diff mbox series

[6/9] suricata: Add rule to skip IPS if a packet has the bypass bit set

Message ID 20211018101022.15448-6-michael.tremer@ipfire.org
State Accepted
Commit 49dd3e2946435b0f4dc77ca1a9d7b14d22edca8d
Headers
Series [1/9] suricata: Set most significant bit as repeat marker |

Commit Message

Michael Tremer Oct. 18, 2021, 10:10 a.m. UTC 
  Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
---
 src/initscripts/system/suricata | 6 ++++++
 1 file changed, 6 insertions(+)

Comments

Stefan Schantl Oct. 19, 2021, 4:04 a.m. UTC | #1 
Tested-by: Stefan Schantl <stefan.schantl@ipfire.org>
> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
> ---
>  src/initscripts/system/suricata | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/src/initscripts/system/suricata
> b/src/initscripts/system/suricata
> index 5ccea9391..2577621b8 100644
> --- a/src/initscripts/system/suricata
> +++ b/src/initscripts/system/suricata
> @@ -134,6 +134,12 @@ function generate_fw_rules {
>         # Flush the firewall chains.
>         flush_fw_chain
>  
> +       # Skip anything that has the bypass bit set
> +       local chain
> +       for chain in "${IPS_INPUT_CHAIN}" "${IPS_FORWARD_CHAIN}"
> "${IPS_OUTPUT_CHAIN}"; do
> +               iptables -w -A "${chain}" -m mark --mark
> "${BYPASS_MARK}/${BYPASS_MASK}" -j RETURN
> +       done
> +
>         # Check if the array of enabled_ips_zones contains any
> elements.
>         if [[ ${enabled_ips_zones[@]} ]]; then
>                 # Loop through the array and create firewall rules.
diff mbox series

Patch

diff --git a/src/initscripts/system/suricata b/src/initscripts/system/suricata
index 5ccea9391..2577621b8 100644
--- a/src/initscripts/system/suricata
+++ b/src/initscripts/system/suricata
@@ -134,6 +134,12 @@  function generate_fw_rules {
 	# Flush the firewall chains.
 	flush_fw_chain
 
+	# Skip anything that has the bypass bit set
+	local chain
+	for chain in "${IPS_INPUT_CHAIN}" "${IPS_FORWARD_CHAIN}" "${IPS_OUTPUT_CHAIN}"; do
+		iptables -w -A "${chain}" -m mark --mark "${BYPASS_MARK}/${BYPASS_MASK}" -j RETURN
+	done
+
 	# Check if the array of enabled_ips_zones contains any elements.
 	if [[ ${enabled_ips_zones[@]} ]]; then
 		# Loop through the array and create firewall rules.