From 55658ee381aeeac19c63a0da8822fc3f727b135b Mon Sep 17 00:00:00 2001 From: Stefan Schantl Date: Fri, 17 Aug 2018 08:45:47 +0200 Subject: [PATCH] suricata: Fix detection of enabled IDS on zone in initscript I accidently commited the wrong file in the previous commit. This is the fixed and working version. Signed-off-by: Stefan Schantl --- src/initscripts/system/suricata | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/src/initscripts/system/suricata b/src/initscripts/system/suricata index 45e04d4639..57eeec1575 100644 --- a/src/initscripts/system/suricata +++ b/src/initscripts/system/suricata @@ -51,8 +51,12 @@ case "$1" in # Convert zone into upper case. zone_upper=${zone^^} + # Generate variable name for checking if the IDS is + # enabled on the zone. + enable_ids_zone="ENABLE_IDS_$zone_upper" + # Check if the IDS is enabled for this network zone. - if [ "$ENABLE_IDS_$$zone_upper" == "on" ]; then + if [ "${!enable_ids_zone}" == "on" ]; then # Generate name of the network interface. network_device=$zone network_device+="0" @@ -72,8 +76,8 @@ case "$1" in # Create firewall rules to queue the traffic and pass to # the IDS. - iptables -I "$FW_CHAIN" -i "$network_device" -m mark ! --mark "$MARK"/"$MASK" -j NFQUEUE "$NFQ_OPTIONS" - iptables -I "$FW_CHAIN" -o "$network_device" -m mark ! --mark "$MARK"/"$MASK" -j NFQUEUE "$NFQ_OPTIONS" + iptables -I "$FW_CHAIN" -i "$network_device" -m mark ! --mark "$MARK"/"$MASK" -j NFQUEUE $NFQ_OPTIONS + iptables -I "$FW_CHAIN" -o "$network_device" -m mark ! --mark "$MARK"/"$MASK" -j NFQUEUE $NFQ_OPTIONS fi done -- 2.39.5