[PATCH] suricata: Explicitly ignore IPsec traffic unless enabled

[PATCH] suricata: Explicitly ignore IPsec traffic unless enabled

[Michael Tremer]

[-- Attachment #1: Type: text/plain, Size: 1106 bytes --]

Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
---
 src/initscripts/system/suricata | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/src/initscripts/system/suricata b/src/initscripts/system/suricata
index a753e32e6..a0f607971 100644
--- a/src/initscripts/system/suricata
+++ b/src/initscripts/system/suricata
@@ -111,6 +111,18 @@ generate_fw_rules() {
 		if [ "${!status}" = "on" ]; then
 			# Handle IPsec packets
 			case "${zone}" in
+				RED)
+					# If IPsec is not enabled, skip everything that is IPsec traffic
+					if [ "${ENABLE_IDS_IPSEC}" != "on" ]; then
+						for intf in $(network_get_intfs "${zone}"); do
+							iptables -w -t mangle -A IPS_SCAN_IN \
+								-i "${intf}" -m policy --pol ipsec --dir in -j RETURN
+							iptables -w -t mangle -A IPS_SCAN_OUT \
+								-o "${intf}" -m policy --pol ipsec --dir out -j RETURN
+						done
+					fi
+					;;
+
 				IPSEC)
 					iptables -w -t mangle -A IPS_SCAN_IN \
 						-m policy --pol ipsec --dir in -j MARK --set-mark "$(( IPS_SCAN_MARK ))/$(( IPS_SCAN_MASK ))"
-- 
2.39.5