Skip to content

Commit

Permalink
exception: in ids mode, only REJECT the packet
Browse files Browse the repository at this point in the history
In case of 'EXCEPTION_POLICY_REJECT', we were applying the same behavior
regardless of being in IDS or IPS mode.
This meant that at least the 'flow.action' was changed to drop when we
hit an exception policy in IDS mode. This minor fix makes the SV test
pass, but I'm afraid the bug can mean more than that.

Bug #6109
  • Loading branch information
jufajardini committed Jun 5, 2023
1 parent 6154bab commit 8d1e93c
Showing 1 changed file with 3 additions and 0 deletions.
3 changes: 3 additions & 0 deletions src/util-exception-policy.c
Original file line number Diff line number Diff line change
Expand Up @@ -72,6 +72,9 @@ void ExceptionPolicyApply(Packet *p, enum ExceptionPolicy policy, enum PacketDro
case EXCEPTION_POLICY_REJECT:
SCLogDebug("EXCEPTION_POLICY_REJECT");
PacketDrop(p, ACTION_REJECT, drop_reason);
if (!EngineModeIsIPS()) {
break;
}
/* fall through */
case EXCEPTION_POLICY_DROP_FLOW:
SCLogDebug("EXCEPTION_POLICY_DROP_FLOW");
Expand Down

0 comments on commit 8d1e93c

Please sign in to comment.