Re: Bug: iptables and interface names that have dashes

On 11/02/2013 04:40 PM, Sean Alexandre wrote:
> ==== Debian package: logwatch
> ==== Version: 7.4.0+svn20120502rev103-1
>
> ==== Problem:
>
> Interface names with dashes are reported with the wrong interface name. Everything
> from the dash on is left off. For example, this log message causes the report to use the name eth instead of eth-wan:
>
> Nov  1 18:57:16 moose kernel: [546033.025222] wan2fw:REJECT:IN=eth-wan OUT= MAC=00:aa:aa:aa:aa:aa:aa:aa:02:5c:41:be:08:00 SRC=222.22.222.22 DST=223.222.22.222 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=25827 DF PROTO=TCP SPT=53565 DPT=80 WINDOW=14600 RES=0x00 SYN URGP=0
>
> ==== Fix:
>
> The fix adds a \- to the expression for the interface name, in the iptables script:
> [\w\.] becomes [\w\.\-]
>

Thanks!  Checked in.

> Here's the diff:
>
> diff --git a/scripts/services/iptables b/scripts/services/iptables
> --- a/scripts/services/iptables
> +++ b/scripts/services/iptables
> @@ -143,7 +143,7 @@ while (defined($ThisLine = <STDIN>)) {
>         $ipt2{$actionType}{$if}{$toport}{$proto}{$fromip}{$toip}{"$chain,$if"}++;
>      }
>      # IPTABLES
> -   elsif (($chain,$ifin,$ifout,$fromip,$toip,$proto,$rest) = ($ThisLine =~ /^(.*?)\s*IN=([\w\.]*).*?OUT=([\w\.]*).*?SRC=([\w\.:]+).*?DST=([\w\.:]+).*?PROTO=(\w+)(.*)/ )) {
> +   elsif (($chain,$ifin,$ifout,$fromip,$toip,$proto,$rest) = ($ThisLine =~ /^(.*?)\s*IN=([\w\.\-]*).*?OUT=([\w\.\-]*).*?SRC=([\w\.:]+).*?DST=([\w\.:]+).*?PROTO=(\w+)(.*)/ )) {
>
>         # get a destination port number  (or icmp type) if there is one
>         if (! ( ($toport) = ( $rest =~ /TYPE=(\w+)/ ) ) ) {
>
> ------------------------------------------------------------------------------
> Android is increasing in popularity, but the open development platform that
> developers love is also attractive to malware creators. Download this white
> paper to learn more about secure code signing practices that can help keep
> Android apps secure.
> http://pubads.g.doubleclick.net/gampad/clk?id=65839951&iu=/4140/ostg.clktrk
> _______________________________________________
> Logwatch-devel mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/logwatch-devel
>


-- 
Orion Poplawski
Technical Manager                     303-415-9701 x222
NWRA, Boulder/CoRA Office             FAX: 303-415-9702
3380 Mitchell Lane                       [email protected]
Boulder, CO 80301                   http://www.nwra.com

------------------------------------------------------------------------------
November Webinars for C, C++, Fortran Developers
Accelerate application performance with scalable programming models. Explore
techniques for threading, error checking, porting, and tuning. Get the most 
from the latest Intel processors and coprocessors. See abstracts and register
http://pubads.g.doubleclick.net/gampad/clk?id=60136231&iu=/4140/ostg.clktrk