Xdp_filter - suricata

Help
,
1

Hi everyone,
I am working xdp_filter with suricata. I added rule about to drop icmp packets. This is af-packet section in suricata.yaml:
af-packet:

  • interface: wlp0s20f3
    #Number of receive threads. “auto” uses the number of cores
    #threads: auto
    #Default clusterid. AF_PACKET will load balance packets based on flow.
    cluster-id: 99
    cluster-type: cluster_cpu
    defrag: yes
    xdp-mode: soft
    xdp-filter-file: /home/ozgurkeskin/Projects/suricata/ebpf/xdp_filter.bpf
    xdp-cpu-redirect: [“all”]
    bypass: yes
    use-mmap: yes
    ring-size: 200000

When I started ping to 8.8.8.8 suricata can not drop icmp packets. Any help would be great!
Best regards,

2

Hi,
Any error during Suricata start? What does the filter bpf do actually?

3

Hi Peter,
I didn’t face any error message during Suricata start. I checked logs it seem fine.
xdp_filter aims “XDP bypass allows Suricata to tell the kernel that packets for some flows have to be dropped via the XDP mechanism. This is an early drop that occurs before the datagram reaches the Linux kernel network stack.”

4

What version are you running?
How does your suricata.yaml look like?
How do you start suricata?

5

Hi Andreas,
This is Suricata version 7.0.0-rc1-dev (4c7ca2c36 2022-12-22)
Run command
/usr/bin/suricata -c /home/ozgurkeskin/Projects/suricata/suricata.yaml --pidfile /var/run/suricata.pid --af-packet=wlp0s20f3 -vvv
And I attached suricata.yaml.
suricata.yaml (79.7 KB)

6

Did you update the xdp_filter.bpf file or did you use a shipped one?

7

I used shipped one but I have to update maps declaration.Here is the link about problem.

8

Hi Andreas, is there any update about my issue?

9

Yes see Libbpf 1.x with Suricata 6 doesn't support XDP - #6 by Loathe and also Bug #6088: xdp/ebpf: updated shipped bpf files to be supported by libbpf v1.0 and higher - Suricata - Open Information Security Foundation so it needs to be updated to make it work, which is not done yet

10

Hi Andreas

I did this refactor about legacy map definitions and then builded ebpf files again. Start suricata with no error. When I entered drop rule in suritaca.rules file in order to drop all icmp trafic it is not working.

11

Hello, it seems you are using Suricata as IPS. In this mode official docs tells you should use 2 interfaces like router or firewall, one for incoming traffic and one for outgoing. To make this work you should also set ipv[4 or 6].ip_forward to 1 in your system (sysctl -a | grep forward can help to find it). And then add symmetric parameters in your af-packet section for both interfaces:
af-packet:

1 Like