suricata: Use device ppp0 if PPPoE dialin is used.
Commit Message
Fixes #12058
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
---
src/initscripts/system/suricata | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
Comments
Thanks. Merged.
> On 23 Apr 2019, at 19:26, Stefan Schantl <stefan.schantl@ipfire.org> wrote:
>
> Fixes #12058
>
> Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
> ---
> src/initscripts/system/suricata | 13 +++++++++++--
> 1 file changed, 11 insertions(+), 2 deletions(-)
>
> diff --git a/src/initscripts/system/suricata b/src/initscripts/system/suricata
> index 16548753e..b407afa3c 100644
> --- a/src/initscripts/system/suricata
> +++ b/src/initscripts/system/suricata
> @@ -18,6 +18,7 @@
> PATH=/usr/local/sbin:/usr/local/bin:/bin:/usr/bin:/sbin:/usr/sbin; export PATH
>
> eval $(/usr/local/bin/readhash /var/ipfire/suricata/settings)
> +eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
>
> # Name of the firewall chain.
> FW_CHAIN="IPS"
> @@ -65,8 +66,16 @@ function generate_fw_rules {
>
> # Check if the IDS is enabled for this network zone.
> if [ "${!enable_ids_zone}" == "on" ]; then
> - # Generate name of the network interface.
> - network_device=$zone
> + # Check if the current processed zone is "red" and the configured type is PPPoE dialin.
> + if [ "$zone" == "red" ] && [ "$RED_TYPE" == "PPPOE" ]; then
> + # Set device name to ppp.
> + network_device="ppp"
> + else
> + # The device name is identical with the zone name.
> + network_device=$zone
> + fi
> +
> + # Finish generation of the device name.
> network_device+="0"
>
> # Assign NFQ_OPTS
> --
> 2.20.1
>
@@ -18,6 +18,7 @@
PATH=/usr/local/sbin:/usr/local/bin:/bin:/usr/bin:/sbin:/usr/sbin; export PATH
eval $(/usr/local/bin/readhash /var/ipfire/suricata/settings)
+eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
# Name of the firewall chain.
FW_CHAIN="IPS"
@@ -65,8 +66,16 @@ function generate_fw_rules {
# Check if the IDS is enabled for this network zone.
if [ "${!enable_ids_zone}" == "on" ]; then
- # Generate name of the network interface.
- network_device=$zone
+ # Check if the current processed zone is "red" and the configured type is PPPoE dialin.
+ if [ "$zone" == "red" ] && [ "$RED_TYPE" == "PPPOE" ]; then
+ # Set device name to ppp.
+ network_device="ppp"
+ else
+ # The device name is identical with the zone name.
+ network_device=$zone
+ fi
+
+ # Finish generation of the device name.
network_device+="0"
# Assign NFQ_OPTS