X-Original-To: alpine-aports@lists.alpinelinux.org Received: from mail01.localdomain (mail01.mcmaster.io [104.236.73.0]) by lists.alpinelinux.org (Postfix) with ESMTP id 4B8995C45D6 for ; Sun, 18 Dec 2016 07:01:53 +0000 (GMT) Received: from sk??ldpadda.mcmaster.io (cpe-24-166-123-228.neo.res.rr.com [24.166.123.228]) by mail01.localdomain (Postfix) with ESMTPSA id CE8313F6B1 for ; Sun, 18 Dec 2016 07:01:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=mcmaster.io; s=mail; t=1482044513; bh=wkobzociB1wFuYDz83QcC0k3neQUUSbJwQA2sn4v81s=; h=From:To:Subject:Date; b=q0AZWWx3C/Ri6ZWMwIQwZuY04tTCJ+lZ625AYvQ+uvqySdxysVnYGRhPpcfyWhLNi vkUO189EUWpSmfBmxsk+WcLSHhelFmgTeS9t1U/jtLFEHaRoVLKBAKJgKgS81Hr3A3 1vtjTYkZndNm5MWyQ3FP4RA/NbASKL5OdIteXjOU= From: Steve McMaster To: alpine-aports@lists.alpinelinux.org Subject: [alpine-aports] [PATCH] testing/suricata: new aport Date: Sun, 18 Dec 2016 02:01:52 -0500 Message-Id: <20161218070152.20866-1-code@mcmaster.io> X-Mailer: git-send-email 2.9.3 (Apple Git-75) X-Mailinglist: alpine-aports Precedence: list List-Id: Alpine Development List-Unsubscribe: List-Post: List-Help: List-Subscribe: https://suricata-ids.org/ High performance Network IDS, IPS and Network Security Monitoring engine --- testing/suricata/APKBUILD | 59 +++++++++++++++++++++++++++++++++ testing/suricata/suricata.confd | 31 ++++++++++++++++++ testing/suricata/suricata.initd | 65 +++++++++++++++++++++++++++++++++++++ testing/suricata/suricata.logrotate | 11 +++++++ 4 files changed, 166 insertions(+) create mode 100644 testing/suricata/APKBUILD create mode 100644 testing/suricata/suricata.confd create mode 100644 testing/suricata/suricata.initd create mode 100644 testing/suricata/suricata.logrotate diff --git a/testing/suricata/APKBUILD b/testing/suricata/APKBUILD new file mode 100644 index 0000000..98249da --- /dev/null +++ b/testing/suricata/APKBUILD @@ -0,0 +1,59 @@ +# Contributor: Steve McMaster +# Maintainer: Steve McMaster +pkgname=suricata +pkgver=3.2 +pkgrel=0 +pkgdesc="High performance Network IDS, IPS and Network Security Monitoring engine" +url="https://suricata-ids.org/" +arch="all" +license="GPL-2" +depends="" +makedepends="automake autoconf libtool libhtp-dev>=0.5.23 libcap-ng-dev + file-dev luajit-dev geoip-dev pcre-dev yaml-dev libpcap-dev hiredis-dev + libnet-dev libnetfilter_queue-dev jansson-dev python nss-dev nspr-dev" +install="" +subpackages="$pkgname-doc" +source="${pkgname}-${pkgver}.tar.gz::http://www.openinfosecfoundation.org/download/${pkgname}-${pkgver}.tar.gz +" + +builddir="$srcdir/$pkgname-$pkgver" + +prepare() { + cd "$builddir" + autoreconf -vif || return 1 +} + +build() { + cd "$builddir" + ./configure \ + --build=$CBUILD \ + --host=$CHOST \ + --prefix=/usr \ + --sysconfdir=/etc \ + --mandir=/usr/share/man \ + --localstatedir=/var \ + --enable-non-bundled-htp \ + --enable-nfqueue \ + --disable-gccmarch-native \ + --enable-hiredis \ + --enable-geoip \ + --enable-gccprotect \ + --enable-pie \ + --enable-luajit \ + || return 1 + make || return 1 +} + +package() { + cd "$builddir" + make DESTDIR="$pkgdir" install || return 1 + make DESTDIR="$pkgdir" install-full || return 1 + + cd "$srcdir" + install -D -m 755 ../suricata.initd "$pkgdir"/etc/init.d/suricata + install -D -m 644 ../suricata.confd "$pkgdir"/etc/conf.d/suricata + install -D -m 644 ../suricata.logrotate "$pkgdir"/etc/logrotate.d/snort +} +md5sums="05854b3390ea86fabe73bdb5a90db36c suricata-3.2.tar.gz" +sha256sums="41cbe19c6fd6bd51ebcbc29063f558e2fbba4a2450e5809fee2e461f16a4ed68 suricata-3.2.tar.gz" +sha512sums="327f5a62449af44f6cb95220e1ff9bf61b51db7bd25f2b1e8def3e8650ba754304cf9d02fc30b46b6cbaa6b5f94fa3d4be90edb8a293ff3b6c0927b596a2976e suricata-3.2.tar.gz" diff --git a/testing/suricata/suricata.confd b/testing/suricata/suricata.confd new file mode 100644 index 0000000..9585bdc --- /dev/null +++ b/testing/suricata/suricata.confd @@ -0,0 +1,31 @@ +# Config file for /etc/init.d/suricata* + +# Where config files are stored. Default: + +# SURICATA_DIR="/etc/suricata" + +# Pass options to each suricata service. +# You can launch more than one service at the same time with different options. +# This can be useful in a multi-queue gateway, for example. +# You can expand on the Suricata inline example found at: +# https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Setting_up_IPSinline_for_Linux +# Instead of configuring iptables to send traffic to just one queue, you can configure it to "load balance" +# on several queues. You can then have a Suricata instance processing traffic for each queue. +# This should help improve performance on the gateway/firewall. +# Suppose you configured iptables to use queues 0 and 1. You can now do the following: +# ln -s /etc/init.d/suricata /etc/init.d/suricata.q0 +# ln -s /etc/init.d/suricata /etc/init.d/suricata.q1 +# cp /etc/suricata/suricata.yaml /etc/suricata/suricata-q0.yaml +# cp /etc/suricata/suricata.yaml /etc/suricata/suricata-q1.yaml +# mkdir /var/log/suricata/q{0,1} +# Edit both suricata-q{0,1}.yaml files and set values accordingly (eg. set the suricata.log file path to +# a dedicated dir in the section "logging:outputs:-file"). +# You can then define the following options here: + +# SURICATA_OPTS[q0]="-q 0 -l /var/log/suricata/q0" +# SURICATA_OPTS[q1]="-q 1 -l /var/log/suricata/q1" + +# If you want to use ${SURICATA_DIR}/suricata.yaml and start the service with /etc/init.d/suricata +# then you can set: + +SURICATA_OPTIONS="--af-packet" diff --git a/testing/suricata/suricata.initd b/testing/suricata/suricata.initd new file mode 100644 index 0000000..e39312f --- /dev/null +++ b/testing/suricata/suricata.initd @@ -0,0 +1,65 @@ +#!/sbin/openrc-run +# Copyright 1999-2016 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Id$ + +SURICATA_DIR=${SURICATA_DIR:-/etc/suricata} +SURICATA=${SVCNAME#*.} +if [ -n "${SURICATA}" ] && [ ${SVCNAME} != "suricata" ]; then + SURICATACONF="${SURICATA_DIR}/suricata-${SURICATA}.yaml" + SURICATAPID="/var/run/suricata/suricata.${SURICATA}.pid" +else + SURICATACONF="${SURICATA_DIR}/suricata.yaml" + SURICATAPID="/var/run/suricata/suricata.pid" +fi +SURICATAOPTS=${SURICATA_OPTIONS} + +extra_commands="checkconfig" +extra_started_commands="reload" + +depend() { + need net + after firewall +} + +checkconfig() { + if [ ! -e ${SURICATACONF} ] ; then + eerror "You need to create ${SURICATACONF} to run ${SVCNAME}." + return 1 + fi +} + +start() { + checkconfig || return 1 + ebegin "Starting ${SVCNAME}" + start-stop-daemon --start --quiet --exec /usr/bin/suricata \ + -- --pidfile ${SURICATAPID} -D ${SURICATAOPTS} \ + -c ${SURICATACONF} >/dev/null 2>&1 + eend $? +} + +stop() { + ebegin "Stopping ${SVCNAME}" + start-stop-daemon --stop --quiet --pidfile ${SURICATAPID} >/dev/null 2>&1 + einfon "Waiting for ${SVCNAME} to shut down. This can take a while..." + echo + # max wait: 5 minutes as it can take quite a while on some systems with heavy traffic + cnt=300 + while [ -f ${SURICATAPID} ]; do + cnt=$(expr $cnt - 1) + if [ $cnt -lt 1 ] ; then + echo + eend 1 "Failed." + break + fi + sleep 1 + echo -ne "$cnt seconds left before we give up\r" + done + eend $? +} + +reload() { + checkconfig || return 1 + ebegin "Reloading ${SVCNAME}" + start-stop-daemon --signal HUP --pidfile ${SURICATAPID} +} diff --git a/testing/suricata/suricata.logrotate b/testing/suricata/suricata.logrotate new file mode 100644 index 0000000..94622f3 --- /dev/null +++ b/testing/suricata/suricata.logrotate @@ -0,0 +1,11 @@ +/var/log/suricata/*.log /var/log/suricata/*.json +{ + rotate 3 + missingok + nocompress + create + sharedscripts + postrotate + /bin/kill -HUP $(cat /var/run/suricata.pid) + endscript +} -- 2.9.3 (Apple Git-75) --- Unsubscribe: alpine-aports+unsubscribe@lists.alpinelinux.org Help: alpine-aports+help@lists.alpinelinux.org ---