From mboxrd@z Thu Jan  1 00:00:00 1970
From: Stefan Schantl <stefan.schantl@ipfire.org>
To: development@lists.ipfire.org
Subject: [PATCH 1/3] ids-functions.pl: Generate ipset based whitelist.
Date: Wed, 06 Apr 2022 21:12:43 +0200
Message-ID: <20220406191245.4218-1-stefan.schantl@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============0146571322921511652=="
List-Id: <development.lists.ipfire.org>

--===============0146571322921511652==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
---
 config/cfgroot/ids-functions.pl | 68 ++++++++++++++++-----------------
 1 file changed, 33 insertions(+), 35 deletions(-)

diff --git a/config/cfgroot/ids-functions.pl b/config/cfgroot/ids-functions.pl
index 94dccc8ae..d8ce5d0a0 100644
--- a/config/cfgroot/ids-functions.pl
+++ b/config/cfgroot/ids-functions.pl
@@ -90,7 +90,7 @@ our $sid_msg_file =3D "$rulespath/sid-msg.map";
 our $local_rules_file =3D "$rulespath/local.rules";
=20
 # File which contains the rules to whitelist addresses on suricata.
-our $whitelist_file =3D "$rulespath/whitelist.rules";
+our $whitelist_file =3D "$settingsdir/whitelist.conf";
=20
 # File which contains a list of all supported ruleset sources.
 # (Sourcefire, Emergingthreads, etc..)
@@ -125,7 +125,7 @@ my @cron_intervals =3D ('off', 'daily', 'weekly' );
 my @http_ports =3D ('80', '81');
=20
 # Array which contains a list of rulefiles which always will be included if =
they exist.
-my @static_included_rulefiles =3D ('local.rules', 'whitelist.rules');
+my @static_included_rulefiles =3D ('local.rules');
=20
 # Array which contains a list of allways enabled application layer protocols.
 my @static_enabled_app_layer_protos =3D ('app-layer', 'decoder', 'files', 's=
tream');
@@ -1199,9 +1199,6 @@ sub _cleanup_rulesdir() {
 		# We only want files.
 		next unless (-f "$rulespath/$file");
=20
-		# Skip rules file for whitelisted hosts.
-		next if ("$rulespath/$file" eq $whitelist_file);
-
 		# Skip rules file with local rules.
 		next if ("$rulespath/$file" eq $local_rules_file);
=20
@@ -1707,46 +1704,47 @@ sub get_suricata_enabled_app_layer_protos() {
 #
 sub generate_ignore_file() {
 	my %ignored =3D ();
+	my @ignored_addresses =3D ();
=20
-	# SID range 1000000-1999999 Reserved for Local Use
-	# Put your custom rules in this range to avoid conflicts
-	my $sid =3D 1500000;
+	# Name of the ipset.
+	my $list =3D "IPSWHITELIST";
=20
 	# Read-in ignoredfile.
 	&General::readhasharray($IDS::ignored_file, \%ignored);
=20
-	# Open ignorefile for writing.
-	open(FILE, ">$IDS::whitelist_file") or die "Could not write to $IDS::whitel=
ist_file. $!\n";
+	# Loop through the entire hash and add the enabled addresses to
+	# the array of ignored addresses..
+	while ( (my $key) =3D each %ignored) {
+		my $address =3D $ignored{$key}[0];
+		my $remark =3D $ignored{$key}[1];
+		my $status =3D $ignored{$key}[2];
+
+		# Check if the status of the entry is "enabled".
+		if ($status eq "enabled") {
+			# Check if the address/network is valid.
+			if ((&General::validip($address)) || (&General::validipandmask($address))=
) {
+				# Add the address to the array of ignored addresses.
+				push(@ignored_addresses, $address);
+			}
+		}
+	}
=20
-	# Config file header.
-	print FILE "# Autogenerated file.\n";
-	print FILE "# All user modifications will be overwritten.\n\n";
+	# Open the the whitelist file for writing.
+	open(FILE, ">", "$whitelist_file") or die "Could not write to $whitelist_fi=
le. $!\n";
=20
-	# Add all user defined addresses to the whitelist.
-	#
-	# Check if the hash contains any elements.
-	if (keys (%ignored)) {
-		# Loop through the entire hash and write the host/network
-		# and remark to the ignore file.
-		while ( (my $key) =3D each %ignored) {
-			my $address =3D $ignored{$key}[0];
-			my $remark =3D $ignored{$key}[1];
-			my $status =3D $ignored{$key}[2];
-
-			# Check if the status of the entry is "enabled".
-			if ($status eq "enabled") {
-				# Check if the address/network is valid.
-				if ((&General::validip($address)) || (&General::validipandmask($address)=
)) {
-					# Write rule line to the file to pass any traffic from this IP
-					print FILE "pass ip $address any -> any any (msg:\"pass all traffic fro=
m/to $address\"\; bypass; sid:$sid\;)\n";
-
-					# Increment sid.
-					$sid++;
-				}
-			}
+	# Check if the array of ignored addresses contains any elements.
+	if(@ignored_addresses) {
+		# Write file header.
+		print FILE "create $list hash:net family inet -exist\n";
+		print FILE "flush $list\n";
+
+		# Loop through the array of ignored addresses.
+		foreach my $address (@ignored_addresses) {
+			print FILE "add $list $address\n";
 		}
 	}
=20
+	# Close filehandle.
 	close(FILE);
 }
=20
--=20
2.30.2


--===============0146571322921511652==--