From 93b31c59eaa2dbde1720fa85ee42c53b46db2cab Mon Sep 17 00:00:00 2001 From: bmeeks8 Date: Sat, 30 Aug 2014 12:22:42 -0400 Subject: Suricata prefers CIDR masks on HOME_NET and EXTERNAL_NET addresses. --- config/suricata/suricata_generate_yaml.php | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) (limited to 'config/suricata/suricata_generate_yaml.php') diff --git a/config/suricata/suricata_generate_yaml.php b/config/suricata/suricata_generate_yaml.php index 7c0a7bdd..0715471d 100644 --- a/config/suricata/suricata_generate_yaml.php +++ b/config/suricata/suricata_generate_yaml.php @@ -68,11 +68,17 @@ foreach ($suricata_files as $file) { $home_net_list = suricata_build_list($suricatacfg, $suricatacfg['homelistname']); $home_net = implode(",", $home_net_list); $home_net = trim($home_net); -$external_net = '!$HOME_NET'; +$external_net = ""; if (!empty($suricatacfg['externallistname']) && $suricatacfg['externallistname'] != 'default') { $external_net_list = suricata_build_list($suricatacfg, $suricatacfg['externallistname'], false, true); $external_net = implode(",", $external_net_list); - $external_net = '[' . trim($external_net) . ']'; + $external_net = "[" . trim($external_net) . "]"; +} +else { + $external_net = "["; + foreach ($home_net_list as $ip) + $external_net .= "!{$ip},"; + $external_net = trim($external_net, ', ') . "]"; } // Set the PASS LIST and write its contents to disk -- cgit v1.2.3