Bug: iptables and interface names that have dashes

Sean Alexandre <[email protected]>
Newsgroups gmane.comp.log.logwatch.devel
Message-ID <20131102224026.GA4366@tuzo>
==== Debian package: logwatch
==== Version: 7.4.0+svn20120502rev103-1

==== Problem: 

Interface names with dashes are reported with the wrong interface name. Everything
from the dash on is left off. For example, this log message causes the report to use the name eth instead of eth-wan:

Nov  1 18:57:16 moose kernel: [546033.025222] wan2fw:REJECT:IN=eth-wan OUT= MAC=00:aa:aa:aa:aa:aa:aa:aa:02:5c:41:be:08:00 SRC=222.22.222.22 DST=223.222.22.222 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=25827 DF PROTO=TCP SPT=53565 DPT=80 WINDOW=14600 RES=0x00 SYN URGP=0

==== Fix: 

The fix adds a \- to the expression for the interface name, in the iptables script: 
[\w\.] becomes [\w\.\-]

Here's the diff:

diff --git a/scripts/services/iptables b/scripts/services/iptables
--- a/scripts/services/iptables
+++ b/scripts/services/iptables
@@ -143,7 +143,7 @@ while (defined($ThisLine = <STDIN>)) {
       $ipt2{$actionType}{$if}{$toport}{$proto}{$fromip}{$toip}{"$chain,$if"}++;
    }
    # IPTABLES
-   elsif (($chain,$ifin,$ifout,$fromip,$toip,$proto,$rest) = ($ThisLine =~ /^(.*?)\s*IN=([\w\.]*).*?OUT=([\w\.]*).*?SRC=([\w\.:]+).*?DST=([\w\.:]+).*?PROTO=(\w+)(.*)/ )) {
+   elsif (($chain,$ifin,$ifout,$fromip,$toip,$proto,$rest) = ($ThisLine =~ /^(.*?)\s*IN=([\w\.\-]*).*?OUT=([\w\.\-]*).*?SRC=([\w\.:]+).*?DST=([\w\.:]+).*?PROTO=(\w+)(.*)/ )) {
 
       # get a destination port number  (or icmp type) if there is one
       if (! ( ($toport) = ( $rest =~ /TYPE=(\w+)/ ) ) ) {

------------------------------------------------------------------------------
Android is increasing in popularity, but the open development platform that
developers love is also attractive to malware creators. Download this white
paper to learn more about secure code signing practices that can help keep
Android apps secure.
http://pubads.g.doubleclick.net/gampad/clk?id=65839951&iu=/4140/ostg.clktrk
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.