[PATCH] suricata: Do not create silly forward rules.

[PATCH] suricata: Do not create silly forward rules.

[Stefan Schantl]

[-- Attachment #1: Type: text/plain, Size: 897 bytes --]

Skip creating forward rules if the input and the output device are the
same.

Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
---
 src/initscripts/system/suricata | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/initscripts/system/suricata b/src/initscripts/system/suricata
index 5ede405ce..a40e02c83 100644
--- a/src/initscripts/system/suricata
+++ b/src/initscripts/system/suricata
@@ -171,6 +171,11 @@ function generate_fw_rules {
 
 			# Create rules which are required to handle forwarded traffic.
 			for enabled_ips_zone_forward in "${enabled_ips_zones[@]}"; do
+				# Skip loop iteration if both zones are the same.
+				if [ "$enabled_ips_zone" -eq "$enabled_ips_zone_forward" ]; then
+					continue
+				fi
+				
 				# Check if the whetelist file is not empty.
 				if [ -s "$WHITELIST_FILE" ]; then
 					# Create rules to handle whitelisted hosts.
-- 
2.30.2

Re: [PATCH] suricata: Do not create silly forward rules.

[Stefan Schantl]

[-- Attachment #1: Type: text/plain, Size: 1653 bytes --]

Woops, brocken patch - I'll send a fixed one.

Sorry for the noise.

-Stefan
> Skip creating forward rules if the input and the output device are
> the
> same.
> 
> Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
> ---
>  src/initscripts/system/suricata | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/src/initscripts/system/suricata
> b/src/initscripts/system/suricata
> index 5ede405ce..a40e02c83 100644
> --- a/src/initscripts/system/suricata
> +++ b/src/initscripts/system/suricata
> @@ -171,6 +171,11 @@ function generate_fw_rules {
>  
>                         # Create rules which are required to handle
> forwarded traffic.
>                         for enabled_ips_zone_forward in
> "${enabled_ips_zones[@]}"; do
> +                               # Skip loop iteration if both zones
> are the same.
> +                               if [ "$enabled_ips_zone" -eq
> "$enabled_ips_zone_forward" ]; then
> +                                       continue
> +                               fi
> +                               
>                                 # Check if the whetelist file is not
> empty.
>                                 if [ -s "$WHITELIST_FILE" ]; then
>                                         # Create rules to handle
> whitelisted hosts.