upstream/suricata
1
0
Fork 0
mirror of https://github.com/OISF/suricata.git synced 2026-05-28 04:32:12 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

exceptions: add dedicated flow drop reason

Browse source 
To better control stats counters.
This commit is contained in:
Juliana Fajardini 2026-05-14 16:41:53 -03:00
parent ebfc5f4023
commit ce175eaa09
6 changed files with 14 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
etc/schema.json
View file

@ -8002,6 +8002,10 @@
"description":
"Number of packets dropped due to defrag memcap exception policy"
},
"exception_policy_flow_drop": {
"type": "integer",
"description": "Number of packets dropped due to an exception policy flow dropping"
},
"flow_drop": {
"type": "integer",
"description": "Number of packets dropped due to dropped flows"

4
src/decode.c
View file

@ -934,6 +934,8 @@ const char *PacketDropReasonToString(enum PacketDropReason r)
return "flow memcap";
case PKT_DROP_REASON_FLOW_DROP:
return "flow drop";
case PKT_DROP_REASON_EP_FLOW_DROP:
return "exception policy flow drop";
case PKT_DROP_REASON_STREAM_ERROR:
return "stream error";
case PKT_DROP_REASON_STREAM_MEMCAP:
@ -988,6 +990,8 @@ static const char *PacketDropReasonToJsonString(enum PacketDropReason r)
return "ips.drop_reason.flow_memcap";
case PKT_DROP_REASON_FLOW_DROP:
return "ips.drop_reason.flow_drop";
case PKT_DROP_REASON_EP_FLOW_DROP:
return "ips.drop_reason.exception_policy_flow_drop";
case PKT_DROP_REASON_STREAM_ERROR:
return "ips.drop_reason.stream_error";
case PKT_DROP_REASON_STREAM_MEMCAP:

1
src/decode.h
View file

@ -386,6 +386,7 @@ enum PacketDropReason {
PKT_DROP_REASON_DEFRAG_MEMCAP,
PKT_DROP_REASON_FLOW_MEMCAP,
PKT_DROP_REASON_FLOW_DROP,
PKT_DROP_REASON_EP_FLOW_DROP,
PKT_DROP_REASON_APPLAYER_ERROR,
PKT_DROP_REASON_APPLAYER_MEMCAP,
PKT_DROP_REASON_RULES,

2
src/flow.c
View file

@ -537,6 +537,8 @@ void FlowHandlePacketUpdate(Flow *f, Packet *p, ThreadVars *tv, DecodeThreadVars
if (f->flags & FLOW_ACTION_DROP) {
if (f->flags & FLOW_ACTION_BY_FIREWALL) {
PacketDrop(p, ACTION_DROP, PKT_DROP_REASON_FW_FLOW_DROP);
} else if (f->flags & FLOW_ACTION_BY_EXCEPTION_POLICY) {
PacketDrop(p, ACTION_DROP, PKT_DROP_REASON_EP_FLOW_DROP);
} else {
PacketDrop(p, ACTION_DROP, PKT_DROP_REASON_FLOW_DROP);
}

2
src/flow.h
View file

@ -123,6 +123,8 @@ typedef struct AppLayerParserState_ AppLayerParserState;
/** Flow action issued by firewall */
#define FLOW_ACTION_BY_FIREWALL BIT_U64(32)
/** Flow action issued by exception policy */
#define FLOW_ACTION_BY_EXCEPTION_POLICY BIT_U64(33)
/* File flags */

1
src/util-exception-policy.c
View file

@ -163,6 +163,7 @@ void ExceptionPolicyApply(Packet *p, enum ExceptionPolicy policy, enum PacketDro
SCLogDebug("EXCEPTION_POLICY_DROP_FLOW");
if (p->flow) {
p->flow->flags |= FLOW_ACTION_DROP;
p->flow->flags |= FLOW_ACTION_BY_EXCEPTION_POLICY;
FlowSetNoPayloadInspectionFlag(p->flow);
StreamTcpDisableAppLayer(p->flow);
}