From: Michael Tremer <michael.tremer@ipfire.org>
Date: Mon, 18 Oct 2021 10:10:19 +0000 (+0000)
Subject: suricata: Add rule to skip IPS if a packet has the bypass bit set
X-Git-Tag: v2.27-core161~2^2~79
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=49dd3e2946435b0f4dc77ca1a9d7b14d22edca8d;p=ipfire-2.x.git

suricata: Add rule to skip IPS if a packet has the bypass bit set

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Tested-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
---

diff --git a/src/initscripts/system/suricata b/src/initscripts/system/suricata
index 5ccea93914..2577621b8f 100644
--- a/src/initscripts/system/suricata
+++ b/src/initscripts/system/suricata
@@ -134,6 +134,12 @@ function generate_fw_rules {
 	# Flush the firewall chains.
 	flush_fw_chain
 
+	# Skip anything that has the bypass bit set
+	local chain
+	for chain in "${IPS_INPUT_CHAIN}" "${IPS_FORWARD_CHAIN}" "${IPS_OUTPUT_CHAIN}"; do
+		iptables -w -A "${chain}" -m mark --mark "${BYPASS_MARK}/${BYPASS_MASK}" -j RETURN
+	done
+
 	# Check if the array of enabled_ips_zones contains any elements.
 	if [[ ${enabled_ips_zones[@]} ]]; then
 		# Loop through the array and create firewall rules.