This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 3.x development tree".

The branch, master has been updated via d0ec0fcb131f8afe0c1dfe5c083f800a74748648 (commit) via 1358ff1040a9e684d354fd17af7cc4b14dd7ea87 (commit) via fcd0b092477880fa2f318a768f0f8e426bbef190 (commit) via 1548a677481995befa4b0b4c98d9f90144ef1f47 (commit) via de58ea22dfc26f8748c9dad2c58f0d39d8c727a1 (commit) via ab63584d8f833254c3d6d50c1bc3ce9cf32b043e (commit) via c1fa1b26fdbd4e471e6a717a3c2cf014ce5cbcee (commit) via d30f48f32d74e1a89c882719dd5a299e47ca3c75 (commit) via 750384fe36f4c31e929c91ef2dfa966c9754ddb7 (commit) via 9d1be60e67d0a70f1bb5d0e9bc39605947444c07 (commit) via f694e81d028764e77abae5ab7bfc6b14ac4a8aa0 (commit) via 9df7245f6101cbfb23dd090c2747cafac3c7a345 (commit) via f84bbab0c8a48740a3bc66d0918d4520b7efd103 (commit) via 0a280e8de08dfc40479b659e2194780ac68ff8b7 (commit) via 2a9a44bd0786c235bbc6052a99f4041fd5d6842c (commit) via 6f4376eeb475e4359e5269c233b4bcef0846a234 (commit) via e8b2558d4ad1be0ff810760ab39583ddf321f2b7 (commit) via d7b4160404c00eb2cbd21413e8641865a9d78d25 (commit) via 972265f0aa57f6b3c1b10ecda5624b1e57057db6 (commit) via 74e6b01b002903568fb468767ae5af6f8bf63eed (commit) via 217da1061b49bc8fcf2945dee15f7a21f288fe60 (commit) via fcf279c00201ba2fe32b1346df219dfcb8da7786 (commit) via c4ea8da6ecb2453803c43991aee9da8692843fd3 (commit) via 1ee71b31bb8784a581eb391ee4bdaf6561132bb1 (commit) via 28c39d19115b305a07b31717b6312a38a7b4684c (commit) via f1f33be6c8954d51f1e4bce0df980201333c21bb (commit) via ee9ea526a0d646a930e700c0ce3d313ef1eb67e5 (commit) via 272bae8f05f6fdce602f87be5e103dc3a0171d60 (commit) via 405051643e7ba8c6e3a2df70e51799c63058b426 (commit) via 9f0b0495d676cacb0a737510ab8e352005f2ffc1 (commit) via 9e169f948262de0cc628000cbe392bc3c5ae0024 (commit) via 5b4a07621ac4f149ac7b0ef38e6219b7a3891d6f (commit) via f6740237c3695546ad8871e7982da6e9964a3b1a (commit) from af015397c39ff259cafabf0334c16a4fc90820ee (commit)

Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below.

- Log ----------------------------------------------------------------- commit d0ec0fcb131f8afe0c1dfe5c083f800a74748648 Author: Jan Paul Tuecking earl@ipfire.org Date: Mon Oct 31 14:00:44 2011 +0100

intltool: Update to 0.40.6.

commit 1358ff1040a9e684d354fd17af7cc4b14dd7ea87 Author: Jan Paul Tuecking earl@ipfire.org Date: Mon Oct 31 13:59:27 2011 +0100

open-vm-tools: new package.

Enhance performance and user experience of virtual machines.

commit fcd0b092477880fa2f318a768f0f8e426bbef190 Author: Jan Paul Tuecking earl@ipfire.org Date: Mon Oct 31 13:55:55 2011 +0100

usb-modeswitch: Update to 1.2.0

Fixes #274.

Conflicts:

usb-modeswitch/usb-modeswitch.nm

commit 1548a677481995befa4b0b4c98d9f90144ef1f47 Merge: de58ea2 6f4376e Author: Michael Tremer michael.tremer@ipfire.org Date: Mon Oct 31 13:54:18 2011 +0100

Merge remote-tracking branch 'maniacikarus/ids'

commit de58ea22dfc26f8748c9dad2c58f0d39d8c727a1 Author: Michael Tremer michael.tremer@ipfire.org Date: Mon Oct 31 13:33:14 2011 +0100

gcc: Update to 4.6.2.

This is an update to fix minor issues. It is not expected to break anything.

commit ab63584d8f833254c3d6d50c1bc3ce9cf32b043e Merge: c1fa1b2 e8b2558 Author: Michael Tremer michael.tremer@ipfire.org Date: Mon Oct 31 13:32:23 2011 +0100

Merge remote-tracking branch 'maniacikarus/proxy'

commit c1fa1b26fdbd4e471e6a717a3c2cf014ce5cbcee Merge: d30f48f c4ea8da Author: Michael Tremer michael.tremer@ipfire.org Date: Mon Oct 31 13:30:20 2011 +0100

Merge remote-tracking branch 'maniacikarus/samba'

Conflicts: samba/samba.nm

commit d30f48f32d74e1a89c882719dd5a299e47ca3c75 Merge: 750384f 28c39d1 Author: Michael Tremer michael.tremer@ipfire.org Date: Mon Oct 31 13:28:21 2011 +0100

Merge remote-tracking branch 'maniacikarus/iperf'

commit 750384fe36f4c31e929c91ef2dfa966c9754ddb7 Merge: 9d1be60 f1f33be Author: Michael Tremer michael.tremer@ipfire.org Date: Mon Oct 31 13:24:54 2011 +0100

Merge remote-tracking branch 'maniacikarus/rsyslog'

commit 9d1be60e67d0a70f1bb5d0e9bc39605947444c07 Merge: f694e81 9f0b049 Author: Michael Tremer michael.tremer@ipfire.org Date: Mon Oct 31 13:14:40 2011 +0100

Merge remote-tracking branch 'maniacikarus/zlib'

commit f694e81d028764e77abae5ab7bfc6b14ac4a8aa0 Merge: 9df7245 f674023 Author: Michael Tremer michael.tremer@ipfire.org Date: Mon Oct 31 13:10:28 2011 +0100

Merge remote-tracking branch 'stevee/Xorg'

commit 9df7245f6101cbfb23dd090c2747cafac3c7a345 Merge: f84bbab 5b4a076 Author: Michael Tremer michael.tremer@ipfire.org Date: Mon Oct 31 13:10:07 2011 +0100

Merge remote-tracking branch 'stevee/sudo'

commit f84bbab0c8a48740a3bc66d0918d4520b7efd103 Merge: 0a280e8 972265f Author: Michael Tremer michael.tremer@ipfire.org Date: Mon Oct 31 13:07:36 2011 +0100

Merge remote-tracking branch 'stevee/freetype'

commit 0a280e8de08dfc40479b659e2194780ac68ff8b7 Merge: af01539 2a9a44b Author: Michael Tremer michael.tremer@ipfire.org Date: Mon Oct 31 13:04:59 2011 +0100

Merge remote-tracking branch 'stevee/keepalived'

commit 2a9a44bd0786c235bbc6052a99f4041fd5d6842c Author: Stefan Schantl stefan.schantl@ipfire.org Date: Sun Oct 30 16:23:36 2011 +0100

keepalived: Remove unwanted environment file in /etc/sysconfig from systemd file.

commit 6f4376eeb475e4359e5269c233b4bcef0846a234 Author: Christian Schmidt christian.schmidt@iipfire.org Date: Sun Oct 30 14:07:44 2011 +0000

suricata: Fixed non functional ExecStopPre systemd command.

commit e8b2558d4ad1be0ff810760ab39583ddf321f2b7 Author: Christian Schmidt christian.schmidt@iipfire.org Date: Sun Oct 30 11:36:29 2011 +0000

c-icap: Updated c-icap and c-icap-modules.

commit d7b4160404c00eb2cbd21413e8641865a9d78d25 Author: Christian Schmidt christian.schmidt@iipfire.org Date: Sun Oct 30 11:30:48 2011 +0000

squid: Enabled icap and wccp support.

commit 972265f0aa57f6b3c1b10ecda5624b1e57057db6 Author: Stefan Schantl stefan.schantl@ipfire.org Date: Sat Oct 29 20:15:32 2011 +0200

freetype: Update to 2.4.7.

commit 74e6b01b002903568fb468767ae5af6f8bf63eed Author: Christian Schmidt christian.schmidt@iipfire.org Date: Sat Oct 29 10:52:14 2011 +0000

suricara: Added systemd file and fixed reference-config-file option.

Systemd needs to support ExecStopPre to delete the chain.

commit 217da1061b49bc8fcf2945dee15f7a21f288fe60 Author: Christian Schmidt christian.schmidt@iipfire.org Date: Sat Oct 29 09:24:02 2011 +0000

squid: Added systemd init file and fixed some permissions.

commit fcf279c00201ba2fe32b1346df219dfcb8da7786 Author: Christian Schmidt christian.schmidt@iipfire.org Date: Fri Oct 28 21:32:12 2011 +0000

squid: Fix squid permiissions and config options.

commit c4ea8da6ecb2453803c43991aee9da8692843fd3 Author: Christian Schmidt christian.schmidt@iipfire.org Date: Fri Oct 28 19:49:47 2011 +0000

samba: Update to latest miinor version.

commit 1ee71b31bb8784a581eb391ee4bdaf6561132bb1 Author: Christian Schmidt christian.schmidt@iipfire.org Date: Fri Oct 28 19:08:30 2011 +0000

oinkmaster: Added oinkmaster.

commit 28c39d19115b305a07b31717b6312a38a7b4684c Author: Christian Schmidt christian.schmidt@iipfire.org Date: Fri Oct 28 19:07:23 2011 +0000

iperf: Added new package iperf.

commit f1f33be6c8954d51f1e4bce0df980201333c21bb Author: Christian Schmidt christian.schmidt@iipfire.org Date: Fri Oct 28 19:05:39 2011 +0000

rsyslog: Updated to latest version, needs latest gnutls.

commit ee9ea526a0d646a930e700c0ce3d313ef1eb67e5 Author: Christian Schmidt christian.schmidt@iipfire.org Date: Fri Oct 28 13:07:26 2011 +0000

suricata: Fixed grsecurity illegal argument exception

commit 272bae8f05f6fdce602f87be5e103dc3a0171d60 Author: Christian Schmidt christian.schmidt@iipfire.org Date: Fri Oct 28 11:43:40 2011 +0000

suricata: Added default config file.

commit 405051643e7ba8c6e3a2df70e51799c63058b426 Author: Christian Schmidt christian.schmidt@iipfire.org Date: Thu Oct 27 21:55:24 2011 +0200

suricata: Updated to version 1.1beta3

commit 9f0b0495d676cacb0a737510ab8e352005f2ffc1 Author: Christian Schmidt christian.schmidt@iipfire.org Date: Thu Oct 27 21:53:09 2011 +0200

zlib: Added patch for building suricata whith 1.2.5

commit 9e169f948262de0cc628000cbe392bc3c5ae0024 Author: Christian Schmidt christian.schmidt@iipfire.org Date: Thu Oct 27 21:16:52 2011 +0200

Merge branch 'master', remote-tracking branch 'origin' into oinkmaster

commit 5b4a07621ac4f149ac7b0ef38e6219b7a3891d6f Author: Stefan Schantl stefan.schantl@ipfire.org Date: Thu Oct 27 19:19:43 2011 +0200

sudo: Update to 1.8.3.

Fixes #268.

commit f6740237c3695546ad8871e7982da6e9964a3b1a Author: Stefan Schantl stefan.schantl@ipfire.org Date: Wed Oct 26 20:09:33 2011 +0200

xorg-x11-server: Add drivers for basic in and output.

Basic drivers for video output with vesa and input with keyboard and mouse.

-----------------------------------------------------------------------

Summary of changes: c_icap/c_icap.nm | 4 +- c_icap_modules/c_icap_modules.nm | 4 +- freetype/freetype.nm | 22 +- gcc/gcc.nm | 6 +- intltool/intltool.nm | 6 +- iperf/iperf.nm | 33 ++ keepalived/keepalived.nm | 2 +- keepalived/systemd/keepalived.service | 3 +- pyxattr/pyxattr.nm => oinkmaster/oinkmaster.nm | 27 +- open-vm-tools/open-vm-tools.nm | 52 +++ rsyslog/rsyslog.nm | 4 +- samba/samba.nm | 10 +- squid/cache_swap.sh | 16 + squid/patches/squid-3.0.STABLE7-from_manpg.patch | 80 ---- squid/squid.nm | 69 +++- squid/squid.sysconfig | 9 + squid/systemd/squid.service | 14 + sudo/sudo.nm | 2 +- suricata/suricata.conf | 516 ++++++++++++++++++++++ suricata/suricata.nm | 40 ++- suricata/systemd/suricata.service | 14 + usb-modeswitch/usb-modeswitch.nm | 4 +- xorg-x11-server/xorg-x11-server.nm | 6 +- zlib/patches/zlib-1.2.5-gentoo.patch | 12 + zlib/zlib.nm | 2 +- 25 files changed, 813 insertions(+), 144 deletions(-) create mode 100644 iperf/iperf.nm copy pyxattr/pyxattr.nm => oinkmaster/oinkmaster.nm (53%) create mode 100644 open-vm-tools/open-vm-tools.nm create mode 100644 squid/cache_swap.sh delete mode 100644 squid/patches/squid-3.0.STABLE7-from_manpg.patch create mode 100644 squid/squid.sysconfig create mode 100644 squid/systemd/squid.service create mode 100644 suricata/suricata.conf create mode 100644 suricata/systemd/suricata.service create mode 100644 zlib/patches/zlib-1.2.5-gentoo.patch

Difference in files: diff --git a/c_icap/c_icap.nm b/c_icap/c_icap.nm index 3c80c63..3fde768 100644 --- a/c_icap/c_icap.nm +++ b/c_icap/c_icap.nm @@ -4,7 +4,7 @@ ###############################################################################

name = c_icap -version = 0.1.5 +version = 0.1.7 release = 1

maintainer = Christian Schmidt christian.schmidt@ipfire.org @@ -19,6 +19,8 @@ description adaptation and filtering services. end

+source_dl = http://downloads.sourceforge.net/project/c-icap/c-icap/0.1.x/ + build requires autoconf diff --git a/c_icap_modules/c_icap_modules.nm b/c_icap_modules/c_icap_modules.nm index 04fc7d0..7b8cde1 100644 --- a/c_icap_modules/c_icap_modules.nm +++ b/c_icap_modules/c_icap_modules.nm @@ -4,7 +4,7 @@ ###############################################################################

name = c_icap_modules -version = 0.1.4 +version = 0.1.6 release = 1

maintainer = Christian Schmidt christian.schmidt@ipfire.org @@ -19,6 +19,8 @@ description adaptation and filtering services. end

+source_dl = http://downloads.sourceforge.net/project/c-icap/c-icap-modules/0.1.x/ + build requires autoconf diff --git a/freetype/freetype.nm b/freetype/freetype.nm index 75ae282..f8aaa8c 100644 --- a/freetype/freetype.nm +++ b/freetype/freetype.nm @@ -4,7 +4,7 @@ ###############################################################################

name = freetype -version = 2.3.9 +version = 2.4.7 release = 1

groups = System/Graphics @@ -13,27 +13,21 @@ license = FTL GPLv2+ summary = A free and portable font rendering engine.

description - The FreeType engine is a free and portable font rendering \ - engine, developed to provide advanced font support for a variety of \ - platforms and environments. FreeType is a library which can open and \ - manages font files as well as efficiently load, hint and render \ - individual glyphs. FreeType is not a font server or a complete \ + The FreeType engine is a free and portable font rendering + engine, developed to provide advanced font support for a variety of + platforms and environments. FreeType is a library which can open and + manages font files as well as efficiently load, hint and render + individual glyphs. FreeType is not a font server or a complete text-rendering library. end

-source_dl = -sources = %{thisapp}.tar.bz2 +source_dl = http://download.savannah.gnu.org/releases/freetype/

build requires + pkg-config zlib-devel end - - prepare_cmds - sed -i -r -e 's:.*(#.*BYTE.*) .*:\1:' \ - -e 's:.*(#.*SUBPIX.*) .*:\1:' \ - include/freetype/config/ftoption.h - end end

packages diff --git a/gcc/gcc.nm b/gcc/gcc.nm index 0be4fc4..8d466d2 100644 --- a/gcc/gcc.nm +++ b/gcc/gcc.nm @@ -9,8 +9,8 @@ build_cloog_ppl = 0

name = gcc -version = 4.6.1 -release = 4 +version = 4.6.2 +release = 1

maintainer = Michael Tremer michael.tremer@ipfire.org groups = Development/Compilers @@ -26,7 +26,7 @@ end # This is the at least required version of binutils. required_binutils_version = 2.21.51.0.8-1

-source_dl = http://ftp.gnu.org/gnu/gcc/ +source_dl = http://ftp.gnu.org/gnu/gcc/%%7Bthisapp%7D/ sources = %{thisapp}.tar.gz

patches diff --git a/intltool/intltool.nm b/intltool/intltool.nm index f7741c7..fde1b3a 100644 --- a/intltool/intltool.nm +++ b/intltool/intltool.nm @@ -4,8 +4,8 @@ ###############################################################################

name = intltool -version = 0.40.5 -release = 2 +version = 0.40.6 +release = 1 arch = noarch

groups = Localization/Tools @@ -19,7 +19,7 @@ description them in the po files. end

-source_dl = +source_dl = http://ftp.gnome.org/pub/gnome/sources/intltool/0.40/ sources = %{thisapp}.tar.bz2

build diff --git a/iperf/iperf.nm b/iperf/iperf.nm new file mode 100644 index 0000000..3a79375 --- /dev/null +++ b/iperf/iperf.nm @@ -0,0 +1,33 @@ +############################################################################### +# IPFire.org - An Open Source Firewall Solution # +# Copyright (C) - IPFire Development Team info@ipfire.org # +############################################################################### + +name = iperf +version = 2.0.5 +release = 1 + +maintainer = Christian Schmidt christian.schmidt@ipfire.org +groups = Applications/Internet +url = http://www..sourceforge.net/projects/iperf/files/ +license = GPLv3+ and LGPLv3+ +summary = Measurement tool for TCP/UDP bandwidth performance + +description + Iperf is a tool to measure maximum TCP bandwidth, allowing the tuning of + various parameters and UDP characteristics. Iperf reports bandwidth, delay + jitter, datagram loss. +end + +source_dl = http://sourceforge.net/projects/iperf/files + +build + requires + gcc-c++ + end +end + +packages + package %{name} + end +end diff --git a/keepalived/keepalived.nm b/keepalived/keepalived.nm index d66ded8..b05f158 100644 --- a/keepalived/keepalived.nm +++ b/keepalived/keepalived.nm @@ -5,7 +5,7 @@

name = keepalived version = 1.2.2 -release = 1 +release = 2

groups = Applications/System url = http://www.keepalived.org/ diff --git a/keepalived/systemd/keepalived.service b/keepalived/systemd/keepalived.service index edb5b7f..438ed78 100644 --- a/keepalived/systemd/keepalived.service +++ b/keepalived/systemd/keepalived.service @@ -4,8 +4,7 @@ After=syslog.target network.target

[Service] Type=forking -EnvironmentFile=-/etc/sysconfig/keepalived -ExecStart=/usr/sbin/keepalived $KEEPALIVED_OPTIONS +ExecStart=/usr/sbin/keepalived

[Install] WantedBy=multi-user.target diff --git a/oinkmaster/oinkmaster.nm b/oinkmaster/oinkmaster.nm new file mode 100644 index 0000000..d920d7f --- /dev/null +++ b/oinkmaster/oinkmaster.nm @@ -0,0 +1,43 @@ +############################################################################### +# IPFire.org - An Open Source Firewall Solution # +# Copyright (C) - IPFire Development Team info@ipfire.org # +############################################################################### + +name = oinkmaster +version = 2.0 +release = 1 + +groups = Development/Libraries +url = http://oinkmaster.sourceforge.net +license = BSD +summary = A Perl interface for updating snort rules. + +description + Oinkmaster is a script that will help you update and manage your Snort rules. +end + +source_dl = + +build + requires + perl + end + + build + # Nothing to do here. + end + + install + mkdir -pv %{BUILDROOT}/usr/sbin + install -m 755 oinkmaster.pl %{BUILDROOT}/usr/sbin + end +end + +packages + package %{name} + + filter_requires + perl>=[0-9]:.* + end + end +end diff --git a/open-vm-tools/open-vm-tools.nm b/open-vm-tools/open-vm-tools.nm new file mode 100644 index 0000000..80e56ee --- /dev/null +++ b/open-vm-tools/open-vm-tools.nm @@ -0,0 +1,52 @@ +############################################################################### +# IPFire.org - An Open Source Firewall Solution # +# Copyright (C) - IPFire Development Team info@ipfire.org # +############################################################################### + +name = open-vm-tools +version = 2011.09.23-491607 +release = 1 + +groups = Virtualization/Applications +url = http://open-vm-tools.sourceforge.net/ +license = GPLv2 +summary = Open source implementation of VMware Tools. + +description + The open Virtual Machine Tools (open-vm-tools) are the open \ + source implementation of VMware Tools. They are a set of guest \ + operation system virtualization components that enhance \ + performance and user experience of virtual machines. +end + +source_dl = http://sourceforge.net/projects/open-vm-tools/files/open-vm-tools/2011.09.23... + +build + requires + glib2-devel + end + + configure_options += \ + --sysconfdir=/etc \ + --without-kernel-modules \ + --without-x \ + --without-procps \ + --without-dnet \ + --without-icu \ + --without-pam \ + + prepare_cmds + sed -e "s/-Werror//g" -i configure + end + + install_cmds + rm -vf %{BUILDROOT}/sbin/mount.vmhgfs + rm -vf %{BUILDROOT}/usr/sbin/mount.vmhgfs + end + +end + +packages + package %{name} + end +end diff --git a/rsyslog/rsyslog.nm b/rsyslog/rsyslog.nm index 70362ae..dfe904b 100644 --- a/rsyslog/rsyslog.nm +++ b/rsyslog/rsyslog.nm @@ -4,8 +4,8 @@ ###############################################################################

name = rsyslog -version = 5.8.0 -release = 3 +version = 5.8.6 +release = 1

groups = Base System/Daemons url = http://www.rsyslog.com/ diff --git a/samba/samba.nm b/samba/samba.nm index e50b083..e0f5537 100644 --- a/samba/samba.nm +++ b/samba/samba.nm @@ -4,8 +4,8 @@ ###############################################################################

name = samba -version = 3.6.0 -release = 2 +version = 3.6.1 +release = 1

maintainer = Christian Schmidt christian.schmidt@ipfire.org groups = Networking/Daemons @@ -88,16 +88,14 @@ end

packages package %{name} - end - + package %{name}-libs template LIBS end - + package %{name}-devel template DEVEL

requires += %{name}-libs=%{thisver} end end - diff --git a/squid/cache_swap.sh b/squid/cache_swap.sh new file mode 100644 index 0000000..b714e66 --- /dev/null +++ b/squid/cache_swap.sh @@ -0,0 +1,16 @@ +#!/bin/bash +if [ -f /etc/sysconfig/squid ]; then + . /etc/sysconfig/squid +fi + +SQUID_CONF=${SQUID_CONF:-"/etc/squid/squid.conf"} + +CACHE_SWAP=`sed -e 's/#.*//g' $SQUID_CONF | \ + grep cache_dir | awk '{ print $3 }'` + +for adir in $CACHE_SWAP; do + if [ ! -d $adir/00 ]; then + echo -n "init_cache_dir $adir... " + squid -z -F -f $SQUID_CONF >> /var/log/squid/squid.out 2>&1 + fi +done diff --git a/squid/patches/squid-3.0.STABLE7-from_manpg.patch b/squid/patches/squid-3.0.STABLE7-from_manpg.patch deleted file mode 100644 index 368e634..0000000 --- a/squid/patches/squid-3.0.STABLE7-from_manpg.patch +++ /dev/null @@ -1,80 +0,0 @@ -diff -up squid-3.0.STABLE7/helpers/basic_auth/NCSA/ncsa_auth.8.from_manpg squid-3.0.STABLE7/helpers/basic_auth/NCSA/ncsa_auth.8 ---- squid-3.0.STABLE7/helpers/basic_auth/NCSA/ncsa_auth.8.from_manpg 2008-06-22 05:35:49.000000000 +0200 -+++ squid-3.0.STABLE7/helpers/basic_auth/NCSA/ncsa_auth.8 2007-06-06 18:25:30.000000000 +0200 -@@ -1,38 +1,38 @@ --." This file is distributed in the hope that it will be useful, --." but WITHOUT ANY WARRANTY; without even the implied warranty of --." MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See --." the GNU General Public License for more details. --." --." You should have received a copy of the GNU General Public License --." along with this file; if not, write to the Free Software --." Foundation, Inc., 59 Temple Place, Suite 330, Boston, --." MA 02111-1307 USA --." --." HISTORY: --." 2006-05-16, created by Rodrigo Rubira Branco rrbranco@br.ibm.com --.TH ncsa_auth 8 "May 16, 2006" "Squid NCSA Auth helper" --.SH NAME --ncsa_auth - NCSA httpd-style password file authentication helper for Squid --\fB --.SH SYNOPSIS --.nf --.fam C --\fBncsa_auth\fP \fIpasswdfile\fP --.fam T --.fi --.SH DESCRIPTION --\fBncsa_auth\fP allows Squid to read and authenticate user and password information from an NCSA/Apache httpd-style password file when using basic HTTP authentication. --.PP --The only parameter is the password file. It must have permissions to be read by the user that Squid is running as (cache_effective_user in squid.conf). --.PP --This password file can be manipulated using htpasswd. --.SH OPTIONS --Only specify the password file name. --.SH EXAMPLE --\fBncsa_auth\fP /etc/squid/squid.pass --.SH SECURITY --\fBncsa_auth\fP must have access to the password file to be executed. --.SH SEE ALSO --\fBhtpasswd\fP(1), \fBsquid\fP(8) --.SH AUTHOR --Manpage written by Rodrigo Rubira Branco rrbranco@br.ibm.com -+." This file is distributed in the hope that it will be useful, -+." but WITHOUT ANY WARRANTY; without even the implied warranty of -+." MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See -+." the GNU General Public License for more details. -+." -+." You should have received a copy of the GNU General Public License -+." along with this file; if not, write to the Free Software -+." Foundation, Inc., 59 Temple Place, Suite 330, Boston, -+." MA 02111-1307 USA -+." -+." HISTORY: -+." 2006-05-16, created by Rodrigo Rubira Branco rrbranco@br.ibm.com -+.TH ncsa_auth 8 "May 16, 2006" "User Manuals" "User Manuals" -+.SH NAME -+ncsa_auth - NCSA httpd-style password file authentication helper for Squid -+\fB -+.SH SYNOPSIS -+.nf -+.fam C -+\fBncsa_auth\fP \fIpasswdfile\fP -+.fam T -+.fi -+.SH DESCRIPTION -+\fBncsa_auth\fP allows Squid to read and authenticate user and password information from an NCSA httpd-style password file when using basic HTTP authentication. -+.PP -+The only parameter is the password file. It must have permissions to be read by the user that Squid is running as. By default this user is proxy. This can be changed using the cache_effective_user directive in the squid.conf file. -+.PP -+This password file can be manipulated using htpasswd. -+.SH OPTIONS -+Only specify the password file name. -+.SH EXAMPLE -+\fBncsa_auth\fP /etc/squid/squid.pass -+.SH SECURITY -+\fBncsa_auth\fP must have access to the password file to be executed. -+.SH SEE ALSO -+\fBhtpasswd\fP(1), \fBsquid\fP(8) -+.SH AUTHOR -+Manpage written by Rodrigo Rubira Branco rrbranco@br.ibm.com diff --git a/squid/squid.nm b/squid/squid.nm index 9bb3e6c..bc6e651 100644 --- a/squid/squid.nm +++ b/squid/squid.nm @@ -5,8 +5,8 @@

name = squid major_ver = 3.1 -version = %{major_ver}.12 -release = 2 +version = %{major_ver}.16 +release = 4

maintainer = Christian Schmidt christian.schmidt@ipfire.org groups = Networking/Daemons @@ -36,6 +36,7 @@ build pam-devel libcap-devel /usr/bin/smbclient + shadow-utils end

CFLAGS += -Wno-error @@ -45,16 +46,17 @@ build --libexecdir=/usr/lib/squid \ --localstatedir=/var \ --sysconfdir=/etc/squid \ + --with-logdir=/var/log/squid \ --enable-storeio="aufs,diskd,ufs" \ --enable-removal-policies="heap,lru" \ --enable-icmp \ --enable-delay-pools \ --disable-esi \ - --disable-icap-client \ + --enable-icap-client \ --enable-useragent-log \ --enable-referrer-log \ - --disable-wccp \ - --disable-wccpv2 \ + --enable-wccp \ + --enable-wccpv2 \ --enable-kill-parent-hack \ --enable-snmp \ --enable-arp-acl \ @@ -82,24 +84,69 @@ build --with-dl \ --with-large-files

+ prepare_cmds + %{create_user} + end + install_cmds rm -vf %{BUILDROOT}/etc/squid/errors - rmdir %{BUILDROOT}/var/logs

mkdir -pv %{BUILDROOT}/var/log/cache %{BUILDROOT}/var/log/squid touch %{BUILDROOT}/var/log/squid/access.log + touch %{BUILDROOT}/var/log/squid/cache.log mkdir -pv %{BUILDROOT}/var/cache/squid

- # What is this????? - #groupadd -r squid && useradd -r -g squid -d %{BUILDROOT}/var/cache/squid -s /bin/false -p '*' squid - #chown -Rv squid:squid %{BUILDROOT}/var/log/squid %{BUILDROOT}/var/log/cache %{BUILDROOT}/var/cache/squid - #chmod 600 %{BUILDROOT}/var/cache/squid - #chown squid:squid %{BUILDROOT}/var/log/squid + echo "visible_hostname %{DISTRO_NAME}" >> %{BUILDROOT}/etc/squid/squid.conf + echo "cache_effective_user squid" >> %{BUILDROOT}/etc/squid/squid.conf + echo "cache_effective_group squid" >> %{BUILDROOT}/etc/squid/squid.conf + + chown -Rv squid:squid %{BUILDROOT}/var/log/squid %{BUILDROOT}/var/log/cache %{BUILDROOT}/var/cache/squid + chmod 600 %{BUILDROOT}/var/cache/squid + mkdir -pv %{BUILDROOT}/etc/sysconfig + cp -vf %{DIR_SOURCE}/squid.sysconfig %{BUILDROOT}/etc/sysconfig/squid + cp -vf %{DIR_SOURCE}/cache_swap.sh %{BUILDROOT}/usr/lib/squid/ + chmod 755 %{BUILDROOT}/usr/lib/squid/cache_swap.sh + chown -Rv squid:squid %{BUILDROOT}/usr/lib/squid/cache_swap.sh end end

+create_user + getent group squid >/dev/null || /usr/sbin/groupadd -r squid + getent passwd squid >/dev/null || /usr/sbin/useradd -r -g squid \ + -d /var/cache/squid -s /sbin/nologin squid +end + packages package %{name} + prerequires = shadow-utils systemd-units + + configfiles + /etc/squid.conf + /etc/sysconfig/squid + end + + script prein + %{create_user} + end + + script postin + /bin/systemctl daemon-reload >/dev/null 2>&1 || : + end + + script preun + /bin/systemctl --no-reload disable squid.service >/dev/null 2>&1 || : + /bin/systemctl stop squid.service >/dev/null 2>&1 || : + end + + script postun + /bin/systemctl daemon-reload >/dev/null 2>&1 || : + end + + script postup + /bin/systemctl daemon-reload >/dev/null 2>&1 || : + /bin/systemctl try-restart squid.service >/dev/null 2>&1 || : + end + requires = /usr/bin/smbclient

filter_requires = perl(Authen::Smb) diff --git a/squid/squid.sysconfig b/squid/squid.sysconfig new file mode 100644 index 0000000..3864bd8 --- /dev/null +++ b/squid/squid.sysconfig @@ -0,0 +1,9 @@ +# default squid options +SQUID_OPTS="" + +# Time to wait for Squid to shut down when asked. Should not be necessary +# most of the time. +SQUID_SHUTDOWN_TIMEOUT=100 + +# default squid conf file +SQUID_CONF="/etc/squid/squid.conf" diff --git a/squid/systemd/squid.service b/squid/systemd/squid.service new file mode 100644 index 0000000..2c0c98e --- /dev/null +++ b/squid/systemd/squid.service @@ -0,0 +1,14 @@ +[Unit] +Description=Squid caching proxy +After=syslog.target network.target + +[Service] +Type=forking +EnvironmentFile=/etc/sysconfig/squid +ExecStartPre=/usr/lib/squid/cache_swap.sh +ExecStart=/usr/sbin/squid $SQUID_OPTS -f $SQUID_CONF +ExecReload=/usr/sbin/squid $SQUID_OPTS -k reconfigure -f $SQUID_CONF +ExecStop=/usr/sbin/squid -k shutdown -f $SQUID_CONF + +[Install] +WantedBy=multi-user.target diff --git a/sudo/sudo.nm b/sudo/sudo.nm index a85f611..45dfc17 100644 --- a/sudo/sudo.nm +++ b/sudo/sudo.nm @@ -4,7 +4,7 @@ ###############################################################################

name = sudo -version = 1.7.4p3 +version = 1.8.3 release = 1

groups = Base Applications/System diff --git a/suricata/suricata.conf b/suricata/suricata.conf new file mode 100644 index 0000000..672a306 --- /dev/null +++ b/suricata/suricata.conf @@ -0,0 +1,516 @@ +%YAML 1.1 +--- +# Suricata Emergingthreats Pro Open Rulesets Recommended +reference-config-file: /etc/suricata/reference.config + +# Number of packets allowed to be processed simultaneously. Default is a +# conservative 50. a higher number will make sure CPU's/CPU cores will be +# more easily kept busy, but will negatively impact caching. +# +# If you are using the CUDA pattern matcher (b2g_cuda below), different rules +# apply. In that case try something like 4000 or more. This is because the CUDA +# pattern matcher scans many packets in parallel. +#max-pending-packets: 50 + +# Set the order of alerts bassed on actions +# The default order is pass, drop, reject, alert +action-order: + - pass + - drop + - reject + - alert + + +# The default logging directory. Any log or output file will be +# placed here if its not specified with a full path name. This can be +# overridden with the -l command line parameter. +default-log-dir: /var/log/suricata + +# Configure the type of alert (and other) logging you would like. +outputs: + + # a line based alerts log similar to Snort's fast.log + - fast: + enabled: yes + filename: fast.log + + # log output for use with Barnyard + - unified-log: + enabled: no + filename: unified.log + + # Limit in MB. + #limit: 32 + + # alert output for use with Barnyard + - unified-alert: + enabled: no + filename: unified.alert + + # Limit in MB. + #limit: 32 + + # alert output for use with Barnyard2 + - unified2-alert: + enabled: no + filename: unified2.alert + + # Limit in MB. + #limit: 32 + + # a line based log of HTTP requests (no alerts) + - http-log: + enabled: yes + filename: http.log + + # a full alerts log containing much information for signature writers + # or for investigating suspected false positives. + - alert-debug: + enabled: no + filename: alert-debug.log + + # alert output to prelude (http://www.prelude-technologies.com/) only + # available if Suricata has been compiled with --enable-prelude + - alert-prelude: + enabled: no + profile: suricata + +defrag: + max-frags: 65535 + prealloc: yes + timeout: 60 + +# You can specify a threshold config file by setting "threshold-file" +# to the path of the threshold config file: +# threshold-file: /etc/suricata/threshold.config + +# The detection engine builds internal groups of signatures. The engine +# allow us to specify the profile to use for them, to manage memory on an +# efficient way keeping a good performance. For the profile keyword you +# can use the words "low", "medium", "high" or "custom". If you use custom +# make sure to define the values at "- custom-values" as your convenience. +# Usually you would prefer medium/high/low +detect-engine: + - profile: medium + - custom-values: + toclient_src_groups: 2 + toclient_dst_groups: 2 + toclient_sp_groups: 2 + toclient_dp_groups: 3 + toserver_src_groups: 2 + toserver_dst_groups: 4 + toserver_sp_groups: 2 + toserver_dp_groups: 25 + +# Suricata is multi-threaded. Here the threading can be influenced. +threading: + # On some cpu's/architectures it is beneficial to tie individual threads + # to specific CPU's/CPU cores. In this case all threads are tied to CPU0, + # and each extra CPU/core has one "detect" thread. + # + # On Intel Core2 and Nehalem CPU's enabling this will degrade performance. + # + set_cpu_affinity: no + # + # By default Suricata creates one "detect" thread per available CPU/CPU core. + # This setting allows controlling this behaviour. A ratio setting of 2 will + # create 2 detect threads for each CPU/CPU core. So for a dual core CPU this + # will result in 4 detect threads. If values below 1 are used, less threads + # are created. So on a dual core CPU a setting of 0.5 results in 1 detect + # thread being created. Regardless of the setting at a minimum 1 detect + # thread will always be created. + # + detect_thread_ratio: 1.5 + +# Select the cuda device to use. The device_id identifies the device to be used +# if one has multiple devices on the system. To find out device_id associated +# with the card(s) on the system run "suricata --list-cuda-cards". +cuda: + device_id: 0 + +# Select the multi pattern algorithm you want to run for scan/search the +# in the engine. The supported algorithms are b2g, b3g and wumanber. +# +# There is also a CUDA pattern matcher (only available if Suricata was +# compiled with --enable-cuda: b2g_cuda. Make sure to update your +# max-pending-packets setting above as well if you use b2g_cuda. + +mpm-algo: b2g + +# The memory settings for hash size of these algorithms can vary from lowest +# (2048) - low (4096) - medium (8192) - high (16384) - highest (32768) - max +# (65536). The bloomfilter sizes of these algorithms can vary from low (512) - +# medium (1024) - high (2048). +# +# For B2g/B3g algorithms, there is a support for two different scan/search +# algorithms. For B2g the scan algorithms are B2gScan & B2gScanBNDMq, and +# search algorithms are B2gSearch & B2gSearchBNDMq. For B3g scan algorithms +# are B3gScan & B3gScanBNDMq, and search algorithms are B3gSearch & +# B3gSearchBNDMq. +# +# For B2g the different scan/search algorithms and, hash and bloom +# filter size settings. For B3g the different scan/search algorithms and, hash +# and bloom filter size settings. For wumanber the hash and bloom filter size +# settings. + +pattern-matcher: + - b2g: + scan_algo: B2gScanBNDMq + search_algo: B2gSearchBNDMq + hash_size: low + bf_size: medium + - b3g: + scan_algo: B3gScanBNDMq + search_algo: B3gSearchBNDMq + hash_size: low + bf_size: medium + - wumanber: + hash_size: low + bf_size: medium + +# Flow settings: +# By default, the reserved memory (memcap) for flows is 32MB. This is the limit +# for flow allocation inside the engine. You can change this value to allow +# more memory usage for flows. +# The hash_size determine the size of the hash used to identify flows inside +# the engine, and by default the value is 65536. +# At the startup, the engine can preallocate a number of flows, to get a better +# performance. The number of flows preallocated is 10000 by default. +# emergency_recovery is the percentage of flows that the engine need to +# prune before unsetting the emergency state. The emergency state is activated +# when the memcap limit is reached, allowing to create new flows, but +# prunning them with the emergency timeouts (they are defined below). +# If the memcap is reached, the engine will try to prune prune_flows +# with the default timeouts. If it doens't find a flow to prune, it will set +# the emergency bit and it will try again with more agressive timeouts. +# If that doesn't work, then it will try to kill the last time seen flows +# not in use. + +flow: + memcap: 33554432 + hash_size: 65536 + prealloc: 10000 + emergency_recovery: 30 + prune_flows: 5 + +# Specific timeouts for flows. Here you can specify the timeouts that the +# active flows will wait to transit from the current state to another, on each +# protocol. The value of "new" determine the seconds to wait after a hanshake or +# stream startup before the engine free the data of that flow it doesn't +# change the state to established (usually if we don't receive more packets +# of that flow). The value of "established" is the amount of +# seconds that the engine will wait to free the flow if it spend that amount +# without receiving new packets or closing the connection. "closed" is the +# amount of time to wait after a flow is closed (usually zero). +# +# There's an emergency mode that will become active under attack circumstances, +# making the engine to check flow status faster. This configuration variables +# use the prefix "emergency_" and work similar as the normal ones. +# Some timeouts doesn't apply to all the protocols, like "closed", for udp and +# icmp. + +flow-timeouts: + + default: + new: 30 + established: 300 + closed: 0 + emergency_new: 10 + emergency_established: 100 + emergency_closed: 0 + tcp: + new: 60 + established: 3600 + closed: 120 + emergency_new: 10 + emergency_established: 300 + emergency_closed: 20 + udp: + new: 30 + established: 300 + emergency_new: 10 + emergency_established: 100 + icmp: + new: 30 + established: 300 + emergency_new: 10 + emergency_established: 100 + +# Stream engine settings. Here the TCP stream tracking and reaasembly +# engine is configured. +# +# stream: +# memcap: 33554432 # 32mb tcp session memcap +# checksum_validation: yes # To validate the checksum of received + # packet. If csum validation is specified as + # "yes", then packet with invalid csum will not + # be processed by the engine stream/app layer. +# max_sessions: 262144 # 256k concurrent sessions +# prealloc_sessions: 32768 # 32k sessions prealloc'd +# midstream: false # don't allow midstream session pickups +# async_oneside: false # don't enable async stream handling +# reassembly: +# memcap: 67108864 # 64mb tcp reassembly memcap +# depth: 1048576 # 1 MB reassembly depth +stream: + memcap: 33554432 + checksum_validation: yes + reassembly: + memcap: 67108864 + depth: 1048576 + +# Logging configuration. This is not about logging IDS alerts, but +# IDS output about what its doing, errors, etc. +logging: + + # The default log level, can be overridden in an output section. + # Note that debug level logging will only be emitted if Suricata was + # compiled with the --enable-debug configure option. + # + # This value is overriden by the SC_LOG_LEVEL env var. + default-log-level: info + + # The default output format. Optional parameter, should default to + # something reasonable if not provided. Can be overriden in an + # output section. You can leave this out to get the default. + # + # This value is overriden by the SC_LOG_FORMAT env var. + #default-log-format: "[%i] %t - (%f:%l) <%d> (%n) -- " + + # A regex to filter output. Can be overridden in an output section. + # Defaults to empty (no filter). + # + # This value is overriden by the SC_LOG_OP_FILTER env var. + default-output-filter: + + # Define your logging outputs. If none are defined, or they are all + # disabled you will get the default - console output. + outputs: + - console: + enabled: yes + - file: + enabled: yes + filename: /var/log/suricata.log + - syslog: + enabled: no + facility: local5 + format: "[%i] <%d> -- " + +# PF_RING configuration. for use with native PF_RING support +# for more info see http://www.ntop.org/PF_RING.html +pfring: + + # Default interface we will listen on. + interface: eth0 + + # Default clusterid. PF_RING will load balance packets based on flow. + # All threads/processes that will participate need to have the same + # clusterid. + cluster-id: 99 + + # Default PF_RING cluster type. PF_RING can load balance per flow or per hash. + # This is only supported in versions of PF_RING > 4.1.1. + cluster-type: cluster_round_robin + +# For FreeBSD ipfw(8) divert(4) support. +# Please make sure you have ipfw_load="YES" and ipdivert_load="YES" +# in /etc/loader.conf or kldload'ing the appropriate kernel modules. +# Additionally, you need to have an ipfw rule for the engine to see +# the packets from ipfw. For Example: +# +# ipfw add 100 divert 8000 ip from any to any +# +# The 8000 above should be the same number you passed on the command +# line, i.e. -d 8000 +# +ipfw: + + # Reinject packets at the specified ipfw rule number. This config + # option is the ipfw rule number AT WHICH rule processing continues + # in the ipfw processing system after the engine has finished + # inspecting the packet for acceptance. If no rule number is specified, + # accepted packets are reinjected at the divert rule which they entered + # and IPFW rule processing continues. No check is done to verify + # this will rule makes sense so care must be taken to avoid loops in ipfw. + # + ## The following example tells the engine to reinject packets + # back into the ipfw firewall AT rule number 5500: + # + # ipfw-reinjection-rule-number: 5500 + +# Set the default rule path here to search for the files. +# if not set, it will look at the current working dir +default-rule-path: /etc/suricata/rules/ +rule-files: +# - emerging-ftp.rules +# - emerging-policy.rules +# - emerging-trojan.rules +# - emerging-games.rules +# - emerging-pop3.rules +# - emerging-user_agents.rules +# - emerging-activex.rules +# - emerging-rpc.rules +# - emerging-virus.rules +# - emerging-attack_response.rules +# - emerging-icmp.rules +# - emerging-scan.rules +# - emerging-scada.rules +# - emerging-voip.rules +# - emerging-chat.rules +# - emerging-icmp_info.rules +# - emerging-shellcode.rules +# - emerging-web_client.rules +# - emerging-imap.rules +# - emerging-web_server.rules +# - emerging-current_events.rules +# - emerging-inappropriate.rules +# - emerging-smtp.rules +# - emerging-web_specific_apps.rules +# - emerging-deleted.rules +# - emerging-malware.rules +# - emerging-snmp.rules +# - emerging-worm.rules +# - emerging-dns.rules +# - emerging-misc.rules +# - emerging-sql.rules +# - emerging-dos.rules +# - emerging-netbios.rules +# - emerging-telnet.rules +# - emerging-exploit.rules +# - emerging-p2p.rules +# - emerging-tftp.rules +# - emerging-botcc.rules +# - emerging-compromised.rules +# - emerging-drop.rules +# - emerging-dshield.rules +# - emerging-rbn.rules +# - emerging-rbn-malvertisers.rules +# - emerging-tor.rules +# - emerging-mobile_malware.rules + +classification-file: /etc/suricata/classification.config + +# Holds variables that would be used by the engine. +vars: + + # Holds the address group vars that would be passed in a Signature. + # These would be retrieved during the Signature address parsing stage. + address-groups: + + HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]" + + EXTERNAL_NET: any + + HTTP_SERVERS: "$HOME_NET" + + SMTP_SERVERS: "$HOME_NET" + + SQL_SERVERS: "$HOME_NET" + + DNS_SERVERS: "$HOME_NET" + + TELNET_SERVERS: "$HOME_NET" + + AIM_SERVERS: any + +#These vars are required if you're using the Digitalbond Scada signatures in the scada.rules category +# DNP3_SERVER: "$HOME_NET" +# DNP3_CLIENT: "$HOME_NET" +# MODBUS_CLIENT: "$HOME_NET" +# MODBUS_SERVER: "$HOME_NET" +# ENIP_CLIENT: "$HOME_NET" +# ENIP_SERVER: "$HOME_NET" + + + # Holds the port group vars that would be passed in a Signature. + # These would be retrieved during the Signature port parsing stage. + port-groups: + + HTTP_PORTS: "80" + + SHELLCODE_PORTS: "!80" + + ORACLE_PORTS: 1521 + + SSH_PORTS: 22 + +# DNP3_PORTS: 20000 + +# Host specific policies for defragmentation and TCP stream +# reassembly. The host OS lookup is done using a radix tree, just +# like a routing table so the most specific entry matches. +host-os-policy: + # Make the default policy windows. + windows: [0.0.0.0/0] + bsd: [] + bsd_right: [] + old_linux: [] + linux: [10.0.0.0/8, 192.168.1.100, "8762:2352:6241:7245:E000:0000:0000:0000"] + old_solaris: [] + solaris: ["::1"] + hpux10: [] + hpux11: [] + irix: [] + macos: [] + vista: [] + windows2k3: [] + +########################################################################### +# Configure libhtp. +# +# +# default-config: Used when no server-config matches +# personality: List of personalities used by default +# +# server-config: List of server configurations to use if address matches +# address: List of ip addresses or networks for this block +# personalitiy: List of personalities used by this block +# +# Currently Available Personalities: +# Minimal +# Generic +# IDS (default) +# IIS_4_0 +# IIS_5_0 +# IIS_5_1 +# IIS_6_0 +# IIS_7_0 +# IIS_7_5 +# Apache +# Apache_2_2 +########################################################################### +libhtp: + + default-config: + personality: IDS + + server-config: + + - apache: + address: [192.168.1.0/24, 127.0.0.0/8, "::1"] + personality: Apache_2_2 + + - iis7: + address: + - 192.168.0.0/24 + - 192.168.10.0/24 + personality: IIS_7_0 + +# rule profiling settings. Only effective if Suricata has been built with the +# the --enable-profiling configure flag. +# +profiling: + + rules: + + # Profiling can be disabled here, but it will still have a + # performance impact if compiled in. + enabled: yes + + # Sort options: ticks, avgticks, checks, matches + sort: avgticks + + # Limit the number of items printed at exit. + limit: 100 + + diff --git a/suricata/suricata.nm b/suricata/suricata.nm index 56becaa..c676d0c 100644 --- a/suricata/suricata.nm +++ b/suricata/suricata.nm @@ -4,8 +4,8 @@ ###############################################################################

name = suricata -version = 1.0.5 -release = 1 +version = 1.1beta3 +release = 4

groups = Networking/IDS url = http://www.openinfosecfoundation.org/ @@ -30,18 +30,52 @@ build libyaml-devel pcre-devel pkg-config - zlib-devel + zlib-devel>=1.2.5-2 end

configure_options += \ --enable-gccprotect \ --enable-nfqueue \ + --disable-gccmarch-native \ --disable-static + + install_cmds + mkdir -pv %{BUILDROOT}/etc + mkdir -pv %{BUILDROOT}/etc/suricata + mkdir -pv %{BUILDROOT}/etc/suricata/rules + cp -vf %{DIR_SOURCE}/%{name}.conf %{BUILDROOT}/etc/suricata + end + end

packages package %{name} + + prerquires = systemd-units + + configfiles + /etc/suricata/suricata.conf + end + + script postin + /bin/systemctl daemon-reload >/dev/null 2>&1 || : + end + + script preun + /bin/systemctl --no-reload disable suricata.service >/dev/null 2>&1 || : + /bin/systemctl stop suricata.service >/dev/null 2>&1 || : + end + + script postun + /bin/systemctl daemon-reload >/dev/null 2>&1 || : + end + + script postup + /bin/systemctl daemon-reload >/dev/null 2>&1 || : + /bin/systemctl try-restart suricata.service >/dev/null 2>&1 || : + end + end package %{name}-devel diff --git a/suricata/systemd/suricata.service b/suricata/systemd/suricata.service new file mode 100644 index 0000000..4e0b689 --- /dev/null +++ b/suricata/systemd/suricata.service @@ -0,0 +1,14 @@ +[Unit] +Description=Open Source Next Generation Intrusion Detection and Prevention Engine +After=syslog.target network.target + +[Service] +Type=forking +ExecStart=/usr/bin/suricata -c /etc/suricata/suricata.conf -q 0 -q 1 -D +ExecStartPost=/sbin/iptables -I INPUT -j NFQUEUE -–queue-balance 0:1 +ExecReload=/bin/kill -HUP $MAINPID +ExecStop=/sbin/iptables -D INPUT -j NFQUEUE -–queue-balance 0:1 +ExecStopPost=/bin/kill $MAINPID + +[Install] +WantedBy=multi-user.target diff --git a/usb-modeswitch/usb-modeswitch.nm b/usb-modeswitch/usb-modeswitch.nm index 7aa7115..dc659ba 100644 --- a/usb-modeswitch/usb-modeswitch.nm +++ b/usb-modeswitch/usb-modeswitch.nm @@ -4,8 +4,8 @@ ###############################################################################

name = usb-modeswitch -version = 1.1.9 -release = 2 +version = 1.2.0 +release = 1

groups = Applications/System url = http://www.draisberghof.de/usb_modeswitch diff --git a/xorg-x11-server/xorg-x11-server.nm b/xorg-x11-server/xorg-x11-server.nm index c46aa31..5897513 100644 --- a/xorg-x11-server/xorg-x11-server.nm +++ b/xorg-x11-server/xorg-x11-server.nm @@ -5,7 +5,7 @@

name = xorg-x11-server version = 1.8.2 -release = 3 +release = 4

maintainer = Stefan Schantl stefan.schantl@ipfire.org groups = X/Server @@ -137,6 +137,10 @@ packages pixman udev xkeyboard-config + xorg-x11-drv-evdev + xorg-x11-drv-keyboard + xorg-x11-drv-mouse + xorg-x11-drv-vesa xorg-x11-fonts xorg-x11-font-utils xorg-x11-xkb-utils diff --git a/zlib/patches/zlib-1.2.5-gentoo.patch b/zlib/patches/zlib-1.2.5-gentoo.patch new file mode 100644 index 0000000..82c7f39 --- /dev/null +++ b/zlib/patches/zlib-1.2.5-gentoo.patch @@ -0,0 +1,12 @@ +diff -up zlib-1.2.5/zlib.h.pom zlib-1.2.5/zlib.h +--- zlib-1.2.5/zlib.h.pom 2010-04-20 06:12:48.000000000 +0200 ++++ zlib-1.2.5/zlib.h 2010-06-16 13:08:59.000000000 +0200 +@@ -1578,7 +1578,7 @@ ZEXTERN int ZEXPORT inflateBackInit_ OF( + # define gzoffset gzoffset64 + # define adler32_combine adler32_combine64 + # define crc32_combine crc32_combine64 +-# ifdef _LARGEFILE64_SOURCE ++# ifndef _LARGEFILE64_SOURCE + ZEXTERN gzFile ZEXPORT gzopen64 OF((const char *, const char *)); + ZEXTERN z_off_t ZEXPORT gzseek64 OF((gzFile, z_off_t, int)); + ZEXTERN z_off_t ZEXPORT gztell64 OF((gzFile)); diff --git a/zlib/zlib.nm b/zlib/zlib.nm index f1611f4..a1bafc2 100644 --- a/zlib/zlib.nm +++ b/zlib/zlib.nm @@ -5,7 +5,7 @@

name = zlib version = 1.2.5 -release = 1 +release = 2

groups = System/Libraries url = http://www.gzip.org/zlib/

hooks/post-receive -- IPFire 3.x development tree