diff options
Diffstat (limited to 'community')
| -rw-r--r-- | community/suricata/APKBUILD | 67 | ||||
| -rw-r--r-- | community/suricata/suricata.confd | 31 | ||||
| -rw-r--r-- | community/suricata/suricata.initd | 65 | ||||
| -rw-r--r-- | community/suricata/suricata.logrotate | 11 |
4 files changed, 174 insertions, 0 deletions
diff --git a/community/suricata/APKBUILD b/community/suricata/APKBUILD new file mode 100644 index 0000000000..e55dd321e0 --- /dev/null +++ b/community/suricata/APKBUILD @@ -0,0 +1,67 @@ +# Contributor: Steve McMaster <code@mcmaster.io> +# Maintainer: Steve McMaster <code@mcmaster.io> +pkgname=suricata +pkgver=4.0.0 +pkgrel=0 +pkgdesc="High performance Network IDS, IPS and Network Security Monitoring engine" +url="https://suricata-ids.org/" +# luajit is not available for disabled arches +arch="all !s390x" +license="GPL-2" +makedepends="automake autoconf libtool libhtp-dev>=0.5.25 libcap-ng-dev + file-dev luajit-dev geoip-dev pcre-dev yaml-dev libpcap-dev hiredis-dev + libnet-dev libnetfilter_queue-dev libnfnetlink-dev jansson-dev python2 + nss-dev nspr-dev" +subpackages="$pkgname-doc" +source="http://www.openinfosecfoundation.org/download/$pkgname-$pkgver.tar.gz + $pkgname.confd + $pkgname.initd + $pkgname.logrotate + " +builddir="$srcdir/$pkgname-$pkgver" + +prepare() { + cd "$builddir" + autoreconf -vif +} + +build() { + cd "$builddir" + ./configure \ + --build=$CBUILD \ + --host=$CHOST \ + --prefix=/usr \ + --sysconfdir=/etc \ + --mandir=/usr/share/man \ + --localstatedir=/var \ + --enable-non-bundled-htp \ + --enable-nfqueue \ + --disable-gccmarch-native \ + --enable-hiredis \ + --enable-geoip \ + --enable-gccprotect \ + --enable-pie \ + --enable-luajit \ + || return 1 + make +} + +check() { + cd "$builddir" + make check +} + +package() { + cd "$builddir" + make DESTDIR="$pkgdir" install + make DESTDIR="$pkgdir" install-full + + cd "$srcdir" + install -D -m 755 $pkgname.initd "$pkgdir"/etc/init.d/$pkgname + install -D -m 644 $pkgname.confd "$pkgdir"/etc/conf.d/$pkgname + install -D -m 644 $pkgname.logrotate "$pkgdir"/etc/logrotate.d/$pkgname +} +sha512sums="1dd386c36a74d1ab6bfa33db1dbde0dbe4f0045dc80f3304ece6b67a630b2a3eacf0b24e76f4501c55bf5ca65a7b54380da202425ca3873a06b3b5f759261453 suricata-4.0.0.tar.gz +ed7c78a80192f3f3ed433330df323beccb6079b5413289b9e9faa3fceea2c536de93de7372968d8605abd1618d73c9319ee39d86b16eed22e7313c8667252f5d suricata.confd +258c6d60fc878dc1c7b7bf93cc758080050f591084a1edf7f1aac81ccb523c73615716616fedd0269f9ac5ef2fa7adcb3e2cefd714754bac5571e9806b6781be suricata.initd +4f76a35bcde78c9860701897fe19bb84cc46bbc429124c4cb2e94cf3330f00ebe8067c0d7f3f83478e9b95323adb947e5081658f455657c4d03c682abe707534 suricata.logrotate" diff --git a/community/suricata/suricata.confd b/community/suricata/suricata.confd new file mode 100644 index 0000000000..9585bdc681 --- /dev/null +++ b/community/suricata/suricata.confd @@ -0,0 +1,31 @@ +# Config file for /etc/init.d/suricata* + +# Where config files are stored. Default: + +# SURICATA_DIR="/etc/suricata" + +# Pass options to each suricata service. +# You can launch more than one service at the same time with different options. +# This can be useful in a multi-queue gateway, for example. +# You can expand on the Suricata inline example found at: +# https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Setting_up_IPSinline_for_Linux +# Instead of configuring iptables to send traffic to just one queue, you can configure it to "load balance" +# on several queues. You can then have a Suricata instance processing traffic for each queue. +# This should help improve performance on the gateway/firewall. +# Suppose you configured iptables to use queues 0 and 1. You can now do the following: +# ln -s /etc/init.d/suricata /etc/init.d/suricata.q0 +# ln -s /etc/init.d/suricata /etc/init.d/suricata.q1 +# cp /etc/suricata/suricata.yaml /etc/suricata/suricata-q0.yaml +# cp /etc/suricata/suricata.yaml /etc/suricata/suricata-q1.yaml +# mkdir /var/log/suricata/q{0,1} +# Edit both suricata-q{0,1}.yaml files and set values accordingly (eg. set the suricata.log file path to +# a dedicated dir in the section "logging:outputs:-file"). +# You can then define the following options here: + +# SURICATA_OPTS[q0]="-q 0 -l /var/log/suricata/q0" +# SURICATA_OPTS[q1]="-q 1 -l /var/log/suricata/q1" + +# If you want to use ${SURICATA_DIR}/suricata.yaml and start the service with /etc/init.d/suricata +# then you can set: + +SURICATA_OPTIONS="--af-packet" diff --git a/community/suricata/suricata.initd b/community/suricata/suricata.initd new file mode 100644 index 0000000000..9ea615e4b1 --- /dev/null +++ b/community/suricata/suricata.initd @@ -0,0 +1,65 @@ +#!/sbin/openrc-run +# Copyright 1999-2016 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Id$ + +SURICATA_DIR=${SURICATA_DIR:-/etc/suricata} +SURICATA=${SVCNAME#*.} +if [ -n "${SURICATA}" ] && [ ${SVCNAME} != "suricata" ]; then + SURICATACONF="${SURICATA_DIR}/suricata-${SURICATA}.yaml" + SURICATAPID="/var/run/suricata/suricata.${SURICATA}.pid" +else + SURICATACONF="${SURICATA_DIR}/suricata.yaml" + SURICATAPID="/var/run/suricata/suricata.pid" +fi +SURICATAOPTS=${SURICATA_OPTIONS} + +extra_commands="checkconfig" +extra_started_commands="reload" + +depend() { + need net + after firewall +} + +checkconfig() { + if [ ! -e ${SURICATACONF} ] ; then + eerror "You need to create ${SURICATACONF} to run ${SVCNAME}." + return 1 + fi +} + +start() { + checkconfig || return 1 + ebegin "Starting ${SVCNAME}" + start-stop-daemon --start --quiet --exec /usr/bin/suricata \ + -- --pidfile ${SURICATAPID} -D ${SURICATAOPTS} \ + -c ${SURICATACONF} >/dev/null 2>&1 + eend $? +} + +stop() { + ebegin "Stopping ${SVCNAME}" + start-stop-daemon --stop --quiet --pidfile ${SURICATAPID} >/dev/null 2>&1 + einfon "Waiting for ${SVCNAME} to shut down. This can take a while..." + echo + # max wait: 5 minutes as it can take quite a while on some systems with heavy traffic + cnt=300 + while [ -f ${SURICATAPID} ]; do + cnt=$(expr $cnt - 1) + if [ $cnt -lt 1 ] ; then + echo + eend 1 "Failed." + break + fi + sleep 1 + echo -ne "$cnt seconds left before we give up\r" + done + eend $? +} + +reload() { + checkconfig || return 1 + ebegin "Reloading ${SVCNAME}" + start-stop-daemon --signal HUP --pidfile ${SURICATAPID} +} diff --git a/community/suricata/suricata.logrotate b/community/suricata/suricata.logrotate new file mode 100644 index 0000000000..f09690a792 --- /dev/null +++ b/community/suricata/suricata.logrotate @@ -0,0 +1,11 @@ +/var/log/suricata/*.log /var/log/suricata/*.json +{ + rotate 3 + missingok + nocompress + create + sharedscripts + postrotate + /bin/kill -HUP $(cat /var/run/suricata/suricata.pid) + endscript +} |