Suricata on ipip tunneled packets

vseregin · September 10, 2024, 10:51am

Hi, team!

We use suricata to catch packets on mirrored traffic. Due to service design packets in one direction encapsulated in ipip tunnel

Frame 188: 984 bytes on wire (7872 bits), 984 bytes captured (7872 bits)
Ethernet II, Src: 02:00:00:05:02:01 (02:00:00:04:02:01), Dst: MellanoxTech_5d:ce:f2 (b8:ce:f6:5d:cb:f2)
802.1Q Virtual LAN, PRI: 0, DEI: 0, ID: 100
Internet Protocol Version 4, Src: 10.0.200.7, Dst: 10.1.200.77
Internet Protocol Version 4, Src: 78.87.12.214, Dst: 15.73.19.77
Transmission Control Protocol, Src Port: 56152, Dst Port: 443, Seq: 1, Ack: 1, Len: 894
Transport Layer Security

In reverse direction packets have no additional header

Frame 202: 1498 bytes on wire (11984 bits), 1498 bytes captured (11984 bits)
Ethernet II, Src: MellanoxTech_5d:ce:f2 (b8:ce:f6:5d:cb:f2), Dst: 02:00:00:05:02:01 (02:00:00:04:02:01)
802.1Q Virtual LAN, PRI: 0, DEI: 0, ID: 100
Internet Protocol Version 4, Src: 15.73.19.77, Dst: 8.87.12.214
Transmission Control Protocol, Src Port: 443, Dst Port: 4043, Seq: 1, Ack: 272, Len: 1428

So we need to strip first ip header for half packets for suricata be able to work with them.

Can you, please, help me choose the right solution for such a scenario. I red there is an opportunity to use XDP in suricata. May be another options are available.

Thnx!

Suricata version 7.0.6 RELEASE
Ubuntu 22.04.4 LTS

vjulien · September 11, 2024, 4:57am

I believe this PR might try to address a similar case:

github.com/OISF/suricata

flow: optionally use pkt recursion for hash

OISF:master ← coledishington:flow-optional-recur-limit-6260-v5

opened 09:13PM - 21 Jan 24 UTC

coledishington

+43 -15

If a Suricata inline IPS device is routing traffic over a non-encrypted tunnel, …like IPv6 tunnels, packets in a flow will be dropped and not be matched. e.g. The following example is a Suricata inline IPS with an IPv6 tunnel: ``` request: IPv4]ICMP] -> |IPS| -> IPv6]IPv4]ICMP] reply: <- |IPS| <- IPv6]IPv4]ICMP] ``` Both the IPv4 request and IPv6 reply will be seen by Suricata on ingress. The flows will not be matched due to flow recursion level. Optionally use pkt recursion level in flow hash. Excluding recursion level in flow hash allows matching of packet flows and defrag on an inline IPS Suricata scenario where the IPS device is a tunnel terminator. Bug: #6260 Make sure these boxes are signed before submitting your Pull Request -- thank you. - [✓] I have read the contributing guide lines at https://docs.suricata.io/en/latest/devguide/codebase/contributing/contribution-process.html - [✓] I have signed the Open Information Security Foundation contribution agreement at https://suricata.io/about/contribution-agreement/ - [✓] I have updated the user guide (in doc/userguide/) to reflect the changes made (if applicable) Link to [redmine](https://redmine.openinfosecfoundation.org/projects/suricata/issues) ticket: https://redmine.openinfosecfoundation.org/issues/6260 Describe changes: Add config (decoder.recursion-level.use-for-tracking) to control the use of packet recursion level in flow matching. This is to support scenarios where Suricata inline IPS device is routing traffic over a non-encrypted tunnel, like IPv6 tunnels, packets in a flow will be dropped and not be matched. e.g. The following example is a Suricata inline IPS with an IPv6 tunnel: request: IPv4]ICMP] -> |IPS| -> IPv6]IPv4]ICMP] reply: <- |IPS| <- IPv6]IPv4]ICMP] Both the IPv4 request and IPv6 reply will be seen by Suricata on ingress. The flows will not be matched due to flow recursion level. ### Provide values to any of the below to override the defaults. To use a pull request use a branch name like `pr/N` where `N` is the pull request number. Alternatively, `SV_BRANCH` may also be a link to an OISF/suricata-verify pull-request. https://github.com/OISF/suricata-verify/pull/1597 ``` SV_BRANCH=pr/1597 ```

Currently Suricata will decode such packets just fine, but won’t match up both sides of the traffic in a flow due to the tunnel imbalance.

vseregin · September 11, 2024, 7:47am

Victor, thnx for your response!
May be i can use eBPF filter (with or without XDP) to find and change tunneled packets (strip upper ip header) before suricata will look to them? Is this the correct approach, will it work?

You also say - suricata will decode such packets just fine. Can you please point which decoder from ~/suricata/src/ is applicable for ipip tunnel and how can i enable packet decapsulation in suricata to see events in log with internal ip header?

Topic		Replies	Views
Applayer Detect protocol only one direction Help	5	5226	November 8, 2023
Unexpected TCP session tracking Help suricata	18	119	September 2, 2024
Suricata http traffic parse exception in mirror traffic Help	5	908	January 25, 2022
Query on IPS Mode Help	1	419	September 19, 2022
Using Suricata in ips mode with AF_XDP Help ips , suricata , xdp	5	46	November 12, 2024

Suricata on ipip tunneled packets

Related topics