From mboxrd@z Thu Jan  1 00:00:00 1970
From: Stefan Schantl <stefan.schantl@ipfire.org>
To: development@lists.ipfire.org
Subject: [PATCH 3/3] initscripts/suricata: Rework creation of firewall rules.
Date: Thu, 25 Apr 2019 19:31:48 +0200
Message-ID: <20190425173148.3868-3-stefan.schantl@ipfire.org>
In-Reply-To: <20190425173148.3868-1-stefan.schantl@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============2190410726194617496=="
List-Id: <development.lists.ipfire.org>

--===============2190410726194617496==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

The script now will use the previously introduced seperate firewall chains ca=
lled
IPS_INPUT, IPS_FORWARD and IPS_OUTPUT.

The commit also creates an AND connection between the choosen network zones i=
n the UI and
the final firwall rules.

Fixes #12062.

Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
---
 src/initscripts/system/suricata | 78 +++++++++++++++++++++------------
 1 file changed, 50 insertions(+), 28 deletions(-)

diff --git a/src/initscripts/system/suricata b/src/initscripts/system/suricata
index 233cded53..c9f131fca 100644
--- a/src/initscripts/system/suricata
+++ b/src/initscripts/system/suricata
@@ -6,7 +6,7 @@
 #
 # Author      : Stefan Schantl <stefan.schantl(a)ipfire.org>
 #
-# Version     : 01.00
+# Version     : 01.01
 #
 # Notes       :
 #
@@ -20,8 +20,10 @@ PATH=3D/usr/local/sbin:/usr/local/bin:/bin:/usr/bin:/sbin:=
/usr/sbin; export PATH
 eval $(/usr/local/bin/readhash /var/ipfire/suricata/settings)
 eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
=20
-# Name of the firewall chain.
-FW_CHAIN=3D"IPS"
+# Name of the firewall chains.
+IPS_INPUT_CHAIN=3D"IPS_INPUT"
+IPS_FORWARD_CHAIN=3D"IPS_FORWARD"
+IPS_OUTPUT_CHAIN=3D"IPS_OUTPUT"
=20
 # Optional options for the Netfilter queue.
 NFQ_OPTS=3D"--queue-bypass "
@@ -29,6 +31,9 @@ NFQ_OPTS=3D"--queue-bypass "
 # Array containing the 4 possible network zones.
 network_zones=3D( red green blue orange )
=20
+# Array to store the network zones weather the IPS is enabled for.
+enabled_ips_zones=3D()
+
 # Mark and Mask options.
 MARK=3D"0x70000000"
 MASK=3D"0x70000000"
@@ -48,19 +53,18 @@ function get_cpu_count {
 	echo $CPUCOUNT
 }
=20
-# Function to flush the firewall chain.
+# Function to flush the firewall chains.
 function flush_fw_chain {
-	# Call iptables and flush the chain
-	iptables -F "$FW_CHAIN"
+	# Call iptables and flush the chains
+	iptables -F "$IPS_INPUT_CHAIN"
+	iptables -F "$IPS_FORWARD_CHAIN"
+	iptables -F "$IPS_OUTPUT_CHAIN"
 }
=20
 # Function to create the firewall rules to pass the traffic to suricata.
 function generate_fw_rules {
 	cpu_count=3D$(get_cpu_count)
=20
-	# Flush the firewall chain.
-	flush_fw_chain
-
 	# Loop through the array of network zones.
 	for zone in "${network_zones[@]}"; do
 		# Convert zone into upper case.
@@ -85,28 +89,46 @@ function generate_fw_rules {
 				network_device=3D${!zone_name}
 			fi
=20
-			# Assign NFQ_OPTS
-			NFQ_OPTIONS=3D$NFQ_OPTS
-
-			# Check if there are multiple cpu cores available.
-			if [ "$cpu_count" -gt "1" ]; then
-				# Balance beetween all queues.
-				NFQ_OPTIONS+=3D"--queue-balance 0:$(($cpu_count-1))"
-				NFQ_OPTIONS+=3D" --queue-cpu-fanout"
-			else
-				# Send all packets to queue 0.
-				NFQ_OPTIONS+=3D"--queue-num 0"
-			fi
-
-			# Create firewall rules to queue the traffic and pass to
-			# the IDS.
-			iptables -I "$FW_CHAIN" -i "$network_device" -m mark ! --mark "$MARK"/"$M=
ASK" -j NFQUEUE $NFQ_OPTIONS
-			iptables -I "$FW_CHAIN" -o "$network_device" -m mark ! --mark "$MARK"/"$M=
ASK" -j NFQUEUE $NFQ_OPTIONS
+			# Add the network device to the array of enabled zones.
+			enabled_ips_zones+=3D( "$network_device" )
 		fi
 	done
=20
-	# Clear repeat bit, so that it does not confuse IPsec or QoS
-	iptables -A "${FW_CHAIN}" -j MARK --set-xmark "0x0/${MASK}"
+	# Assign NFQ_OPTS
+	NFQ_OPTIONS=3D$NFQ_OPTS
+
+	# Check if there are multiple cpu cores available.
+	if [ "$cpu_count" -gt "1" ]; then
+		# Balance beetween all queues.
+		NFQ_OPTIONS+=3D"--queue-balance 0:$(($cpu_count-1))"
+		NFQ_OPTIONS+=3D" --queue-cpu-fanout"
+	else
+		# Send all packets to queue 0.
+		NFQ_OPTIONS+=3D"--queue-num 0"
+	fi
+
+	# Flush the firewall chains.
+	flush_fw_chain
+
+	# Check if the array of enabled_ips_zones contains any elements.
+	if [[ ${enabled_ips_zones[@]} ]]; then
+		# Loop through the array and create firewall rules.
+		for enabled_ips_zone in "${enabled_ips_zones[@]}"; do
+			# Create rules queue input and output related traffic and pass it to the =
IPS.
+			iptables -I "$IPS_INPUT_CHAIN" -i "$enabled_ips_zone" -m mark ! --mark "$=
MARK"/"$MASK" -j NFQUEUE $NFQ_OPTIONS
+			iptables -I "$IPS_OUTPUT_CHAIN" -o "$enabled_ips_zone" -m mark ! --mark "=
$MARK"/"$MASK" -j NFQUEUE $NFQ_OPTIONS
+
+			# Create rules which are required to handle forwarded traffic.
+			for enabled_ips_zone_forward in "${enabled_ips_zones[@]}"; do
+				iptables -I "$IPS_FORWARD_CHAIN" -i "$enabled_ips_zone" -o "$enabled_ips=
_zone_forward" -m mark ! --mark "$MARK"/"$MASK" -j NFQUEUE $NFQ_OPTIONS
+			done
+		done
+
+		# Clear repeat bit, so that it does not confuse IPsec or QoS
+		iptables -A "${IPS_INPUT_CHAIN}" -j MARK --set-xmark "0x0/${MASK}"
+		iptables -A "${IPS_FORWARD_CHAIN}" -j MARK --set-xmark "0x0/${MASK}"
+		iptables -A "${IPS_OUTPUT_CHAIN}" -j MARK --set-xmark "0x0/${MASK}"
+	fi
 }
=20
 case "$1" in
--=20
2.20.1


--===============2190410726194617496==--