testing/suricata: new aport

https://suricata-ids.org/
High performance Network IDS, IPS and Network Security Monitoring engine

4 files changed, 166 insertions, 0 deletions

diff --git a/testing/suricata/APKBUILD b/testing/suricata/APKBUILD
new file mode 100644
index 0000000000..98249da3f0
--- /dev/null
+++ b/testing/suricata/APKBUILD
@@ -0,0 +1,59 @@
+# Contributor: Steve McMaster <code@mcmaster.io>
+# Maintainer: Steve McMaster <code@mcmaster.io>
+pkgname=suricata
+pkgver=3.2
+pkgrel=0
+pkgdesc="High performance Network IDS, IPS and Network Security Monitoring engine"
+url="https://suricata-ids.org/"
+arch="all"
+license="GPL-2"
+depends=""
+makedepends="automake autoconf libtool libhtp-dev>=0.5.23 libcap-ng-dev
+	file-dev luajit-dev geoip-dev pcre-dev yaml-dev libpcap-dev hiredis-dev
+	libnet-dev libnetfilter_queue-dev jansson-dev python nss-dev nspr-dev"
+install=""
+subpackages="$pkgname-doc"
+source="${pkgname}-${pkgver}.tar.gz::http://www.openinfosecfoundation.org/download/${pkgname}-${pkgver}.tar.gz
+"
+
+builddir="$srcdir/$pkgname-$pkgver"
+
+prepare() {
+	cd "$builddir"
+	autoreconf -vif || return 1
+}
+
+build() {
+	cd "$builddir"
+	./configure \
+		--build=$CBUILD \
+		--host=$CHOST \
+		--prefix=/usr \
+		--sysconfdir=/etc \
+		--mandir=/usr/share/man \
+		--localstatedir=/var \
+		--enable-non-bundled-htp \
+		--enable-nfqueue \
+		--disable-gccmarch-native \
+		--enable-hiredis \
+		--enable-geoip \
+		--enable-gccprotect \
+		--enable-pie \
+		--enable-luajit \
+		|| return 1
+	make || return 1
+}
+
+package() {
+	cd "$builddir"
+	make DESTDIR="$pkgdir" install || return 1
+	make DESTDIR="$pkgdir" install-full || return 1
+
+	cd "$srcdir"
+	install -D -m 755 ../suricata.initd "$pkgdir"/etc/init.d/suricata
+	install -D -m 644 ../suricata.confd "$pkgdir"/etc/conf.d/suricata
+	install -D -m 644 ../suricata.logrotate "$pkgdir"/etc/logrotate.d/snort
+}
+md5sums="05854b3390ea86fabe73bdb5a90db36c  suricata-3.2.tar.gz"
+sha256sums="41cbe19c6fd6bd51ebcbc29063f558e2fbba4a2450e5809fee2e461f16a4ed68  suricata-3.2.tar.gz"
+sha512sums="327f5a62449af44f6cb95220e1ff9bf61b51db7bd25f2b1e8def3e8650ba754304cf9d02fc30b46b6cbaa6b5f94fa3d4be90edb8a293ff3b6c0927b596a2976e  suricata-3.2.tar.gz"
diff --git a/testing/suricata/suricata.confd b/testing/suricata/suricata.confd
new file mode 100644
index 0000000000..9585bdc681
--- /dev/null
+++ b/testing/suricata/suricata.confd
@@ -0,0 +1,31 @@
+# Config file for /etc/init.d/suricata*
+
+# Where config files are stored. Default:
+
+# SURICATA_DIR="/etc/suricata"
+
+# Pass options to each suricata service.
+# You can launch more than one service at the same time with different options.
+# This can be useful in a multi-queue gateway, for example.
+# You can expand on the Suricata inline example found at:
+# https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Setting_up_IPSinline_for_Linux
+# Instead of configuring iptables to send traffic to just one queue, you can configure it to "load balance"
+# on several queues. You can then have a Suricata instance processing traffic for each queue.
+# This should help improve performance on the gateway/firewall.
+# Suppose you configured iptables to use queues 0 and 1. You can now do the following:
+# ln -s /etc/init.d/suricata /etc/init.d/suricata.q0
+# ln -s /etc/init.d/suricata /etc/init.d/suricata.q1
+# cp /etc/suricata/suricata.yaml /etc/suricata/suricata-q0.yaml
+# cp /etc/suricata/suricata.yaml /etc/suricata/suricata-q1.yaml
+# mkdir /var/log/suricata/q{0,1}
+# Edit both suricata-q{0,1}.yaml files and set values accordingly (eg. set the suricata.log file path to
+# a dedicated dir in the section "logging:outputs:-file").
+# You can then define the following options here:
+
+# SURICATA_OPTS[q0]="-q 0 -l /var/log/suricata/q0"
+# SURICATA_OPTS[q1]="-q 1 -l /var/log/suricata/q1"
+
+# If you want to use ${SURICATA_DIR}/suricata.yaml and start the service with /etc/init.d/suricata
+# then you can set:
+
+SURICATA_OPTIONS="--af-packet"
diff --git a/testing/suricata/suricata.initd b/testing/suricata/suricata.initd
new file mode 100644
index 0000000000..e39312f377
--- /dev/null
+++ b/testing/suricata/suricata.initd
@@ -0,0 +1,65 @@
+#!/sbin/openrc-run
+# Copyright 1999-2016 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Id$
+
+SURICATA_DIR=${SURICATA_DIR:-/etc/suricata}
+SURICATA=${SVCNAME#*.}
+if [ -n "${SURICATA}" ] && [ ${SVCNAME} != "suricata" ]; then
+    SURICATACONF="${SURICATA_DIR}/suricata-${SURICATA}.yaml"
+    SURICATAPID="/var/run/suricata/suricata.${SURICATA}.pid"
+else
+    SURICATACONF="${SURICATA_DIR}/suricata.yaml"
+    SURICATAPID="/var/run/suricata/suricata.pid"
+fi
+SURICATAOPTS=${SURICATA_OPTIONS}
+
+extra_commands="checkconfig"
+extra_started_commands="reload"
+
+depend() {
+	need net
+	after firewall
+}
+
+checkconfig() {
+	if [ ! -e ${SURICATACONF} ] ; then
+		eerror "You need to create ${SURICATACONF} to run ${SVCNAME}."
+		return 1
+	fi
+}
+
+start() {
+	checkconfig || return 1
+	ebegin "Starting ${SVCNAME}"
+	start-stop-daemon --start --quiet --exec /usr/bin/suricata \
+		-- --pidfile ${SURICATAPID} -D ${SURICATAOPTS} \
+        -c ${SURICATACONF} >/dev/null 2>&1
+	eend $?
+}
+
+stop() {
+	ebegin "Stopping ${SVCNAME}"
+	start-stop-daemon --stop --quiet --pidfile ${SURICATAPID} >/dev/null 2>&1
+	einfon "Waiting for ${SVCNAME} to shut down. This can take a while..."
+	echo
+	# max wait: 5 minutes as it can take quite a while on some systems with heavy traffic
+	cnt=300
+	while [ -f ${SURICATAPID} ]; do
+	    cnt=$(expr $cnt - 1)
+	    if [ $cnt -lt 1 ] ; then
+    		echo
+    		eend 1 "Failed."
+    		break
+	    fi
+	    sleep 1
+	    echo -ne "$cnt seconds left before we give up\r"
+	done
+	eend $?
+}
+
+reload() {
+    checkconfig || return 1
+	ebegin "Reloading ${SVCNAME}"
+	start-stop-daemon --signal HUP --pidfile ${SURICATAPID}
+}
diff --git a/testing/suricata/suricata.logrotate b/testing/suricata/suricata.logrotate
new file mode 100644
index 0000000000..94622f38c1
--- /dev/null
+++ b/testing/suricata/suricata.logrotate
@@ -0,0 +1,11 @@
+/var/log/suricata/*.log /var/log/suricata/*.json
+{
+    rotate 3
+    missingok
+    nocompress
+    create
+    sharedscripts
+    postrotate
+            /bin/kill -HUP $(cat /var/run/suricata.pid)
+    endscript
+}