webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-09 18:45:54 +02:00
Code Issues Packages Projects Releases Wiki Activity

suricata: Add support for zones having multiple interfaces

Browse Source 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
This commit is contained in:
Michael Tremer
2024-09-22 17:08:03 +02:00
parent 09831e9ca9
commit db151ad716
2 changed files with 7 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/initscripts/networking/functions.network
View File

@@ -54,7 +54,7 @@ bin2ip() {
echo "${address[*]}"
}
network_get_intf() {
network_get_intfs() {
local zone="${1}"
case "${zone}" in

17
src/initscripts/system/suricata
View File

@@ -109,17 +109,12 @@ generate_fw_rules() {
status="ENABLE_IDS_${zone}"
if [ "${!status}" = "on" ]; then
intf="$(network_get_intf "${zone}")"
# Skip if we could not determine an interface
if [ -z "${intf}" ]; then
continue
fi
iptables -w -t mangle -A IPS_SCAN_IN \
-i "${intf}" -j MARK --set-mark "$(( IPS_SCAN_MARK ))/$(( IPS_SCAN_MASK ))"
iptables -w -t mangle -A IPS_SCAN_OUT \
-o "${intf}" -j MARK --set-mark "$(( IPS_SCAN_MARK ))/$(( IPS_SCAN_MASK ))"
for intf in $(network_get_intfs "${zone}"); do
iptables -w -t mangle -A IPS_SCAN_IN \
-i "${intf}" -j MARK --set-mark "$(( IPS_SCAN_MARK ))/$(( IPS_SCAN_MASK ))"
iptables -w -t mangle -A IPS_SCAN_OUT \
-o "${intf}" -j MARK --set-mark "$(( IPS_SCAN_MARK ))/$(( IPS_SCAN_MASK ))"
done
fi
done