From: Michael Tremer <michael.tremer@ipfire.org>
Date: Sun, 22 Sep 2024 15:08:03 +0000 (+0200)
Subject: suricata: Add support for zones having multiple interfaces
X-Git-Tag: v2.29-core189~20
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=db151ad716beefcb9ab9fadd2bb3ac9934748793;p=ipfire-2.x.git

suricata: Add support for zones having multiple interfaces

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
---

diff --git a/src/initscripts/networking/functions.network b/src/initscripts/networking/functions.network
index 02ac6b8fe6..aff2f5675b 100644
--- a/src/initscripts/networking/functions.network
+++ b/src/initscripts/networking/functions.network
@@ -54,7 +54,7 @@ bin2ip() {
 	echo "${address[*]}"
 }
 
-network_get_intf() {
+network_get_intfs() {
 	local zone="${1}"
 
 	case "${zone}" in
diff --git a/src/initscripts/system/suricata b/src/initscripts/system/suricata
index e366375bab..139f9ed1a7 100644
--- a/src/initscripts/system/suricata
+++ b/src/initscripts/system/suricata
@@ -109,17 +109,12 @@ generate_fw_rules() {
 		status="ENABLE_IDS_${zone}"
 
 		if [ "${!status}" = "on" ]; then
-			intf="$(network_get_intf "${zone}")"
-
-			# Skip if we could not determine an interface
-			if [ -z "${intf}" ]; then
-				continue
-			fi
-
-			iptables -w -t mangle -A IPS_SCAN_IN \
-				-i "${intf}" -j MARK --set-mark "$(( IPS_SCAN_MARK ))/$(( IPS_SCAN_MASK ))"
-			iptables -w -t mangle -A IPS_SCAN_OUT \
-				-o "${intf}" -j MARK --set-mark "$(( IPS_SCAN_MARK ))/$(( IPS_SCAN_MASK ))"
+			for intf in $(network_get_intfs "${zone}"); do
+				iptables -w -t mangle -A IPS_SCAN_IN \
+					-i "${intf}" -j MARK --set-mark "$(( IPS_SCAN_MARK ))/$(( IPS_SCAN_MASK ))"
+				iptables -w -t mangle -A IPS_SCAN_OUT \
+					-o "${intf}" -j MARK --set-mark "$(( IPS_SCAN_MARK ))/$(( IPS_SCAN_MASK ))"
+			done
 		fi
 	done