From: Michael Tremer <michael.tremer@ipfire.org>
Date: Wed, 18 Aug 2021 15:18:50 +0000 (+0100)
Subject: suricata: Add rule to skip IPS if a packet has the bypass bit set
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=0ab5c8f9e264b49fc8ef43ee1b7939912b013b6a;p=people%2Fms%2Fipfire-2.x.git

suricata: Add rule to skip IPS if a packet has the bypass bit set

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
---

diff --git a/src/initscripts/system/suricata b/src/initscripts/system/suricata
index 5ccea93914..2577621b8f 100644
--- a/src/initscripts/system/suricata
+++ b/src/initscripts/system/suricata
@@ -134,6 +134,12 @@ function generate_fw_rules {
 	# Flush the firewall chains.
 	flush_fw_chain
 
+	# Skip anything that has the bypass bit set
+	local chain
+	for chain in "${IPS_INPUT_CHAIN}" "${IPS_FORWARD_CHAIN}" "${IPS_OUTPUT_CHAIN}"; do
+		iptables -w -A "${chain}" -m mark --mark "${BYPASS_MARK}/${BYPASS_MASK}" -j RETURN
+	done
+
 	# Check if the array of enabled_ips_zones contains any elements.
 	if [[ ${enabled_ips_zones[@]} ]]; then
 		# Loop through the array and create firewall rules.