exceptions: add reject support to exception policy

This enables the usage of 'reject' as an exception policy. As for both
IPS and IDS modes the intended result of sending a reject packet is to
reject the related flow, this will effectively mean setting the reject
action to the packet that triggered the exception condition, and then
dropping the associated flow.

Task #5503

doc/userguide/configuration/suricata-yaml.rst

@@ -997,7 +997,8 @@ thread ensures that wherever possible and within the memcap. there
 will be 10000 flows prepared.
 
 In IPS mode, a memcap-policy exception policy can be set, telling Suricata
-what to do in case memcap is hit: 'drop-flow', 'pass-flow', 'bypass', 'ignore'.
+what to do in case memcap is hit: 'drop-flow', 'pass-flow', 'bypass', 'reject',
+'ignore'.
 
 ::
 
@@ -1098,7 +1099,8 @@ be recognized by Suricata.
 The stream-engine has two memcaps that can be set. One for the
 stream-tracking-engine and one for the reassembly-engine. For both cases,
 in IPS mode, an exception policy (memcap-policy) can be set, telling Suricata
-what to do in case memcap is hit: 'drop-flow', 'pass-flow', 'bypass', 'ignore'.
+what to do in case memcap is hit: 'drop-flow', 'pass-flow', 'bypass', 'reject',
+'ignore'.
 
 The stream-tracking-engine keeps information of the flow in
 memory. Information about the state, TCP-sequence-numbers and the TCP
@@ -1189,7 +1191,7 @@ The reassembly-engine has to keep data segments in memory in order to
 be able to reconstruct a stream. To avoid resource starvation a memcap
 is used to limit the memory used. In IPS mode, an exception policy
 (memcap-policy) can be set, telling Suricata what to do in case memcap
-is hit: 'drop-flow', 'pass-flow', 'bypass', 'ignore'.
+is hit: 'drop-flow', 'pass-flow', 'bypass', 'reject', 'ignore'.
 
 Reassembling a stream is an expensive operation. With the option depth
 you can control how far into a stream reassembly is done. By default
@@ -1252,8 +1254,8 @@ The ``app-layer`` section holds application layer specific configurations.
 A in IPS mode, a global exception policy accessed via the ``error-policy``
 setting can be defined to indicate what the engine should do in case if
 encounters an app-layer error. Possible values are "drop-flow", "pass-flow",
-"bypass", "drop-packet", "pass-packet" or "ignore" (which will mean keeping
+"bypass", "drop-packet", "pass-packet", "reject" or "ignore" (which will mean
-the default behavior).
+keeping the default behavior).
 
 Each supported protocol will have a dedicated subsection under ``protocols``.
 

src/util-exception-policy.c

@@ -32,6 +32,10 @@ void ExceptionPolicyApply(Packet *p, enum ExceptionPolicy policy, enum PacketDro
         switch (policy) {
             case EXCEPTION_POLICY_IGNORE:
                 break;
+            case EXCEPTION_POLICY_REJECT:
+                SCLogDebug("EXCEPTION_POLICY_REJECT");
+                PacketDrop(p, ACTION_REJECT, drop_reason);
+                /* fall through */
             case EXCEPTION_POLICY_DROP_FLOW:
                 SCLogDebug("EXCEPTION_POLICY_DROP_FLOW");
                 if (p->flow) {
@@ -88,6 +92,9 @@ enum ExceptionPolicy ExceptionPolicyParse(const char *option, const bool support
         } else if (strcmp(value_str, "pass-packet") == 0) {
             policy = EXCEPTION_POLICY_PASS_PACKET;
             SCLogConfig("%s: %s", option, value_str);
+        } else if (strcmp(value_str, "reject") == 0) {
+            policy = EXCEPTION_POLICY_REJECT;
+            SCLogConfig("%s: %s", option, value_str);
         } else if (strcmp(value_str, "ignore") == 0) { // TODO name?
             policy = EXCEPTION_POLICY_IGNORE;
             SCLogConfig("%s: %s", option, value_str);

src/util-exception-policy.h

@@ -29,6 +29,7 @@ enum ExceptionPolicy {
     EXCEPTION_POLICY_BYPASS_FLOW,
     EXCEPTION_POLICY_DROP_PACKET,
     EXCEPTION_POLICY_DROP_FLOW,
+    EXCEPTION_POLICY_REJECT,
 };
 
 void ExceptionPolicyApply(

suricata.yaml.in

@@ -778,8 +778,8 @@ pcap-file:
 # Configure the app-layer parsers.
 #
 # The error-policy setting applies to all app-layer parsers. Values can be
-# "drop-flow", "pass-flow", "bypass", "drop-packet", "pass-packet" or "ignore"
+# "drop-flow", "pass-flow", "bypass", "drop-packet", "pass-packet", "reject" or
-# (the default).
+# "ignore" (the default).
 #
 # The protocol's section details each protocol.
 #
@@ -1244,7 +1244,7 @@ host-os-policy:
 # Defrag settings:
 
 # The memcap-policy value can be "drop-flow", "pass-flow", "bypass",
-# "drop-packet", "pass-packet" or "ignore" (which is the default).
+# "drop-packet", "pass-packet", "reject" or "ignore" (which is the default).
 defrag:
   memcap: 32mb
   # memcap-policy: ignore
@@ -1288,7 +1288,7 @@ defrag:
 # The memcap can be specified in kb, mb, gb.  Just a number indicates it's
 # in bytes.
 # The memcap-policy can be "drop-flow", "pass-flow", "bypass", "drop-packet",
-# "pass-packet" or "ignore" (which is the default).
+# "pass-packet", "reject" or "ignore" (which is the default).
 
 flow:
   memcap: 128mb
@@ -1366,8 +1366,8 @@ flow-timeouts:
 #   memcap: 64mb                # Can be specified in kb, mb, gb.  Just a
 #                               # number indicates it's in bytes.
 #   memcap-policy: ignore       # Can be "drop-flow", "pass-flow", "bypass",
-#                               # "drop-packet", "pass-packet" or "ignore"
+#                               # "drop-packet", "pass-packet", "reject" or
-#                               # default is "ignore"
+#                               # "ignore" default is "ignore"
 #   checksum-validation: yes    # To validate the checksum of received
 #                               # packet. If csum validation is specified as
 #                               # "yes", then packets with invalid csum values will not
@@ -1380,8 +1380,8 @@ flow-timeouts:
 #   prealloc-sessions: 2048     # 2k sessions prealloc'd per stream thread
 #   midstream: false            # don't allow midstream session pickups
 #   midstream-policy: ignore    # Can be "drop-flow", "pass-flow", "bypass",
-#                               # "drop-packet", "pass-packet" or "ignore"
+#                               # "drop-packet", "pass-packet", "reject" or
-#                               # default is "ignore"
+#                               # "ignore" default is "ignore"
 #   async-oneside: false        # don't enable async stream handling
 #   inline: no                  # stream inline mode
 #   drop-invalid: yes           # in inline mode, drop packets that are invalid with regards to streaming engine
@@ -1394,8 +1394,8 @@ flow-timeouts:
 #     memcap: 256mb             # Can be specified in kb, mb, gb.  Just a number
 #                               # indicates it's in bytes.
 #     memcap-policy: ignore     # Can be "drop-flow", "pass-flow", "bypass",
-#                               # "drop-packet", "pass-packet" or "ignore"
+#                               # "drop-packet", "pass-packet", "reject" or
-#                               # default is "ignore"
+#                               # "ignore" default is "ignore"
 #     depth: 1mb                # Can be specified in kb, mb, gb.  Just a number
 #                               # indicates it's in bytes.
 #     toserver-chunk-size: 2560 # inspect raw stream in chunks of at least