suricata: Use device ppp0 if PPPoE dialin is used.

[ipfire-2.x.git] / src / initscripts / system / suricata

diff --git a/src/initscripts/system/suricata b/src/initscripts/system/suricata
index e755dfaff22bb54c6ff11adac354ef1d9c7ca2c9..ecd6930541f03bfd3a8b1c9faad0392ea5e3b07a 100644 (file)
--- a/src/initscripts/system/suricata
+++ b/src/initscripts/system/suricata
@@ -18,6 +18,7 @@
 PATH=/usr/local/sbin:/usr/local/bin:/bin:/usr/bin:/sbin:/usr/sbin; export PATH
 
 eval $(/usr/local/bin/readhash /var/ipfire/suricata/settings)
+eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
 
 # Name of the firewall chain.
 FW_CHAIN="IPS"
@@ -65,9 +66,18 @@ function generate_fw_rules {
 
                # Check if the IDS is enabled for this network zone.
                if [ "${!enable_ids_zone}" == "on" ]; then
-                       # Generate name of the network interface.
-                       network_device=$zone
-                       network_device+="0"
+                       # Check if the current processed zone is "red" and the configured type is PPPoE dialin.
+                       if [ "$zone" == "red" ] && [ "$RED_TYPE" == "PPPOE" ]; then
+                               # Set device name to ppp0.
+                               network_device="ppp0"
+                       else
+                               # Generate variable name which contains the device name.
+                               zone_name="$zone_upper"
+                               zone_name+="_DEV"
+
+                               # Grab device name.
+                               network_device=${!zone_name}
+                       fi
 
                        # Assign NFQ_OPTS
                        NFQ_OPTIONS=$NFQ_OPTS
@@ -75,8 +85,8 @@ function generate_fw_rules {
                        # Check if there are multiple cpu cores available.
                        if [ "$cpu_count" -gt "1" ]; then
                                # Balance beetween all queues.
-                               NFQ_OPTIONS+="--queue-balance 0:"
-                               NFQ_OPTIONS+=$(($cpu_count-1))
+                               NFQ_OPTIONS+="--queue-balance 0:$(($cpu_count-1))"
+                               NFQ_OPTIONS+=" --queue-cpu-fanout"
                        else
                                # Send all packets to queue 0.
                                NFQ_OPTIONS+="--queue-num 0"
@@ -107,7 +117,7 @@ case "$1" in
                # Numer of NFQUES.
                NFQUEUES=
 
-               for i in $(seq 0 $cpu_count); do
+               for i in $(seq 0 $((cpu_count-1)) ); do
                        NFQUEUES+="-q $i "
                done