From: Arne Fitzenreiter <arne_f@ipfire.org>
Date: Fri, 26 Apr 2019 17:39:55 +0000 (+0200)
Subject: Merge branch 'master' into next
X-Git-Tag: v2.23-core133~174
X-Git-Url: http://git.ipfire.org/?p=ipfire-2.x.git;a=commitdiff_plain;h=20c7552e0d1453e90cd069a83c712ff29fb1cbc7;hp=2cecfd0fdb1ab4b0b7c1b9468a61c8d1d7d06961

Merge branch 'master' into next

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
---

diff --git a/config/rootfiles/oldcore/131/filelists/files b/config/rootfiles/oldcore/131/filelists/files
index 810c67b1e4..aa842b73c9 100644
--- a/config/rootfiles/oldcore/131/filelists/files
+++ b/config/rootfiles/oldcore/131/filelists/files
@@ -19,6 +19,7 @@ srv/web/ipfire/cgi-bin/logs.cgi/ids.dat
 srv/web/ipfire/cgi-bin/logs.cgi/log.dat
 srv/web/ipfire/cgi-bin/ovpnmain.cgi
 srv/web/ipfire/cgi-bin/remote.cgi
+srv/web/ipfire/cgi-bin/services.cgi
 srv/web/ipfire/cgi-bin/vpnmain.cgi
 usr/local/bin/ipsec-interfaces
 usr/local/bin/sshctrl
diff --git a/html/cgi-bin/wlanap.cgi b/html/cgi-bin/wlanap.cgi
index 06ce05bfb4..04b2a94911 100644
--- a/html/cgi-bin/wlanap.cgi
+++ b/html/cgi-bin/wlanap.cgi
@@ -388,8 +388,6 @@ print <<END
 <!--SSID Broadcast: on => HIDESSID: off -->
 <tr><td width='25%' class='base'>$Lang::tr{'wlanap broadcast ssid'}:&nbsp;</td><td class='base' colspan='3'>$Lang::tr{'on'} <input type='radio' name='HIDESSID' value='off' $checked{'HIDESSID'}{'off'} /> | <input type='radio' name='HIDESSID' value='on' $checked{'HIDESSID'}{'on'} /> $Lang::tr{'off'}</td></tr>
 <tr><td width='25%' class='base'>$Lang::tr{'wlanap client isolation'}:&nbsp;</td><td class='base' colspan='3'>$Lang::tr{'on'} <input type='radio' name='CLIENTISOLATION' value='on' $checked{'CLIENTISOLATION'}{'on'} /> | <input type='radio' name='CLIENTISOLATION' value='off' $checked{'CLIENTISOLATION'}{'off'} /> $Lang::tr{'off'}</td></tr>
-
-
 <tr><td width='25%' class='base'>$Lang::tr{'wlanap country'}:&nbsp;</td><td class='base' colspan='3'>
 	<select name='COUNTRY'>
 END
diff --git a/lfs/hostapd b/lfs/hostapd
index 14932cccb7..ce399df754 100644
--- a/lfs/hostapd
+++ b/lfs/hostapd
@@ -32,7 +32,7 @@ DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 PROG       = hostapd
-PAK_VER    = 48
+PAK_VER    = 47
 
 DEPS       = ""
 
diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall
index be6c9169f3..da89857d8b 100644
--- a/src/initscripts/system/firewall
+++ b/src/initscripts/system/firewall
@@ -186,10 +186,12 @@ iptables_init() {
 	iptables -A FORWARD -j GUARDIAN
 
 	# IPS (suricata) chains
-	iptables -N IPS
-	iptables -A INPUT -j IPS
-	iptables -A FORWARD -j IPS
-	iptables -A OUTPUT -j IPS
+	iptables -N IPS_INPUT
+	iptables -N IPS_FORWARD
+	iptables -N IPS_OUTPUT
+	iptables -A INPUT -j IPS_INPUT
+	iptables -A FORWARD -j IPS_FORWARD
+	iptables -A OUTPUT -j IPS_OUTPUT
 
 	# Block non-established IPsec networks
 	iptables -N IPSECBLOCK
diff --git a/src/initscripts/system/suricata b/src/initscripts/system/suricata
index ecd6930541..c9f131fcae 100644
--- a/src/initscripts/system/suricata
+++ b/src/initscripts/system/suricata
@@ -6,7 +6,7 @@
 #
 # Author      : Stefan Schantl <stefan.schantl@ipfire.org>
 #
-# Version     : 01.00
+# Version     : 01.01
 #
 # Notes       :
 #
@@ -20,8 +20,10 @@ PATH=/usr/local/sbin:/usr/local/bin:/bin:/usr/bin:/sbin:/usr/sbin; export PATH
 eval $(/usr/local/bin/readhash /var/ipfire/suricata/settings)
 eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
 
-# Name of the firewall chain.
-FW_CHAIN="IPS"
+# Name of the firewall chains.
+IPS_INPUT_CHAIN="IPS_INPUT"
+IPS_FORWARD_CHAIN="IPS_FORWARD"
+IPS_OUTPUT_CHAIN="IPS_OUTPUT"
 
 # Optional options for the Netfilter queue.
 NFQ_OPTS="--queue-bypass "
@@ -29,6 +31,9 @@ NFQ_OPTS="--queue-bypass "
 # Array containing the 4 possible network zones.
 network_zones=( red green blue orange )
 
+# Array to store the network zones weather the IPS is enabled for.
+enabled_ips_zones=()
+
 # Mark and Mask options.
 MARK="0x70000000"
 MASK="0x70000000"
@@ -48,13 +53,18 @@ function get_cpu_count {
 	echo $CPUCOUNT
 }
 
+# Function to flush the firewall chains.
+function flush_fw_chain {
+	# Call iptables and flush the chains
+	iptables -F "$IPS_INPUT_CHAIN"
+	iptables -F "$IPS_FORWARD_CHAIN"
+	iptables -F "$IPS_OUTPUT_CHAIN"
+}
+
 # Function to create the firewall rules to pass the traffic to suricata.
 function generate_fw_rules {
 	cpu_count=$(get_cpu_count)
 
-	# Flush the firewall chain.
-	iptables -F "$FW_CHAIN"
-
 	# Loop through the array of network zones.
 	for zone in "${network_zones[@]}"; do
 		# Convert zone into upper case.
@@ -79,34 +89,46 @@ function generate_fw_rules {
 				network_device=${!zone_name}
 			fi
 
-			# Assign NFQ_OPTS
-			NFQ_OPTIONS=$NFQ_OPTS
-
-			# Check if there are multiple cpu cores available.
-			if [ "$cpu_count" -gt "1" ]; then
-				# Balance beetween all queues.
-				NFQ_OPTIONS+="--queue-balance 0:$(($cpu_count-1))"
-				NFQ_OPTIONS+=" --queue-cpu-fanout"
-			else
-				# Send all packets to queue 0.
-				NFQ_OPTIONS+="--queue-num 0"
-			fi
-
-			# Create firewall rules to queue the traffic and pass to
-			# the IDS.
-			iptables -I "$FW_CHAIN" -i "$network_device" -m mark ! --mark "$MARK"/"$MASK" -j NFQUEUE $NFQ_OPTIONS
-			iptables -I "$FW_CHAIN" -o "$network_device" -m mark ! --mark "$MARK"/"$MASK" -j NFQUEUE $NFQ_OPTIONS
+			# Add the network device to the array of enabled zones.
+			enabled_ips_zones+=( "$network_device" )
 		fi
 	done
 
-	# Clear repeat bit, so that it does not confuse IPsec or QoS
-	iptables -A "${FW_CHAIN}" -j MARK --set-xmark "0x0/${MASK}"
-}
+	# Assign NFQ_OPTS
+	NFQ_OPTIONS=$NFQ_OPTS
+
+	# Check if there are multiple cpu cores available.
+	if [ "$cpu_count" -gt "1" ]; then
+		# Balance beetween all queues.
+		NFQ_OPTIONS+="--queue-balance 0:$(($cpu_count-1))"
+		NFQ_OPTIONS+=" --queue-cpu-fanout"
+	else
+		# Send all packets to queue 0.
+		NFQ_OPTIONS+="--queue-num 0"
+	fi
+
+	# Flush the firewall chains.
+	flush_fw_chain
+
+	# Check if the array of enabled_ips_zones contains any elements.
+	if [[ ${enabled_ips_zones[@]} ]]; then
+		# Loop through the array and create firewall rules.
+		for enabled_ips_zone in "${enabled_ips_zones[@]}"; do
+			# Create rules queue input and output related traffic and pass it to the IPS.
+			iptables -I "$IPS_INPUT_CHAIN" -i "$enabled_ips_zone" -m mark ! --mark "$MARK"/"$MASK" -j NFQUEUE $NFQ_OPTIONS
+			iptables -I "$IPS_OUTPUT_CHAIN" -o "$enabled_ips_zone" -m mark ! --mark "$MARK"/"$MASK" -j NFQUEUE $NFQ_OPTIONS
+
+			# Create rules which are required to handle forwarded traffic.
+			for enabled_ips_zone_forward in "${enabled_ips_zones[@]}"; do
+				iptables -I "$IPS_FORWARD_CHAIN" -i "$enabled_ips_zone" -o "$enabled_ips_zone_forward" -m mark ! --mark "$MARK"/"$MASK" -j NFQUEUE $NFQ_OPTIONS
+			done
+		done
 
-# Function to flush the firewall chain.
-function flush_fw_chain {
-	# Call iptables and flush the chain
-	iptables -F "$FW_CHAIN"
+		# Clear repeat bit, so that it does not confuse IPsec or QoS
+		iptables -A "${IPS_INPUT_CHAIN}" -j MARK --set-xmark "0x0/${MASK}"
+		iptables -A "${IPS_FORWARD_CHAIN}" -j MARK --set-xmark "0x0/${MASK}"
+		iptables -A "${IPS_OUTPUT_CHAIN}" -j MARK --set-xmark "0x0/${MASK}"
+	fi
 }
 
 case "$1" in