search

vipinpv85 / DPDK-Suricata_3.0

add dpdk interface and packet processing to suricata in worker mode
https://github.com/vipinpv85/DPDK-Suricata_3.0
GNU Lesser General Public License v3.0
62 stars 34 forks source link

feature to pre-parse and perform IP ACL via DPDK #19

Closed vipinpv85 closed 4 years ago

vipinpv85 commented 4 years ago

Orginal implementation counts how many rules are added successfully. If rules are present, enqueue packets for Suricata processing.

Implemented 3 Tuple ACL (src-ip, dst-ip, proto) for IPv4 and IPv6. Parse successful signatures for ACL key and updated DPDK ACL. For all incoming packets perform DPDK ACL to filter if the packets need to processed by Suricata or not.

Operation Mode | PKT type | action IDS | non IP | drop IDS | IPv4 and IPv6 | rule hit suricata process else drop IPS | non IP | fwd IPS | IPv4 and IPv6 | rule hit suricata process else fwd

Note: currently we are processing 1 pkt at a time to maintain order.