honor BRIM_SURICATA_USER_DIR in Windows runner #69
Conversation
The Windows Suricata runner fails on per-machine installs of the Zui app because it ignores the BRIM_SURICATA_USER_DIR environment variable and tries to write a Suricata configuration file to its own directory, which isn't writable by a non-Administrator on per-machine installs. Fix by writing the file to BRIM_SURICATA_USER_DIR if specified. The Windows runner also ignores the rules file that suricataupdater.exe generates at $BRIM_SURICATA_USER_DIR\rules\suricata.rules. Fix by using that file if it exists, falling back to the packaged rules file if it does not. For brimdata/zui#2715.
There was a problem hiding this comment.
The logic in this change makes sense to me and lines up with what's in the script-based runners that have been working adequately on Linux and macOS. I tested it out with a test Zui artifact from an Actions run that's bundled with a test Brimcap artifact that includes a test Suricata artifact that includes a runner compiled from this branch. It passed two different tests for me:
-
I did a per-machine install and successfully imported a pcap and saw the generated Suricata alerts, whereas this failed in the past (pcap import fails on Windows with per-machine install zui#2715).
-
I manually hacked one of the downloaded rules in
%APPDATA%\data\suricata\rules\suricata.rulesthat I knew would be triggered by my pcap and added some unique text, then re-imported my pcap and confirmed I saw that text as part of the alert.
The Windows Suricata runner fails on per-machine installs of the Zui app because it ignores the BRIM_SURICATA_USER_DIR environment variable and tries to write a Suricata configuration file to its own directory, which isn't writable by a non-Administrator on per-machine installs. Fix by writing the file to BRIM_SURICATA_USER_DIR if specified.
The Windows runner also ignores the rules file that suricataupdater.exe generates at $BRIM_SURICATA_USER_DIR\rules\suricata.rules. Fix by using that file if it exists, falling back to the packaged rules file if it does not.
For brimdata/zui#2715.