From mboxrd@z Thu Jan 1 00:00:00 1970 From: Michael Tremer To: ipfire-scm@lists.ipfire.org Subject: [git.ipfire.org] IPFire 2.x development tree branch, master, updated. 84b04cb6d38eb0ca0fca426e4d6e0c0a2c467d9e Date: Tue, 24 Sep 2024 08:54:09 +0000 Message-ID: <4XCYZ9327Jz2xM8@people01.haj.ipfire.org> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============0941016868519722792==" List-Id: --===============0941016868519722792== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, master has been updated via 84b04cb6d38eb0ca0fca426e4d6e0c0a2c467d9e (commit) via d99826dc71146a6d019341892d6f2d7b69ee2407 (commit) via e5da7dea66167602b9255ac6b77d9ab32398a23d (commit) via db151ad716beefcb9ab9fadd2bb3ac9934748793 (commit) via 09831e9ca9c27b024d305f40655298d8106cdf5c (commit) via 75a89ddf4aaccaf397e320a98bf1ecf65c78cff4 (commit) via 6826eed0a4a892bf6ef24abd312bad474568c988 (commit) via 4efa4c4b714f117cb561201f7f6c122cb7da624a (commit) via 0c5a683b7ed3cb268648c573bcbeead20f824e95 (commit) via d98d10f7df7bd8715b338c6c3b30801f65243977 (commit) via cf44d8d149dbda8aa8dccd89dd5e3ff75af628b9 (commit) via 5da15c5d3b1772f133d10a309d99b3588b98be0f (commit) via 4721fac3c88069d5ca426f6be750f9b860efecaa (commit) via a85924cc2534c65eb10b800375ade8a5bb311dc1 (commit) via 8b73307b15a74b3e0781cfb3430298403e849ed6 (commit) via 63f4b3a7bc4bd80b036c02f2483fd82ac5810aca (commit) via 0d38ebeb059cca9f97316f4980ee4437110ddf55 (commit) via 525ff6d74dac833854dde69a152e98f1b5fd14d2 (commit) via 2438c6c2497015e92e823ecd2fbe9071a2cda575 (commit) via d3db0465703fe15855b02c3487859c8ca5a0db2b (commit) via d2f7d18e338975fa5d6a6f89b3eb86378e124612 (commit) via 891702cad16def266ab4ab1e8dde79367dd3d140 (commit) via 119cb837067ab16f6bf6ea88f512f8f8c38ea49c (commit) via 50f3e2a534d99ad4606535709e02f40ac89260fd (commit) via 1b7d1abdf0978be4dfd57f339313ce811322aaf9 (commit) via 72d501f9235e290c974b2e4207b822b164d3a2fc (commit) via eb3156ed6b4a1de646259295db47c6cbeaa438ae (commit) via 79cce701a94fb903e94838faf4c2e1016a24ba62 (commit) via 7e1c564ec8f25cb00c49a5ceecdb004c0b186555 (commit) via 17887e69a82dc92880136940ccdff1254c612233 (commit) via e088c2115843cb6d70ea5bc21af818f5dbd7e822 (commit) via 54a58a2891910ece5174ec8f20504ae2f80841e2 (commit) via 84a73d5f3997be2f1907c5eb4ad7a7069611ab4a (commit) via 655a95803a2fdc16ed7541b0c368620bb23d7740 (commit) via 50d987cc2194945be50030fde179e293f692135d (commit) via 7e5ec5699886664686d05ef3d7dc3006d162b5a7 (commit) via 558dcc66e632fe12b566edc4e39c519cdbc1b6a0 (commit) from fc1537434f007977161c2ba46b823d276b8c5d7c (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 84b04cb6d38eb0ca0fca426e4d6e0c0a2c467d9e Author: Michael Tremer Date: Tue Sep 24 08:53:40 2024 +0000 core189: Ship suricata changes =20 Signed-off-by: Michael Tremer commit d99826dc71146a6d019341892d6f2d7b69ee2407 Author: Michael Tremer Date: Tue Sep 24 10:33:22 2024 +0200 suricata: Enable scanning IPsec packets =20 Signed-off-by: Michael Tremer commit e5da7dea66167602b9255ac6b77d9ab32398a23d Author: Michael Tremer Date: Sun Sep 22 17:22:48 2024 +0200 ids.cgi: Add UI to enable scanning on IPsec =20 Signed-off-by: Michael Tremer commit db151ad716beefcb9ab9fadd2bb3ac9934748793 Author: Michael Tremer Date: Sun Sep 22 17:08:03 2024 +0200 suricata: Add support for zones having multiple interfaces =20 Signed-off-by: Michael Tremer commit 09831e9ca9c27b024d305f40655298d8106cdf5c Author: Michael Tremer Date: Sun Sep 22 17:06:21 2024 +0200 suricata: Split marking packets off into a separate chain =20 This is required so that we can have different policies for incoming and outgoing packets. =20 Signed-off-by: Michael Tremer commit 75a89ddf4aaccaf397e320a98bf1ecf65c78cff4 Author: Michael Tremer Date: Sat Sep 21 17:55:09 2024 +0200 suricata: Clear IPS bits after use =20 Signed-off-by: Michael Tremer commit 6826eed0a4a892bf6ef24abd312bad474568c988 Author: Michael Tremer Date: Sat Sep 21 12:39:32 2024 +0200 suricata: Always count the whitelisted packets =20 Even if there are no rules, if this does not exist, collectd will be unhappy and we cannot generate the graph. =20 Signed-off-by: Michael Tremer commit 4efa4c4b714f117cb561201f7f6c122cb7da624a Author: Michael Tremer Date: Sat Sep 21 12:37:09 2024 +0200 ids.cgi: Don't show the graph if there is no RRD data =20 Signed-off-by: Michael Tremer commit 0c5a683b7ed3cb268648c573bcbeead20f824e95 Author: Michael Tremer Date: Sat Sep 21 12:34:56 2024 +0200 ids.cgi: Fix empty states of tables =20 Signed-off-by: Michael Tremer commit d98d10f7df7bd8715b338c6c3b30801f65243977 Author: Michael Tremer Date: Sat Sep 21 12:28:50 2024 +0200 graphs.pl: Fix suricata graph name =20 Signed-off-by: Michael Tremer commit cf44d8d149dbda8aa8dccd89dd5e3ff75af628b9 Author: Michael Tremer Date: Tue Sep 17 04:04:07 2024 +0200 firewall: Move the IPS back to INPUT/FORWARD/OUTPUT =20 We cannot use the PREROUTING/POSTROUTING chains here because Suricata will fail to track NAT-ed connections. =20 Signed-off-by: Michael Tremer commit 5da15c5d3b1772f133d10a309d99b3588b98be0f Author: Michael Tremer Date: Fri Sep 13 10:12:30 2024 +0200 suricata: Track whitelisted traffic and add it to the IPS graph =20 Signed-off-by: Michael Tremer commit 4721fac3c88069d5ca426f6be750f9b860efecaa Author: Michael Tremer Date: Wed Sep 11 00:43:59 2024 +0200 IPS: Ada a graph that shows the IPS throughput =20 This graph is split into three parts. One shows bypassed packets, the next one shows the actually scanned packets and lastly we show the total throughput. =20 Signed-off-by: Michael Tremer commit a85924cc2534c65eb10b800375ade8a5bb311dc1 Author: Michael Tremer Date: Tue Sep 10 23:45:53 2024 +0200 suricata: Collect metrics on scanned and bypassed packets =20 Signed-off-by: Michael Tremer commit 8b73307b15a74b3e0781cfb3430298403e849ed6 Author: Michael Tremer Date: Tue Sep 10 23:23:38 2024 +0200 suricata: Force Suricata to write a PID file again =20 The PID file does not get written when Suricata is not being started in daemon mode and therefore we need to pass it as a command line parameter. =20 The initscript should not deal with the PID file when starting but needs it to terminate the process and to check the process status. =20 The web UI can use the PID file again. =20 Signed-off-by: Michael Tremer commit 63f4b3a7bc4bd80b036c02f2483fd82ac5810aca Author: Michael Tremer Date: Tue Sep 10 23:23:18 2024 +0200 suricata: Fix syntax error in watcher script =20 Signed-off-by: Michael Tremer commit 0d38ebeb059cca9f97316f4980ee4437110ddf55 Author: Michael Tremer Date: Tue Sep 10 23:17:20 2024 +0200 suricata: Remove debugging code =20 Signed-off-by: Michael Tremer commit 525ff6d74dac833854dde69a152e98f1b5fd14d2 Author: Michael Tremer Date: Tue Sep 10 11:37:38 2024 +0200 firewall: Move the IPS after the NAT marking =20 This is because we might still land in the scenario where Suricata crashes and NFQUEUE will simply ACCEPT all packets which will terminate the processing of the mangle table. =20 Therefore the NFQUEUE rule should be the last one so that we never skip any of the other processing. =20 Signed-off-by: Michael Tremer commit 2438c6c2497015e92e823ecd2fbe9071a2cda575 Author: Michael Tremer Date: Tue Sep 10 11:35:18 2024 +0200 ids.cgi: Fix detection for the Suricata process =20 We don't seem to have a PID file any more. =20 Signed-off-by: Michael Tremer commit d3db0465703fe15855b02c3487859c8ca5a0db2b Author: Michael Tremer Date: Tue Sep 10 11:24:01 2024 +0200 ids.cgi: Remove box from the top section =20 Signed-off-by: Michael Tremer commit d2f7d18e338975fa5d6a6f89b3eb86378e124612 Author: Michael Tremer Date: Tue Sep 10 11:22:59 2024 +0200 ids.cgi: Sort whitelist entries =20 Signed-off-by: Michael Tremer commit 891702cad16def266ab4ab1e8dde79367dd3d140 Author: Michael Tremer Date: Tue Sep 10 11:17:33 2024 +0200 ids.cgi: Use new-style table for whitelist entries =20 Signed-off-by: Michael Tremer commit 119cb837067ab16f6bf6ea88f512f8f8c38ea49c Author: Michael Tremer Date: Tue Sep 10 11:09:58 2024 +0200 ids.cgi: Use new style tables for rulesets =20 Signed-off-by: Michael Tremer commit 50f3e2a534d99ad4606535709e02f40ac89260fd Author: Michael Tremer Date: Tue Sep 10 11:01:52 2024 +0200 suricata: Fix broken spacing in the settings section =20 Signed-off-by: Michael Tremer commit 1b7d1abdf0978be4dfd57f339313ce811322aaf9 Author: Michael Tremer Date: Tue Sep 10 10:50:15 2024 +0200 suricata: Add option to scan WireGuard =20 Signed-off-by: Michael Tremer commit 72d501f9235e290c974b2e4207b822b164d3a2fc Author: Michael Tremer Date: Tue Sep 10 10:42:11 2024 +0200 suricata: Don't load /var/ipfire/ethernet/settings =20 We no longer need this directly as it is being pulled in from the network functions. =20 Signed-off-by: Michael Tremer commit eb3156ed6b4a1de646259295db47c6cbeaa438ae Author: Michael Tremer Date: Tue Sep 10 10:41:19 2024 +0200 suricata: Remove superfluous bits from the initscript =20 I don't know why these hacks are here. =20 Signed-off-by: Michael Tremer commit 79cce701a94fb903e94838faf4c2e1016a24ba62 Author: Michael Tremer Date: Tue Sep 10 10:40:28 2024 +0200 suricata: Restore the interface selection =20 Signed-off-by: Michael Tremer commit 7e1c564ec8f25cb00c49a5ceecdb004c0b186555 Author: Michael Tremer Date: Mon Sep 9 23:08:11 2024 +0200 suricata: Start the new watcher in the background =20 Signed-off-by: Michael Tremer commit 17887e69a82dc92880136940ccdff1254c612233 Author: Michael Tremer Date: Mon Sep 9 20:09:22 2024 +0200 suricata: Add a watcher to restart on unexpected termination =20 This patch adds a watcher process that will restart suricata when it is being killed by SIGKILL (e.g. by the OOM killer) or after a SEGV. =20 Signed-off-by: Michael Tremer commit e088c2115843cb6d70ea5bc21af818f5dbd7e822 Author: Michael Tremer Date: Mon Sep 9 19:38:47 2024 +0200 suricata: Be more efficient with marks =20 This patch changes that we introduce a new mark which allows us to identify any newly bypassed connections and permanently store the bypass flag. =20 We also only restore marks from the connection tracking when a packet has no marks, yet. =20 Tested-by: Adolf Belka Signed-off-by: Michael Tremer commit 54a58a2891910ece5174ec8f20504ae2f80841e2 Author: Michael Tremer Date: Mon Sep 9 19:37:56 2024 +0200 suricata: Replace removed CPU count function =20 Signed-off-by: Michael Tremer commit 84a73d5f3997be2f1907c5eb4ad7a7069611ab4a Author: Michael Tremer Date: Mon Sep 9 12:46:23 2024 +0200 suricata: Add whitelist to iptables =20 This allows us to workaround better against any problems in Suricata because we never send any whitelisted packets to the IPS in the first place. =20 Signed-off-by: Michael Tremer commit 655a95803a2fdc16ed7541b0c368620bb23d7740 Author: Michael Tremer Date: Mon Sep 9 11:58:50 2024 +0200 suricata: Remove some unused constants =20 Signed-off-by: Michael Tremer commit 50d987cc2194945be50030fde179e293f692135d Author: Michael Tremer Date: Mon Sep 9 11:55:34 2024 +0200 suricata: Use getconf to determine the number of processors =20 Signed-off-by: Michael Tremer commit 7e5ec5699886664686d05ef3d7dc3006d162b5a7 Author: Michael Tremer Date: Mon Sep 9 11:54:04 2024 +0200 initscripts: Fix bash function definitions in suricata =20 Signed-off-by: Michael Tremer commit 558dcc66e632fe12b566edc4e39c519cdbc1b6a0 Author: Michael Tremer Date: Mon Sep 9 11:49:30 2024 +0200 suricata: Move the IPS into the mangle table =20 This should make the IPS more efficient, we should have fewer rules and the IPS will now sit at the edge of the networking stack as it will see packets immediately when they come and and just before they leave. =20 Signed-off-by: Michael Tremer ----------------------------------------------------------------------- Summary of changes: config/cfgroot/graphs.pl | 87 ++++++++ config/collectd/collectd.conf | 5 + config/rootfiles/common/suricata | 1 + config/rootfiles/core/189/filelists/files | 8 + config/rootfiles/core/189/update.sh | 1 + .../execute.sh =3D> config/suricata/suricata-watcher | 45 +++- doc/language_issues.de | 1 + doc/language_issues.en | 8 +- doc/language_issues.es | 8 + doc/language_issues.fr | 8 + doc/language_issues.it | 8 +- doc/language_issues.nl | 8 +- doc/language_issues.pl | 8 +- doc/language_issues.ru | 8 +- doc/language_issues.tr | 8 +- doc/language_missings | 57 +++++ html/cgi-bin/getrrdimage.cgi | 10 +- html/cgi-bin/ids.cgi | 145 +++++++------ langs/de/cgi-bin/de.pl | 7 + langs/en/cgi-bin/en.pl | 8 + lfs/suricata | 3 + src/initscripts/networking/functions.network | 80 +++++++ src/initscripts/system/firewall | 42 ++-- src/initscripts/system/suricata | 240 ++++++++++---------= -- 24 files changed, 572 insertions(+), 232 deletions(-) copy tools/execute.sh =3D> config/suricata/suricata-watcher (68%) mode change 100755 =3D> 100644 Difference in files: diff --git a/config/cfgroot/graphs.pl b/config/cfgroot/graphs.pl index 2439c5bf6..f07214cf8 100644 --- a/config/cfgroot/graphs.pl +++ b/config/cfgroot/graphs.pl @@ -1189,3 +1189,90 @@ sub updateconntrackgraph { =20 return "Error in RRD::Graph for conntrack: " . $ERROR . "\n" if $ERROR; } + +sub updateipsthroughputgraph { + my $period =3D $_[0]; + + my @command =3D ( + @GRAPH_ARGS, + "-", + "--start", + "-1" . $period, + "-r", + "--lower-limit","0", + "-v $Lang::tr{'bytes per second'}", + "--color=3DBACK" . $color{"color21"}, + + # Read bypassed packets + "DEF:bypassed_bytes=3D$mainsettings{'RRDLOG'}/collectd/localhost/iptables-= mangle-IPS/ipt_bytes-BYPASSED.rrd:value:AVERAGE", + #"DEF:bypassed_packets=3D$mainsettings{'RRDLOG'}/collectd/localhost/iptabl= es-mangle-IPS/ipt_packets-BYPASSED.rrd:value:AVERAGE", + + "VDEF:bypassed_bytes_avg=3Dbypassed_bytes,AVERAGE", + "VDEF:bypassed_bytes_min=3Dbypassed_bytes,MINIMUM", + "VDEF:bypassed_bytes_max=3Dbypassed_bytes,MAXIMUM", + + # Read scanned packets + "DEF:scanned_bytes=3D$mainsettings{'RRDLOG'}/collectd/localhost/iptables-m= angle-IPS/ipt_bytes-SCANNED.rrd:value:AVERAGE", + #"DEF:scanned_packets=3D$mainsettings{'RRDLOG'}/collectd/localhost/iptable= s-mangle-IPS/ipt_packets-SCANNED.rrd:value:AVERAGE", + + "VDEF:scanned_bytes_avg=3Dscanned_bytes,AVERAGE", + "VDEF:scanned_bytes_min=3Dscanned_bytes,MINIMUM", + "VDEF:scanned_bytes_max=3Dscanned_bytes,MAXIMUM", + + # Read whitelisted packets + "DEF:whitelisted_bytes=3D$mainsettings{'RRDLOG'}/collectd/localhost/iptabl= es-mangle-IPS/ipt_bytes-WHITELISTED.rrd:value:AVERAGE", + #"DEF:whitelisted_packets=3D$mainsettings{'RRDLOG'}/collectd/localhost/ipt= ables-mangle-IPS/ipt_packets-WHITELISTED.rrd:value:AVERAGE", + + "VDEF:whitelisted_bytes_avg=3Dwhitelisted_bytes,AVERAGE", + "VDEF:whitelisted_bytes_min=3Dwhitelisted_bytes,MINIMUM", + "VDEF:whitelisted_bytes_max=3Dwhitelisted_bytes,MAXIMUM", + + # Total + "CDEF:total_bytes=3Dbypassed_bytes,scanned_bytes,ADDNAN,whitelisted_bytes,= ADDNAN", + #"CDEF:total_packets=3Dbypassed_packets,scanned_packets,ADDNAN,whitelisted= _packets,ADDNAN", + + "VDEF:total_bytes_avg=3Dtotal_bytes,AVERAGE", + "VDEF:total_bytes_min=3Dtotal_bytes,MINIMUM", + "VDEF:total_bytes_max=3Dtotal_bytes,MAXIMUM", + + # Add some space below the graph + "COMMENT: \\n", + + # Headline + "COMMENT:" . sprintf("%32s", ""), + "COMMENT:" . sprintf("%16s", $Lang::tr{'average'}), + "COMMENT:" . sprintf("%16s", $Lang::tr{'minimum'}), + "COMMENT:" . sprintf("%16s", $Lang::tr{'maximum'}) . "\\j", + + # Whitelisted Packets + "AREA:whitelisted_bytes$color{'color12'}A0:" . sprintf("%-30s", $Lang::tr{= 'whitelisted'}), + "GPRINT:whitelisted_bytes_avg:%9.2lf %sbps", + "GPRINT:whitelisted_bytes_min:%9.2lf %sbps", + "GPRINT:whitelisted_bytes_max:%9.2lf %sbps\\j", + + # Bypassed Packets + "STACK:bypassed_bytes$color{'color11'}A0:" . sprintf("%-30s", $Lang::tr{'b= ypassed'}), + "GPRINT:bypassed_bytes_avg:%9.2lf %sbps", + "GPRINT:bypassed_bytes_min:%9.2lf %sbps", + "GPRINT:bypassed_bytes_max:%9.2lf %sbps\\j", + + # Scanned Packets + "STACK:scanned_bytes$color{'color13'}A0:" . sprintf("%-30s", $Lang::tr{'sc= anned'}), + "GPRINT:scanned_bytes_avg:%9.2lf %sbps", + "GPRINT:scanned_bytes_min:%9.2lf %sbps", + "GPRINT:scanned_bytes_max:%9.2lf %sbps\\j", + + "COMMENT: \\n", + + # Total Packets + "COMMENT:" . sprintf("%-32s", $Lang::tr{'total'}), + "GPRINT:total_bytes_avg:%9.2lf %sbps", + "GPRINT:total_bytes_min:%9.2lf %sbps", + "GPRINT:total_bytes_max:%9.2lf %sbps\\j", + ); + + RRDs::graph(@command); + $ERROR =3D RRDs::error; + + return "Error in RRD::Graph for suricata: " . $ERROR . "\n" if $ERROR; +} diff --git a/config/collectd/collectd.conf b/config/collectd/collectd.conf index 27e1fe984..a90331f21 100644 --- a/config/collectd/collectd.conf +++ b/config/collectd/collectd.conf @@ -52,6 +52,11 @@ include "/etc/collectd.precache" Chain filter SPOOFED_MARTIAN DROP_SPOOFED_MARTIAN Chain filter HOSTILE_DROP_IN DROP_HOSTILE Chain filter HOSTILE_DROP_OUT DROP_HOSTILE + + # IPS + Chain mangle IPS BYPASSED + Chain mangle IPS SCANNED + Chain mangle IPS WHITELISTED =20 # diff --git a/config/rootfiles/common/suricata b/config/rootfiles/common/suric= ata index 53224d006..8fe53f7e6 100644 --- a/config/rootfiles/common/suricata +++ b/config/rootfiles/common/suricata @@ -1,6 +1,7 @@ etc/suricata etc/suricata/suricata.yaml usr/bin/suricata +usr/bin/suricata-watcher usr/sbin/convert-ids-backend-files #usr/share/doc/suricata #usr/share/doc/suricata/AUTHORS diff --git a/config/rootfiles/core/189/filelists/files b/config/rootfiles/cor= e/189/filelists/files index 2586805ea..7afa1ac2e 100644 --- a/config/rootfiles/core/189/filelists/files +++ b/config/rootfiles/core/189/filelists/files @@ -1,4 +1,12 @@ +etc/collectd.conf +etc/rc.d/init.d/firewall etc/rc.d/init.d/functions +etc/rc.d/init.d/networking/functions.network +etc/rc.d/init.d/suricata +srv/web/ipfire/cgi-bin/getrrdimage.cgi +srv/web/ipfire/cgi-bin/ids.cgi srv/web/ipfire/html/include/rrdimage.js +usr/bin/suricata-watcher +var/ipfire/graphs.pl var/ipfire/header.pl var/ipfire/ids-functions.pl diff --git a/config/rootfiles/core/189/update.sh b/config/rootfiles/core/189/= update.sh index f2c8863d6..43323f38a 100644 --- a/config/rootfiles/core/189/update.sh +++ b/config/rootfiles/core/189/update.sh @@ -349,6 +349,7 @@ ldconfig telinit u =20 # Start services +/etc/init.d/collectd restart /usr/local/bin/openvpnctrl -s /usr/local/bin/openvpnctrl -sn2n =20 diff --git a/config/suricata/suricata-watcher b/config/suricata/suricata-watc= her new file mode 100644 index 000000000..d937ef8cc --- /dev/null +++ b/config/suricata/suricata-watcher @@ -0,0 +1,58 @@ +#!/bin/bash +############################################################################= ### +# = # +# IPFire.org - A Linux-based Firewall = # +# Copyright (C) 2024 IPFire Team = # +# = # +# This program is free software: you can redistribute it and/or modify = # +# it under the terms of the GNU General Public License as published by = # +# the Free Software Foundation, either version 3 of the License, or = # +# (at your option) any later version. = # +# = # +# This program is distributed in the hope that it will be useful, = # +# but WITHOUT ANY WARRANTY; without even the implied warranty of = # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the = # +# GNU General Public License for more details. = # +# = # +# You should have received a copy of the GNU General Public License = # +# along with this program. If not, see . = # +# = # +############################################################################= ### + +PIDFILE=3D"/var/run/suricata.pid" + +main() { + local ret + + # Suricata becomes unhappy if the PID file exists + unlink "${PIDFILE}" &>/dev/null + + while :; do + # Launch suricata + /usr/bin/suricata --pidfile "${PIDFILE}" "$@" &>/dev/null + + # Wait until suricata is done + ret=3D$? + + case "${ret}" in + # If suricata has been killed by SIGKILL (e.g. by + # the OOM killer, or if it ran into a SEGV, we will + # restart the process. + 137|139) + # Remove the PID file + unlink "${PIDFILE}" 2>/dev/null + + sleep 1 + continue + ;; + + *) + break + ;; + esac + done + + return ${ret} +} + +main "$@" || exit $? diff --git a/doc/language_issues.de b/doc/language_issues.de index b3d7082df..bd335de41 100644 --- a/doc/language_issues.de +++ b/doc/language_issues.de @@ -400,6 +400,7 @@ WARNING: translation string unused: icmp type WARNING: translation string unused: id WARNING: translation string unused: ids oinkcode required WARNING: translation string unused: ids rules update +WARNING: translation string unused: ids ruleset settings WARNING: translation string unused: ids unsupported provider WARNING: translation string unused: ike encryption WARNING: translation string unused: ike grouptype diff --git a/doc/language_issues.en b/doc/language_issues.en index 3aa4e9bd8..c762cc6f7 100644 --- a/doc/language_issues.en +++ b/doc/language_issues.en @@ -361,6 +361,7 @@ WARNING: untranslated string: broken =3D Broken WARNING: untranslated string: broken pipe =3D Broken pipe WARNING: untranslated string: buffered memory =3D Buffered Memory WARNING: untranslated string: buffers =3D buffers +WARNING: untranslated string: bypassed =3D Bypassed WARNING: untranslated string: bytes per second =3D Bytes per Second WARNING: untranslated string: bytes received =3D Bytes Received WARNING: untranslated string: bytes sent =3D Bytes Sent @@ -1070,7 +1071,7 @@ WARNING: untranslated string: ids remove rule structure= s =3D Remove old rule struc WARNING: untranslated string: ids reset provider =3D Reset provider WARNING: untranslated string: ids ruleset autoupdate in progress =3D Ruleset= update in progress. Please wait until all operations have completed successf= ully... WARNING: untranslated string: ids ruleset is up to date =3D No update requir= ed - The ruleset is up to date. -WARNING: untranslated string: ids ruleset settings =3D Ruleset Settings +WARNING: untranslated string: ids rulesets =3D Rulesets WARNING: untranslated string: ids show =3D Show WARNING: untranslated string: ids subscription code required =3D The selecte= d ruleset requires a subscription code WARNING: untranslated string: ids the choosen provider is already in use =3D= The choosen provider is already in use. @@ -1191,6 +1192,7 @@ WARNING: untranslated string: ipfire has now shutdown = =3D IPFire is shutting down WARNING: untranslated string: ipfire side is invalid =3D IPFire side is inva= lid. WARNING: untranslated string: ipfires hostname =3D IPFire's Hostname WARNING: untranslated string: ipinfo =3D IP info +WARNING: untranslated string: ips throughput =3D Throughput WARNING: untranslated string: ipsec =3D IPsec WARNING: untranslated string: ipsec connection =3D IPsec Connection WARNING: untranslated string: ipsec dns server address is invalid =3D Invali= d DNS server IP address(es) @@ -1217,6 +1219,7 @@ WARNING: untranslated string: lan =3D LAN WARNING: untranslated string: languagepurpose =3D Select the language you wi= sh IPFire to display in: WARNING: untranslated string: last =3D Last WARNING: untranslated string: last activity =3D Last Activity +WARNING: untranslated string: last updated =3D Last Updated WARNING: untranslated string: lease expires =3D Lease expires WARNING: untranslated string: least preferred =3D least preferred WARNING: untranslated string: legend =3D Legend @@ -1612,6 +1615,7 @@ WARNING: untranslated string: samba server role standal= one =3D Standalone WARNING: untranslated string: saturday =3D Saturday WARNING: untranslated string: save =3D Save WARNING: untranslated string: save-adv-options =3D Save advanced options +WARNING: untranslated string: scanned =3D Scanned WARNING: untranslated string: script name =3D Script name: WARNING: untranslated string: search =3D Search WARNING: untranslated string: secondary dns =3D Secondary DNS: @@ -1802,6 +1806,7 @@ WARNING: untranslated string: tor traffic limit soft = =3D Traffic limit almost reac WARNING: untranslated string: tor traffic read written =3D Total traffic (re= ad/written) WARNING: untranslated string: tor use exit nodes =3D Use only these exit nod= es (one fingerprint per line) WARNING: untranslated string: tor use guard nodes =3D Use only these guard n= odes (one fingerprint per line) +WARNING: untranslated string: total =3D Total WARNING: untranslated string: total connection time =3D Total Connection Time WARNING: untranslated string: total hits for log section =3D Total hits for = log section WARNING: untranslated string: traffic stat in =3D In @@ -2156,6 +2161,7 @@ WARNING: untranslated string: webradio playlist =3D Web= radio Playlist WARNING: untranslated string: website =3D Website WARNING: untranslated string: wednesday =3D Wednesday WARNING: untranslated string: weeks =3D Weeks +WARNING: untranslated string: whitelisted =3D Whitelisted WARNING: untranslated string: whois results from =3D WHOIS results from WARNING: untranslated string: winbind daemon =3D Winbind Daemon WARNING: untranslated string: wio =3D unknown string diff --git a/doc/language_issues.es b/doc/language_issues.es index fbbcd1e74..67f82a450 100644 --- a/doc/language_issues.es +++ b/doc/language_issues.es @@ -444,6 +444,7 @@ WARNING: translation string unused: ids rules license1 WARNING: translation string unused: ids rules license2 WARNING: translation string unused: ids rules license3 WARNING: translation string unused: ids rules update +WARNING: translation string unused: ids ruleset settings WARNING: translation string unused: ike encryption WARNING: translation string unused: ike grouptype WARNING: translation string unused: ike integrity @@ -979,6 +980,7 @@ WARNING: untranslated string: Scan for Songs =3D unknown = string WARNING: untranslated string: access point name =3D Access Point Name WARNING: untranslated string: access point name is invalid =3D Access Point = Name is invalid WARNING: untranslated string: access point name is required =3D Access Point= Name is required +WARNING: untranslated string: bypassed =3D Bypassed WARNING: untranslated string: cpu frequency =3D CPU frequency WARNING: untranslated string: data transfer =3D Data Transfer WARNING: untranslated string: dhcp fixed ip address in dynamic range =3D Fix= ed IP Address in dynamic range @@ -1028,8 +1030,11 @@ WARNING: untranslated string: hostile networks in =3D = >>From Hostile Networks WARNING: untranslated string: hostile networks out =3D To Hostile Networks WARNING: untranslated string: hostile networks total =3D Total Hostile Netwo= rks WARNING: untranslated string: ids provider eol =3D (EOL) +WARNING: untranslated string: ids rulesets =3D Rulesets WARNING: untranslated string: info messages =3D unknown string WARNING: untranslated string: invalid ip or hostname =3D Invalid IP Address = or Hostname +WARNING: untranslated string: ips throughput =3D Throughput +WARNING: untranslated string: last updated =3D Last Updated WARNING: untranslated string: load average =3D Load Average WARNING: untranslated string: log drop hostile in =3D Log dropped packets FR= OM hostile networks WARNING: untranslated string: log drop hostile out =3D Log dropped packets T= O hostile networks @@ -1048,12 +1053,15 @@ WARNING: untranslated string: route config changed = =3D unknown string WARNING: untranslated string: routing config added =3D unknown string WARNING: untranslated string: routing config changed =3D unknown string WARNING: untranslated string: routing table =3D unknown string +WARNING: untranslated string: scanned =3D Scanned WARNING: untranslated string: service boot setting unavailable =3D No valid = runlevel symlink was found for the initscript of this service. WARNING: untranslated string: spec rstack overflow =3D Speculative Return St= ack Overflow WARNING: untranslated string: system time =3D System Time (as of last page l= oad) WARNING: untranslated string: timeformat =3D %Y-%m-%d at %H:%M:%S %Z +WARNING: untranslated string: total =3D Total WARNING: untranslated string: transport mode does not support vti =3D VTI is= not support in transport mode WARNING: untranslated string: warning =3D Warning +WARNING: untranslated string: whitelisted =3D Whitelisted WARNING: untranslated string: wio =3D unknown string WARNING: untranslated string: wio checked =3D unknown string WARNING: untranslated string: wio cron =3D unknown string diff --git a/doc/language_issues.fr b/doc/language_issues.fr index 25193da6a..db8b6071e 100644 --- a/doc/language_issues.fr +++ b/doc/language_issues.fr @@ -428,6 +428,7 @@ WARNING: translation string unused: id WARNING: translation string unused: ids automatic rules update WARNING: translation string unused: ids oinkcode required WARNING: translation string unused: ids rules update +WARNING: translation string unused: ids ruleset settings WARNING: translation string unused: ike encryption WARNING: translation string unused: ike grouptype WARNING: translation string unused: ike integrity @@ -942,6 +943,7 @@ WARNING: translation string unused: zoneconf val vlan amo= unt assignment error WARNING: translation string unused: zoneconf val vlan tag assignment error WARNING: translation string unused: zoneconf val vlan tag range error WARNING: translation string unused: zoneconf val zoneslave amount error +WARNING: untranslated string: bypassed =3D Bypassed WARNING: untranslated string: core notice 3 =3D available. WARNING: untranslated string: data transfer =3D Data Transfer WARNING: untranslated string: enable disable client =3D unknown string @@ -981,6 +983,9 @@ WARNING: untranslated string: guardian no entries =3D unk= nown string WARNING: untranslated string: guardian service =3D unknown string WARNING: untranslated string: hostile networks total =3D Total Hostile Netwo= rks WARNING: untranslated string: ids provider eol =3D (EOL) +WARNING: untranslated string: ids rulesets =3D Rulesets +WARNING: untranslated string: ips throughput =3D Throughput +WARNING: untranslated string: last updated =3D Last Updated WARNING: untranslated string: load average =3D Load Average WARNING: untranslated string: oops something went wrong =3D Oops, something = went wrong... WARNING: untranslated string: ovpn roadwarrior server =3D OpenVPN Roadwarrio= r Server @@ -989,9 +994,12 @@ WARNING: untranslated string: processors =3D Processors WARNING: untranslated string: reg_file_data_sampling =3D Register File Data = Sampling (RFDS) WARNING: untranslated string: routing config added =3D unknown string WARNING: untranslated string: routing config changed =3D unknown string +WARNING: untranslated string: scanned =3D Scanned WARNING: untranslated string: system time =3D System Time (as of last page l= oad) WARNING: untranslated string: timeformat =3D %Y-%m-%d at %H:%M:%S %Z +WARNING: untranslated string: total =3D Total WARNING: untranslated string: warning =3D Warning +WARNING: untranslated string: whitelisted =3D Whitelisted WARNING: untranslated string: wio =3D unknown string WARNING: untranslated string: wio checked =3D unknown string WARNING: untranslated string: wio cron =3D unknown string diff --git a/doc/language_issues.it b/doc/language_issues.it index f00d959d5..553417e59 100644 --- a/doc/language_issues.it +++ b/doc/language_issues.it @@ -948,6 +948,7 @@ WARNING: untranslated string: autonomous system =3D Auton= omous System WARNING: untranslated string: available =3D available WARNING: untranslated string: block =3D Block WARNING: untranslated string: broken =3D Broken +WARNING: untranslated string: bypassed =3D Bypassed WARNING: untranslated string: cake profile bridged-llcsnap 32 =3D Bridged LL= C SNAP (32 bytes) WARNING: untranslated string: cake profile bridged-ptm 19 =3D Bridged PTM (1= 9 bytes) WARNING: untranslated string: cake profile bridged-vcmux 24 =3D Bridged VC-M= UX (24 bytes) @@ -1132,7 +1133,7 @@ WARNING: untranslated string: ids remove rule structure= s =3D Remove old rule struc WARNING: untranslated string: ids reset provider =3D Reset provider WARNING: untranslated string: ids ruleset autoupdate in progress =3D Ruleset= update in progress. Please wait until all operations have completed successf= ully... WARNING: untranslated string: ids ruleset is up to date =3D No update requir= ed - The ruleset is up to date. -WARNING: untranslated string: ids ruleset settings =3D Ruleset Settings +WARNING: untranslated string: ids rulesets =3D Rulesets WARNING: untranslated string: ids show =3D Show WARNING: untranslated string: ids subscription code required =3D The selecte= d ruleset requires a subscription code WARNING: untranslated string: ids the choosen provider is already in use =3D= The choosen provider is already in use. @@ -1173,6 +1174,7 @@ WARNING: untranslated string: ipblocklist logs =3D IP A= ddress Blocklist Logs WARNING: untranslated string: ipblocklist name =3D Name WARNING: untranslated string: ipblocklist output =3D Packets dropped (OUT) WARNING: untranslated string: ipblocklist use ipblocklists =3D Enable IP Blo= cklists +WARNING: untranslated string: ips throughput =3D Throughput WARNING: untranslated string: ipsec connection =3D IPsec Connection WARNING: untranslated string: ipsec dns server address is invalid =3D Invali= d DNS server IP address(es) WARNING: untranslated string: ipsec interface mode gre =3D GRE @@ -1185,6 +1187,7 @@ WARNING: untranslated string: ipsec roadwarrior endpoin= t =3D Host-to-Net Endpoint WARNING: untranslated string: ipsec routing table entries =3D IPsec Routing = Table Entries WARNING: untranslated string: ipsec settings =3D IPsec Settings WARNING: untranslated string: itlb multihit =3D iTLB MultiHit +WARNING: untranslated string: last updated =3D Last Updated WARNING: untranslated string: link-layer encapsulation =3D Link-Layer Encaps= ulation WARNING: untranslated string: load average =3D Load Average WARNING: untranslated string: local ip address =3D Local IP Address @@ -1272,6 +1275,7 @@ WARNING: untranslated string: samba join a domain =3D J= oin a domain WARNING: untranslated string: samba join domain =3D Join domain WARNING: untranslated string: samba server role member =3D Domain Member WARNING: untranslated string: samba server role standalone =3D Standalone +WARNING: untranslated string: scanned =3D Scanned WARNING: untranslated string: search =3D Search WARNING: untranslated string: secret =3D Secret WARNING: untranslated string: sent =3D Sent @@ -1309,6 +1313,7 @@ WARNING: untranslated string: token not set =3D No Toke= n has been given. WARNING: untranslated string: tor guard country any =3D Any country WARNING: untranslated string: tor guard nodes =3D Guard Nodes WARNING: untranslated string: tor use guard nodes =3D Use only these guard n= odes (one fingerprint per line) +WARNING: untranslated string: total =3D Total WARNING: untranslated string: traffic stat in =3D In WARNING: untranslated string: traffic stat out =3D Out WARNING: untranslated string: traffic stat title =3D RED Traffic @@ -1342,6 +1347,7 @@ WARNING: untranslated string: vpn weak =3D Weak WARNING: untranslated string: vulnerability =3D Vulnerability WARNING: untranslated string: vulnerable =3D Vulnerable WARNING: untranslated string: warning =3D Warning +WARNING: untranslated string: whitelisted =3D Whitelisted WARNING: untranslated string: whois results from =3D WHOIS results from WARNING: untranslated string: winbind daemon =3D Winbind Daemon WARNING: untranslated string: wio =3D unknown string diff --git a/doc/language_issues.nl b/doc/language_issues.nl index 9607f98af..0b16d098d 100644 --- a/doc/language_issues.nl +++ b/doc/language_issues.nl @@ -950,6 +950,7 @@ WARNING: untranslated string: autonomous system =3D Auton= omous System WARNING: untranslated string: available =3D available WARNING: untranslated string: block =3D Block WARNING: untranslated string: broken =3D Broken +WARNING: untranslated string: bypassed =3D Bypassed WARNING: untranslated string: cake profile bridged-llcsnap 32 =3D Bridged LL= C SNAP (32 bytes) WARNING: untranslated string: cake profile bridged-ptm 19 =3D Bridged PTM (1= 9 bytes) WARNING: untranslated string: cake profile bridged-vcmux 24 =3D Bridged VC-M= UX (24 bytes) @@ -1138,7 +1139,7 @@ WARNING: untranslated string: ids remove rule structure= s =3D Remove old rule struc WARNING: untranslated string: ids reset provider =3D Reset provider WARNING: untranslated string: ids ruleset autoupdate in progress =3D Ruleset= update in progress. Please wait until all operations have completed successf= ully... WARNING: untranslated string: ids ruleset is up to date =3D No update requir= ed - The ruleset is up to date. -WARNING: untranslated string: ids ruleset settings =3D Ruleset Settings +WARNING: untranslated string: ids rulesets =3D Rulesets WARNING: untranslated string: ids show =3D Show WARNING: untranslated string: ids subscription code required =3D The selecte= d ruleset requires a subscription code WARNING: untranslated string: ids the choosen provider is already in use =3D= The choosen provider is already in use. @@ -1181,6 +1182,7 @@ WARNING: untranslated string: ipblocklist logs =3D IP A= ddress Blocklist Logs WARNING: untranslated string: ipblocklist name =3D Name WARNING: untranslated string: ipblocklist output =3D Packets dropped (OUT) WARNING: untranslated string: ipblocklist use ipblocklists =3D Enable IP Blo= cklists +WARNING: untranslated string: ips throughput =3D Throughput WARNING: untranslated string: ipsec connection =3D IPsec Connection WARNING: untranslated string: ipsec dns server address is invalid =3D Invali= d DNS server IP address(es) WARNING: untranslated string: ipsec interface mode gre =3D GRE @@ -1193,6 +1195,7 @@ WARNING: untranslated string: ipsec roadwarrior endpoin= t =3D Host-to-Net Endpoint WARNING: untranslated string: ipsec routing table entries =3D IPsec Routing = Table Entries WARNING: untranslated string: ipsec settings =3D IPsec Settings WARNING: untranslated string: itlb multihit =3D iTLB MultiHit +WARNING: untranslated string: last updated =3D Last Updated WARNING: untranslated string: link-layer encapsulation =3D Link-Layer Encaps= ulation WARNING: untranslated string: load average =3D Load Average WARNING: untranslated string: local ip address =3D Local IP Address @@ -1295,6 +1298,7 @@ WARNING: untranslated string: samba join a domain =3D J= oin a domain WARNING: untranslated string: samba join domain =3D Join domain WARNING: untranslated string: samba server role member =3D Domain Member WARNING: untranslated string: samba server role standalone =3D Standalone +WARNING: untranslated string: scanned =3D Scanned WARNING: untranslated string: search =3D Search WARNING: untranslated string: secret =3D Secret WARNING: untranslated string: sent =3D Sent @@ -1335,6 +1339,7 @@ WARNING: untranslated string: token not set =3D No Toke= n has been given. WARNING: untranslated string: tor guard country any =3D Any country WARNING: untranslated string: tor guard nodes =3D Guard Nodes WARNING: untranslated string: tor use guard nodes =3D Use only these guard n= odes (one fingerprint per line) +WARNING: untranslated string: total =3D Total WARNING: untranslated string: transfers =3D Transfers WARNING: untranslated string: transport mode does not support vti =3D VTI is= not support in transport mode WARNING: untranslated string: twelve hours =3D 12 Hours @@ -1365,6 +1370,7 @@ WARNING: untranslated string: vpn weak =3D Weak WARNING: untranslated string: vulnerability =3D Vulnerability WARNING: untranslated string: vulnerable =3D Vulnerable WARNING: untranslated string: warning =3D Warning +WARNING: untranslated string: whitelisted =3D Whitelisted WARNING: untranslated string: whois results from =3D WHOIS results from WARNING: untranslated string: winbind daemon =3D Winbind Daemon WARNING: untranslated string: wio =3D unknown string diff --git a/doc/language_issues.pl b/doc/language_issues.pl index 92ad3b7be..a3acd734f 100644 --- a/doc/language_issues.pl +++ b/doc/language_issues.pl @@ -875,6 +875,7 @@ WARNING: untranslated string: available =3D available WARNING: untranslated string: bit =3D bit WARNING: untranslated string: block =3D Block WARNING: untranslated string: broken =3D Broken +WARNING: untranslated string: bypassed =3D Bypassed WARNING: untranslated string: cake profile bridged-llcsnap 32 =3D Bridged LL= C SNAP (32 bytes) WARNING: untranslated string: cake profile bridged-ptm 19 =3D Bridged PTM (1= 9 bytes) WARNING: untranslated string: cake profile bridged-vcmux 24 =3D Bridged VC-M= UX (24 bytes) @@ -1276,7 +1277,7 @@ WARNING: untranslated string: ids remove rule structure= s =3D Remove old rule struc WARNING: untranslated string: ids reset provider =3D Reset provider WARNING: untranslated string: ids ruleset autoupdate in progress =3D Ruleset= update in progress. Please wait until all operations have completed successf= ully... WARNING: untranslated string: ids ruleset is up to date =3D No update requir= ed - The ruleset is up to date. -WARNING: untranslated string: ids ruleset settings =3D Ruleset Settings +WARNING: untranslated string: ids rulesets =3D Rulesets WARNING: untranslated string: ids show =3D Show WARNING: untranslated string: ids subscription code required =3D The selecte= d ruleset requires a subscription code WARNING: untranslated string: ids the choosen provider is already in use =3D= The choosen provider is already in use. @@ -1323,6 +1324,7 @@ WARNING: untranslated string: ipblocklist logs =3D IP A= ddress Blocklist Logs WARNING: untranslated string: ipblocklist name =3D Name WARNING: untranslated string: ipblocklist output =3D Packets dropped (OUT) WARNING: untranslated string: ipblocklist use ipblocklists =3D Enable IP Blo= cklists +WARNING: untranslated string: ips throughput =3D Throughput WARNING: untranslated string: ipsec =3D IPsec WARNING: untranslated string: ipsec connection =3D IPsec Connection WARNING: untranslated string: ipsec dns server address is invalid =3D Invali= d DNS server IP address(es) @@ -1338,6 +1340,7 @@ WARNING: untranslated string: ipsec routing table entri= es =3D IPsec Routing Table WARNING: untranslated string: ipsec settings =3D IPsec Settings WARNING: untranslated string: itlb multihit =3D iTLB MultiHit WARNING: untranslated string: last =3D Last +WARNING: untranslated string: last updated =3D Last Updated WARNING: untranslated string: least preferred =3D least preferred WARNING: untranslated string: lifetime =3D Lifetime: WARNING: untranslated string: link-layer encapsulation =3D Link-Layer Encaps= ulation @@ -1474,6 +1477,7 @@ WARNING: untranslated string: samba join a domain =3D J= oin a domain WARNING: untranslated string: samba join domain =3D Join domain WARNING: untranslated string: samba server role member =3D Domain Member WARNING: untranslated string: samba server role standalone =3D Standalone +WARNING: untranslated string: scanned =3D Scanned WARNING: untranslated string: search =3D Search WARNING: untranslated string: secret =3D Secret WARNING: untranslated string: sent =3D Sent @@ -1568,6 +1572,7 @@ WARNING: untranslated string: tor traffic limit soft = =3D Traffic limit almost reac WARNING: untranslated string: tor traffic read written =3D Total traffic (re= ad/written) WARNING: untranslated string: tor use exit nodes =3D Use only these exit nod= es (one fingerprint per line) WARNING: untranslated string: tor use guard nodes =3D Use only these guard n= odes (one fingerprint per line) +WARNING: untranslated string: total =3D Total WARNING: untranslated string: traffic stat in =3D In WARNING: untranslated string: traffic stat out =3D Out WARNING: untranslated string: traffic stat title =3D RED Traffic @@ -1606,6 +1611,7 @@ WARNING: untranslated string: vpn weak =3D Weak WARNING: untranslated string: vulnerability =3D Vulnerability WARNING: untranslated string: vulnerable =3D Vulnerable WARNING: untranslated string: warning =3D Warning +WARNING: untranslated string: whitelisted =3D Whitelisted WARNING: untranslated string: whois results from =3D WHOIS results from WARNING: untranslated string: winbind daemon =3D Winbind Daemon WARNING: untranslated string: wio =3D unknown string diff --git a/doc/language_issues.ru b/doc/language_issues.ru index 35a590b6b..66b6cae13 100644 --- a/doc/language_issues.ru +++ b/doc/language_issues.ru @@ -870,6 +870,7 @@ WARNING: untranslated string: available =3D available WARNING: untranslated string: bit =3D bit WARNING: untranslated string: block =3D Block WARNING: untranslated string: broken =3D Broken +WARNING: untranslated string: bypassed =3D Bypassed WARNING: untranslated string: cake profile bridged-llcsnap 32 =3D Bridged LL= C SNAP (32 bytes) WARNING: untranslated string: cake profile bridged-ptm 19 =3D Bridged PTM (1= 9 bytes) WARNING: untranslated string: cake profile bridged-vcmux 24 =3D Bridged VC-M= UX (24 bytes) @@ -1271,7 +1272,7 @@ WARNING: untranslated string: ids remove rule structure= s =3D Remove old rule struc WARNING: untranslated string: ids reset provider =3D Reset provider WARNING: untranslated string: ids ruleset autoupdate in progress =3D Ruleset= update in progress. Please wait until all operations have completed successf= ully... WARNING: untranslated string: ids ruleset is up to date =3D No update requir= ed - The ruleset is up to date. -WARNING: untranslated string: ids ruleset settings =3D Ruleset Settings +WARNING: untranslated string: ids rulesets =3D Rulesets WARNING: untranslated string: ids show =3D Show WARNING: untranslated string: ids subscription code required =3D The selecte= d ruleset requires a subscription code WARNING: untranslated string: ids the choosen provider is already in use =3D= The choosen provider is already in use. @@ -1319,6 +1320,7 @@ WARNING: untranslated string: ipblocklist logs =3D IP A= ddress Blocklist Logs WARNING: untranslated string: ipblocklist name =3D Name WARNING: untranslated string: ipblocklist output =3D Packets dropped (OUT) WARNING: untranslated string: ipblocklist use ipblocklists =3D Enable IP Blo= cklists +WARNING: untranslated string: ips throughput =3D Throughput WARNING: untranslated string: ipsec =3D IPsec WARNING: untranslated string: ipsec connection =3D IPsec Connection WARNING: untranslated string: ipsec dns server address is invalid =3D Invali= d DNS server IP address(es) @@ -1334,6 +1336,7 @@ WARNING: untranslated string: ipsec routing table entri= es =3D IPsec Routing Table WARNING: untranslated string: ipsec settings =3D IPsec Settings WARNING: untranslated string: itlb multihit =3D iTLB MultiHit WARNING: untranslated string: last =3D Last +WARNING: untranslated string: last updated =3D Last Updated WARNING: untranslated string: least preferred =3D least preferred WARNING: untranslated string: lifetime =3D Lifetime: WARNING: untranslated string: link-layer encapsulation =3D Link-Layer Encaps= ulation @@ -1467,6 +1470,7 @@ WARNING: untranslated string: samba join a domain =3D J= oin a domain WARNING: untranslated string: samba join domain =3D Join domain WARNING: untranslated string: samba server role member =3D Domain Member WARNING: untranslated string: samba server role standalone =3D Standalone +WARNING: untranslated string: scanned =3D Scanned WARNING: untranslated string: search =3D Search WARNING: untranslated string: secret =3D Secret WARNING: untranslated string: sent =3D Sent @@ -1561,6 +1565,7 @@ WARNING: untranslated string: tor traffic limit soft = =3D Traffic limit almost reac WARNING: untranslated string: tor traffic read written =3D Total traffic (re= ad/written) WARNING: untranslated string: tor use exit nodes =3D Use only these exit nod= es (one fingerprint per line) WARNING: untranslated string: tor use guard nodes =3D Use only these guard n= odes (one fingerprint per line) +WARNING: untranslated string: total =3D Total WARNING: untranslated string: traffic stat in =3D In WARNING: untranslated string: traffic stat out =3D Out WARNING: untranslated string: traffic stat title =3D RED Traffic @@ -1599,6 +1604,7 @@ WARNING: untranslated string: vpn weak =3D Weak WARNING: untranslated string: vulnerability =3D Vulnerability WARNING: untranslated string: vulnerable =3D Vulnerable WARNING: untranslated string: warning =3D Warning +WARNING: untranslated string: whitelisted =3D Whitelisted WARNING: untranslated string: whois results from =3D WHOIS results from WARNING: untranslated string: winbind daemon =3D Winbind Daemon WARNING: untranslated string: wio =3D unknown string diff --git a/doc/language_issues.tr b/doc/language_issues.tr index 3bf595efe..ec657539f 100644 --- a/doc/language_issues.tr +++ b/doc/language_issues.tr @@ -935,6 +935,7 @@ WARNING: untranslated string: asn lookup failed =3D AS lo= okup failed WARNING: untranslated string: autonomous system =3D Autonomous System WARNING: untranslated string: available =3D available WARNING: untranslated string: broken =3D Broken +WARNING: untranslated string: bypassed =3D Bypassed WARNING: untranslated string: cake profile bridged-llcsnap 32 =3D Bridged LL= C SNAP (32 bytes) WARNING: untranslated string: cake profile bridged-ptm 19 =3D Bridged PTM (1= 9 bytes) WARNING: untranslated string: cake profile bridged-vcmux 24 =3D Bridged VC-M= UX (24 bytes) @@ -1074,7 +1075,7 @@ WARNING: untranslated string: ids remove rule structure= s =3D Remove old rule struc WARNING: untranslated string: ids reset provider =3D Reset provider WARNING: untranslated string: ids ruleset autoupdate in progress =3D Ruleset= update in progress. Please wait until all operations have completed successf= ully... WARNING: untranslated string: ids ruleset is up to date =3D No update requir= ed - The ruleset is up to date. -WARNING: untranslated string: ids ruleset settings =3D Ruleset Settings +WARNING: untranslated string: ids rulesets =3D Rulesets WARNING: untranslated string: ids show =3D Show WARNING: untranslated string: ids subscription code required =3D The selecte= d ruleset requires a subscription code WARNING: untranslated string: ids the choosen provider is already in use =3D= The choosen provider is already in use. @@ -1110,6 +1111,7 @@ WARNING: untranslated string: ipblocklist logs =3D IP A= ddress Blocklist Logs WARNING: untranslated string: ipblocklist name =3D Name WARNING: untranslated string: ipblocklist output =3D Packets dropped (OUT) WARNING: untranslated string: ipblocklist use ipblocklists =3D Enable IP Blo= cklists +WARNING: untranslated string: ips throughput =3D Throughput WARNING: untranslated string: ipsec connection =3D IPsec Connection WARNING: untranslated string: ipsec dns server address is invalid =3D Invali= d DNS server IP address(es) WARNING: untranslated string: ipsec interface mode gre =3D GRE @@ -1122,6 +1124,7 @@ WARNING: untranslated string: ipsec roadwarrior endpoin= t =3D Host-to-Net Endpoint WARNING: untranslated string: ipsec routing table entries =3D IPsec Routing = Table Entries WARNING: untranslated string: ipsec settings =3D IPsec Settings WARNING: untranslated string: itlb multihit =3D iTLB MultiHit +WARNING: untranslated string: last updated =3D Last Updated WARNING: untranslated string: link-layer encapsulation =3D Link-Layer Encaps= ulation WARNING: untranslated string: load average =3D Load Average WARNING: untranslated string: local ip address =3D Local IP Address @@ -1179,6 +1182,7 @@ WARNING: untranslated string: routing config changed = =3D unknown string WARNING: untranslated string: routing table =3D unknown string WARNING: untranslated string: samba server role member =3D Domain Member WARNING: untranslated string: samba server role standalone =3D Standalone +WARNING: untranslated string: scanned =3D Scanned WARNING: untranslated string: secret =3D Secret WARNING: untranslated string: sent =3D Sent WARNING: untranslated string: service boot setting unavailable =3D No valid = runlevel symlink was found for the initscript of this service. @@ -1212,6 +1216,7 @@ WARNING: untranslated string: token not set =3D No Toke= n has been given. WARNING: untranslated string: tor guard country any =3D Any country WARNING: untranslated string: tor guard nodes =3D Guard Nodes WARNING: untranslated string: tor use guard nodes =3D Use only these guard n= odes (one fingerprint per line) +WARNING: untranslated string: total =3D Total WARNING: untranslated string: traffic stat in =3D In WARNING: untranslated string: traffic stat out =3D Out WARNING: untranslated string: traffic stat title =3D RED Traffic @@ -1226,6 +1231,7 @@ WARNING: untranslated string: vpn wait =3D WAITING WARNING: untranslated string: vulnerability =3D Vulnerability WARNING: untranslated string: vulnerable =3D Vulnerable WARNING: untranslated string: warning =3D Warning +WARNING: untranslated string: whitelisted =3D Whitelisted WARNING: untranslated string: whois results from =3D WHOIS results from WARNING: untranslated string: winbind daemon =3D Winbind Daemon WARNING: untranslated string: wio =3D unknown string diff --git a/doc/language_missings b/doc/language_missings index 98856b0e8..6a44630bd 100644 --- a/doc/language_missings +++ b/doc/language_missings @@ -103,6 +103,7 @@ < upload fcdsl.o < user management < vpn configuration main +< wg < winbind daemon < wireguard < wlanap 802.11w disabled @@ -120,6 +121,7 @@ < access point name is invalid < access point name is required < addon +< bypassed < cpu frequency < data transfer < dhcp fixed ip address in dynamic range @@ -136,8 +138,11 @@ < hostile networks out < hostile networks total < ids provider eol +< ids rulesets < ids unsupported provider < invalid ip or hostname +< ips throughput +< last updated < load average < log drop hostile in < log drop hostile out @@ -150,12 +155,16 @@ < reg_file_data_sampling < reiserfs warning1 < reiserfs warning2 +< scanned < service boot setting unavailable < spec rstack overflow < system time < timeformat +< total < transport mode does not support vti < warning +< wg +< whitelisted < wireguard < wlanap < wlanap psk @@ -168,6 +177,7 @@ < ansi t1.483 < bewan adsl pci st < bewan adsl usb +< bypassed < data transfer < extrahd because it it outside the allowed mount path < fwdfw syn flood protection @@ -175,16 +185,23 @@ < g.lite < hostile networks total < ids provider eol +< ids rulesets < ids unsupported provider +< ips throughput +< last updated < load average < oops something went wrong < ovpn roadwarrior server < processors < reg_file_data_sampling +< scanned < system time < timeformat +< total < upload fcdsl.o < warning +< wg +< whitelisted < wireguard < wlanap psk < wlanap wireless mode @@ -226,6 +243,7 @@ < available < block < broken +< bypassed < cake profile bridged-llcsnap 32 < cake profile bridged-ptm 19 < cake profile bridged-vcmux 24 @@ -444,6 +462,7 @@ < ids reset provider < ids ruleset autoupdate in progress < ids ruleset is up to date +< ids rulesets < ids ruleset settings < ids show < ids subscription code required @@ -503,7 +522,9 @@ < ipsec roadwarrior endpoint < ipsec routing table entries < ipsec settings +< ips throughput < itlb multihit +< last updated < legacy architecture warning < link-layer encapsulation < load average @@ -595,6 +616,7 @@ < samba join domain < samba server role member < samba server role standalone +< scanned < search < secret < sent @@ -633,6 +655,7 @@ < tor guard country any < tor guard nodes < tor use guard nodes +< total < traffic stat in < traffic stat out < traffic stat title @@ -668,6 +691,8 @@ < vulnerable < warning < Weekly +< wg +< whitelisted < whois results from < winbind daemon < wireguard @@ -761,6 +786,7 @@ < available < block < broken +< bypassed < cake profile bridged-llcsnap 32 < cake profile bridged-ptm 19 < cake profile bridged-vcmux 24 @@ -984,6 +1010,7 @@ < ids reset provider < ids ruleset autoupdate in progress < ids ruleset is up to date +< ids rulesets < ids ruleset settings < ids show < ids subscription code required @@ -1045,7 +1072,9 @@ < ipsec roadwarrior endpoint < ipsec routing table entries < ipsec settings +< ips throughput < itlb multihit +< last updated < legacy architecture warning < link-layer encapsulation < load average @@ -1155,6 +1184,7 @@ < samba join domain < samba server role member < samba server role standalone +< scanned < search < secret < sent @@ -1197,6 +1227,7 @@ < tor guard country any < tor guard nodes < tor use guard nodes +< total < transfers < transport mode does not support vti < twelve hours @@ -1229,6 +1260,8 @@ < vulnerable < warning < Weekly +< wg +< whitelisted < whois results from < winbind daemon < wireguard @@ -1336,6 +1369,7 @@ < bit < block < broken +< bypassed < cake profile bridged-llcsnap 32 < cake profile bridged-ptm 19 < cake profile bridged-vcmux 24 @@ -1829,6 +1863,7 @@ < ids reset provider < ids ruleset autoupdate in progress < ids ruleset is up to date +< ids rulesets < ids ruleset settings < ids show < ids subscription code required @@ -1897,8 +1932,10 @@ < ipsec roadwarrior endpoint < ipsec routing table entries < ipsec settings +< ips throughput < itlb multihit < last +< last updated < least preferred < legacy architecture warning < lifetime @@ -2057,6 +2094,7 @@ < samba join domain < samba server role member < samba server role standalone +< scanned < search < secret < sent @@ -2160,6 +2198,7 @@ < tor traffic read written < tor use exit nodes < tor use guard nodes +< total < traffic stat in < traffic stat out < traffic stat title @@ -2205,6 +2244,8 @@ < vulnerable < warning < Weekly +< wg +< whitelisted < whois results from < winbind daemon < wireguard @@ -2344,6 +2385,7 @@ < bit < block < broken +< bypassed < cake profile bridged-llcsnap 32 < cake profile bridged-ptm 19 < cake profile bridged-vcmux 24 @@ -2842,6 +2884,7 @@ < ids reset provider < ids ruleset autoupdate in progress < ids ruleset is up to date +< ids rulesets < ids ruleset settings < ids show < ids subscription code required @@ -2911,8 +2954,10 @@ < ipsec roadwarrior endpoint < ipsec routing table entries < ipsec settings +< ips throughput < itlb multihit < last +< last updated < least preferred < legacy architecture warning < lifetime @@ -3069,6 +3114,7 @@ < samba join domain < samba server role member < samba server role standalone +< scanned < search < secret < sent @@ -3172,6 +3218,7 @@ < tor traffic read written < tor use exit nodes < tor use guard nodes +< total < traffic stat in < traffic stat out < traffic stat title @@ -3218,6 +3265,8 @@ < warning < week-graph < Weekly +< wg +< whitelisted < whois results from < winbind daemon < wireguard @@ -3333,6 +3382,7 @@ < autonomous system < available < broken +< bypassed < cake profile bridged-llcsnap 32 < cake profile bridged-ptm 19 < cake profile bridged-vcmux 24 @@ -3447,6 +3497,7 @@ < ids reset provider < ids ruleset autoupdate in progress < ids ruleset is up to date +< ids rulesets < ids ruleset settings < ids show < ids subscription code required @@ -3501,7 +3552,9 @@ < ipsec roadwarrior endpoint < ipsec routing table entries < ipsec settings +< ips throughput < itlb multihit +< last updated < legacy architecture warning < link-layer encapsulation < load average @@ -3558,6 +3611,7 @@ < runmode < samba server role member < samba server role standalone +< scanned < secret < sent < service boot setting unavailable @@ -3592,6 +3646,7 @@ < tor guard country any < tor guard nodes < tor use guard nodes +< total < traffic stat in < traffic stat out < traffic stat title @@ -3608,6 +3663,8 @@ < vulnerable < warning < Weekly +< wg +< whitelisted < whois results from < winbind daemon < wireguard diff --git a/html/cgi-bin/getrrdimage.cgi b/html/cgi-bin/getrrdimage.cgi index f80f0138f..77556217d 100644 --- a/html/cgi-bin/getrrdimage.cgi +++ b/html/cgi-bin/getrrdimage.cgi @@ -35,7 +35,7 @@ require "${General::swroot}/graphs.pl"; =20 # List of graph origins that getrrdimage.cgi can process directly # (unknown origins are forwarded to ensure compatibility) -my @supported_origins =3D ("hardwaregraphs.cgi", "media.cgi", +my @supported_origins =3D ("ids.cgi", "hardwaregraphs.cgi", "media.cgi", "memory.cgi", "netexternal.cgi", "netinternal.cgi", "netother.cgi", "netovpnrw.cgi", "netovpnsrv.cgi", "qos.cgi", "services.cgi", "system.cgi"); =20 @@ -80,7 +80,13 @@ _start_svg_output(); # Graphs are first grouped by their origin. # This is because some graph categories require special parameter handling. my $graphstatus =3D ''; -if($origin eq "hardwaregraphs.cgi") { ## hardwaregraphs.cgi +if ($origin eq "ids.cgi") { ## ids.cgi + if ($graph eq "ips-throughput") { + $graphstatus =3D Graphs::updateipsthroughputgraph($range); + } else { + $graphstatus =3D "Unknown graph name."; + } +} elsif($origin eq "hardwaregraphs.cgi") { ## hardwaregraphs.cgi if($graph eq "hwtemp") { $graphstatus =3D Graphs::updatehwtempgraph($range); } elsif($graph eq "hwfan") { diff --git a/html/cgi-bin/ids.cgi b/html/cgi-bin/ids.cgi index 502e2a125..4eaf4911d 100644 --- a/html/cgi-bin/ids.cgi +++ b/html/cgi-bin/ids.cgi @@ -53,6 +53,9 @@ my %ignored=3D(); # the list of zones in an array. my @network_zones =3D &Network::get_available_network_zones(); =20 +# Always show IPsec & Wireguard +push(@network_zones, "ipsec", "wg"); + # Check if openvpn is started and add it to the array of network zones. if ( -e "/var/run/openvpn.pid") { push(@network_zones, "ovpn"); @@ -69,7 +72,9 @@ my %colourhash =3D ( 'green' =3D> $Header::colourgreen, 'blue' =3D> $Header::colourblue, 'orange' =3D> $Header::colourorange, - 'ovpn' =3D> $Header::colourovpn + 'ipsec' =3D> $Header::colourvpn, + 'ovpn' =3D> $Header::colourovpn, + 'wg' =3D> $Header::colourwg, ); =20 &Header::showhttpheaders(); @@ -1003,7 +1008,7 @@ sub show_mainpage() { $checked{'ENABLE_IDS'}{$idssettings{'ENABLE_IDS'}} =3D "checked=3D'checked'= "; =20 # Draw current state of the IDS - &Header::openbox('100%', 'left', $Lang::tr{'intrusion detection system'}); + &Header::opensection(); =20 &Header::ServiceStatus({ $Lang::tr{'intrusion prevention system'} =3D> { @@ -1013,30 +1018,29 @@ sub show_mainpage() { =20 # Only show this area, if at least one ruleset provider is configured. if (%used_providers) { + my $num_zones =3D scalar @network_zones; =20 print <

$Lang::tr{'settings'}

+
=20
- - - =20 - - - - - + + =20 - + =20 @@ -1064,21 +1068,29 @@ END $checked_input =3D "checked =3D 'checked'"; } =20 - print "\n"; + print < + + +END } =20 print < -
+  $Lang::tr{'ids enable'}








+   +
$Lang::tr{'ids monitored interfaces'}
 + $Lang::tr{'ids monitored interfaces'} +
\n"; - print "\n"; - print " $Lang::tr{'enabled on'} $= Lang::tr{$zone_name}\n"; - print "
=20 -

+ + +   + + =20 - - +
+ +
@@ -1087,21 +1099,25 @@ END =20 } =20 - &Header::closebox(); + &Header::closesection(); + + # Throughput Graph + if (-e "/var/log/rrd/collectd/localhost/iptables-mangle-IPS/ipt_bytes-BYPAS= SED.rrd") { + &Header::graph("$Lang::tr{'ips throughput'}", "ids.cgi", "ips-throughput",= "day"); + } =20 # # Used Ruleset Providers section. # - &Header::openbox('100%', 'center', $Lang::tr{'ids ruleset settings'}); + &Header::openbox('100%', 'center', $Lang::tr{'ids rulesets'}); =20 print < + - - - - - + END my $line =3D 1; @@ -1122,13 +1138,6 @@ END my $status =3D $used_providers{$id}[3]; my $unsupported; =20 - # Check if the item number is even or not. - if ($line % 2) { - $col=3D"bgcolor=3D'$color{'color22'}'"; - } else { - $col=3D"bgcolor=3D'$color{'color20'}'"; - } - # Handle providers which are not longer supported. unless ($IDS::Ruleset::Providers{$provider}{'dl_url'}) { $col =3D "bgcolor=3D'$Header::colouryellow'"; @@ -1161,8 +1170,8 @@ END =20 print < - - + + =20 \n"; - print "\n"; } =20 @@ -1214,8 +1223,6 @@ END # Section to add new elements or edit existing ones. print < -
-
=20
@@ -1240,11 +1247,11 @@ END &Header::openbox('100%', 'center', $Lang::tr{'ids ignored hosts'}); =20 print < +
$Lang::tr{'ids provid= er'}$Lang::tr{'date'}= $Lan= g::tr{'ids autoupdates'}$Lan= g::tr{'action'}$Lang::tr{'ids provider'} + $Lang::tr{'last updated'} + $Lang::tr{'ids autoupdates'} + $Lang::tr{'action'}
$provider_name $unsupported$rulesetdate$provider_name $unsupported$rulesetdate
@@ -1205,7 +1214,7 @@ END } else { # Print notice that currently no hosts are ignored. print "
$Lang::tr{'guardian no entries'}<= /td>\n"; + print "$Lang::tr{'guardian no entries'}<= /td>\n"; print "
- - - + END # Check if some hosts have been added to be ignored. @@ -1252,7 +1259,7 @@ END my $col =3D ""; =20 # Loop through all entries of the hash. - while( (my $key) =3D each %ignored) { + foreach my $key (sort { $ignored{$a}[0] <=3D> $ignored{$b}[0] } keys %ign= ored) { # Assign data array positions to some nice variable names. my $address =3D $ignored{$key}[0]; my $remark =3D $ignored{$key}[1]; @@ -1261,10 +1268,6 @@ END # Check if the key (id) number is even or not. if ($cgiparams{'ID'} eq $key) { $col=3D"bgcolor=3D'${Header::colouryellow}'"; - } elsif ($key % 2) { - $col=3D"bgcolor=3D'$color{'color22'}'"; - } else { - $col=3D"bgcolor=3D'$color{'color20'}'"; } =20 # Choose icon for the checkbox. @@ -1282,8 +1285,8 @@ END =20 print < - - + + =20 \n"; - print "\n"; + print "\n"; print "\n"; } =20 @@ -1322,12 +1325,10 @@ END =20 # Section to add new elements or edit existing ones. print < -
-
+ + =20 -
-
$Lang::tr{'ip address= '}$Lang::tr{'remark'}$Lang::tr{'ip address'} + $Lang::tr{'remark'} +
$address$remark$address$remark @@ -1314,7 +1317,7 @@ END } else { # Print notice that currently no hosts are ignored. print "
$Lang::tr{'guardian no entries'}= $Lang::tr{'guardian no entries'}=
+
END =20 # Assign correct headline and button text. @@ -1338,30 +1339,36 @@ END # Check if an ID (key) has been given, in this case an existing entry shou= ld be edited. if ($cgiparams{'ID'} ne '') { $buttontext =3D $Lang::tr{'update'}; - print "\n"; + print "\n"; =20 # Grab address and remark for the given key. $entry_address =3D $ignored{$cgiparams{'ID'}}[0]; $entry_remark =3D $ignored{$cgiparams{'ID'}}[1]; } else { $buttontext =3D $Lang::tr{'add'}; - print "\n"; + print "\n"; } =20 print < - - - + + + + + + + + =20 - - - + + -
$Lang::tr{'update'}
$Lang::tr{'update'}
$Lang::tr{'dnsforward= add a new entry'}
$Lang::tr{'dnsforward add a new entry'}=
$Lang::tr{'ip address'}: $Lang::tr{'ip address'} + +
$Lang::tr{'remark'} + +
$Lang::tr{'remark'}:
- + END =20 &Header::closebox(); diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl index a718228bc..0598952ca 100644 --- a/langs/de/cgi-bin/de.pl +++ b/langs/de/cgi-bin/de.pl @@ -503,6 +503,7 @@ 'broken pipe' =3D> 'Zerbrochene Pipe', 'buffered memory' =3D> 'Pufferspeicher ', 'buffers' =3D> 'Puffer', +'bypassed' =3D> '=C3=9Cbersprungen', 'bytes' =3D> 'Bytes', 'bytes per second' =3D> 'Bytes pro Sekunde', 'bytes received' =3D> 'Bytes empfangen', @@ -1413,6 +1414,7 @@ 'ids ruleset autoupdate in progress' =3D> 'Der Regelsatz wird gerade aktuali= siert. Bitte warten Sie, bis dieser Vorgang erfolgreich beendet wurde...', 'ids ruleset is up to date' =3D> 'Regelset ist aktuell - Keine Aktualisierun= g notwendig.', 'ids ruleset settings' =3D> 'Regelsatzeinstellungen', +'ids rulesets' =3D> 'Regels=C3=A4tze', 'ids show' =3D> 'Anzeigen', 'ids the choosen provider is already in use' =3D> 'Der gewh=C3=A4hlte Provid= er wird bereits verwendet.', 'ids unable to download the ruleset' =3D> 'Das Regelset konnte nicht herunte= rgeladen werden.', @@ -1571,6 +1573,7 @@ 'ipfire side is invalid' =3D> 'IPFire Seite ist ung=C3=BCltig.', 'ipfires hostname' =3D> 'IPFire\'s Hostname', 'ipinfo' =3D> 'IP-Info', +'ips throughput' =3D> 'Durchsatz', 'ipsec' =3D> 'IPsec', 'ipsec connection' =3D> 'IPsec-Verbindung', 'ipsec interface mode gre' =3D> 'GRE', @@ -1603,6 +1606,7 @@ 'languagepurpose' =3D> 'W=C3=A4hlen Sie eine Sprache, in der IPFire angezeig= t werden soll:', 'last' =3D> 'Letzte', 'last activity' =3D> 'Letzte Aktivit=C3=A4t', +'last updated' =3D> 'Zuletzt Aktualisiert', 'lateprompting' =3D> 'Late prompting', 'lease expires' =3D> 'Zuordnung verf=C3=A4llt', 'least preferred' =3D> 'weniger pr=C3=A4feriert', @@ -2218,6 +2222,7 @@ 'save error' =3D> 'Konfigurationsarchiv-Datei konnte nicht gespeichert werde= n', 'save settings' =3D> 'Einstellungen speichern', 'save-adv-options' =3D> 'Erweiterte Optionen speichern', +'scanned' =3D> 'Gescannt', 'script name' =3D> 'Skriptname:', 'search' =3D> 'Suchen', 'secondary dns' =3D> 'Sekund=C3=A4rer DNS-Server:', @@ -2493,6 +2498,7 @@ 'tor traffic read written' =3D> 'Gesamter Traffic (empfangen/gesendet)', 'tor use exit nodes' =3D> 'Nur diese Exitknoten benutzen (ein Fingerabdruck = pro Zeile)', 'tor use guard nodes' =3D> 'Nur diese Guardknoten benutzen (ein Fingerabdruc= k pro Zeile)', +'total' =3D> 'Gesamt', 'total connection time' =3D> 'Gesamte Verbindungszeit', 'total hits for log section' =3D> 'Gesamte Treffer f=C3=BCr Protokollsektion= ', 'traffic back' =3D> 'Zur=C3=BCck', @@ -2936,6 +2942,7 @@ 'week-graph' =3D> 'Woche', 'weekly firewallhits' =3D> 'w=C3=B6chentliche Firewalltreffer', 'weeks' =3D> 'Wochen', +'whitelisted' =3D> 'Ausgenommen', 'whois results from' =3D> 'WHOIS-Ergebnisse von', 'wildcards' =3D> 'Wildcards', 'wins server' =3D> 'WINS-Server', diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index dca9f1645..91ea2e64a 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -524,6 +524,7 @@ 'broken pipe' =3D> 'Broken pipe', 'buffered memory' =3D> 'Buffered Memory', 'buffers' =3D> 'buffers', +'bypassed' =3D> 'Bypassed', 'bytes per second' =3D> 'Bytes per Second', 'bytes received' =3D> 'Bytes Received', 'bytes sent' =3D> 'Bytes Sent', @@ -1466,6 +1467,7 @@ 'ids ruleset autoupdate in progress' =3D> 'Ruleset update in progress. Pleas= e wait until all operations have completed successfully...', 'ids ruleset is up to date' =3D> 'No update required - The ruleset is up to = date.', 'ids ruleset settings' =3D> 'Ruleset Settings', +'ids rulesets' =3D> 'Rulesets', 'ids show' =3D> 'Show', 'ids subscription code required' =3D> 'The selected ruleset requires a subsc= ription code', 'ids the choosen provider is already in use' =3D> 'The choosen provider is a= lready in use.', @@ -1625,6 +1627,7 @@ 'ipfire side is invalid' =3D> 'IPFire side is invalid.', 'ipfires hostname' =3D> 'IPFire\'s Hostname', 'ipinfo' =3D> 'IP info', +'ips throughput' =3D> 'Throughput', 'ipsec' =3D> 'IPsec', 'ipsec connection' =3D> 'IPsec Connection', 'ipsec dns server address is invalid' =3D> 'Invalid DNS server IP address(es= )', @@ -1660,6 +1663,7 @@ 'languagepurpose' =3D> 'Select the language you wish IPFire to display in:', 'last' =3D> 'Last', 'last activity' =3D> 'Last Activity', +'last updated' =3D> 'Last Updated', 'lateprompting' =3D> 'Lateprompting', 'lease expires' =3D> 'Lease expires', 'least preferred' =3D> 'least preferred', @@ -2289,6 +2293,7 @@ 'save error' =3D> 'Unable to save configuration archive file', 'save settings' =3D> 'Save settings', 'save-adv-options' =3D> 'Save advanced options', +'scanned' =3D> 'Scanned', 'script name' =3D> 'Script name:', 'search' =3D> 'Search', 'secondary dns' =3D> 'Secondary DNS:', @@ -2573,6 +2578,7 @@ 'tor traffic read written' =3D> 'Total traffic (read/written)', 'tor use exit nodes' =3D> 'Use only these exit nodes (one fingerprint per li= ne)', 'tor use guard nodes' =3D> 'Use only these guard nodes (one fingerprint per = line)', +'total' =3D> 'Total', 'total connection time' =3D> 'Total Connection Time', 'total hits for log section' =3D> 'Total hits for log section', 'traffic back' =3D> 'Back', @@ -3020,6 +3026,8 @@ 'week-graph' =3D> 'Week', 'weekly firewallhits' =3D> 'weekly firewallhits', 'weeks' =3D> 'Weeks', +'wg' =3D> 'WireGuard', +'whitelisted' =3D> 'Whitelisted', 'whois results from' =3D> 'WHOIS results from', 'wildcards' =3D> 'Wildcards', 'winbind daemon' =3D> 'Winbind Daemon', diff --git a/lfs/suricata b/lfs/suricata index 88f3c4575..dcee61ea1 100644 --- a/lfs/suricata +++ b/lfs/suricata @@ -132,5 +132,8 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) # Install converter script needed for Core Update 167 install -m 0755 $(DIR_SRC)/config/suricata/convert-ids-backend-files /usr/s= bin/convert-ids-backend-files =20 + # Install the watcher + install -v -m 755 $(DIR_SRC)/config/suricata/suricata-watcher /usr/bin/suri= cata-watcher + @rm -rf $(DIR_APP) @$(POSTBUILD) diff --git a/src/initscripts/networking/functions.network b/src/initscripts/n= etworking/functions.network index e134d0cce..eb83b183d 100644 --- a/src/initscripts/networking/functions.network +++ b/src/initscripts/networking/functions.network @@ -54,6 +54,86 @@ bin2ip() { echo "${address[*]}" } =20 +network_get_intfs() { + local zone=3D"${1}" + + case "${zone^^}" in + RED) + # For PPPoE, the RED interface is called ppp0 (unless we use QMI) + if [ "${RED_TYPE}" =3D "PPPOE" ] && [ "${RED_DRIVER}" !=3D "qmi_wwan" ]; = then + echo "ppp0" + return 0 + + # Otherwise we return RED_DEV + elif [ -n "${RED_DEV}" ]; then + echo "${RED_DEV}" + return 0 + fi + ;; + + GREEN) + if [ -n "${GREEN_DEV}" ]; then + echo "${GREEN_DEV}" + return 0 + fi + ;; + + ORANGE) + if [ -n "${ORANGE_DEV}" ]; then + echo "${ORANGE_DEV}" + return 0 + fi + ;; + + BLUE) + if [ -n "${BLUE_DEV}" ]; then + echo "${BLUE_DEV}" + return 0 + fi + ;; + + IPSEC) + local VARS=3D( + id status x1 x2 type x3 x4 x5 x6 x7 x8 x9 x10 + x11 x12 x13 x14 x15 x16 x17 x18 x19 x20 + x21 x22 x23 x24 x25 x26 x27 x28 x29 x30 + x31 x32 x33 x34 interface_mode rest + ) + + while IFS=3D"," read -r "${VARS[@]}"; do + # Check if the connection is enabled + [ "${status}" =3D "on" ] || continue + + # Check if this a net-to-net connection + [ "${type}" =3D "net" ] || continue + + # Determine the interface name + case "${interface_mode}" in + gre|vti) + echo "${interface_mode}${id}" + ;; + esac + done < /var/ipfire/vpn/config + + return 0 + ;; + + WIREGUARD|WG) + echo "wg+" + return 0 + ;; + + OPENVPN|OVPN) + # OpenVPN is using all tun devices + echo "tun+" + return 0 + ;; + esac + + # Not found + return 1 +} + network_get_address() { local network=3D"${1}" =20 diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall index 6727e4a20..139d94aa0 100644 --- a/src/initscripts/system/firewall +++ b/src/initscripts/system/firewall @@ -39,11 +39,6 @@ fi =20 NAT_MASK=3D"0x0f000000" =20 -IPS_REPEAT_MARK=3D"0x80000000" -IPS_REPEAT_MASK=3D"0x80000000" -IPS_BYPASS_MARK=3D"0x40000000" -IPS_BYPASS_MASK=3D"0x40000000" - IPSET_DB_DIR=3D"/var/lib/location/ipset" =20 SYNPROXY_OPTIONS=3D( @@ -84,16 +79,6 @@ iptables_init() { modprobe nf_log_ipv4 sysctl -q -w net.netfilter.nf_log.2=3Dnf_log_ipv4 =20 - # IPS Bypass Chain which stores the BYPASS bit in connection tracking - iptables -N IPSBYPASS - iptables -A IPSBYPASS -j CONNMARK --save-mark --mask "$(( ~IPS_REPEAT_MASK = & 0xffffffff ))" - - # Jump into bypass chain when the BYPASS bit is set - for chain in INPUT FORWARD OUTPUT; do - iptables -A "${chain}" -m mark \ - --mark "$(( IPS_REPEAT_MARK | IPS_BYPASS_MARK ))/$(( IPS_REPEAT_MASK | IP= S_BYPASS_MASK ))" -j IPSBYPASS - done - # Empty LOG_DROP and LOG_REJECT chains iptables -N LOG_DROP iptables -A LOG_DROP -m limit --limit 10/second -j LOG @@ -175,7 +160,7 @@ iptables_init() { iptables -A CTOUTPUT -p icmp -m conntrack --ctstate RELATED -j ACCEPT =20 # Restore any connection marks - iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark + iptables -t mangle -A PREROUTING -m mark --mark 0 -j CONNMARK --restore-mark =20 # Fix for braindead ISPs iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to= -pmtu @@ -236,15 +221,6 @@ iptables_init() { iptables -A FORWARD -i tun+ -j OVPNBLOCK iptables -A FORWARD -o tun+ -j OVPNBLOCK =20 - # IPS (Suricata) chains - iptables -N IPS_INPUT - iptables -N IPS_FORWARD - iptables -N IPS_OUTPUT - - for chain in INPUT FORWARD OUTPUT; do - iptables -A "${chain}" -m mark --mark "0x0/$(( IPS_REPEAT_MASK | IPS_BYPAS= S_MASK ))" -j "IPS_${chain}" - done - # OpenVPN transfer network translation iptables -t nat -N OVPNNAT iptables -t nat -A POSTROUTING -j OVPNNAT @@ -399,6 +375,22 @@ iptables_init() { -m mark --mark "0x04000000/${NAT_MASK}" -j SNAT --to-source "${ORANGE_ADD= RESS}" fi =20 + # IPS (Suricata) chains + iptables -t mangle -N IPS + iptables -t mangle -N IPS_CLEAR + iptables -t mangle -N IPS_SCAN_IN + iptables -t mangle -N IPS_SCAN_OUT + + iptables -t mangle -A INPUT -j IPS_SCAN_IN + iptables -t mangle -A FORWARD -j IPS_SCAN_IN + iptables -t mangle -A FORWARD -j IPS_SCAN_OUT + iptables -t mangle -A OUTPUT -j IPS_SCAN_OUT + + for chain in INPUT FORWARD OUTPUT; do + iptables -t mangle -A "${chain}" -j IPS + iptables -t mangle -A "${chain}" -j IPS_CLEAR + done + # RED chain, used for the red interface iptables -N REDINPUT iptables -A INPUT -j REDINPUT diff --git a/src/initscripts/system/suricata b/src/initscripts/system/suricata index 79f9478c3..a753e32e6 100644 --- a/src/initscripts/system/suricata +++ b/src/initscripts/system/suricata @@ -21,140 +21,150 @@ =20 . /etc/sysconfig/rc . ${rc_functions} - -PATH=3D/usr/local/sbin:/usr/local/bin:/bin:/usr/bin:/sbin:/usr/sbin; export = PATH +. /etc/init.d/networking/functions.network =20 eval $(/usr/local/bin/readhash /var/ipfire/suricata/settings) -eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings) - -# Name of the firewall chains. -IPS_INPUT_CHAIN=3D"IPS_INPUT" -IPS_FORWARD_CHAIN=3D"IPS_FORWARD" -IPS_OUTPUT_CHAIN=3D"IPS_OUTPUT" =20 -# Optional options for the Netfilter queue. -NFQ_OPTS=3D"--queue-bypass " +IPS_REPEAT_MARK=3D"0x80000000" +IPS_REPEAT_MASK=3D"0x80000000" =20 -# Array containing the 4 possible network zones. -network_zones=3D( red green blue orange ovpn ) +# The IPS requested that this connection is being bypassed +IPS_BYPASS_REQUESTED_MARK=3D"0x40000000" +IPS_BYPASS_REQUESTED_MASK=3D"0x40000000" =20 -# Array to store the network zones weather the IPS is enabled for. -enabled_ips_zones=3D() +# Marks a connection to be bypassed +IPS_BYPASS_MARK=3D"0x20000000" +IPS_BYPASS_MASK=3D"0x20000000" =20 -# PID file of suricata. -PID_FILE=3D"/var/run/suricata.pid" +# Set if we request to scan this packet +IPS_SCAN_MARK=3D"0x10000000" +IPS_SCAN_MASK=3D"0x10000000" =20 -# Function to get the amount of CPU cores of the system. -function get_cpu_count { - CPUCOUNT=3D0 +# Set if a packet has been whitelisted +IPS_WHITELISTED_MARK=3D"0x08000000" +IPS_WHITELISTED_MASK=3D"0x08000000" =20 - # Loop through "/proc/cpuinfo" and count the amount of CPU cores. - while read line; do - [ "$line" ] && [ -z "${line%processor*}" ] && ((CPUCOUNT++)) - done /dev/null = 2>/dev/null - evaluate_retval - - # Allow reading the pidfile. - chmod 644 $PID_FILE + loadproc -b /usr/bin/suricata-watcher -c /etc/suricata/suricata.yaml $NFQ= UEUES =20 # Flush the firewall chain flush_fw_chain @@ -183,32 +189,24 @@ case "$1" in =20 stop) boot_mesg "Stopping Intrusion Detection System..." - killproc -p $PID_FILE /var/run + killproc -p /var/run/suricata.pid /usr/bin/suricata =20 # Flush firewall chain. flush_fw_chain =20 - # Sometimes suricata not correct shutdown. So killall. - killall -KILL /usr/bin/suricata 2>/dev/null - - # Remove suricata control socket. - rm /var/run/suricata/* >/dev/null 2>/dev/null - - # Trash remain pid file if still exists. - rm -f $PID_FILE >/dev/null 2>/dev/null - # Don't report returncode of rm if suricata was not started exit 0 ;; =20 status) - statusproc /usr/bin/suricata + PIDFILE=3D"/var/run/suricata.pid" statusproc /usr/bin/surica= ta ;; =20 restart) $0 stop $0 start ;; + reload) # Send SIGUSR2 to the suricata process to perform a reload # of the ruleset. @@ -226,5 +224,3 @@ case "$1" in exit 1 ;; esac - -chmod 644 /var/log/suricata/* 2>/dev/null hooks/post-receive -- IPFire 2.x development tree --===============0941016868519722792==--