diff --git a/doc/userguide/configuration/suricata-yaml.rst b/doc/userguide/configuration/suricata-yaml.rst index 70d83e5bca..e98a6d6034 100644 --- a/doc/userguide/configuration/suricata-yaml.rst +++ b/doc/userguide/configuration/suricata-yaml.rst @@ -997,7 +997,8 @@ thread ensures that wherever possible and within the memcap. there will be 10000 flows prepared. In IPS mode, a memcap-policy exception policy can be set, telling Suricata -what to do in case memcap is hit: 'drop-flow', 'pass-flow', 'bypass', 'ignore'. +what to do in case memcap is hit: 'drop-flow', 'pass-flow', 'bypass', 'reject', +'ignore'. :: @@ -1098,7 +1099,8 @@ be recognized by Suricata. The stream-engine has two memcaps that can be set. One for the stream-tracking-engine and one for the reassembly-engine. For both cases, in IPS mode, an exception policy (memcap-policy) can be set, telling Suricata -what to do in case memcap is hit: 'drop-flow', 'pass-flow', 'bypass', 'ignore'. +what to do in case memcap is hit: 'drop-flow', 'pass-flow', 'bypass', 'reject', +'ignore'. The stream-tracking-engine keeps information of the flow in memory. Information about the state, TCP-sequence-numbers and the TCP @@ -1189,7 +1191,7 @@ The reassembly-engine has to keep data segments in memory in order to be able to reconstruct a stream. To avoid resource starvation a memcap is used to limit the memory used. In IPS mode, an exception policy (memcap-policy) can be set, telling Suricata what to do in case memcap -is hit: 'drop-flow', 'pass-flow', 'bypass', 'ignore'. +is hit: 'drop-flow', 'pass-flow', 'bypass', 'reject', 'ignore'. Reassembling a stream is an expensive operation. With the option depth you can control how far into a stream reassembly is done. By default @@ -1252,8 +1254,8 @@ The ``app-layer`` section holds application layer specific configurations. A in IPS mode, a global exception policy accessed via the ``error-policy`` setting can be defined to indicate what the engine should do in case if encounters an app-layer error. Possible values are "drop-flow", "pass-flow", -"bypass", "drop-packet", "pass-packet" or "ignore" (which will mean keeping -the default behavior). +"bypass", "drop-packet", "pass-packet", "reject" or "ignore" (which will mean +keeping the default behavior). Each supported protocol will have a dedicated subsection under ``protocols``. diff --git a/src/util-exception-policy.c b/src/util-exception-policy.c index c849469db0..577cba3b40 100644 --- a/src/util-exception-policy.c +++ b/src/util-exception-policy.c @@ -32,6 +32,10 @@ void ExceptionPolicyApply(Packet *p, enum ExceptionPolicy policy, enum PacketDro switch (policy) { case EXCEPTION_POLICY_IGNORE: break; + case EXCEPTION_POLICY_REJECT: + SCLogDebug("EXCEPTION_POLICY_REJECT"); + PacketDrop(p, ACTION_REJECT, drop_reason); + /* fall through */ case EXCEPTION_POLICY_DROP_FLOW: SCLogDebug("EXCEPTION_POLICY_DROP_FLOW"); if (p->flow) { @@ -88,6 +92,9 @@ enum ExceptionPolicy ExceptionPolicyParse(const char *option, const bool support } else if (strcmp(value_str, "pass-packet") == 0) { policy = EXCEPTION_POLICY_PASS_PACKET; SCLogConfig("%s: %s", option, value_str); + } else if (strcmp(value_str, "reject") == 0) { + policy = EXCEPTION_POLICY_REJECT; + SCLogConfig("%s: %s", option, value_str); } else if (strcmp(value_str, "ignore") == 0) { // TODO name? policy = EXCEPTION_POLICY_IGNORE; SCLogConfig("%s: %s", option, value_str); diff --git a/src/util-exception-policy.h b/src/util-exception-policy.h index 093a93924c..0a3b78d9f7 100644 --- a/src/util-exception-policy.h +++ b/src/util-exception-policy.h @@ -29,6 +29,7 @@ enum ExceptionPolicy { EXCEPTION_POLICY_BYPASS_FLOW, EXCEPTION_POLICY_DROP_PACKET, EXCEPTION_POLICY_DROP_FLOW, + EXCEPTION_POLICY_REJECT, }; void ExceptionPolicyApply( diff --git a/suricata.yaml.in b/suricata.yaml.in index 3caa9d29ec..7f3ad5b5ca 100644 --- a/suricata.yaml.in +++ b/suricata.yaml.in @@ -778,8 +778,8 @@ pcap-file: # Configure the app-layer parsers. # # The error-policy setting applies to all app-layer parsers. Values can be -# "drop-flow", "pass-flow", "bypass", "drop-packet", "pass-packet" or "ignore" -# (the default). +# "drop-flow", "pass-flow", "bypass", "drop-packet", "pass-packet", "reject" or +# "ignore" (the default). # # The protocol's section details each protocol. # @@ -1244,7 +1244,7 @@ host-os-policy: # Defrag settings: # The memcap-policy value can be "drop-flow", "pass-flow", "bypass", -# "drop-packet", "pass-packet" or "ignore" (which is the default). +# "drop-packet", "pass-packet", "reject" or "ignore" (which is the default). defrag: memcap: 32mb # memcap-policy: ignore @@ -1288,7 +1288,7 @@ defrag: # The memcap can be specified in kb, mb, gb. Just a number indicates it's # in bytes. # The memcap-policy can be "drop-flow", "pass-flow", "bypass", "drop-packet", -# "pass-packet" or "ignore" (which is the default). +# "pass-packet", "reject" or "ignore" (which is the default). flow: memcap: 128mb @@ -1366,8 +1366,8 @@ flow-timeouts: # memcap: 64mb # Can be specified in kb, mb, gb. Just a # # number indicates it's in bytes. # memcap-policy: ignore # Can be "drop-flow", "pass-flow", "bypass", -# # "drop-packet", "pass-packet" or "ignore" -# # default is "ignore" +# # "drop-packet", "pass-packet", "reject" or +# # "ignore" default is "ignore" # checksum-validation: yes # To validate the checksum of received # # packet. If csum validation is specified as # # "yes", then packets with invalid csum values will not @@ -1380,8 +1380,8 @@ flow-timeouts: # prealloc-sessions: 2048 # 2k sessions prealloc'd per stream thread # midstream: false # don't allow midstream session pickups # midstream-policy: ignore # Can be "drop-flow", "pass-flow", "bypass", -# # "drop-packet", "pass-packet" or "ignore" -# # default is "ignore" +# # "drop-packet", "pass-packet", "reject" or +# # "ignore" default is "ignore" # async-oneside: false # don't enable async stream handling # inline: no # stream inline mode # drop-invalid: yes # in inline mode, drop packets that are invalid with regards to streaming engine @@ -1394,8 +1394,8 @@ flow-timeouts: # memcap: 256mb # Can be specified in kb, mb, gb. Just a number # # indicates it's in bytes. # memcap-policy: ignore # Can be "drop-flow", "pass-flow", "bypass", -# # "drop-packet", "pass-packet" or "ignore" -# # default is "ignore" +# # "drop-packet", "pass-packet", "reject" or +# # "ignore" default is "ignore" # depth: 1mb # Can be specified in kb, mb, gb. Just a number # # indicates it's in bytes. # toserver-chunk-size: 2560 # inspect raw stream in chunks of at least