suricata: Be more efficient with marks

This patch changes that we introduce a new mark which allows us to
identify any newly bypassed connections and permanently store the bypass
flag.

We also only restore marks from the connection tracking when a packet
has no marks, yet.

Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall
index 39d9c0f2373abdeadab8a5f129637d67a5588bd8..5d37cffd775660c6d1ddc62565310889b451afcc 100644 (file)
--- a/src/initscripts/system/firewall
+++ b/src/initscripts/system/firewall
@@ -160,7 +160,7 @@ iptables_init() {
        iptables -A CTOUTPUT -p icmp -m conntrack --ctstate RELATED -j ACCEPT
 
        # Restore any connection marks
-       iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark
+       iptables -t mangle -A PREROUTING -m mark --mark 0 -j CONNMARK --restore-mark
 
        # Fix for braindead ISPs
        iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

diff --git a/src/initscripts/system/suricata b/src/initscripts/system/suricata
index 30a81333f3d117cdd07c191f4a36ce2f465564af..20afab1300a59ac7a73679d466617328ec205be6 100644 (file)
--- a/src/initscripts/system/suricata
+++ b/src/initscripts/system/suricata
@@ -29,8 +29,14 @@ eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
 
 IPS_REPEAT_MARK="0x80000000"
 IPS_REPEAT_MASK="0x80000000"
-IPS_BYPASS_MARK="0x40000000"
-IPS_BYPASS_MASK="0x40000000"
+
+# The IPS requested that this connection is being bypassed
+IPS_BYPASS_REQUESTED_MARK="0x40000000"
+IPS_BYPASS_REQUESTED_MASK="0x40000000"
+
+# Marks a connection to be bypassed
+IPS_BYPASS_MARK="0x20000000"
+IPS_BYPASS_MASK="0x20000000"
 
 # Optional options for the Netfilter queue.
 NFQ_OPTS=(
@@ -72,6 +78,11 @@ generate_fw_rules() {
        # Don't process packets where the IPS has requested to bypass the stream
        iptables -w -t mangle -A IPS -m mark --mark "$(( IPS_BYPASS_MARK ))/$(( IPS_BYPASS_MASK ))" -j RETURN
 
+       # If suricata decided to bypass a stream, we will store the mark in the connection tracking table
+       iptables -w -t mangle -A IPS \
+               -m mark --mark "$(( IPS_BYPASS_REQUESTED_MARK ))/$(( IPS_BYPASS_REQUESTED_MASK ))" \
+               -j CONNMARK --set-mark "$(( IPS_BYPASS_MARK ))/$(( IPS_BYPASS_MASK ))"
+
        # Don't process packets that have already been seen by the IPS
        iptables -w -t mangle -A IPS -m mark --mark "$(( IPS_REPEAT_MARK ))/$(( IPS_REPEAT_MASK ))" -j RETURN
 
@@ -93,11 +104,6 @@ generate_fw_rules() {
        # Send packets to suricata
        iptables -w -t mangle -A IPS -j NFQUEUE "${NFQ_OPTIONS[@]}"
 
-       # If suricata decided to bypass a stream, we will store the mark in the connection tracking table
-       iptables -w -t mangle -A IPS \
-               -m mark --mark "$(( IPS_BYPASS_MARK ))/$(( IPS_BYPASS_MASK ))" \
-               -j CONNMARK --save-mark --mask "$(( IPS_BYPASS_MASK ))"
-
        return 0
 }