Suricata on ipip tunneled packets

vjulien · September 11, 2024, 4:57am

I believe this PR might try to address a similar case:

github.com/OISF/suricata

flow: optionally use pkt recursion for hash

OISF:master ← coledishington:flow-optional-recur-limit-6260-v5

opened 09:13PM - 21 Jan 24 UTC

coledishington

+43 -15

If a Suricata inline IPS device is routing traffic over a non-encrypted tunnel, …like IPv6 tunnels, packets in a flow will be dropped and not be matched. e.g. The following example is a Suricata inline IPS with an IPv6 tunnel: ``` request: IPv4]ICMP] -> |IPS| -> IPv6]IPv4]ICMP] reply: <- |IPS| <- IPv6]IPv4]ICMP] ``` Both the IPv4 request and IPv6 reply will be seen by Suricata on ingress. The flows will not be matched due to flow recursion level. Optionally use pkt recursion level in flow hash. Excluding recursion level in flow hash allows matching of packet flows and defrag on an inline IPS Suricata scenario where the IPS device is a tunnel terminator. Bug: #6260 Make sure these boxes are signed before submitting your Pull Request -- thank you. - [✓] I have read the contributing guide lines at https://docs.suricata.io/en/latest/devguide/codebase/contributing/contribution-process.html - [✓] I have signed the Open Information Security Foundation contribution agreement at https://suricata.io/about/contribution-agreement/ - [✓] I have updated the user guide (in doc/userguide/) to reflect the changes made (if applicable) Link to [redmine](https://redmine.openinfosecfoundation.org/projects/suricata/issues) ticket: https://redmine.openinfosecfoundation.org/issues/6260 Describe changes: Add config (decoder.recursion-level.use-for-tracking) to control the use of packet recursion level in flow matching. This is to support scenarios where Suricata inline IPS device is routing traffic over a non-encrypted tunnel, like IPv6 tunnels, packets in a flow will be dropped and not be matched. e.g. The following example is a Suricata inline IPS with an IPv6 tunnel: request: IPv4]ICMP] -> |IPS| -> IPv6]IPv4]ICMP] reply: <- |IPS| <- IPv6]IPv4]ICMP] Both the IPv4 request and IPv6 reply will be seen by Suricata on ingress. The flows will not be matched due to flow recursion level. ### Provide values to any of the below to override the defaults. To use a pull request use a branch name like `pr/N` where `N` is the pull request number. Alternatively, `SV_BRANCH` may also be a link to an OISF/suricata-verify pull-request. https://github.com/OISF/suricata-verify/pull/1597 ``` SV_BRANCH=pr/1597 ```

Currently Suricata will decode such packets just fine, but won’t match up both sides of the traffic in a flow due to the tunnel imbalance.

Topic		Replies	Views
Applayer Detect protocol only one direction Help	5	5224	November 8, 2023
Unexpected TCP session tracking Help suricata	18	119	September 2, 2024
Suricata http traffic parse exception in mirror traffic Help	5	907	January 25, 2022
Query on IPS Mode Help	1	419	September 19, 2022
Using Suricata in ips mode with AF_XDP Help ips , suricata , xdp	5	45	November 12, 2024

Suricata on ipip tunneled packets

Related topics