[PATCH] Suricata: Do not use hard-coded red interface name

[PATCH] Suricata: Do not use hard-coded red interface name

[Stefan Schantl]

[-- Attachment #1: Type: text/plain, Size: 1397 bytes --]

Read the correct interface name from the corresponding interface
file.

Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
---
 src/initscripts/system/suricata | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/initscripts/system/suricata b/src/initscripts/system/suricata
index 938ea66de..f2fe21f44 100644
--- a/src/initscripts/system/suricata
+++ b/src/initscripts/system/suricata
@@ -27,6 +27,8 @@ PATH=/usr/local/sbin:/usr/local/bin:/bin:/usr/bin:/sbin:/usr/sbin; export PATH
 eval $(/usr/local/bin/readhash /var/ipfire/suricata/settings)
 eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
 
+IFACE_FILE="/var/ipfire/red/iface"
+
 # Name of the firewall chains.
 IPS_INPUT_CHAIN="IPS_INPUT"
 IPS_FORWARD_CHAIN="IPS_FORWARD"
@@ -87,8 +89,8 @@ function generate_fw_rules {
 		if [ "${!enable_ids_zone}" == "on" ]; then
 			# Check if the current processed zone is "red" and the configured type is PPPoE dialin.
 			if [ "$zone" == "red" ] && [ "$RED_TYPE" == "PPPOE" ]; then
-				# Set device name to ppp0.
-				network_device="ppp0"
+				# Read the used interface name from the corresponding file.
+				network_device="$(head -n 1 $IFACE_FILE)"
 			elif [ "$zone" == "ovpn" ]; then
 				# Get all virtual net devices because the RW server and each
 				# N2N connection creates it's own tun device.
-- 
2.30.2

Re: [PATCH] Suricata: Do not use hard-coded red interface name

[Michael Tremer]

[-- Attachment #1: Type: text/plain, Size: 1637 bytes --]

Hello,

Is there a chance that the file that you are reading is empty or does not exist?

What do we do then?

-Michael

> On 7 Mar 2023, at 19:20, Stefan Schantl <stefan.schantl(a)ipfire.org> wrote:
> 
> Read the correct interface name from the corresponding interface
> file.
> 
> Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
> ---
> src/initscripts/system/suricata | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/src/initscripts/system/suricata b/src/initscripts/system/suricata
> index 938ea66de..f2fe21f44 100644
> --- a/src/initscripts/system/suricata
> +++ b/src/initscripts/system/suricata
> @@ -27,6 +27,8 @@ PATH=/usr/local/sbin:/usr/local/bin:/bin:/usr/bin:/sbin:/usr/sbin; export PATH
> eval $(/usr/local/bin/readhash /var/ipfire/suricata/settings)
> eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
> 
> +IFACE_FILE="/var/ipfire/red/iface"
> +
> # Name of the firewall chains.
> IPS_INPUT_CHAIN="IPS_INPUT"
> IPS_FORWARD_CHAIN="IPS_FORWARD"
> @@ -87,8 +89,8 @@ function generate_fw_rules {
> if [ "${!enable_ids_zone}" == "on" ]; then
> # Check if the current processed zone is "red" and the configured type is PPPoE dialin.
> if [ "$zone" == "red" ] && [ "$RED_TYPE" == "PPPOE" ]; then
> - # Set device name to ppp0.
> - network_device="ppp0"
> + # Read the used interface name from the corresponding file.
> + network_device="$(head -n 1 $IFACE_FILE)"
> elif [ "$zone" == "ovpn" ]; then
> # Get all virtual net devices because the RW server and each
> # N2N connection creates it's own tun device.
> -- 
> 2.30.2
>