From ef3487e785d04e9ef0501e40347d303c0aea5069 Mon Sep 17 00:00:00 2001 From: Eric Leblond Date: Wed, 29 Jul 2026 08:57:17 +0200 Subject: [PATCH 1/3] run: add --set option The --set option is passed to Suricata which can then be tune during run. It can for example be used to check some global changes on Suricata that are not supposed to break tests. For example, it can be used to test Landlock support. --- run.py | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/run.py b/run.py index 610d6aea43..2fb1a4399e 100755 --- a/run.py +++ b/run.py @@ -279,6 +279,7 @@ def __init__(self, version): self.version = version self.features = set() self.config = {} + self.extra_set = [] self.load_build_info() def load_build_info(self): @@ -1050,6 +1051,12 @@ def default_args(self): args += ["-c", self.get_suricata_yaml_path()] + # Extra command line arguments provided on the run.py command + # line. Added late so they take precedence over the values set + # above. + for keyvalue in self.suricata_config.extra_set: + args += ["--set", keyvalue] + # Find pcaps. if "pcap" in self.config: pcap_path = os.path.join(self.directory, self.config["pcap"]) @@ -1266,6 +1273,9 @@ def main(): help="Outputs to custom directory") parser.add_argument("--valgrind", dest="valgrind", action="store_true", help="Run tests in with valgrind") + parser.add_argument("--set", dest="extra_set", action="append", default=[], + metavar="KEY=VALUE", + help="Pass --set KEY=VALUE to Suricata (may be used multiple times)") parser.add_argument("--self-test", action="store_true", help="Run self tests") parser.add_argument("--debug-failed", dest="debugfailed", action="store_true", @@ -1333,6 +1343,7 @@ def main(): print("error: suricatasc binary is missing") suricata_config.valgrind = args.valgrind + suricata_config.extra_set = args.extra_set tdir = os.path.join(TOPDIR, "tests") if args.testdir: tdir = os.path.abspath(args.testdir) From 59721296e1444b99bff74eebb7cb9621a22f64a1 Mon Sep 17 00:00:00 2001 From: Eric Leblond Date: Wed, 29 Jul 2026 09:23:19 +0200 Subject: [PATCH 2/3] run: add skip-env condition It is useful to skip a test if a variable is set. For example, it can be used to skip a test that is supposed to fail with Landlock. --- run.py | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/run.py b/run.py index 2fb1a4399e..692b06b678 100755 --- a/run.py +++ b/run.py @@ -375,6 +375,14 @@ def check_requires(requires, suricata_config: SuricataConfig, test_dir=None): if not env in os.environ: raise UnsatisfiedRequirementError( "requires env var %s" % (env)) + elif key == "skip-env": + # Inverse of "env": skip the test when the variable is set. Lets a + # test opt out of a specific run configuration without every other + # run having to set a variable to opt in. + for env in requires["skip-env"]: + if env in os.environ: + raise UnsatisfiedRequirementError( + "skipped because env var %s is set" % (env)) elif key == "files": for filename in requires["files"]: if test_dir and not os.path.isabs(filename): From 85a3ee82c1d5283e923c34e8b62a124068ec96f3 Mon Sep 17 00:00:00 2001 From: Eric Leblond Date: Wed, 29 Jul 2026 09:28:46 +0200 Subject: [PATCH 3/3] tests: skip 2 tests if running with Landlock They are supposed to fail as they access unknown directories. --- tests/datasets/datasets-absolute-allowed/test.yaml | 5 +++++ tests/lua-output-streaming/test.yaml | 6 ++++++ 2 files changed, 11 insertions(+) diff --git a/tests/datasets/datasets-absolute-allowed/test.yaml b/tests/datasets/datasets-absolute-allowed/test.yaml index 788538014e..126033d8b6 100644 --- a/tests/datasets/datasets-absolute-allowed/test.yaml +++ b/tests/datasets/datasets-absolute-allowed/test.yaml @@ -4,6 +4,11 @@ pcap: ../../datasets/datasets-parent-path/one-packet.pcap requires: min-version: 8 lambda: sys.platform != "win32" + # The dataset state/save files are absolute paths under /tmp, which is + # outside anything the Landlock sandbox grants, so the rules are rejected + # when it is enabled. + skip-env: + - SV_LANDLOCK args: - -vvv diff --git a/tests/lua-output-streaming/test.yaml b/tests/lua-output-streaming/test.yaml index 9008f2ff1d..827aaca3f5 100644 --- a/tests/lua-output-streaming/test.yaml +++ b/tests/lua-output-streaming/test.yaml @@ -2,6 +2,12 @@ requires: features: - HAVE_LUA min-version: 8 + # The Lua script builds its output filename at runtime, so Suricata cannot + # declare it and the Landlock sandbox denies the write. Running under + # Landlock needs the output directory in security.landlock.directories.write, + # which the test does not control. + skip-env: + - SV_LANDLOCK pcap: ../filestore-v2.1-forced/suricata-update-pdf.pcap