suricata
util-exception-policy.c
Go to the documentation of this file.
1 /* Copyright (C) 2022 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  */
21 
22 #include "suricata-common.h"
23 #include "suricata.h"
24 #include "util-exception-policy.h"
25 #include "util-misc.h"
26 
27 void ExceptionPolicyApply(Packet *p, enum ExceptionPolicy policy, enum PacketDropReason drop_reason)
28 {
29  SCLogDebug("start: pcap_cnt %" PRIu64 ", policy %u", p->pcap_cnt, policy);
30  if (EngineModeIsIPS()) {
31  switch (policy) {
33  break;
35  SCLogDebug("EXCEPTION_POLICY_DROP_FLOW");
36  if (p->flow) {
38  }
39  /* fall through */
41  SCLogDebug("EXCEPTION_POLICY_DROP_PACKET");
42  DecodeSetNoPayloadInspectionFlag(p);
43  DecodeSetNoPacketInspectionFlag(p);
44  PacketDrop(p, drop_reason);
45  break;
48  /* fall through */
50  SCLogDebug("EXCEPTION_POLICY_PASS_FLOW");
51  if (p->flow) {
53  FlowSetNoPacketInspectionFlag(p->flow); // TODO util func
54  }
55  /* fall through */
57  SCLogDebug("EXCEPTION_POLICY_PASS_PACKET");
58  DecodeSetNoPayloadInspectionFlag(p);
59  DecodeSetNoPacketInspectionFlag(p);
60  PacketPass(p);
61  break;
62  }
63  }
64  SCLogDebug("end");
65 }
66 
67 enum ExceptionPolicy ExceptionPolicyParse(const char *option, const bool support_flow)
68 {
70  const char *value_str = NULL;
71  if ((ConfGet(option, &value_str)) == 1 && value_str != NULL) {
72  if (strcmp(value_str, "drop-flow") == 0) {
74  SCLogConfig("%s: %s", option, value_str);
75  } else if (strcmp(value_str, "pass-flow") == 0) {
77  SCLogConfig("%s: %s", option, value_str);
78  } else if (strcmp(value_str, "bypass") == 0) {
80  SCLogConfig("%s: %s", option, value_str);
81  } else if (strcmp(value_str, "drop-packet") == 0) {
83  SCLogConfig("%s: %s", option, value_str);
84  } else if (strcmp(value_str, "pass-packet") == 0) {
86  SCLogConfig("%s: %s", option, value_str);
87  } else if (strcmp(value_str, "ignore") == 0) { // TODO name?
88  policy = EXCEPTION_POLICY_IGNORE;
89  SCLogConfig("%s: %s", option, value_str);
90  } else {
91  SCLogConfig("%s: ignore", option);
92  }
93 
94  if (!support_flow) {
95  if (policy == EXCEPTION_POLICY_DROP_FLOW || policy == EXCEPTION_POLICY_PASS_FLOW ||
96  policy == EXCEPTION_POLICY_BYPASS_FLOW) {
98  "flow actions not supported for %s, defaulting to \"ignore\"", option);
99  policy = EXCEPTION_POLICY_IGNORE;
100  }
101  }
102 
103  } else {
104  SCLogConfig("%s: ignore", option);
105  }
106  return policy;
107 }
108 
109 #ifndef DEBUG
110 
111 int ExceptionSimulationCommandlineParser(const char *name, const char *arg)
112 {
113  return 0;
114 }
115 
116 #else
117 
118 /* exception policy simulation (eps) handling */
119 
120 uint64_t g_eps_applayer_error_offset_ts = UINT64_MAX;
121 uint64_t g_eps_applayer_error_offset_tc = UINT64_MAX;
122 uint64_t g_eps_pcap_packet_loss = UINT64_MAX;
123 uint64_t g_eps_stream_ssn_memcap = UINT64_MAX;
124 uint64_t g_eps_stream_reassembly_memcap = UINT64_MAX;
125 uint64_t g_eps_flow_memcap = UINT64_MAX;
126 uint64_t g_eps_defrag_memcap = UINT64_MAX;
127 bool g_eps_is_alert_queue_fail_mode = false;
128 
129 /* 1: parsed, 0: not for us, -1: error */
130 int ExceptionSimulationCommandlineParser(const char *name, const char *arg)
131 {
132  if (strcmp(name, "simulate-applayer-error-at-offset-ts") == 0) {
133  BUG_ON(arg == NULL);
134  uint64_t offset = 0;
135  if (ParseSizeStringU64(arg, &offset) < 0) {
136  return -1;
137  }
138  g_eps_applayer_error_offset_ts = offset;
139  } else if (strcmp(name, "simulate-applayer-error-at-offset-tc") == 0) {
140  BUG_ON(arg == NULL);
141  uint64_t offset = 0;
142  if (ParseSizeStringU64(arg, &offset) < 0) {
143  return TM_ECODE_FAILED;
144  }
145  g_eps_applayer_error_offset_tc = offset;
146  } else if (strcmp(name, "simulate-packet-loss") == 0) {
147  BUG_ON(arg == NULL);
148  uint64_t pkt_num = 0;
149  if (ParseSizeStringU64(arg, &pkt_num) < 0) {
150  return TM_ECODE_FAILED;
151  }
152  g_eps_pcap_packet_loss = pkt_num;
153  } else if (strcmp(name, "simulate-packet-tcp-reassembly-memcap") == 0) {
154  BUG_ON(arg == NULL);
155  uint64_t pkt_num = 0;
156  if (ParseSizeStringU64(arg, &pkt_num) < 0) {
157  return TM_ECODE_FAILED;
158  }
159  g_eps_stream_reassembly_memcap = pkt_num;
160  } else if (strcmp(name, "simulate-packet-tcp-ssn-memcap") == 0) {
161  BUG_ON(arg == NULL);
162  uint64_t pkt_num = 0;
163  if (ParseSizeStringU64(arg, &pkt_num) < 0) {
164  return TM_ECODE_FAILED;
165  }
166  g_eps_stream_ssn_memcap = pkt_num;
167  } else if (strcmp(name, "simulate-packet-flow-memcap") == 0) {
168  BUG_ON(arg == NULL);
169  uint64_t pkt_num = 0;
170  if (ParseSizeStringU64(arg, &pkt_num) < 0) {
171  return TM_ECODE_FAILED;
172  }
173  g_eps_flow_memcap = pkt_num;
174  } else if (strcmp(name, "simulate-packet-defrag-memcap") == 0) {
175  BUG_ON(arg == NULL);
176  uint64_t pkt_num = 0;
177  if (ParseSizeStringU64(arg, &pkt_num) < 0) {
178  return TM_ECODE_FAILED;
179  }
180  g_eps_defrag_memcap = pkt_num;
181  } else if (strcmp(name, "simulate-alert-queue-realloc-failure") == 0) {
182  g_eps_is_alert_queue_fail_mode = true;
183  } else {
184  // not for us
185  return 0;
186  }
187  return 1;
188 }
189 #endif
ExceptionPolicyApply
void ExceptionPolicyApply(Packet *p, enum ExceptionPolicy policy, enum PacketDropReason drop_reason)
Definition: util-exception-policy.c:27
offset
uint64_t offset
Definition: util-streaming-buffer.h:0
PacketBypassCallback
void PacketBypassCallback(Packet *p)
Definition: decode.c:444
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:296
Packet_::pcap_cnt
uint64_t pcap_cnt
Definition: decode.h:594
ParseSizeStringU64
int ParseSizeStringU64(const char *size, uint64_t *res)
Definition: util-misc.c:200
EXCEPTION_POLICY_DROP_PACKET
@ EXCEPTION_POLICY_DROP_PACKET
Definition: util-exception-policy.h:30
FLOW_ACTION_DROP
#define FLOW_ACTION_DROP
Definition: flow.h:66
ExceptionSimulationCommandlineParser
int ExceptionSimulationCommandlineParser(const char *name, const char *arg)
Definition: util-exception-policy.c:111
SC_WARN_COMPATIBILITY
@ SC_WARN_COMPATIBILITY
Definition: util-error.h:193
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:83
PacketDropReason
PacketDropReason
Definition: decode.h:398
ConfGet
int ConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
Definition: conf.c:330
FLOW_ACTION_PASS
#define FLOW_ACTION_PASS
Definition: flow.h:113
util-exception-policy.h
EXCEPTION_POLICY_IGNORE
@ EXCEPTION_POLICY_IGNORE
Definition: util-exception-policy.h:26
EXCEPTION_POLICY_PASS_PACKET
@ EXCEPTION_POLICY_PASS_PACKET
Definition: util-exception-policy.h:27
EXCEPTION_POLICY_DROP_FLOW
@ EXCEPTION_POLICY_DROP_FLOW
Definition: util-exception-policy.h:31
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:281
ExceptionPolicy
ExceptionPolicy
Definition: util-exception-policy.h:25
Packet_
Definition: decode.h:433
Packet_::flow
struct Flow_ * flow
Definition: decode.h:470
ExceptionPolicyParse
enum ExceptionPolicy ExceptionPolicyParse(const char *option, const bool support_flow)
Definition: util-exception-policy.c:67
suricata-common.h
EXCEPTION_POLICY_BYPASS_FLOW
@ EXCEPTION_POLICY_BYPASS_FLOW
Definition: util-exception-policy.h:29
SCLogConfig
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
EXCEPTION_POLICY_PASS_FLOW
@ EXCEPTION_POLICY_PASS_FLOW
Definition: util-exception-policy.h:28
SCLogWarning
#define SCLogWarning(err_code,...)
Macro used to log WARNING messages.
Definition: util-debug.h:242
Flow_::flags
uint32_t flags
Definition: flow.h:431
EngineModeIsIPS
int EngineModeIsIPS(void)
Definition: suricata.c:256
suricata.h
util-misc.h