diff mbox series

[PATCHv2] suricata: Do not create silly forward rules.

Message ID 20220406192332.4865-1-stefan.schantl@ipfire.org
State Dropped
Headers
Series [PATCHv2] suricata: Do not create silly forward rules. |

Commit Message

Stefan Schantl April 6, 2022, 7:23 p.m. UTC 
  Skip creating forward rules if the input and the output device are the
same.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
---
 src/initscripts/system/suricata | 5 +++++
 1 file changed, 5 insertions(+)

Comments

Michael Tremer April 7, 2022, 8:55 a.m. UTC | #1 
Why do you think these rules are not needed?

> On 6 Apr 2022, at 20:23, Stefan Schantl <stefan.schantl@ipfire.org> wrote:
> 
> Skip creating forward rules if the input and the output device are the
> same.
> 
> Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
> ---
> src/initscripts/system/suricata | 5 +++++
> 1 file changed, 5 insertions(+)
> 
> diff --git a/src/initscripts/system/suricata b/src/initscripts/system/suricata
> index 5ede405ce..79c105c23 100644
> --- a/src/initscripts/system/suricata
> +++ b/src/initscripts/system/suricata
> @@ -171,6 +171,11 @@ function generate_fw_rules {
> 
> 			# Create rules which are required to handle forwarded traffic.
> 			for enabled_ips_zone_forward in "${enabled_ips_zones[@]}"; do
> +				# Skip loop iteration if both zones are the same.
> +				if [ "$enabled_ips_zone" == "$enabled_ips_zone_forward" ]; then
> +					continue
> +				fi
> +				
> 				# Check if the whetelist file is not empty.
> 				if [ -s "$WHITELIST_FILE" ]; then
> 					# Create rules to handle whitelisted hosts.
> -- 
> 2.30.2
>
Stefan Schantl May 6, 2022, 4:30 p.m. UTC | #2 
For the records,

I had a short talk with Michael on the phone about that topic.

My intension of the patch was, if there are no packets which have the
same input and output device, these rules are not needed.

He answered that there are some reasons, why this could happened. In
case you are using DNAT, SNAT or some kind of asynchronous routing etc.

So the iptables rules are required to pass such traffic to the IDS/IPS
and the patch can be ignored.

Best regards,

-Stefan  
> Why do you think these rules are not needed?
> 
> > On 6 Apr 2022, at 20:23, Stefan Schantl <stefan.schantl@ipfire.org>
> > wrote:
> > 
> > Skip creating forward rules if the input and the output device are
> > the
> > same.
> > 
> > Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
> > ---
> > src/initscripts/system/suricata | 5 +++++
> > 1 file changed, 5 insertions(+)
> > 
> > diff --git a/src/initscripts/system/suricata
> > b/src/initscripts/system/suricata
> > index 5ede405ce..79c105c23 100644
> > --- a/src/initscripts/system/suricata
> > +++ b/src/initscripts/system/suricata
> > @@ -171,6 +171,11 @@ function generate_fw_rules {
> > 
> >                         # Create rules which are required to handle
> > forwarded traffic.
> >                         for enabled_ips_zone_forward in
> > "${enabled_ips_zones[@]}"; do
> > +                               # Skip loop iteration if both zones
> > are the same.
> > +                               if [ "$enabled_ips_zone" ==
> > "$enabled_ips_zone_forward" ]; then
> > +                                       continue
> > +                               fi
> > +                               
> >                                 # Check if the whetelist file is
> > not empty.
> >                                 if [ -s "$WHITELIST_FILE" ]; then
> >                                         # Create rules to handle
> > whitelisted hosts.
> > -- 
> > 2.30.2
> > 
>
diff mbox series

Patch

diff --git a/src/initscripts/system/suricata b/src/initscripts/system/suricata
index 5ede405ce..79c105c23 100644
--- a/src/initscripts/system/suricata
+++ b/src/initscripts/system/suricata
@@ -171,6 +171,11 @@  function generate_fw_rules {
 
 			# Create rules which are required to handle forwarded traffic.
 			for enabled_ips_zone_forward in "${enabled_ips_zones[@]}"; do
+				# Skip loop iteration if both zones are the same.
+				if [ "$enabled_ips_zone" == "$enabled_ips_zone_forward" ]; then
+					continue
+				fi
+				
 				# Check if the whetelist file is not empty.
 				if [ -s "$WHITELIST_FILE" ]; then
 					# Create rules to handle whitelisted hosts.