1 |
commit: a8e82003db4b6ef62cf260263bafc1cc32f33acc |
2 |
Author: Marek Szuba <marecki <AT> gentoo <DOT> org> |
3 |
AuthorDate: Fri Oct 9 12:09:22 2020 +0000 |
4 |
Commit: Marek Szuba <marecki <AT> gentoo <DOT> org> |
5 |
CommitDate: Fri Oct 9 12:14:16 2020 +0000 |
6 |
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a8e82003 |
7 |
|
8 |
net-analyzer/suricata: bump to 6.0.0 |
9 |
|
10 |
Okay, this has turned out to be easier than I thought it might be. |
11 |
Note to self: since suricata-6 no longer supports unified2 output and |
12 |
suricata-5 is still supported upstream (even 4 will only reach end of |
13 |
life on 2020-12-31), keep the latter around for at least a bit longer. |
14 |
|
15 |
Signed-off-by: Marek Szuba <marecki <AT> gentoo.org> |
16 |
|
17 |
net-analyzer/suricata/Manifest | 1 + |
18 |
.../files/suricata-6.0.0_default-config.patch | 27 +++ |
19 |
net-analyzer/suricata/suricata-6.0.0.ebuild | 203 +++++++++++++++++++++ |
20 |
3 files changed, 231 insertions(+) |
21 |
|
22 |
diff --git a/net-analyzer/suricata/Manifest b/net-analyzer/suricata/Manifest |
23 |
index 06edb9b7cc8..fde179dd2cb 100644 |
24 |
--- a/net-analyzer/suricata/Manifest |
25 |
+++ b/net-analyzer/suricata/Manifest |
26 |
@@ -1 +1,2 @@ |
27 |
DIST suricata-5.0.4.tar.gz 29091046 BLAKE2B 38526ca39d2460d630fdd9e804f36c74bfcde54a529748896779b549ed1b55174d6080ddad8933ddfd26004f4e78748a503832f47ee5f52d84a133643aef482b SHA512 e5da14f80b628968e146839b828971e888fd0158b2ecbbcc15c0f42fda2bdcc8ad89632ba05cc45c88d88e537452e77f8e2f3a5e09ecd038d0d38b1a8cf8cea6 |
28 |
+DIST suricata-6.0.0.tar.gz 30832555 BLAKE2B 9cea05b07520924706e961efed6a45b9ba73388a25777f43c1a90497aa00ec200bad15863b7b17b84e622c79309365596853423776da9c3d103c2a8c1126a0d2 SHA512 3c30f6f57c0e8a24992ff2b4ce8ce166d3c0d4b28c8f5e79434d04de9f2016773be01a1689fedfc9e54ff1c8bc9838206bc28f3ff2e47d60102a7016f1062ec3 |
29 |
|
30 |
diff --git a/net-analyzer/suricata/files/suricata-6.0.0_default-config.patch b/net-analyzer/suricata/files/suricata-6.0.0_default-config.patch |
31 |
new file mode 100644 |
32 |
index 00000000000..03e0f1cda94 |
33 |
--- /dev/null |
34 |
+++ b/net-analyzer/suricata/files/suricata-6.0.0_default-config.patch |
35 |
@@ -0,0 +1,27 @@ |
36 |
+--- a/suricata.yaml.in |
37 |
++++ b/suricata.yaml.in |
38 |
+@@ -209,8 +209,9 @@ |
39 |
+ # https://suricata.readthedocs.io/en/latest/output/eve/eve-json-output.html#dns-v1-format |
40 |
+ |
41 |
+ # As of Suricata 5.0, version 2 of the eve dns output |
42 |
+- # format is the default. |
43 |
+- #version: 2 |
44 |
++ # format is the default - but the daemon produces a warning to that effect |
45 |
++ # at start-up if this isn't explicitly set. |
46 |
++ version: 2 |
47 |
+ |
48 |
+ # Enable/disable this logger. Default: enabled. |
49 |
+ #enabled: yes |
50 |
+@@ -988,9 +989,9 @@ |
51 |
+ ## |
52 |
+ |
53 |
+ # Run Suricata with a specific user-id and group-id: |
54 |
+-#run-as: |
55 |
+-# user: suri |
56 |
+-# group: suri |
57 |
++run-as: |
58 |
++ user: suricata |
59 |
++ group: suricata |
60 |
+ |
61 |
+ # Some logging modules will use that name in event as identifier. The default |
62 |
+ # value is the hostname |
63 |
|
64 |
diff --git a/net-analyzer/suricata/suricata-6.0.0.ebuild b/net-analyzer/suricata/suricata-6.0.0.ebuild |
65 |
new file mode 100644 |
66 |
index 00000000000..5f5d14e3eec |
67 |
--- /dev/null |
68 |
+++ b/net-analyzer/suricata/suricata-6.0.0.ebuild |
69 |
@@ -0,0 +1,203 @@ |
70 |
+# Copyright 1999-2020 Gentoo Authors |
71 |
+# Distributed under the terms of the GNU General Public License v2 |
72 |
+ |
73 |
+EAPI=7 |
74 |
+ |
75 |
+PYTHON_COMPAT=( python3_{6..9} ) |
76 |
+ |
77 |
+inherit autotools flag-o-matic linux-info python-single-r1 systemd |
78 |
+ |
79 |
+DESCRIPTION="High performance Network IDS, IPS and Network Security Monitoring engine" |
80 |
+HOMEPAGE="https://suricata-ids.org/" |
81 |
+SRC_URI="https://www.openinfosecfoundation.org/download/${P}.tar.gz" |
82 |
+ |
83 |
+LICENSE="GPL-2" |
84 |
+SLOT="0" |
85 |
+KEYWORDS="~amd64 ~x86" |
86 |
+IUSE="+af-packet bpf control-socket cuda debug +detection geoip hardened logrotate lua luajit lz4 nflog +nfqueue redis systemd test" |
87 |
+ |
88 |
+RESTRICT="!test? ( test )" |
89 |
+ |
90 |
+REQUIRED_USE="${PYTHON_REQUIRED_USE} |
91 |
+ ?? ( lua luajit ) |
92 |
+ bpf? ( af-packet )" |
93 |
+ |
94 |
+RDEPEND="${PYTHON_DEPS} |
95 |
+ acct-group/suricata |
96 |
+ acct-user/suricata |
97 |
+ dev-libs/jansson |
98 |
+ dev-libs/libpcre |
99 |
+ dev-libs/libyaml |
100 |
+ net-libs/libnet:* |
101 |
+ net-libs/libnfnetlink |
102 |
+ dev-libs/nspr |
103 |
+ dev-libs/nss |
104 |
+ $(python_gen_cond_dep ' |
105 |
+ dev-python/pyyaml[${PYTHON_USEDEP}] |
106 |
+ ') |
107 |
+ >=net-libs/libhtp-0.5.35 |
108 |
+ net-libs/libpcap |
109 |
+ sys-apps/file |
110 |
+ sys-libs/libcap-ng |
111 |
+ bpf? ( >=dev-libs/libbpf-0.1.0 ) |
112 |
+ cuda? ( dev-util/nvidia-cuda-toolkit ) |
113 |
+ geoip? ( dev-libs/libmaxminddb ) |
114 |
+ logrotate? ( app-admin/logrotate ) |
115 |
+ lua? ( dev-lang/lua:* ) |
116 |
+ luajit? ( dev-lang/luajit:* ) |
117 |
+ lz4? ( app-arch/lz4 ) |
118 |
+ nflog? ( net-libs/libnetfilter_log ) |
119 |
+ nfqueue? ( net-libs/libnetfilter_queue ) |
120 |
+ redis? ( dev-libs/hiredis )" |
121 |
+DEPEND="${RDEPEND} |
122 |
+ >=sys-devel/autoconf-2.69-r5 |
123 |
+ virtual/rust" |
124 |
+ |
125 |
+PATCHES=( |
126 |
+ "${FILESDIR}/${PN}-5.0.1_configure-no-lz4-automagic.patch" |
127 |
+ "${FILESDIR}/${PN}-6.0.0_default-config.patch" |
128 |
+) |
129 |
+ |
130 |
+pkg_pretend() { |
131 |
+ if use bpf && use kernel_linux; then |
132 |
+ if kernel_is -lt 4 15; then |
133 |
+ ewarn "Kernel 4.15 or newer is necessary to use all XDP features like the CPU redirect map" |
134 |
+ fi |
135 |
+ |
136 |
+ CONFIG_CHECK="~XDP_SOCKETS" |
137 |
+ ERROR_XDP_SOCKETS="CONFIG_XDP_SOCKETS is not set, making it impossible for Suricata to load XDP programs. " |
138 |
+ ERROR_XDP_SOCKETS+="Other eBPF features should work normally." |
139 |
+ check_extra_config |
140 |
+ fi |
141 |
+} |
142 |
+ |
143 |
+src_prepare() { |
144 |
+ default |
145 |
+ sed -ie 's/docdir =.*/docdir = ${datarootdir}\/doc\/'${PF}'\//' "${S}/doc/Makefile.am" || die |
146 |
+ eautoreconf |
147 |
+} |
148 |
+ |
149 |
+src_configure() { |
150 |
+ local myeconfargs=( |
151 |
+ "--localstatedir=/var" \ |
152 |
+ "--runstatedir=/run" \ |
153 |
+ "--enable-non-bundled-htp" \ |
154 |
+ "--enable-gccmarch-native=no" \ |
155 |
+ "--enable-python" \ |
156 |
+ $(use_enable af-packet) \ |
157 |
+ $(use_enable bpf ebpf) \ |
158 |
+ $(use_enable control-socket unix-socket) \ |
159 |
+ $(use_enable cuda) \ |
160 |
+ $(use_enable detection) \ |
161 |
+ $(use_enable geoip) \ |
162 |
+ $(use_enable hardened gccprotect) \ |
163 |
+ $(use_enable hardened pie) \ |
164 |
+ $(use_enable lua) \ |
165 |
+ $(use_enable luajit) \ |
166 |
+ $(use_enable lz4) \ |
167 |
+ $(use_enable nflog) \ |
168 |
+ $(use_enable nfqueue) \ |
169 |
+ $(use_enable redis hiredis) \ |
170 |
+ $(use_enable test unittests) \ |
171 |
+ "--disable-coccinelle" |
172 |
+ ) |
173 |
+ |
174 |
+ if use debug; then |
175 |
+ myeconfargs+=( $(use_enable debug) ) |
176 |
+ # so we can get a backtrace according to "reporting bugs" on upstream web site |
177 |
+ CFLAGS="-ggdb -O0" econf ${myeconfargs[@]} |
178 |
+ else |
179 |
+ econf ${myeconfargs[@]} |
180 |
+ fi |
181 |
+} |
182 |
+ |
183 |
+src_install() { |
184 |
+ emake DESTDIR="${D}" install |
185 |
+ python_optimize |
186 |
+ |
187 |
+ if use bpf; then |
188 |
+ rm -f ebpf/Makefile.{am,in} |
189 |
+ dodoc -r ebpf/ |
190 |
+ keepdir /usr/libexec/suricata/ebpf |
191 |
+ fi |
192 |
+ |
193 |
+ insinto "/etc/${PN}" |
194 |
+ doins etc/{classification,reference}.config threshold.config suricata.yaml |
195 |
+ |
196 |
+ keepdir "/var/lib/${PN}/rules" "/var/lib/${PN}/update" |
197 |
+ keepdir "/var/log/${PN}" |
198 |
+ |
199 |
+ fowners -R ${PN}: "/var/lib/${PN}" "/var/log/${PN}" "/etc/${PN}" |
200 |
+ fperms 750 "/var/lib/${PN}" "/var/log/${PN}" "/etc/${PN}" |
201 |
+ fperms 2750 "/var/lib/${PN}/rules" "/var/lib/${PN}/update" |
202 |
+ |
203 |
+ newinitd "${FILESDIR}/${PN}-5.0.1-init" ${PN} |
204 |
+ newconfd "${FILESDIR}/${PN}-5.0.1-conf" ${PN} |
205 |
+ systemd_dounit "${FILESDIR}"/${PN}.service |
206 |
+ systemd_newtmpfilesd "${FILESDIR}"/${PN}.tmpfiles ${PN}.conf |
207 |
+ |
208 |
+ if use logrotate; then |
209 |
+ insopts -m0644 |
210 |
+ insinto /etc/logrotate.d |
211 |
+ newins etc/${PN}.logrotate ${PN} |
212 |
+ fi |
213 |
+} |
214 |
+ |
215 |
+pkg_postinst() { |
216 |
+ elog |
217 |
+ if use systemd; then |
218 |
+ elog "Suricata requires either the mode of operation (e.g. --af-packet) or the interface to listen on (e.g. -i eth0)" |
219 |
+ elog "to be specified on the command line. The provided systemd unit launches Suricata in af-packet mode and relies" |
220 |
+ elog "on file configuration to specify interfaces, should you prefer to run it differently you will have to customise" |
221 |
+ elog "said unit. The simplest way of doing it is to override the Environment=OPTIONS='...' line using a .conf file" |
222 |
+ elog "placed in the directory ${EPREFIX}/etc/systemd/system/suricata.service.d/ ." |
223 |
+ elog "For details, see the section on drop-in directories in systemd.unit(5)." |
224 |
+ else |
225 |
+ elog "The ${PN} init script expects to find the path to the configuration" |
226 |
+ elog "file as well as extra options in /etc/conf.d." |
227 |
+ elog |
228 |
+ elog "To create more than one ${PN} service, simply create a new .yaml file for it" |
229 |
+ elog "then create a symlink to the init script from a link called" |
230 |
+ elog "${PN}.foo - like so" |
231 |
+ elog " cd /etc/${PN}" |
232 |
+ elog " ${EDITOR##*/} suricata-foo.yaml" |
233 |
+ elog " cd /etc/init.d" |
234 |
+ elog " ln -s ${PN} ${PN}.foo" |
235 |
+ elog "Then edit /etc/conf.d/${PN} and make sure you specify sensible options for foo." |
236 |
+ elog |
237 |
+ elog "You can create as many ${PN}.foo* services as you wish." |
238 |
+ fi |
239 |
+ |
240 |
+ if use bpf; then |
241 |
+ elog |
242 |
+ elog "eBPF/XDP files must be compiled (using sys-devel/clang[llvm_targets_BPF]) before use" |
243 |
+ elog "because their configuration is hard-coded. You can find the default ones in" |
244 |
+ elog " ${EPREFIX}/usr/share/doc/${PF}/ebpf" |
245 |
+ elog "and the common location for eBPF bytecode is" |
246 |
+ elog " ${EPREFIX}/usr/libexec/${PN}" |
247 |
+ elog "For more information, see https://${PN}.readthedocs.io/en/${P}/capture-hardware/ebpf-xdp.html" |
248 |
+ fi |
249 |
+ |
250 |
+ if use debug; then |
251 |
+ elog |
252 |
+ elog "You have enabled the debug USE flag. Please read this link to report bugs upstream:" |
253 |
+ elog "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Reporting_Bugs" |
254 |
+ elog "You need to also ensure the FEATURES variable in make.conf contains the" |
255 |
+ elog "'nostrip' option to produce useful core dumps or back traces." |
256 |
+ fi |
257 |
+ |
258 |
+ elog |
259 |
+ if [[ -n "${REPLACING_VERSIONS}" ]]; then |
260 |
+ ewarn "Since version 6.0.0 Suricata no longer supports the unified2 output format commonly used" |
261 |
+ ewarn "in legacy, Snort-compatible IDS solutions, e.g. ones based on net-analyzer/barnyard2." |
262 |
+ ewarn "If you need unified2 support, please continue to use suricata-5." |
263 |
+ else |
264 |
+ elog "To download and install an initial set of rules, run:" |
265 |
+ elog " emerge --config =${CATEGORY}/${PF}" |
266 |
+ fi |
267 |
+ elog |
268 |
+} |
269 |
+ |
270 |
+pkg_config() { |
271 |
+ suricata-update |
272 |
+} |