From 2469ca9fbab0a02502fc8086bc94517d7dcdcfaf Mon Sep 17 00:00:00 2001 From: Michael Tremer Date: Mon, 18 Oct 2021 10:10:20 +0000 Subject: [PATCH] suricata: Store bypass flag in connmark and restore Signed-off-by: Michael Tremer Tested-by: Stefan Schantl Signed-off-by: Arne Fitzenreiter --- src/initscripts/system/suricata | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/src/initscripts/system/suricata b/src/initscripts/system/suricata index 2577621b8f..72d01b91da 100644 --- a/src/initscripts/system/suricata +++ b/src/initscripts/system/suricata @@ -154,10 +154,14 @@ function generate_fw_rules { done done - # Clear repeat bit, so that it does not confuse IPsec or QoS - iptables -w -A "${IPS_INPUT_CHAIN}" -j MARK --set-xmark "0x0/${REPEAT_MASK}" - iptables -w -A "${IPS_FORWARD_CHAIN}" -j MARK --set-xmark "0x0/${REPEAT_MASK}" - iptables -w -A "${IPS_OUTPUT_CHAIN}" -j MARK --set-xmark "0x0/${REPEAT_MASK}" + # Add common rules at the end of the chain + for chain in "${IPS_INPUT_CHAIN}" "${IPS_FORWARD_CHAIN}" "${IPS_OUTPUT_CHAIN}"; do + # Clear repeat bit + iptables -w -A "${chain}" -j MARK --set-xmark "0x0/${REPEAT_MASK}" + + # Store bypass bit in CONNMARK + iptables -w -A "${chain}" -m mark --mark "${BYPASS_MARK}/${BYPASS_MASK}" -j CONNMARK --save-mark + done fi } -- 2.39.5