exception: fix use of master switch with default

If an exception policy wasn't set up individually, use the GetDefault
function to pick one. This will check for the master switch option and
handle 'auto' cases.

Instead of deciding what the auto value should be when we are parsing
the master switch, leave that for when some of the other policies is to
be set via the master switch, when since this can change for specific
exception policies - like for midstream, for instance.

Update exceptions policies documentation to clarify that the default
configuration in IPS when midstream is enabled is `ignore`, not
`drop-flow`.

Bug #6169

(cherry picked from commit e306bc6ecc9f526d02d178c5715e40e493fa8cb6)

diff --git a/doc/userguide/configuration/exception-policies.rst b/doc/userguide/configuration/exception-policies.rst
index 86cfd37427bc68ef94036bc3f92d3a038ac3e6e9..b6c9523280557a1bc516de7d4039b9c1e7f7555b 100644 (file)
--- a/doc/userguide/configuration/exception-policies.rst
+++ b/doc/userguide/configuration/exception-policies.rst
@@ -29,25 +29,29 @@ have the need to.
 
 ::
 
-   # In IPS mode, the default is drop-packet/drop-flow. To fallback to old
-   # behavior (setting each of them individually, or ignoring all), set this
-   # to ignore.
+   # The default is ``ignore``.
+   #
    # All values available for exception policies can be used, and there is one
-   # extra option: auto - which means drop-packet/drop-flow in IPS mode and
-   # ignore in IDS mode).
+   # extra option: auto - same as ``ignore``.
    # Exception policy values are: drop-packet, drop-flow, reject, bypass,
    # pass-packet, pass-flow, ignore (disable).
    exception-policy: auto
 
+.. note::
+
+    The default/``auto`` value changes to ``drop-flow`` in Suricata 7.0, for IPS mode.
+
 This value will be overwritten by specific exception policies whose settings are
 also defined in the yaml file.
 
 Auto
 ''''
 
-**In IPS mode**, the default behavior for all exception policies is to drop
-packets and/or flows. It is possible to disable this default, by setting the
-exception policies "master switch" yaml config option to ``ignore``.
+The default behavior is to ``ignore`` exception policies. This behavior changes
+with Suricata 7.0, where **in IPS mode**, the default for most of the exception
+policies is to fail close, that is, ``drop-flow``, or ``drop-packet`` if the
+flow action is not supported. For the midstream exception policy, the default
+will be ``ignore`` if midstream flows are accepted.
 
 **In IDS mode**, setting auto mode actually means disabling the
 ``master-swtich``, or ignoring the exception policies.

diff --git a/src/util-exception-policy.c b/src/util-exception-policy.c
index 251183dafe958fdb84749849d5f67740d25962d5..eb077007b9a7d6d32a5a8f721975216c158cef02 100644 (file)
--- a/src/util-exception-policy.c
+++ b/src/util-exception-policy.c
@@ -172,26 +172,17 @@ static enum ExceptionPolicy ExceptionPolicyConfigValueParse(
     return policy;
 }
 
+/* 'auto' means ignore, for now */
 static enum ExceptionPolicy ExceptionPolicyPickAuto(bool midstream_enabled, bool support_flow)
 {
-    enum ExceptionPolicy policy = EXCEPTION_POLICY_NOT_SET;
-    if (!midstream_enabled && EngineModeIsIPS()) {
-        if (support_flow) {
-            policy = EXCEPTION_POLICY_DROP_FLOW;
-        } else {
-            policy = EXCEPTION_POLICY_DROP_PACKET;
-        }
-    }
-    return policy;
+    return EXCEPTION_POLICY_NOT_SET;
 }
 
 static enum ExceptionPolicy ExceptionPolicyMasterParse(const char *value)
 {
     enum ExceptionPolicy policy = ExceptionPolicyConfigValueParse("exception-policy", value);
-    if (policy == EXCEPTION_POLICY_AUTO) {
-        policy = ExceptionPolicyPickAuto(false, true);
-    } else if (!EngineModeIsIPS() &&
-               (policy == EXCEPTION_POLICY_DROP_PACKET || policy == EXCEPTION_POLICY_DROP_FLOW)) {
+    if (!EngineModeIsIPS() &&
+            (policy == EXCEPTION_POLICY_DROP_PACKET || policy == EXCEPTION_POLICY_DROP_FLOW)) {
         policy = EXCEPTION_POLICY_NOT_SET;
     }
     g_eps_have_exception_policy = true;
@@ -207,17 +198,28 @@ static enum ExceptionPolicy ExceptionPolicyGetDefault(
     enum ExceptionPolicy p = EXCEPTION_POLICY_NOT_SET;
     if (g_eps_have_exception_policy) {
         p = GetMasterExceptionPolicy(option);
+
+        if (p == EXCEPTION_POLICY_AUTO) {
+            p = ExceptionPolicyPickAuto(midstream, support_flow);
+            SCLogConfig("%s: %s (defined via 'exception-policy' master switch). "
+                        "Warning: this will change to drop-flow or drop-packet in Suricata 7.",
+                    option, ExceptionPolicyEnumToString(p));
+            return p;
+        }
+
         if (!support_flow) {
             p = PickPacketAction(option, p);
         }
         SCLogConfig("%s: %s (defined via 'exception-policy' master switch)", option,
                 ExceptionPolicyEnumToString(p));
         return p;
-    } else if (EngineModeIsIPS() && !midstream) {
-        p = EXCEPTION_POLICY_DROP_FLOW;
     }
-    SCLogConfig("%s: %s (defined via 'built-in default' for %s-mode)", option,
-            ExceptionPolicyEnumToString(p), EngineModeIsIPS() ? "IPS" : "IDS");
+
+    /* If we don't have the master switch set, default is `not_set` */
+
+    SCLogConfig("%s: %s (defined via 'built-in default' for %s-mode). "
+                "Warning: this will change to drop-flow or drop-packet in Suricata 7.",
+            option, ExceptionPolicyEnumToString(p), EngineModeIsIPS() ? "IPS" : "IDS");
 
     return p;
 }
@@ -275,7 +277,7 @@ enum ExceptionPolicy ExceptionPolicyMidstreamParse(bool midstream_enabled)
             }
         }
     } else {
-        policy = ExceptionPolicyGetDefault("midstream-policy", true, midstream_enabled);
+        policy = ExceptionPolicyGetDefault("stream.midstream-policy", true, midstream_enabled);
     }
 
     if (policy == EXCEPTION_POLICY_PASS_PACKET || policy == EXCEPTION_POLICY_DROP_PACKET) {