docs/exceptions: minor improvements

Add section label and doc reference, add another term to Common terms
section.

Tried to also improve readability for the Midstream behavior tables:
- Highlight key-words when differences are only in `do` vs `no`.
- Change order of sentences in certain descriptions, to align with the
  steps those happen for the engine.

(cherry picked from commit 95560f09662129c3888e0fa2a0917d9f6c85ad7b)

diff --git a/doc/userguide/configuration/exception-policies.rst b/doc/userguide/configuration/exception-policies.rst
index 5d99c116fb91172e0875dadc5de31662d4200a13..5fce9ebb23568ca3822fd037443a387ebd741f9f 100644 (file)
--- a/doc/userguide/configuration/exception-policies.rst
+++ b/doc/userguide/configuration/exception-policies.rst
@@ -12,6 +12,7 @@ enabled, the engine will call them when it reaches exception states.
 For developers or for researching purposes, there are also simulation options
 exposed in debug mode and passed via command-line. These exist to force or
 simulate failures or errors and understand Suricata behavior under such conditions.
+See :any:`command-line-exception-policies` for those.
 
 .. _master-switch:
 
@@ -128,8 +129,8 @@ midstream pick-ups enabled or not and the various exception policy values:
      - Midstream pick-up sessions ENABLED (stream.midstream=true)
      - Midstream pick-up sessions DISABLED (stream.midstream=false)
    * - Ignore
-     - Session and app-layer traffic tracked and parsed, log app-layer traffic, do detection.
-     - Session not tracked. No app-layer parsing or logging. No detection. No stream reassembly.
+     - Session and app-layer traffic tracked and parsed, log app-layer traffic, **do** detection.
+     - Session not tracked. No app-layer parsing or logging. No stream reassembly. No detection.
    * - Drop-flow
      - Not valid.*
      - Not valid.*
@@ -140,14 +141,14 @@ midstream pick-ups enabled or not and the various exception policy values:
      - Not valid.*
      - Session not tracked, flow REJECTED.
    * - Pass-flow
-     - Session and app-layer traffic tracked and parsed, log app-layer traffic, no detection.
-     - Session not tracked. No app-layer parsing or logging. No detection. No stream reassembly.
+     - Session and app-layer traffic tracked and parsed, log app-layer traffic, **no** detection.
+     - Session not tracked. No app-layer parsing or logging. No stream reassembly. No detection.
    * - Pass-packet
      - Not valid.*
      - Not valid.*
    * - Bypass
      - Not valid.*
-     - Session not tracked. No app-layer parsing or logging. No detection. No stream reassembly.
+     - Session not tracked. No app-layer parsing or logging. No stream reassembly. No detection.
    * - Auto
      - Midstream policy applied: "ignore". Same behavior.
      - Midstream policy applied: "ignore". Same behavior.
@@ -166,11 +167,11 @@ whole flow.
      - Midstream pick-up sessions ENABLED (stream.midstream=true)
      - Midstream pick-up sessions DISABLED (stream.midstream=false)
    * - Ignore
-     - Session and app-layer traffic tracked and parsed, log app-layer traffic, do detection.
-     - Session not tracked. No app-layer parsing or logging. No detection. No stream reassembly.
+     - Session and app-layer traffic tracked and parsed, log app-layer traffic, **do** detection.
+     - Session not tracked. No app-layer parsing or logging. No stream reassembly. No detection.
    * - Drop-flow
      - Not valid.*
-     - Session not tracked. No app-layer parsing or logging. No detection. No stream reassembly.
+     - Session not tracked. No app-layer parsing or logging. No stream reassembly. No detection.
        Flow DROPPED.
    * - Drop-packet
      - Not valid.*
@@ -179,14 +180,14 @@ whole flow.
      - Not valid.*
      - Session not tracked, flow DROPPED and REJECTED.
    * - Pass-flow
-     - Track session, parse and log app-layer traffic, no detection.
-     - Session not tracked. No app-layer parsing or logging. No detection. No stream reassembly.
+     - Track session, parse and log app-layer traffic, **no** detection.
+     - Session not tracked. No app-layer parsing or logging. No stream reassembly. No detection.
    * - Pass-packet
      - Not valid.*
      - Not valid.*
    * - Bypass
      - Not valid.*
-     - Session not tracked. No app-layer parsing or logging. No detection. No stream reassembly.
+     - Session not tracked. No app-layer parsing or logging. No stream reassembly. No detection.
        Packets ALLOWED.
    * - Auto
      - Midstream policy applied: "ignore". Same behavior.
@@ -198,6 +199,8 @@ Notes:
    * ``REJECT`` will make Suricata send a Reset-packet unreach error to the sender
      of the matching packet.
 
+.. _command-line-exception-policies:
+
 Command-line Options for Simulating Exceptions
 ==============================================
 
@@ -235,6 +238,6 @@ Glossary
 Common abbreviations
 --------------------
 
-- applayer: application layer protocol
+- applayer/ app-layer: application layer protocol
 - memcap: (maximum) memory capacity available
 - defrag: defragmentation