webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-09 18:45:54 +02:00
Code Issues Packages Projects Releases Wiki Activity

suricata: Be more efficient with marks

Browse Source 
This patch changes that we introduce a new mark which allows us to
identify any newly bypassed connections and permanently store the bypass
flag.

We also only restore marks from the connection tracking when a packet
has no marks, yet.

Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
This commit is contained in:
Michael Tremer
2024-09-09 19:38:47 +02:00
parent 54a58a2891
commit e088c21158
2 changed files with 14 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/initscripts/system/firewall
View File

@@ -160,7 +160,7 @@ iptables_init() {
iptables -A CTOUTPUT -p icmp -m conntrack --ctstate RELATED -j ACCEPT
# Restore any connection marks
iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark
iptables -t mangle -A PREROUTING -m mark --mark 0 -j CONNMARK --restore-mark
# Fix for braindead ISPs
iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

20
src/initscripts/system/suricata
View File

@@ -29,8 +29,14 @@ eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
IPS_REPEAT_MARK="0x80000000"
IPS_REPEAT_MASK="0x80000000"
IPS_BYPASS_MARK="0x40000000"
IPS_BYPASS_MASK="0x40000000"
# The IPS requested that this connection is being bypassed
IPS_BYPASS_REQUESTED_MARK="0x40000000"
IPS_BYPASS_REQUESTED_MASK="0x40000000"
# Marks a connection to be bypassed
IPS_BYPASS_MARK="0x20000000"
IPS_BYPASS_MASK="0x20000000"
# Optional options for the Netfilter queue.
NFQ_OPTS=(
@@ -72,6 +78,11 @@ generate_fw_rules() {
# Don't process packets where the IPS has requested to bypass the stream
iptables -w -t mangle -A IPS -m mark --mark "$(( IPS_BYPASS_MARK ))/$(( IPS_BYPASS_MASK ))" -j RETURN
# If suricata decided to bypass a stream, we will store the mark in the connection tracking table
iptables -w -t mangle -A IPS \
-m mark --mark "$(( IPS_BYPASS_REQUESTED_MARK ))/$(( IPS_BYPASS_REQUESTED_MASK ))" \
-j CONNMARK --set-mark "$(( IPS_BYPASS_MARK ))/$(( IPS_BYPASS_MASK ))"
# Don't process packets that have already been seen by the IPS
iptables -w -t mangle -A IPS -m mark --mark "$(( IPS_REPEAT_MARK ))/$(( IPS_REPEAT_MASK ))" -j RETURN
@@ -93,11 +104,6 @@ generate_fw_rules() {
# Send packets to suricata
iptables -w -t mangle -A IPS -j NFQUEUE "${NFQ_OPTIONS[@]}"
# If suricata decided to bypass a stream, we will store the mark in the connection tracking table
iptables -w -t mangle -A IPS \
-m mark --mark "$(( IPS_BYPASS_MARK ))/$(( IPS_BYPASS_MASK ))" \
-j CONNMARK --save-mark --mask "$(( IPS_BYPASS_MASK ))"
return 0
}