From 52574e21c67bdb7b3bdf75f627df47003158f65a Mon Sep 17 00:00:00 2001
From: Josh Patterson <josh.patterson@securityonionsolutions.com>
Date: Tue, 30 Jun 2026 09:40:23 -0400
Subject: [PATCH] suricata: treat in-progress rule reload as success

so-suricata-reload-rules failed the surirulereload state when a rule
reload was already running: suricatasc returns
{"message":"Reload already in progress","return":"NOK"}, which never
matched the expected output, so retry looped all 60 attempts (~3 min)
and called fail.

Wrap the suricatasc calls so an in-progress reload is treated as
success (the in-flight reload picks up the new rules) while genuine
container-not-ready conditions still retry and ultimately fail.
---
 .../tools/sbin/so-suricata-reload-rules        | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/salt/suricata/tools/sbin/so-suricata-reload-rules b/salt/suricata/tools/sbin/so-suricata-reload-rules
index e21e28e2f..aec6bc966 100644
--- a/salt/suricata/tools/sbin/so-suricata-reload-rules
+++ b/salt/suricata/tools/sbin/so-suricata-reload-rules
@@ -7,5 +7,19 @@
 
 . /usr/sbin/so-common
 
-retry 60 3 'docker exec so-suricata /opt/suricata/bin/suricatasc -c reload-rules /var/run/suricata/suricata-command.socket' '{"message":"done","return":"OK"}' || fail "The Suricata container was not ready in time."
-retry 60 3 'docker exec so-suricata /opt/suricata/bin/suricatasc -c ruleset-reload-nonblocking /var/run/suricata/suricata-command.socket' '{"message":"done","return":"OK"}' || fail "The Suricata container was not ready in time."
+reload_suricata_rules() {
+  # $1 = suricatasc command (reload-rules | ruleset-reload-nonblocking)
+  local output
+  output=$(docker exec so-suricata /opt/suricata/bin/suricatasc -c "$1" /var/run/suricata/suricata-command.socket)
+  echo "$output"
+  # A reload already running is fine — the new rules get picked up by it.
+  if [[ "$output" =~ "Reload already in progress" ]]; then
+    echo "A rule reload is already in progress; treating as success."
+    return 0
+  fi
+  [[ "$output" =~ '{"message":"done","return":"OK"}' ]] && return 0
+  return 1
+}
+
+retry 60 3 'reload_suricata_rules reload-rules' || fail "The Suricata container was not ready in time."
+retry 60 3 'reload_suricata_rules ruleset-reload-nonblocking' || fail "The Suricata container was not ready in time."