webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-28 03:33:25 +02:00
Code Issues Packages Projects Releases Wiki Activity

suricata: Add support for zones having multiple interfaces

Browse Source 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
This commit is contained in:
Michael Tremer
2024-09-22 17:08:03 +02:00
parent 09831e9ca9
commit db151ad716
2 changed files with 7 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/initscripts/networking/functions.network
View File

@@ -54,7 +54,7 @@ bin2ip() {
echo "${address[*]}" echo "${address[*]}"
} }
network_get_intf() { network_get_intfs() {
local zone="${1}" local zone="${1}"
case "${zone}" in case "${zone}" in

17
src/initscripts/system/suricata
View File

@@ -109,17 +109,12 @@ generate_fw_rules() {
status="ENABLE_IDS_${zone}" status="ENABLE_IDS_${zone}"
if [ "${!status}" = "on" ]; then if [ "${!status}" = "on" ]; then
intf="$(network_get_intf "${zone}")" for intf in $(network_get_intfs "${zone}"); do
iptables -w -t mangle -A IPS_SCAN_IN \
# Skip if we could not determine an interface -i "${intf}" -j MARK --set-mark "$(( IPS_SCAN_MARK ))/$(( IPS_SCAN_MASK ))"
if [ -z "${intf}" ]; then iptables -w -t mangle -A IPS_SCAN_OUT \
continue -o "${intf}" -j MARK --set-mark "$(( IPS_SCAN_MARK ))/$(( IPS_SCAN_MASK ))"
fi done
iptables -w -t mangle -A IPS_SCAN_IN \
-i "${intf}" -j MARK --set-mark "$(( IPS_SCAN_MARK ))/$(( IPS_SCAN_MASK ))"
iptables -w -t mangle -A IPS_SCAN_OUT \
-o "${intf}" -j MARK --set-mark "$(( IPS_SCAN_MARK ))/$(( IPS_SCAN_MASK ))"
fi fi
done done