495195d60a
Changes: 2.1.0: ====== - A new connection tracking module, Flow (replaces conversation) - A new portscan detector based off of Flow, Flow-Portscan (replaces portscan2) - A new http preprocessor, HttpInspect (replaces http_decode) - Alert Thresholding and Suppression - PCRE rule keyword (Perl Compat Regular Expressions) - isdataat rule keyword (buffer length detection) - A ton of new and updated rules. 2.0.6: ====== - 64-bit update for detection engine. (Thanks, Silio d'Angelo) - Added better PPP decoding. (Thanks Jesper Peterson) - Updated ip_proto optimization for high-speed detection engine. - Fixed infinite loop problem that was introduced by the recursive pattern matching patch. Reported by Lawrence Reed, thanks for testing out the changes for us! - Various changes to help respond (version 1) work a little better. - spp_http_decode 64-bit patch from Dirk Mueller. - Out-of-order ACK problem from Andrew Rucker. Also, updated stream4 to the most recent version from HEAD. - Minor fixes to tagging related to 'src' and 'dst' directives - When counting one byte patterns in 'ningroup' added a check for psLen==1 (wu-manber pattern matcher). Thanks Josh Sakofsky and Dennis McGuire for helping us test this. 2.0.5: ====== - Stream4 fixes from Andrew Rucker Jones. - Allow memcap to be configured for threshold features. 2.0.4: ====== - Fixed a core dump introduced with 2.0.3 when dealing with negated patterns 2.0.3: ====== - doe_ptr handling in byte_test/byte_jump slightly modified to work better with the pcre patch - content processing is now recursive to make distance/within processing better ( thanks to Shai Rubin for patch! ) - fixed a bug in the mwm.c pattern matcher that resulted in some alerts not firing in a particular configuration of rules 2.0.2: ====== - Added Thresholding and Suppression features (Marc Norton/Sourcefire) - Fixed TCP RST processing bug found (Shai Rubin) - Cleanup of spp_arpspoof (Jeff Nathan) - Cleanup of win32 version including proper Event Log support (Chris Reid) - Munged data fixes for stream4 (Chris Green)
81 lines
2.5 KiB
Text
81 lines
2.5 KiB
Text
# $NetBSD: Makefile.common,v 1.13 2003/12/31 14:11:42 salo Exp $
|
|
#
|
|
|
|
DISTNAME= snort-2.1.0
|
|
CATEGORIES= net security
|
|
MASTER_SITES= http://www.snort.org/dl/ \
|
|
ftp://the.wiretapped.net/pub/security/network-intrusion-detection/snort/ \
|
|
ftp://gd.tuwien.ac.at/infosys/security/snort/dl/
|
|
|
|
MAINTAINER= salo@NetBSD.org
|
|
HOMEPAGE= http://www.snort.org/
|
|
|
|
USE_BUILDLINK2= YES
|
|
USE_PKGINSTALL= YES
|
|
GNU_CONFIGURE= YES
|
|
|
|
CONFIGURE_ARGS+= --sysconfdir=${PKG_SYSCONFDIR}
|
|
CONFIGURE_ARGS+= --with-libpcap-includes=${BUILDLINK_PREFIX.libpcap}/include
|
|
CONFIGURE_ARGS+= --with-libpcap-libraries=${BUILDLINK_PREFIX.libpcap}/lib
|
|
|
|
PKG_SYSCONFSUBDIR= snort
|
|
|
|
RCD_SCRIPTS= snort
|
|
|
|
SNORT_USER?= snort
|
|
SNORT_GROUP?= snort
|
|
PKG_GROUPS= ${SNORT_GROUP}
|
|
PKG_USERS= ${SNORT_USER}:${SNORT_GROUP}::Snort\\ user
|
|
FILES_SUBST+= SNORT_USER="${SNORT_USER}" SNORT_GROUP="${SNORT_GROUP}"
|
|
|
|
OWN_DIRS_PERMS= /var/log/snort ${SNORT_USER} ${SNORT_GROUP} 700
|
|
CONF_FILES= ${EGDIR}/snort.conf.default \
|
|
${PKG_SYSCONFDIR}/snort.conf
|
|
CONF_FILES+= ${EGDIR}/threshold.conf \
|
|
${PKG_SYSCONFDIR}/threshold.conf
|
|
CONF_FILES+= ${EGDIR}/classification.config \
|
|
${PKG_SYSCONFDIR}/classification.config
|
|
CONF_FILES+= ${EGDIR}/reference.config \
|
|
${PKG_SYSCONFDIR}/reference.config
|
|
SUPPORT_FILES+= ${EGDIR}/gen-msg.map \
|
|
${PKG_SYSCONFDIR}/gen-msg.map
|
|
SUPPORT_FILES+= ${EGDIR}/generators \
|
|
${PKG_SYSCONFDIR}/generators
|
|
SUPPORT_FILES+= ${EGDIR}/sid \
|
|
${PKG_SYSCONFDIR}/sid
|
|
SUPPORT_FILES+= ${EGDIR}/sid-msg.map \
|
|
${PKG_SYSCONFDIR}/sid-msg.map
|
|
SUPPORT_FILES+= ${EGDIR}/unicode.map \
|
|
${PKG_SYSCONFDIR}/unicode.map
|
|
|
|
EGDIR= ${PREFIX}/share/examples/snort
|
|
|
|
post-configure:
|
|
@${SED} ${FILES_SUBST_SED} ${WRKSRC}/etc/snort.conf > \
|
|
${WRKDIR}/snort.conf.default
|
|
|
|
post-install:
|
|
${INSTALL_DATA_DIR} ${EGDIR}
|
|
${INSTALL_DATA} ${WRKSRC}/etc/*.config \
|
|
${WRKSRC}/etc/*.map \
|
|
${WRKSRC}/etc/generators \
|
|
${WRKSRC}/etc/sid \
|
|
${WRKSRC}/etc/threshold.conf \
|
|
${WRKDIR}/snort.conf.default ${EGDIR}/
|
|
${INSTALL_DATA_DIR} ${PREFIX}/share/doc/snort
|
|
cd ${WRKSRC}/doc ; \
|
|
for i in `${LS} | ${EGREP} -v "(Makefile|signatures)"` ; do \
|
|
${INSTALL_DATA} $$i ${PREFIX}/share/doc/snort ; \
|
|
done
|
|
cd ${WRKSRC}/doc ; \
|
|
${RM} -rf signatures/CVS; \
|
|
${PAX} -rw -pm signatures ${PREFIX}/share/doc/snort
|
|
${INSTALL_DATA_DIR} ${PREFIX}/share/snort/rules
|
|
cd ${WRKSRC}/rules ; \
|
|
for i in `${LS} | ${GREP} -v Makefile` ; do \
|
|
${INSTALL_DATA} $$i ${PREFIX}/share/snort/rules ; \
|
|
done
|
|
${INSTALL_MAN} ${WRKSRC}/snort.8 ${PREFIX}/man/man8
|
|
|
|
.include "../../devel/pcre/buildlink2.mk"
|
|
.include "../../net/libpcap/buildlink2.mk"
|