Inventory: track new Snort, WireGuard and MAC binding features

[gsanchietti]

Improve currently collected information inside the inventory.

IPS

• status
• rule policy
• oinkcode enabled or not
• number of bypass
• number of suppression

WireGuard

• number of server instances
• number of peers for each instance
• instance connected to system user database or not

MAC/IP binding

• status: off, soft, hard
• number of interfaces where enabled

[gsanchietti]

Testing image.

[stephdl]

QA

case wireguard

• follow the documentation
• create two instances with user_db set to "" or ldap database
• set some peers
• think to apply the configuration
  uci commit network
• trigger the /usr/sbin/inventory and verify the stats
  this an example of the output

    "wiregard": {
      "instances": 2,
      "statistics": [
        {
          "server": "wg1",
          "peers": 2,
          "ns_user_db": "main"
        },
        {
          "server": "wg2",
          "peers": 0,
          "ns_user_db": "ldap"
        }
      ]
    },

case 2 snort

• follow the documentation to enable snort
• enable extra rule
• set the oinkcode
• set some bypass
• disable some rules

this is the json example

    "snort": {
      "enabled": true,
      "policy": "security",
      "oink_enabled": false,
      "disabled_rules": 2,
      "suppressed_rules": 0,
      "bypass_src_ipv4": 2,
      "bypass_src_ipv6": 0,
      "bypass_dst_ipv4": 0,
      "bypass_dst_ipv6": 0
    },

case MAC/IP binding

• enable a dhcp server
• enable the ip mac binding
• you can change the parameter (0.1.2)

this is the example of json object

    "mac_ip_binding": {
      "disabled": 1,
      "soft-binding": 0,
      "hard-binding": 1
    },

[gsanchietti]

Test case 1 not verified: the key should be named wireguard.

Test case 2 verified.

Test case 3 not verified: the count of disabled interfaces does not match the number of interfaces where the feature can be enabled.
I have a machine with 2 interfaces (1 LAN, 1 WAN), I can enable the binding only on interfaces listed inside the screenshot (LAN , blue etc with static address):

The inventory returns the wrong number:

 inventory  | jq .features.mac_ip_binding
{
  "disabled": 2,
  "soft-binding": 0,
  "hard-binding": 0
}

[gsanchietti]

Testing image: 23.05.5-ns.1.4.1-29-g3d2d5a331

[gsanchietti]

All test cases have been verified.