_/suricata_.py +++ b/suricata_/suricata_.py @@ -12,12 +12,12 @@ from pathlib import Path from retrying import retry +from assemblyline.common.digests import get_sha256_for_file from assemblyline.common.exceptions import RecoverableError from assemblyline.common.str_utils import safe_str -from assemblyline.common.digests import get_sha256_for_file from assemblyline_v4_service.common.base import ServiceBase -from assemblyline_v4_service.common.result import Result, ResultSection, BODY_FORMAT from assemblyline_v4_service.common.request import MaxExtractedExceeded +from assemblyline_v4_service.common.result import BODY_FORMAT, Result, ResultSection SURICATA_BIN = "/usr/local/bin/suricata" FILE_UPDATE_DIRECTORY = os.environ.get('FILE_UPDATE_DIRECTORY', '/mount/updates/') @@ -243,10 +243,12 @@ def execute(self, request): # Wait for the socket finish processing our PCAP while True: time.sleep(1) - ret = self.suricata_sc.send_command("pcap-current") - - if ret and ret["message"] == "None": - break + try: + ret = self.suricata_sc.send_command("pcap-current") + if ret and ret["message"] == "None": + break + except ConnectionResetError as e: + raise RecoverableError(e) # Bring back stdout and stderr sys.stdout = old_stdout