Question : How to apply SSLProxy to Suricata inline IDPS?

[samiux]

I am setting up a Suricata inline IDPS with AF-PACKET. It is a 3 network interfaces device, two of the interfaces are without IP address and the other one is for management purpose. The two network interfaces are for capturing traffic from/to internet to/from internet via the Suricata.

My question is how to apply SSLProxy to the Suricata when Suricata does not have any IP address or port? Any suggestion? Thank you.

[sonertari]

The UTMFW project uses Snort as IPS, but SSLproxy requires modification in Snort sources, more specifically I have developed a Snort preprocessor for SSLproxy. See: https://github.com/sonertari/UTMFW/blob/master/ports/distfiles/snort-2.9.20_sslproxy.diff

But there is no such modification for Suricata yet. See: #8

Note that UTMFW uses divert sockets (not network sockets) to divert packets to Snort.