Development March 2019

development@lists.ipfire.org

17 participants
64 discussions

[PATCH v2 1/3] Revert "Suricata: detect DNS events on port 853, too"
by Michael Tremer 02 Mar '19

02 Mar '19

This reverts commit ad99f959e2b83dd9f1275c1d385140271c8926ae. It does not make any sense to try to decode the TLS connection with the DNS decoder. Therefore should 853 (TCP only) be added to the TLS decoder. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- config/suricata/suricata.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/config/suricata/suricata.yaml b/config/suricata/suricata.yaml index d3ebbcfe4..767f84074 100644 --- a/config/suricata/suricata.yaml +++ b/config/suricata/suricata.yaml @@ -140,7 +140,7 @@ app-layer: tls: enabled: yes detection-ports: - dp: "[443,444,465,993,995]" + dp: "[443,444,465,853,993,995]" # Completely stop processing TLS/SSL session after the handshake # completed. If bypass is enabled this will also trigger flow @@ -204,11 +204,11 @@ app-layer: tcp: enabled: yes detection-ports: - dp: "[53,853]" + dp: 53 udp: enabled: yes detection-ports: - dp: "[53,853]" + dp: 53 http: enabled: yes # memcap: 64mb -- 2.12.2

1 2

Building 'bind 9.11.6' fails with python error
by Matthias Fischer 02 Mar '19

02 Mar '19

Hi, Building current 'bind 9.11.6' suddenly fails with the following errors: ***SNIP*** checking for perl... /usr/bin/perl checking for python... no checking for python3... no checking for python3.7... no checking for python3.6... no checking for python3.5... no checking for python3.4... no checking for python3.3... no checking for python3.2... no checking for python2... no checking for python2.7... no checking for Python support... no configure: error: Python required for dnssec-keymgr make: *** [bind:76: /usr/src/log/bind-9.11.6] Error 1 ***SNAP*** Sorry, I'm not sure: do we need 'dnssec-keymgr'? Or should I compile bind with '--without-python'? Excerpt from 'configure'-help: "# Python is also optional but required by default so that dnssec-keymgr # gets installed unless explicitly prevented by the user using # --without-python." I tried moving 'lfsmake2 bind' behind 'lfsmake2 python' and 'lfsmake2 python3' in 'make.sh', but this didn't work. Any hints would be appreciated. Best, Matthias

2 3

[PATCH] Suricata: detect TLS traffic on port 444, too
by Peter Müller 01 Mar '19

01 Mar '19

This is the default port for IPFire's administrative web interface and should be monitored by Suricata, too. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> c: Stefan Schantl <stefan.schantl(a)ipfire.org> --- config/suricata/suricata.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/suricata/suricata.yaml b/config/suricata/suricata.yaml index 4fbd32b85..0ff06f4ae 100644 --- a/config/suricata/suricata.yaml +++ b/config/suricata/suricata.yaml @@ -140,7 +140,7 @@ app-layer: tls: enabled: yes detection-ports: - dp: "[443,465,993,995]" + dp: "[443,444,465,993,995]" # Completely stop processing TLS/SSL session after the handshake # completed. If bypass is enabled this will also trigger flow -- 2.16.4

3 2

[PATCH] suricata: Use highest bit to mark packets
by Michael Tremer 01 Mar '19

01 Mar '19

We are using the netfilter MARK in IPsec & QoS and this is causing conflicts. Therefore, we use the highest bit in the IPS chain now and clear it afterwards because we do not really care about this after the packets have been passed through suricata. Then, no other application has to worry about suricata. Fixes: #12010 Signed-off-by: Arne Fitzenreiter <arne.fitzenreiter(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- config/suricata/suricata.yaml | 4 ++-- src/initscripts/system/suricata | 7 +++++-- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/config/suricata/suricata.yaml b/config/suricata/suricata.yaml index 12937ab22..7f651327e 100644 --- a/config/suricata/suricata.yaml +++ b/config/suricata/suricata.yaml @@ -117,8 +117,8 @@ logging: nfq: mode: repeat - repeat-mark: 16 - repeat-mask: 16 + repeat-mark: 1879048192 + repeat-mask: 1879048192 # bypass-mark: 1 # bypass-mask: 1 # route-queue: 2 diff --git a/src/initscripts/system/suricata b/src/initscripts/system/suricata index d2c758660..e755dfaff 100644 --- a/src/initscripts/system/suricata +++ b/src/initscripts/system/suricata @@ -29,8 +29,8 @@ NFQ_OPTS="--queue-bypass " network_zones=( red green blue orange ) # Mark and Mask options. -MARK="0x16" -MASK="0x16" +MARK="0x70000000" +MASK="0x70000000" # PID file of suricata. PID_FILE="/var/run/suricata.pid" @@ -88,6 +88,9 @@ function generate_fw_rules { iptables -I "$FW_CHAIN" -o "$network_device" -m mark ! --mark "$MARK"/"$MASK" -j NFQUEUE $NFQ_OPTIONS fi done + + # Clear repeat bit, so that it does not confuse IPsec or QoS + iptables -A "${FW_CHAIN}" -j MARK --set-xmark "0x0/${MASK}" } # Function to flush the firewall chain. -- 2.12.2

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development March 2019