devguide: add chapter about exception policies - v1 #14483
+140
−0
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Adds a chapter indicating what are the main steps when adding exception policies, how is it possible to extend them, as well as main aspects and files to consider when doing so. Task OISF#5612
jufajardini
commented
Dec 12, 2025
| For an example PR on adding a new exception policy, see: | ||
| https://github.com/OISF/suricata/pull/7791, especially commit | ||
| `aa5bb2c329aff5 <https://github.com/OISF/suricata/pull/7791/commits/aa5bb2c329aff59b7811b43258ffd4d95fe7364f>`_. | ||
|
|
Contributor
Author
There was a problem hiding this comment.
Could possibly also add a section or note about the command-line options for simulating exception scenarios...
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #14483 +/- ##
==========================================
- Coverage 82.09% 82.08% -0.01%
==========================================
Files 1013 1013
Lines 262402 262402
==========================================
- Hits 215414 215398 -16
- Misses 46988 47004 +16
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
|
WARNING:
Pipeline = 28748 |
catenacyber
reviewed
Dec 17, 2025
|
|
||
| Exception Policies allow control on how the engine will behave when it reaches | ||
| exception scenarios where it could lose visibility into traffic being processed, | ||
| for instance. |
Contributor
There was a problem hiding this comment.
Feels strange to end a sentence by , for instance
catenacyber
reviewed
Dec 17, 2025
|
|
||
| - hitting memory capacity limits; | ||
| - encountering application layer protocol errors; | ||
| - picking a TCP session midstream. |
Contributor
There was a problem hiding this comment.
Can these exception policies be reachable from the rules language ? (from signatures)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Task #5612
Link to ticket: https://redmine.openinfosecfoundation.org/issues/
https://redmine.openinfosecfoundation.org/issues/5612
Built version of chapter: https://suri-rtd-test.readthedocs.io/en/devguide-5612-v1/devguide/extending/exception-policies/index.html
Describe changes: