suricata: Track whitelisted traffic and add it to the IPS graph

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/config/cfgroot/graphs.pl b/config/cfgroot/graphs.pl
index ba7887840766a5bc9a8a02cfb9abf5323ae45706..cdfc1a18035ddb1051a5d176c0a903a9ca529888 100644 (file)
--- a/config/cfgroot/graphs.pl
+++ b/config/cfgroot/graphs.pl
@@ -1219,9 +1219,17 @@ sub updateipsthroughputgraph {
                "VDEF:scanned_bytes_min=scanned_bytes,MINIMUM",
                "VDEF:scanned_bytes_max=scanned_bytes,MAXIMUM",
 
+               # Read whitelisted packets
+               "DEF:whitelisted_bytes=$mainsettings{'RRDLOG'}/collectd/localhost/iptables-mangle-IPS/ipt_bytes-WHITELISTED.rrd:value:AVERAGE",
+               #"DEF:whitelisted_packets=$mainsettings{'RRDLOG'}/collectd/localhost/iptables-mangle-IPS/ipt_packets-WHITELISTED.rrd:value:AVERAGE",
+
+               "VDEF:whitelisted_bytes_avg=whitelisted_bytes,AVERAGE",
+               "VDEF:whitelisted_bytes_min=whitelisted_bytes,MINIMUM",
+               "VDEF:whitelisted_bytes_max=whitelisted_bytes,MAXIMUM",
+
                # Total
-               "CDEF:total_bytes=bypassed_bytes,scanned_bytes,+",
-               #"CDEF:total_packets=bypassed_packets,scanned_packets,+",
+               "CDEF:total_bytes=bypassed_bytes,scanned_bytes,ADDNAN,whitelisted_bytes,ADDNAN",
+               #"CDEF:total_packets=bypassed_packets,scanned_packets,ADDNAN,whitelisted_packets,ADDNAN",
 
                "VDEF:total_bytes_avg=total_bytes,AVERAGE",
                "VDEF:total_bytes_min=total_bytes,MINIMUM",
@@ -1236,8 +1244,14 @@ sub updateipsthroughputgraph {
                "COMMENT:" . sprintf("%16s", $Lang::tr{'minimum'}),
                "COMMENT:" . sprintf("%16s", $Lang::tr{'maximum'}) . "\\j",
 
+               # Whitelisted Packets
+               "AREA:whitelisted_bytes$color{'color12'}A0:" . sprintf("%-30s", $Lang::tr{'whitelisted'}),
+               "GPRINT:whitelisted_bytes_avg:%9.2lf %sbps",
+               "GPRINT:whitelisted_bytes_min:%9.2lf %sbps",
+               "GPRINT:whitelisted_bytes_max:%9.2lf %sbps\\j",
+
                # Bypassed Packets
-               "AREA:bypassed_bytes$color{'color12'}A0:" . sprintf("%-30s", $Lang::tr{'bypassed'}),
+               "STACK:bypassed_bytes$color{'color11'}A0:" . sprintf("%-30s", $Lang::tr{'bypassed'}),
                "GPRINT:bypassed_bytes_avg:%9.2lf %sbps",
                "GPRINT:bypassed_bytes_min:%9.2lf %sbps",
                "GPRINT:bypassed_bytes_max:%9.2lf %sbps\\j",

diff --git a/config/collectd/collectd.conf b/config/collectd/collectd.conf
index fd548b6cf18ce5a8ec09c4a69720cc6ce1f33d30..a90331f21cb5ae866fa3e424922ab038b23da5f8 100644 (file)
--- a/config/collectd/collectd.conf
+++ b/config/collectd/collectd.conf
@@ -56,6 +56,7 @@ include "/etc/collectd.precache"
        # IPS
        Chain mangle IPS BYPASSED
        Chain mangle IPS SCANNED
+       Chain mangle IPS WHITELISTED
 </Plugin>
 
 #<Plugin logfile>

diff --git a/doc/language_issues.en b/doc/language_issues.en
index e32edc44c6cc42cf84b5f03523b273880110578d..c762cc6f7ff4ed4e8584ce402900e23c3ba5028c 100644 (file)
--- a/doc/language_issues.en
+++ b/doc/language_issues.en
@@ -2161,6 +2161,7 @@ WARNING: untranslated string: webradio playlist = Webradio Playlist
 WARNING: untranslated string: website = Website
 WARNING: untranslated string: wednesday = Wednesday
 WARNING: untranslated string: weeks = Weeks
+WARNING: untranslated string: whitelisted = Whitelisted
 WARNING: untranslated string: whois results from = WHOIS results from
 WARNING: untranslated string: winbind daemon = Winbind Daemon
 WARNING: untranslated string: wio = unknown string

diff --git a/doc/language_issues.es b/doc/language_issues.es
index e4aa7c3fc1f370a2cb47e5ecf72e464670a97d02..67f82a450e57a7e25e2b9efdf08e15ca7e5c6998 100644 (file)
--- a/doc/language_issues.es
+++ b/doc/language_issues.es
@@ -1061,6 +1061,7 @@ WARNING: untranslated string: timeformat = %Y-%m-%d at %H:%M:%S %Z
 WARNING: untranslated string: total = Total
 WARNING: untranslated string: transport mode does not support vti = VTI is not support in transport mode
 WARNING: untranslated string: warning = Warning
+WARNING: untranslated string: whitelisted = Whitelisted
 WARNING: untranslated string: wio = unknown string
 WARNING: untranslated string: wio checked = unknown string
 WARNING: untranslated string: wio cron = unknown string

diff --git a/doc/language_issues.fr b/doc/language_issues.fr
index 245f3cc31c1a7dd346dda84facd0517b5e91ddfc..db8b6071e15bb296552b05dcf6276b5b3edb1842 100644 (file)
--- a/doc/language_issues.fr
+++ b/doc/language_issues.fr
@@ -999,6 +999,7 @@ WARNING: untranslated string: system time = System Time (as of last page load)
 WARNING: untranslated string: timeformat = %Y-%m-%d at %H:%M:%S %Z
 WARNING: untranslated string: total = Total
 WARNING: untranslated string: warning = Warning
+WARNING: untranslated string: whitelisted = Whitelisted
 WARNING: untranslated string: wio = unknown string
 WARNING: untranslated string: wio checked = unknown string
 WARNING: untranslated string: wio cron = unknown string

diff --git a/doc/language_issues.it b/doc/language_issues.it
index 41049ff996aa14c58e48c3f5a537c7c5bb908536..553417e59d7586c5f4708eb070f7f43e6f7c2238 100644 (file)
--- a/doc/language_issues.it
+++ b/doc/language_issues.it
@@ -1347,6 +1347,7 @@ WARNING: untranslated string: vpn weak = Weak
 WARNING: untranslated string: vulnerability = Vulnerability
 WARNING: untranslated string: vulnerable = Vulnerable
 WARNING: untranslated string: warning = Warning
+WARNING: untranslated string: whitelisted = Whitelisted
 WARNING: untranslated string: whois results from = WHOIS results from
 WARNING: untranslated string: winbind daemon = Winbind Daemon
 WARNING: untranslated string: wio = unknown string

diff --git a/doc/language_issues.nl b/doc/language_issues.nl
index 8c3828a00f49cacf05dee9e4aeb5645da46ebb8a..0b16d098dfd7cf1c4e91610385a0b9d32049cd4b 100644 (file)
--- a/doc/language_issues.nl
+++ b/doc/language_issues.nl
@@ -1370,6 +1370,7 @@ WARNING: untranslated string: vpn weak = Weak
 WARNING: untranslated string: vulnerability = Vulnerability
 WARNING: untranslated string: vulnerable = Vulnerable
 WARNING: untranslated string: warning = Warning
+WARNING: untranslated string: whitelisted = Whitelisted
 WARNING: untranslated string: whois results from = WHOIS results from
 WARNING: untranslated string: winbind daemon = Winbind Daemon
 WARNING: untranslated string: wio = unknown string

diff --git a/doc/language_issues.pl b/doc/language_issues.pl
index eccba9d7e21d4923f3b0ec74379359a68d49772f..a3acd734f1d279b429edba21c1823285584e9fcb 100644 (file)
--- a/doc/language_issues.pl
+++ b/doc/language_issues.pl
@@ -1611,6 +1611,7 @@ WARNING: untranslated string: vpn weak = Weak
 WARNING: untranslated string: vulnerability = Vulnerability
 WARNING: untranslated string: vulnerable = Vulnerable
 WARNING: untranslated string: warning = Warning
+WARNING: untranslated string: whitelisted = Whitelisted
 WARNING: untranslated string: whois results from = WHOIS results from
 WARNING: untranslated string: winbind daemon = Winbind Daemon
 WARNING: untranslated string: wio = unknown string

diff --git a/doc/language_issues.ru b/doc/language_issues.ru
index 3d514aa7b655f659b262b252185a3e5edef3c5c2..66b6cae138fbee3db23e6702ca9c8656d86de6db 100644 (file)
--- a/doc/language_issues.ru
+++ b/doc/language_issues.ru
@@ -1604,6 +1604,7 @@ WARNING: untranslated string: vpn weak = Weak
 WARNING: untranslated string: vulnerability = Vulnerability
 WARNING: untranslated string: vulnerable = Vulnerable
 WARNING: untranslated string: warning = Warning
+WARNING: untranslated string: whitelisted = Whitelisted
 WARNING: untranslated string: whois results from = WHOIS results from
 WARNING: untranslated string: winbind daemon = Winbind Daemon
 WARNING: untranslated string: wio = unknown string

diff --git a/doc/language_issues.tr b/doc/language_issues.tr
index 516a009ecb827620c2b341bf047037c4100b78e5..ec657539f6080e8ca5681871c2182196d6a05a1e 100644 (file)
--- a/doc/language_issues.tr
+++ b/doc/language_issues.tr
@@ -1231,6 +1231,7 @@ WARNING: untranslated string: vpn wait = WAITING
 WARNING: untranslated string: vulnerability = Vulnerability
 WARNING: untranslated string: vulnerable = Vulnerable
 WARNING: untranslated string: warning = Warning
+WARNING: untranslated string: whitelisted = Whitelisted
 WARNING: untranslated string: whois results from = WHOIS results from
 WARNING: untranslated string: winbind daemon = Winbind Daemon
 WARNING: untranslated string: wio = unknown string

diff --git a/doc/language_missings b/doc/language_missings
index 63e13797159f6783364ed2b75d90fb557fd3a76c..6a44630bd8a2012873b5662e23aee81b1dde24d4 100644 (file)
--- a/doc/language_missings
+++ b/doc/language_missings
@@ -164,6 +164,7 @@
 < transport mode does not support vti
 < warning
 < wg
+< whitelisted
 < wireguard
 < wlanap
 < wlanap psk
@@ -200,6 +201,7 @@
 < upload fcdsl.o
 < warning
 < wg
+< whitelisted
 < wireguard
 < wlanap psk
 < wlanap wireless mode
@@ -690,6 +692,7 @@
 < warning
 < Weekly
 < wg
+< whitelisted
 < whois results from
 < winbind daemon
 < wireguard
@@ -1258,6 +1261,7 @@
 < warning
 < Weekly
 < wg
+< whitelisted
 < whois results from
 < winbind daemon
 < wireguard
@@ -2241,6 +2245,7 @@
 < warning
 < Weekly
 < wg
+< whitelisted
 < whois results from
 < winbind daemon
 < wireguard
@@ -3261,6 +3266,7 @@
 < week-graph
 < Weekly
 < wg
+< whitelisted
 < whois results from
 < winbind daemon
 < wireguard
@@ -3658,6 +3664,7 @@
 < warning
 < Weekly
 < wg
+< whitelisted
 < whois results from
 < winbind daemon
 < wireguard

diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl
index d40ffa6618ec7d71938c7050365c2341c6fc2b36..0598952ca917d078ba8aa8a71269ffde997354cb 100644 (file)
--- a/langs/de/cgi-bin/de.pl
+++ b/langs/de/cgi-bin/de.pl
@@ -2942,6 +2942,7 @@
 'week-graph' => 'Woche',
 'weekly firewallhits' => 'wöchentliche Firewalltreffer',
 'weeks' => 'Wochen',
+'whitelisted' => 'Ausgenommen',
 'whois results from' => 'WHOIS-Ergebnisse von',
 'wildcards' => 'Wildcards',
 'wins server' => 'WINS-Server',

diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl
index 998ead0658077122e32c0048d23e693740f10b97..91ea2e64add45e8c22ebb2a94ea8c1c06dac038f 100644 (file)
--- a/langs/en/cgi-bin/en.pl
+++ b/langs/en/cgi-bin/en.pl
@@ -3027,6 +3027,7 @@
 'weekly firewallhits' => 'weekly firewallhits',
 'weeks' => 'Weeks',
 'wg' => 'WireGuard',
+'whitelisted' => 'Whitelisted',
 'whois results from' => 'WHOIS results from',
 'wildcards' => 'Wildcards',
 'winbind daemon' => 'Winbind Daemon',

diff --git a/src/initscripts/system/suricata b/src/initscripts/system/suricata
index 150984d93007b756390396c57982dfd19a4c998e..a80a32f782ef6244e598d6541797b935e0fe632c 100644 (file)
--- a/src/initscripts/system/suricata
+++ b/src/initscripts/system/suricata
@@ -40,6 +40,10 @@ IPS_BYPASS_MASK="0x20000000"
 IPS_SCAN_MARK="0x10000000"
 IPS_SCAN_MASK="0x10000000"
 
+# Set if a packet has been whitelisted
+IPS_WHITELISTED_MARK="0x08000000"
+IPS_WHITELISTED_MASK="0x08000000"
+
 # Supported network zones
 NETWORK_ZONES=( "RED" "GREEN" "ORANGE" "BLUE" "WG" "OVPN" )
 
@@ -122,9 +126,14 @@ generate_fw_rules() {
                        # Skip disabled entries
                        [ "${enabled}" = "enabled" ] || continue
 
-                       iptables -w -t mangle -A IPS -s "${network}" -j RETURN
-                       iptables -w -t mangle -A IPS -d "${network}" -j RETURN
+                       iptables -w -t mangle -A IPS -s "${network}" -j MARK --set-mark "$(( IPS_WHITELISTED_MARK ))/$(( IPS_WHITELISTED_MASK ))"
+                       iptables -w -t mangle -A IPS -d "${network}" -j MARK --set-mark "$(( IPS_WHITELISTED_MARK ))/$(( IPS_WHITELISTED_MASK ))"
                done < "/var/ipfire/suricata/ignored"
+
+               # Count and skip the whitelisted packets
+               iptables -w -t mangle -A IPS \
+                       -m comment --comment "WHITELISTED" \
+                       -m mark --mark "$(( IPS_WHITELISTED_MARK ))/$(( IPS_WHITELISTED_MASK ))" -j RETURN
        fi
 
        # Send packets to suricata