140 lines
4.4 KiB
Makefile
140 lines
4.4 KiB
Makefile
PORTNAME= snort
|
|
PORTVERSION= 2.9.20
|
|
PORTREVISION= 1
|
|
CATEGORIES= security
|
|
MASTER_SITES= https://snort.org/downloads/snort/ \
|
|
https://snort.org/downloads/archive/snort/
|
|
|
|
PATCH_DIST_STRIP= -p1
|
|
|
|
MAINTAINER= dvl@FreeBSD.org
|
|
COMMENT= Lightweight network intrusion detection system
|
|
WWW= https://www.snort.org/
|
|
|
|
LICENSE= GPLv2
|
|
LICENSE_FILE= ${WRKSRC}/LICENSE
|
|
|
|
BUILD_DEPENDS= daq>=2.2.2_3:net/daq
|
|
LIB_DEPENDS= libpcre.so:devel/pcre \
|
|
libdnet.so:net/libdnet \
|
|
libpcap.so:net/libpcap
|
|
RUN_DEPENDS= daq>=2.2.2_3:net/daq
|
|
|
|
USES= bison cpe libtool pathfix shebangfix ssl
|
|
USE_RC_SUBR= snort
|
|
USE_LDCONFIG= yes
|
|
|
|
SUB_FILES= pkg-message
|
|
SHEBANG_FILES= tools/appid_detector_builder.sh
|
|
GNU_CONFIGURE= yes
|
|
MAKE_JOBS_UNSAFE= yes
|
|
|
|
RULES_DIR= ${ETCDIR}/rules
|
|
PREPROC_RULE_DIR= ${ETCDIR}/preproc_rules
|
|
LOGS_DIR= /var/log/snort
|
|
|
|
CONFLICTS_INSTALL= snort3-3.*
|
|
|
|
OPTIONS_DEFINE= IPV6 GRE HA NORMALIZER DOCS APPID \
|
|
PERFPROFILE LRGPCAP SOURCEFIRE NONETHER \
|
|
FILEINSPECT
|
|
|
|
OPTIONS_GROUP= ADDONS DEV
|
|
OPTIONS_GROUP_ADDONS= BARNYARD PULLEDPORK
|
|
OPTIONS_GROUP_DEV= DBGSNORT COREDUMPS
|
|
OPTIONS_SUB= yes
|
|
OPTIONS_DEFAULT= GRE NORMALIZER BARNYARD \
|
|
PERFPROFILE SOURCEFIRE PULLEDPORK
|
|
|
|
GRE_DESC= GRE support
|
|
IPV6_DESC= IPv6 in snort.conf
|
|
LRGPCAP_DESC= Pcaps larger than 2GB
|
|
NONETHER_DESC= Non-Ethernet Decoders
|
|
NORMALIZER_DESC= Normalizer
|
|
PERFPROFILE_DESC= Performance profiling
|
|
SOURCEFIRE_DESC= Sourcefire recommended build options
|
|
APPID_DESC= Build with application id support (EXPERIMENTAL)
|
|
HA_DESC= Enable high-availability state sharing (EXPERIMENTAL)
|
|
FILEINSPECT_DESC= Build with extended file inspection features (EXPERIMENTAL)
|
|
ADDONS_DESC= Depend on 3rd party addons
|
|
BARNYARD_DESC= Depend on barnyard2 (supports also snortsam)
|
|
PULLEDPORK_DESC= Depend on pulledpork
|
|
DEV_DESC= Developer options
|
|
DBGSNORT_DESC= Enable debugging symbols
|
|
COREDUMPS_DESC= Enable core dumps
|
|
|
|
COREDUMPS_CONFIGURE_ENABLE= corefiles
|
|
DBGSNORT_CONFIGURE_ENABLE= debug
|
|
DBGSNORT_MAKE_ENV= DONTSTRIP="yes"
|
|
GRE_CONFIGURE_ENABLE= gre
|
|
LRGPCAP_CONFIGURE_ENABLE= large-pcap
|
|
NONETHER_CONFIGURE_ENABLE= non-ether-decoders
|
|
NORMALIZER_CONFIGURE_ENABLE= normalizer
|
|
PERFPROFILE_CONFIGURE_ENABLE= perfprofiling ppm
|
|
SOURCEFIRE_CONFIGURE_ENABLE= sourcefire
|
|
APPID_CONFIGURE_ENABLE= open-appid
|
|
HA_CONFIGURE_ENABLE= ha
|
|
FILEINSPECT_CONFIGURE_ENABLE= file-inspect
|
|
|
|
BARNYARD_RUN_DEPENDS= barnyard2:security/barnyard2
|
|
PULLEDPORK_RUN_DEPENDS= pulledpork.pl:security/pulledpork
|
|
APPID_USES= luajit
|
|
APPID_CONFIGURE_ENV+= luajit_CFLAGS="-I${LUAJIT_INCDIR}" \
|
|
luajit_LIBS="-L${LOCALBASE}/lib -lluajit-5.1"
|
|
|
|
# Disable SIMD on 32-bit arm. Snort has numerous arbitrarily misaligned memory
|
|
# accesses and some of them cause faults. The kludge below combined with
|
|
# patch-configure seems to work around it well enough.
|
|
#
|
|
# Note the change is more aggressive than it possibly needs to be reduce surprises.
|
|
CFLAGS_armv6= -mfpu=vfpv3
|
|
CFLAGS_armv7= -mfpu=vfpv3
|
|
|
|
CONFIG_FILES= classification.config gen-msg.map reference.config \
|
|
snort.conf threshold.conf unicode.map file_magic.conf
|
|
|
|
DOCS= RELEASE.NOTES doc/AUTHORS doc/BUGS doc/CREDITS \
|
|
doc/README* doc/USAGE doc/*.pdf
|
|
PREPROC_RULES= decoder.rules preprocessor.rules sensitive-data.rules
|
|
|
|
CFLAGS+= -fstack-protector
|
|
CONFIGURE_ARGS+=--enable-reload \
|
|
--enable-mpls --enable-targetbased \
|
|
--enable-reload-error-restart
|
|
|
|
post-patch:
|
|
@${REINPLACE_CMD} "s,/etc/snort.conf,${ETCDIR}/snort.conf," \
|
|
${WRKSRC}/src/snort.c ${WRKSRC}/snort.8
|
|
|
|
@${REINPLACE_CMD} -e 's|^dynamicdetection|#dynamicdetection|' \
|
|
-e '/ipvar HOME_NET/s/any/[YOU_NEED_TO_SET_HOME_NET_IN_snort.conf]/' \
|
|
-e '/^# include .PREPROC_RULE/s/# include/include/' \
|
|
${WRKSRC}/etc/snort.conf
|
|
|
|
post-patch-IPV6-off:
|
|
# IPv6 is no longer a ./configure option!
|
|
@${REINPLACE_CMD} -e '/normalize_ip6/s/^preprocessor/#preprocessor/' \
|
|
-e '/normalize_icmp6/s/^preprocessor/#preprocessor/' \
|
|
${WRKSRC}/etc/snort.conf
|
|
|
|
post-build:
|
|
@${FIND} ${WRKSRC}/src -name '*.0' -type f -exec ${STRIP_CMD} {} \;
|
|
|
|
post-install:
|
|
@${MKDIR} ${STAGEDIR}${ETCDIR} ${STAGEDIR}${RULES_DIR} ${STAGEDIR}${LOGS_DIR} \
|
|
${STAGEDIR}${PREPROC_RULE_DIR}
|
|
|
|
.for f in ${CONFIG_FILES}
|
|
${INSTALL_DATA} ${WRKSRC}/etc/${f} ${STAGEDIR}${ETCDIR}/${f}-sample
|
|
.endfor
|
|
|
|
.for f in ${PREPROC_RULES}
|
|
${INSTALL_DATA} ${WRKSRC}/preproc_rules/${f} ${STAGEDIR}${PREPROC_RULE_DIR}/${f}-sample
|
|
.endfor
|
|
|
|
post-install-DOCS-on:
|
|
@${MKDIR} ${STAGEDIR}${PREPROC_RULE_DIR} ${STAGEDIR}${DOCSDIR}
|
|
(cd ${WRKSRC} && ${INSTALL_DATA} ${DOCS} ${STAGEDIR}${DOCSDIR})
|
|
|
|
.include <bsd.port.mk>
|