From: Michael Tremer <michael.tremer@ipfire.org>
Date: Sat, 21 Sep 2024 10:39:32 +0000 (+0200)
Subject: suricata: Always count the whitelisted packets
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=20edd42bf67af240ea65537a0d313dcb25ae0507;p=people%2Fms%2Fipfire-2.x.git

suricata: Always count the whitelisted packets

Even if there are no rules, if this does not exist, collectd will be
unhappy and we cannot generate the graph.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
---

diff --git a/src/initscripts/system/suricata b/src/initscripts/system/suricata
index a80a32f78..86836ee8c 100644
--- a/src/initscripts/system/suricata
+++ b/src/initscripts/system/suricata
@@ -129,13 +129,13 @@ generate_fw_rules() {
 			iptables -w -t mangle -A IPS -s "${network}" -j MARK --set-mark "$(( IPS_WHITELISTED_MARK ))/$(( IPS_WHITELISTED_MASK ))"
 			iptables -w -t mangle -A IPS -d "${network}" -j MARK --set-mark "$(( IPS_WHITELISTED_MARK ))/$(( IPS_WHITELISTED_MASK ))"
 		done < "/var/ipfire/suricata/ignored"
-
-		# Count and skip the whitelisted packets
-		iptables -w -t mangle -A IPS \
-			-m comment --comment "WHITELISTED" \
-			-m mark --mark "$(( IPS_WHITELISTED_MARK ))/$(( IPS_WHITELISTED_MASK ))" -j RETURN
 	fi
 
+	# Count and skip the whitelisted packets
+	iptables -w -t mangle -A IPS \
+		-m comment --comment "WHITELISTED" \
+		-m mark --mark "$(( IPS_WHITELISTED_MARK ))/$(( IPS_WHITELISTED_MASK ))" -j RETURN
+
 	# Send packets to suricata
 	iptables -w -t mangle -A IPS -m comment --comment "SCANNED" -j NFQUEUE "${NFQ_OPTIONS[@]}"