OpenPKG Specs: snort/snort.spec@6b18bb69901e (annotated)

snort/snort.spec@6b18bb69901e (annotated)

snort/snort.spec

Tue, 28 Aug 2012 18:36:35 +0200

author: Michael Schloh von Bennewitz <michael@schloh.com>
date: Tue, 28 Aug 2012 18:36:35 +0200
changeset 579: 6b18bb69901e
parent 549: 00e5f0537340
permissions: -rw-r--r--

Correct the paths of patched scripts, refine password generation,
mitigate fdatasync(2) detection problems, correct dependencies, remove
outdated autoconf components, correct conf file paths and attributes,
complete and correct log file rotation handing, and note warnings
useful for diagnosing builds.

 ##
 ##  snort.spec -- OpenPKG RPM Package Specification
 ##  Copyright (c) 2000-2010 OpenPKG Foundation e.V. <http://openpkg.net/>
 ##
 ##  Permission to use, copy, modify, and distribute this software for
 ##  any purpose with or without fee is hereby granted, provided that
 ##  the above copyright notice and this permission notice appear in all
 ##  copies.
 ##
 ##  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED
 ##  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
 ##  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 ##  IN NO EVENT SHALL THE AUTHORS AND COPYRIGHT HOLDERS AND THEIR
 ##  CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 ##  SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 ##  LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
 ##  USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
 ##  ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
 ##  OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
 ##  OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 ##  SUCH DAMAGE.
 ##
 #   package version
 %define       V_snort      2.9.3.1
 %define       V_rules      2.4
 %define       V_oinkmaster 2.0
 %define       V_pulledpork 0.6.1
 #   package information
 Name:         snort
 Summary:      Network Intrusion Detection System
 URL:          http://www.snort.org/
 Vendor:       B. Caswell, M. Roesch
 Packager:     OpenPKG Foundation e.V.
 Distribution: OpenPKG Community
 Class:        BASE
 Group:        Monitoring
 License:      GPL
 Version:      %{V_snort}
 Release:      20120800
 #   package options
 %option       with_fsl    yes
 %option       with_mysql  no
 %option       with_pgsql  no
 #   list of sources
 Source0:      http://dl.snort.org/snort-current/snort-%{V_snort}.tar.gz
 Source1:      http://www.snort.org/pub-bin/downloads.cgi/Download/vrt_pr/snortrules-pr-%{V_rules}.tar.gz
 Source2:      http://switch.dl.sourceforge.net/sourceforge/oinkmaster/oinkmaster-%{V_oinkmaster}.tar.gz
 Source3:      http://pulledpork.googlecode.com/files/pulledpork-%{V_pulledpork}.tar.gz
 Source4:      snort.conf
 Source5:      rc.snort
 Source6:      fsl.snort
 Source7:      snort-update.sh
 #   build information
 BuildPreReq:  OpenPKG, openpkg >= 20100101, make, gcc
 PreReq:       OpenPKG, openpkg >= 20100101, perl, perl-www, perl-sys, perl-comp
 BuildPreReq:  daq, libdnet, pcre
 PreReq:       daq, libdnet, pcre
 %if "%{with_fsl}" == "yes"
 BuildPreReq:  fsl
 PreReq:       fsl
 %endif
 %if "%{with_mysql}" == "yes"
 BuildPreReq:  mysql
 PreReq:       mysql
 %endif
 %if "%{with_pgsql}" == "yes"
 BuildPreReq:  postgresql
 PreReq:       postgresql
 %endif
 %description
     Snort is an open source network intrusion detection system,
     capable of performing real-time traffic analysis and packet
     logging on IP networks. It can perform protocol analysis, content
     searching/matching and can be used to detect a variety of attacks
     and probes. Snort uses a flexible rules language to describe traffic
     that it should collect or pass, as well as a detection engine that
     utilizes a modular plugin architecture. Snort has a real-time
     alerting capability as well. Snort has three primary uses. It can be
     used as a straight packet sniffer like tcpdump(1), a packet logger
     (useful for network traffic debugging, etc), or as a full blown
     network intrusion detection system.
 %track
     prog snort = {
         version   = %{V_snort}
         url       = http://www.snort.org/downloads
         regex     = snort-(\d+\.\d+\.\d+(\.\d+)*)\.tar\.gz
     }
     prog snort:rules = {
         version   = %{V_rules}
         url       = http://www.snort.org/pub-bin/downloads.cgi
         regex     = snortrules-pr-(\d+\.\d+)\.tar\.gz
     }
     prog snort:oinkmaster = {
         version   = %{V_oinkmaster}
         url       = http://sourceforge.net/projects/oinkmaster/files/
         regex     = oinkmaster-(__VER__)\.tar\.gz
     }
     prog snort:pulledpork = {
         version   = %{V_pulledpork}
         url       = http://sourceforge.net/projects/oinkmaster/files/
         url       = http://pulledpork.googlecode.com/files/
         regex     = pulledpork-(__VER__)\.tar\.gz
     }
 %prep
     %setup -q
     %setup -q -D -T -a 2
     %setup -q -D -T -a 3
     %{l_shtool} subst \
         -e 's;\(# define.*\)/var/log/snort;\1%{l_prefix}/var/snort;' \
         src/snort.h
     %{l_shtool} subst \
         -e 's;u_int\([0-9]*\)_t;uint\1_t;g' \
         src/dynamic-plugins/sf_engine/sf_snort_plugin_rc4.c \
         src/sfutil/sf_ip.h
 %build
     #   configure program
     LIBS=""
 %if "%{with_pgsql}" == "yes"
     LIBS="$LIBS -lpq -lcrypt -lssl -lcrypto"
 %endif
     case "%{l_platform -t}" in
         *-sunos* ) LIBS="$LIBS -lresolv" ;;
     esac
     CC="%{l_cc}" \
     CFLAGS="%{l_cflags -O}" \
     CPPFLAGS="%{l_cppflags}" \
     LDFLAGS="%{l_ldflags} %{l_fsl_ldflags}" \
     LIBS="$LIBS %{l_fsl_libs}" \
     ./configure \
         --prefix=%{l_prefix} \
         --sysconfdir=%{l_prefix}/etc/snort \
         --without-odbc \
         --without-oracle \
 %if "%{with_mysql}" == "yes"
         --with-mysql=%{l_prefix} \
 %else
         --without-mysql \
 %endif
 %if "%{with_pgsql}" == "yes"
         --with-postgresql=%{l_prefix} \
 %else
         --without-postgresql \
 %endif
         --with-daq-includes=%{l_prefix}/include \
         --with-daq-libraries=%{l_prefix}/lib \
         --with-libpcre-includes=%{l_prefix}/include \
         --with-libpcre-libraries=%{l_prefix}/lib \
         --enable-perfmonitor
     #   build program
     %{l_make} %{l_mflags -O}
 %install
     #   create installation hierarchy
     %{l_shtool} mkdir -f -p -m 755 \
         $RPM_BUILD_ROOT%{l_prefix}/sbin \
         $RPM_BUILD_ROOT%{l_prefix}/man/man8 \
         $RPM_BUILD_ROOT%{l_prefix}/etc/fsl \
         $RPM_BUILD_ROOT%{l_prefix}/etc/rc.d \
         $RPM_BUILD_ROOT%{l_prefix}/etc/snort \
         $RPM_BUILD_ROOT%{l_prefix}/share/snort \
         $RPM_BUILD_ROOT%{l_prefix}/var/snort/rules \
         $RPM_BUILD_ROOT%{l_prefix}/var/snort/tmp
     #   install program and manual page
     %{l_shtool} install -c -s -m 755 \
         src/snort $RPM_BUILD_ROOT%{l_prefix}/sbin/
     %{l_shtool} install -c -m 644 \
         snort.8 $RPM_BUILD_ROOT%{l_prefix}/man/man8/
     #   install default configuration
     %{l_shtool} install -c -m 644 %{l_value -s -a} \
         %{SOURCE snort.conf} $RPM_BUILD_ROOT%{l_prefix}/etc/snort/
     #   install default ruleset tarball
     %{l_shtool} install -c -m 644 \
         %{SOURCE snortrules-pr-%{V_rules}.tar.gz} \
         $RPM_BUILD_ROOT%{l_prefix}/share/snort/rules.tar.gz
     #   install run-command script
     %{l_shtool} install -c -m 755 %{l_value -s -a} \
         %{SOURCE rc.snort} $RPM_BUILD_ROOT%{l_prefix}/etc/rc.d/
     #   install OSSP fsl configuration
     %{l_shtool} install -c -m 644 %{l_value -s -a} \
         %{SOURCE fsl.snort} $RPM_BUILD_ROOT%{l_prefix}/etc/fsl/
     #   install optional/additional files
 %if "%{with_mysql}" == "yes"
     %{l_shtool} install -c -m 644 \
         schemas/create_mysql \
         $RPM_BUILD_ROOT%{l_prefix}/share/snort/
 %endif
 %if "%{with_pgsql}" == "yes"
     %{l_shtool} install -c -m 644 \
         schemas/create_postgresql \
         $RPM_BUILD_ROOT%{l_prefix}/share/snort/
 %endif
     #   install oinkmaster utility
     ( cd oinkmaster-%{V_oinkmaster}
       %{l_shtool} install -c -m 755 \
           -e 's;#!/usr/bin/perl;#! %{l_prefix}/bin/perl;g' \
           -e 's;/etc/oinkmaster\.conf;%{l_prefix}/etc/snort/oinkmaster.conf;' \
           oinkmaster.pl $RPM_BUILD_ROOT%{l_prefix}/sbin/oinkmaster
       %{l_shtool} install -c -m 644 \
           oinkmaster.1 $RPM_BUILD_ROOT%{l_prefix}/man/man8/oinkmaster.8
       %{l_shtool} install -c -m 644 \
           -e 's;^\(path = \);\1%{l_prefix}/bin:;' \
           -e 's;^# tmpdir = /home/oinkmaster/tmp/;tmpdir = %{l_prefix}/var/snort/tmp;' \
           -e 's;^\(use_external_bins = 0\);\1;' \
           -e 's;^\(skipfile snort\.conf\);# \1;' \
           oinkmaster.conf $RPM_BUILD_ROOT%{l_prefix}/etc/snort/
     ) || exit $?
     #   install pulledpork utility
     ( cd pulledpork-%{V_pulledpork}
       %{l_shtool} install -c -m 755 \
           -e 's;/usr/local;%{l_prefix};g' \
           -e 's;#!/usr/bin/perl;#! %{l_prefix}/bin/perl;g' \
           pulledpork.pl $RPM_BUILD_ROOT%{l_prefix}/sbin/pulledpork
       %{l_shtool} install -c -m 644 \
           -e 's;\(temp_path\) *=.*;\1 = %{l_prefix}/var/snort/tmp;' \
           etc/*.conf $RPM_BUILD_ROOT%{l_prefix}/etc/snort/
     ) || exit $?
     #   install rule update utility
     %{l_shtool} install -c -m 755 %{l_value -s -a} \
         -e 's;@V_rules@;%{V_rules};g' \
         %{SOURCE snort-update.sh} \
         $RPM_BUILD_ROOT%{l_prefix}/sbin/snort-update
     #   determine installation files
     %{l_rpmtool} files -v -ofiles -r$RPM_BUILD_ROOT \
         %{l_files_std} \
         '%config %{l_prefix}/etc/fsl/*' \
         '%config %{l_prefix}/etc/snort/*' \
         '%attr(-,%{l_rusr},%{l_rgrp}) %{l_prefix}/var/snort' \
         '%attr(-,%{l_rusr},%{l_rgrp}) %{l_prefix}/var/snort/rules' \
         '%attr(-,%{l_rusr},%{l_rgrp}) %{l_prefix}/var/snort/tmp'
 %files -f files
 %clean
 %post
     if [ $1 -eq 1 ]; then
         #   display final hints on initial installation
         ( echo "Before starting Snort IDS, please set the configuration variable"
           echo "\"snort_if\" in $RPM_INSTALL_PREFIX/etc/rc.conf to the name of the"
           echo "used network interface."
         ) | %{l_rpmtool} msg -b -t notice
         ( echo "To use Snort as an IDS, its rules HAVE to be ALWAYS up to date."
           echo "But this package just ships with the latest PUBLIC version of the"
           echo "\"Sourcefire VRT Certified Rules\" for UNREGISTERED Snort users."
           echo "This means your rules are NOT covering the latest known attacks."
           echo ""
           echo "Hence, we strongly recommend to become at least a REGISTERED Snort"
           echo "user (see http://www.snort.org/ for details). This way you receive"
           echo "a so-called \"oinkcode\" (a sequence of 40 hexadecimal numbers)"
           echo "which you can configure in the file"
           echo "    $RPM_INSTALL_PREFIX/etc/rc.conf"
           echo "via the directives"
           echo "    snort_update_time=\"daily\""
           echo "    snort_update_source=\"oinkcode:XXXX...\""
           echo "to update your Snort rules in"
           echo "    $RPM_INSTALL_PREFIX/var/snort/rules/"
           echo "automatically once per day with the latest version of the"
           echo "\"Sourcefire VRT Certified Rules\" for REGISTERED Snort users."
         ) | %{l_rpmtool} msg -b -t notice
     fi
     #   trigger a ruleset update
     snort_update_source=`%{l_rc} -q snort_update_source`
     if [ ".$snort_update_source" != . ]; then
         su - %{l_rusr} -c "$RPM_INSTALL_PREFIX/sbin/snort-update \"$snort_update_source\""
     fi
     #   after upgrade, restart service
     [ $1 -eq 2 ] || exit 0
     eval `%{l_rc} snort status 2>/dev/null`
     [ ".$snort_active" = .yes ] && %{l_rc} snort restart
     exit 0
 %preun
     #   before erase, stop service and remove log files
     [ $1 -eq 0 ] || exit 0
     %{l_rc} snort stop 2>/dev/null
     rm -f $RPM_INSTALL_PREFIX/var/snort/*.pid >/dev/null 2>&1 || true
     rm -f $RPM_INSTALL_PREFIX/var/snort/*.log >/dev/null 2>&1 || true
     rm -f $RPM_INSTALL_PREFIX/var/snort/*.cap >/dev/null 2>&1 || true
     rm -f $RPM_INSTALL_PREFIX/var/snort/rules/* >/dev/null 2>&1 || true
     rm -f $RPM_INSTALL_PREFIX/var/snort/tmp/*   >/dev/null 2>&1 || true
     exit 0

OpenPKG Specs / annotate

snort/snort.spec@6b18bb69901e (annotated)

snort/snort.spec