webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-09 18:45:54 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'master' into next

Browse Source 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
This commit is contained in:
Arne Fitzenreiter
2019-04-26 19:39:55 +02:00
parent 2cecfd0fdb 9cf253e150
commit 20c7552e0d
5 changed files with 60 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
config/rootfiles/oldcore/131/filelists/files
View File

@@ -19,6 +19,7 @@ srv/web/ipfire/cgi-bin/logs.cgi/ids.dat
srv/web/ipfire/cgi-bin/logs.cgi/log.dat
srv/web/ipfire/cgi-bin/ovpnmain.cgi
srv/web/ipfire/cgi-bin/remote.cgi
srv/web/ipfire/cgi-bin/services.cgi
srv/web/ipfire/cgi-bin/vpnmain.cgi
usr/local/bin/ipsec-interfaces
usr/local/bin/sshctrl

2
html/cgi-bin/wlanap.cgi
View File

@@ -388,8 +388,6 @@ print <<END
<!--SSID Broadcast: on => HIDESSID: off -->
<tr><td width='25%' class='base'>$Lang::tr{'wlanap broadcast ssid'}:&nbsp;</td><td class='base' colspan='3'>$Lang::tr{'on'} <input type='radio' name='HIDESSID' value='off' $checked{'HIDESSID'}{'off'} /> | <input type='radio' name='HIDESSID' value='on' $checked{'HIDESSID'}{'on'} /> $Lang::tr{'off'}</td></tr>
<tr><td width='25%' class='base'>$Lang::tr{'wlanap client isolation'}:&nbsp;</td><td class='base' colspan='3'>$Lang::tr{'on'} <input type='radio' name='CLIENTISOLATION' value='on' $checked{'CLIENTISOLATION'}{'on'} /> | <input type='radio' name='CLIENTISOLATION' value='off' $checked{'CLIENTISOLATION'}{'off'} /> $Lang::tr{'off'}</td></tr>
<tr><td width='25%' class='base'>$Lang::tr{'wlanap country'}:&nbsp;</td><td class='base' colspan='3'>
<select name='COUNTRY'>
END

2
lfs/hostapd
View File

@@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE)
DIR_APP = $(DIR_SRC)/$(THISAPP)
TARGET = $(DIR_INFO)/$(THISAPP)
PROG = hostapd
PAK_VER = 48
PAK_VER = 47
DEPS = ""

10
src/initscripts/system/firewall
View File

@@ -186,10 +186,12 @@ iptables_init() {
iptables -A FORWARD -j GUARDIAN
# IPS (suricata) chains
iptables -N IPS
iptables -A INPUT -j IPS
iptables -A FORWARD -j IPS
iptables -A OUTPUT -j IPS
iptables -N IPS_INPUT
iptables -N IPS_FORWARD
iptables -N IPS_OUTPUT
iptables -A INPUT -j IPS_INPUT
iptables -A FORWARD -j IPS_FORWARD
iptables -A OUTPUT -j IPS_OUTPUT
# Block non-established IPsec networks
iptables -N IPSECBLOCK

82
src/initscripts/system/suricata
View File

@@ -6,7 +6,7 @@
#
# Author : Stefan Schantl <stefan.schantl@ipfire.org>
#
# Version : 01.00
# Version : 01.01
#
# Notes :
#
@@ -20,8 +20,10 @@ PATH=/usr/local/sbin:/usr/local/bin:/bin:/usr/bin:/sbin:/usr/sbin; export PATH
eval $(/usr/local/bin/readhash /var/ipfire/suricata/settings)
eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
# Name of the firewall chain.
FW_CHAIN="IPS"
# Name of the firewall chains.
IPS_INPUT_CHAIN="IPS_INPUT"
IPS_FORWARD_CHAIN="IPS_FORWARD"
IPS_OUTPUT_CHAIN="IPS_OUTPUT"
# Optional options for the Netfilter queue.
NFQ_OPTS="--queue-bypass "
@@ -29,6 +31,9 @@ NFQ_OPTS="--queue-bypass "
# Array containing the 4 possible network zones.
network_zones=( red green blue orange )
# Array to store the network zones weather the IPS is enabled for.
enabled_ips_zones=()
# Mark and Mask options.
MARK="0x70000000"
MASK="0x70000000"
@@ -48,13 +53,18 @@ function get_cpu_count {
echo $CPUCOUNT
}
# Function to flush the firewall chains.
function flush_fw_chain {
# Call iptables and flush the chains
iptables -F "$IPS_INPUT_CHAIN"
iptables -F "$IPS_FORWARD_CHAIN"
iptables -F "$IPS_OUTPUT_CHAIN"
}
# Function to create the firewall rules to pass the traffic to suricata.
function generate_fw_rules {
cpu_count=$(get_cpu_count)
# Flush the firewall chain.
iptables -F "$FW_CHAIN"
# Loop through the array of network zones.
for zone in "${network_zones[@]}"; do
# Convert zone into upper case.
@@ -79,34 +89,46 @@ function generate_fw_rules {
network_device=${!zone_name}
fi
# Assign NFQ_OPTS
NFQ_OPTIONS=$NFQ_OPTS
# Check if there are multiple cpu cores available.
if [ "$cpu_count" -gt "1" ]; then
# Balance beetween all queues.
NFQ_OPTIONS+="--queue-balance 0:$(($cpu_count-1))"
NFQ_OPTIONS+=" --queue-cpu-fanout"
else
# Send all packets to queue 0.
NFQ_OPTIONS+="--queue-num 0"
fi
# Create firewall rules to queue the traffic and pass to
# the IDS.
iptables -I "$FW_CHAIN" -i "$network_device" -m mark ! --mark "$MARK"/"$MASK" -j NFQUEUE $NFQ_OPTIONS
iptables -I "$FW_CHAIN" -o "$network_device" -m mark ! --mark "$MARK"/"$MASK" -j NFQUEUE $NFQ_OPTIONS
# Add the network device to the array of enabled zones.
enabled_ips_zones+=( "$network_device" )
fi
done
# Clear repeat bit, so that it does not confuse IPsec or QoS
iptables -A "${FW_CHAIN}" -j MARK --set-xmark "0x0/${MASK}"
}
# Assign NFQ_OPTS
NFQ_OPTIONS=$NFQ_OPTS
# Function to flush the firewall chain.
function flush_fw_chain {
# Call iptables and flush the chain
iptables -F "$FW_CHAIN"
# Check if there are multiple cpu cores available.
if [ "$cpu_count" -gt "1" ]; then
# Balance beetween all queues.
NFQ_OPTIONS+="--queue-balance 0:$(($cpu_count-1))"
NFQ_OPTIONS+=" --queue-cpu-fanout"
else
# Send all packets to queue 0.
NFQ_OPTIONS+="--queue-num 0"
fi
# Flush the firewall chains.
flush_fw_chain
# Check if the array of enabled_ips_zones contains any elements.
if [[ ${enabled_ips_zones[@]} ]]; then
# Loop through the array and create firewall rules.
for enabled_ips_zone in "${enabled_ips_zones[@]}"; do
# Create rules queue input and output related traffic and pass it to the IPS.
iptables -I "$IPS_INPUT_CHAIN" -i "$enabled_ips_zone" -m mark ! --mark "$MARK"/"$MASK" -j NFQUEUE $NFQ_OPTIONS
iptables -I "$IPS_OUTPUT_CHAIN" -o "$enabled_ips_zone" -m mark ! --mark "$MARK"/"$MASK" -j NFQUEUE $NFQ_OPTIONS
# Create rules which are required to handle forwarded traffic.
for enabled_ips_zone_forward in "${enabled_ips_zones[@]}"; do
iptables -I "$IPS_FORWARD_CHAIN" -i "$enabled_ips_zone" -o "$enabled_ips_zone_forward" -m mark ! --mark "$MARK"/"$MASK" -j NFQUEUE $NFQ_OPTIONS
done
done
# Clear repeat bit, so that it does not confuse IPsec or QoS
iptables -A "${IPS_INPUT_CHAIN}" -j MARK --set-xmark "0x0/${MASK}"
iptables -A "${IPS_FORWARD_CHAIN}" -j MARK --set-xmark "0x0/${MASK}"
iptables -A "${IPS_OUTPUT_CHAIN}" -j MARK --set-xmark "0x0/${MASK}"
fi
}
case "$1" in