From mboxrd@z Thu Jan  1 00:00:00 1970
From: Michael Tremer <michael.tremer@ipfire.org>
To: development@lists.ipfire.org
Subject: [PATCH 07/20] suricata: Be more efficient with marks
Date: Tue, 10 Sep 2024 14:37:20 +0000
Message-ID: <20240910143748.3469271-8-michael.tremer@ipfire.org>
In-Reply-To: <20240910143748.3469271-1-michael.tremer@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============7329479806889556102=="
List-Id: <development.lists.ipfire.org>

--===============7329479806889556102==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

This patch changes that we introduce a new mark which allows us to
identify any newly bypassed connections and permanently store the bypass
flag.

We also only restore marks from the connection tracking when a packet
has no marks, yet.

Tested-by: Adolf Belka <adolf.belka(a)ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
---
 src/initscripts/system/firewall |  2 +-
 src/initscripts/system/suricata | 20 +++++++++++++-------
 2 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall
index 39d9c0f23..5d37cffd7 100644
--- a/src/initscripts/system/firewall
+++ b/src/initscripts/system/firewall
@@ -160,7 +160,7 @@ iptables_init() {
 	iptables -A CTOUTPUT -p icmp -m conntrack --ctstate RELATED -j ACCEPT
=20
 	# Restore any connection marks
-	iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark
+	iptables -t mangle -A PREROUTING -m mark --mark 0 -j CONNMARK --restore-mark
=20
 	# Fix for braindead ISPs
 	iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to=
-pmtu
diff --git a/src/initscripts/system/suricata b/src/initscripts/system/suricata
index 30a81333f..20afab130 100644
--- a/src/initscripts/system/suricata
+++ b/src/initscripts/system/suricata
@@ -29,8 +29,14 @@ eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settin=
gs)
=20
 IPS_REPEAT_MARK=3D"0x80000000"
 IPS_REPEAT_MASK=3D"0x80000000"
-IPS_BYPASS_MARK=3D"0x40000000"
-IPS_BYPASS_MASK=3D"0x40000000"
+
+# The IPS requested that this connection is being bypassed
+IPS_BYPASS_REQUESTED_MARK=3D"0x40000000"
+IPS_BYPASS_REQUESTED_MASK=3D"0x40000000"
+
+# Marks a connection to be bypassed
+IPS_BYPASS_MARK=3D"0x20000000"
+IPS_BYPASS_MASK=3D"0x20000000"
=20
 # Optional options for the Netfilter queue.
 NFQ_OPTS=3D(
@@ -72,6 +78,11 @@ generate_fw_rules() {
 	# Don't process packets where the IPS has requested to bypass the stream
 	iptables -w -t mangle -A IPS -m mark --mark "$(( IPS_BYPASS_MARK ))/$(( IPS=
_BYPASS_MASK ))" -j RETURN
=20
+	# If suricata decided to bypass a stream, we will store the mark in the con=
nection tracking table
+	iptables -w -t mangle -A IPS \
+		-m mark --mark "$(( IPS_BYPASS_REQUESTED_MARK ))/$(( IPS_BYPASS_REQUESTED_=
MASK ))" \
+		-j CONNMARK --set-mark "$(( IPS_BYPASS_MARK ))/$(( IPS_BYPASS_MASK ))"
+
 	# Don't process packets that have already been seen by the IPS
 	iptables -w -t mangle -A IPS -m mark --mark "$(( IPS_REPEAT_MARK ))/$(( IPS=
_REPEAT_MASK ))" -j RETURN
=20
@@ -93,11 +104,6 @@ generate_fw_rules() {
 	# Send packets to suricata
 	iptables -w -t mangle -A IPS -j NFQUEUE "${NFQ_OPTIONS[@]}"
=20
-	# If suricata decided to bypass a stream, we will store the mark in the con=
nection tracking table
-	iptables -w -t mangle -A IPS \
-		-m mark --mark "$(( IPS_BYPASS_MARK ))/$(( IPS_BYPASS_MASK ))" \
-		-j CONNMARK --save-mark --mask "$(( IPS_BYPASS_MASK ))"
-
 	return 0
 }
=20
--=20
2.39.2


--===============7329479806889556102==--