From mboxrd@z Thu Jan  1 00:00:00 1970
From: Michael Tremer <michael.tremer@ipfire.org>
To: development@lists.ipfire.org
Subject: [PATCH 10/20] suricata: Restore the interface selection
Date: Tue, 10 Sep 2024 14:37:23 +0000
Message-ID: <20240910143748.3469271-11-michael.tremer@ipfire.org>
In-Reply-To: <20240910143748.3469271-1-michael.tremer@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============8375360239294951308=="
List-Id: <development.lists.ipfire.org>

--===============8375360239294951308==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
---
 src/initscripts/networking/functions.network | 48 ++++++++++++++++++++
 src/initscripts/system/suricata              | 32 +++++++++++++
 2 files changed, 80 insertions(+)

diff --git a/src/initscripts/networking/functions.network b/src/initscripts/n=
etworking/functions.network
index e134d0cce..c189c2fbc 100644
--- a/src/initscripts/networking/functions.network
+++ b/src/initscripts/networking/functions.network
@@ -54,6 +54,54 @@ bin2ip() {
 	echo "${address[*]}"
 }
=20
+network_get_intf() {
+	local zone=3D"${1}"
+
+	case "${zone}" in
+		RED)
+			# For PPPoE, the RED interface is called ppp0 (unless we use QMI)
+			if [ "${RED_TYPE}" =3D "PPPOE" ] && [ "${RED_DRIVER}" !=3D "qmi_wwan" ]; =
then
+				echo "ppp0"
+				return 0
+
+			# Otherwise we return RED_DEV
+			elif [ -n "${RED_DEV}" ]; then
+				echo "${RED_DEV}"
+				return 0
+			fi
+			;;
+
+		GREEN)
+			if [ -n "${GREEN_DEV}" ]; then
+				echo "${GREEN_DEV}"
+				return 0
+			fi
+			;;
+
+		ORANGE)
+			if [ -n "${ORANGE_DEV}" ]; then
+				echo "${ORANGE_DEV}"
+				return 0
+			fi
+			;;
+
+		BLUE)
+			if [ -n "${BLUE_DEV}" ]; then
+				echo "${BLUE_DEV}"
+				return 0
+			fi
+			;;
+
+		OPENVPN|OVPN)
+			# OpenVPN is using all tun devices
+			echo "tun+"
+			;;
+	esac
+
+	# Not found
+	return 1
+}
+
 network_get_address() {
 	local network=3D"${1}"
=20
diff --git a/src/initscripts/system/suricata b/src/initscripts/system/suricata
index 455715d1b..8a1740528 100644
--- a/src/initscripts/system/suricata
+++ b/src/initscripts/system/suricata
@@ -21,6 +21,7 @@
=20
 . /etc/sysconfig/rc
 . ${rc_functions}
+. /etc/init.d/networking/functions.network
=20
 PATH=3D/usr/local/sbin:/usr/local/bin:/bin:/usr/bin:/sbin:/usr/sbin; export =
PATH
=20
@@ -38,6 +39,13 @@ IPS_BYPASS_REQUESTED_MASK=3D"0x40000000"
 IPS_BYPASS_MARK=3D"0x20000000"
 IPS_BYPASS_MASK=3D"0x20000000"
=20
+# Set if we request to scan this packet
+IPS_SCAN_MARK=3D"0x10000000"
+IPS_SCAN_MASK=3D"0x10000000"
+
+# Supported network zones
+NETWORK_ZONES=3D( "RED" "GREEN" "ORANGE" "BLUE" "OVPN" )
+
 # Optional options for the Netfilter queue.
 NFQ_OPTS=3D(
 	"--queue-bypass"
@@ -83,6 +91,30 @@ generate_fw_rules() {
 	# Don't process packets that have already been seen by the IPS
 	iptables -w -t mangle -A IPS -m mark --mark "$(( IPS_REPEAT_MARK ))/$(( IPS=
_REPEAT_MASK ))" -j RETURN
=20
+	local zone
+	local status
+	local intf
+
+	# Mark packets for all zones that we want to scan
+	for zone in "${NETWORK_ZONES[@]}"; do
+		status=3D"ENABLE_IDS_${zone}"
+
+		if [ "${!status}" =3D "on" ]; then
+			intf=3D"$(network_get_intf "${zone}")"
+
+			# Skip if we could not determine an interface
+			if [ -z "${intf}" ]; then
+				continue
+			fi
+
+			iptables -w -t mangle -A IPS -i "${intf}" -j MARK --set-mark "$(( IPS_SCA=
N_MARK ))/$(( IPS_SCAN_MASK ))"
+			iptables -w -t mangle -A IPS -o "${intf}" -j MARK --set-mark "$(( IPS_SCA=
N_MARK ))/$(( IPS_SCAN_MASK ))"
+		fi
+	done
+
+	# Don't keep processing packets we don't want to scan
+	iptables -w -t mangle -A IPS -m mark ! --mark "$(( IPS_SCAN_MARK ))/$(( IPS=
_SCAN_MASK ))" -j RETURN
+
 	# Never send any whitelisted packets to the IPS
 	if [ -r "/var/ipfire/suricata/ignored" ]; then
 		local id network remark enabled rest
--=20
2.39.2


--===============8375360239294951308==--