Repository navigation
Conversation
Every request ran RETRIES times, even on success, so submit_job queued three jobs; retryable errors slept and then raised without retrying. Requests are now made once, retried on 429/5xx (job submissions only on 429/503, so a job can't be queued twice), rewind uploaded files before a retry, and time out. submit_job returns the job ID and raises DaltonAPIError on Dalton's error page.
…nd custom rules - job submissions wait for Dalton's reply by default (submit_timeout sets a limit) - GETs are retried on connection errors and timeouts; submissions only when the connection failed before anything was sent - honour Retry-After; accept files as a list; reuse one Session - set optionCustomRuleset, without which Dalton ignored the custom rules - the example takes the pcap as an argument (its mock pcap was never committed)
- fresh connection per request (no Session), with a headers= option - read uploads once from their current position instead of rewinding - connect timeout taken from a (connect, read) timeout tuple - retry proxy connection failures; cap Retry-After at 300s - error messages show Dalton's message only; RETRIES=0 still makes one attempt
- a POST dropped by a proxy after it was sent is not retried - unresolvable hosts aren't retried; connection failures wait 10s, not 60s - GETs are retried when reading the body fails - ignore non-ASCII digits in Retry-After - files type hint, example docstring, test thread timeouts
- retry a job submission only on 429; a proxy's 503 may follow a queued job - import on Python 3.8/3.9; read files given as lists; accept files=None - one-hour default for the submission reply instead of no limit
whartond
marked this pull request as ready for review
November 14, 2026 15:34
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the Python API client in
api/dalton.py:RETRIES(3) times even when it succeeded, sosubmit_job()queued three jobs. A retryable error slept 60 seconds and then raised without retrying.Retry-After(in seconds, at most 300) or 60 seconds; retries after a connection failure wait 10 seconds, and (with urllib3 2) a host name that doesn't resolve isn't retried. Uploads are read once, from the file's current position, so every attempt sends the same bytes;filescan be a dict or a list, with tuple or list values.submit_timeout=;Nonewaits forever). A newheaders=option adds headers, such as an API key, to every request.submit_job()sendsoptionCustomRuleset. Without it Dalton ignoredcustom_ruleset, so the custom rules were never loaded. The README's field name is fixed too.submit_job()returns the job ID (comma-separated IDs if the pcap was split) instead ofNone, and raisesDaltonAPIErrorwith Dalton's error message when it answers with its error page.requestsis added to thetestingextras (the client needs it and the new tests import it).Tests:
tests/test_api_client.py(33 tests, against a stubbedrequestsplus real local sockets for the connection-failure checks; also run against urllib3 1.26 and on Python 3.8). Also checked live against Dalton with Suricata 8.0.6 and 7.0.17: the same pcap bytes submitted to both engines, custom rules loaded and fired, an API key sent withheaders=, and an unknown sensor raisingDaltonAPIErrorwith Dalton's message.