Version bump as per security bug #75395. Still masked pendingpending further testing

8 files changed, 297 insertions, 22 deletions

diff --git a/net-analyzer/snort/ChangeLog b/net-analyzer/snort/ChangeLog
index e1f8cc84f57e..f8b4cda54608 100644
--- a/net-analyzer/snort/ChangeLog
+++ b/net-analyzer/snort/ChangeLog
@@ -1,6 +1,13 @@
 # ChangeLog for net-analyzer/snort
-# Copyright 2002-2004 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/net-analyzer/snort/ChangeLog,v 1.51 2004/11/28 15:32:00 eldad Exp $
+# Copyright 2002-2005 Gentoo Foundation; Distributed under the GPL v2
+# $Header: /var/cvsroot/gentoo-x86/net-analyzer/snort/ChangeLog,v 1.52 2005/01/10 14:33:42 dragonheart Exp $
+
+*snort-2.3.0_rc2 (11 Jan 2005)
+
+  11 Jan 2005; Daniel Black <dragonheart@gentoo.org>
+  +files/2.3.0_rc2-libnet-1.0.patch, +snort-2.3.0_rc2.ebuild:
+  Version bump as per security bug #75395. Still masked pending
+  further testing
 
   28 Nov 2004; Eldad Zack <eldad@gentoo.org> snort-2.1.3.ebuild,
   snort-2.2.0.ebuild:
diff --git a/net-analyzer/snort/Manifest b/net-analyzer/snort/Manifest
index a3296ad9769f..dceac6409778 100644
--- a/net-analyzer/snort/Manifest
+++ b/net-analyzer/snort/Manifest
@@ -1,26 +1,29 @@
 -----BEGIN PGP SIGNED MESSAGE-----
 Hash: SHA1
 
-MD5 8e287f7b6b33af628bddaf46382ff3b8 snort-2.2.0.ebuild 4394
-MD5 8f89d5403bedc2791b69f44b0813bfef snort-2.0.6.ebuild 3139
-MD5 6bbd6df3ee499cf6516ea502b72ae2b9 snort-2.1.3.ebuild 4387
-MD5 7b5cc0835617725b1cdb28ea3a37edbc ChangeLog 10036
+MD5 c0583b3fb48ce6d647195f049193839f ChangeLog 10272
 MD5 53edc4328d9adeaf087c65ea94b1594b metadata.xml 246
-MD5 919058894f4983c35900bc8bb98a96d4 files/snort.rc6 764
-MD5 ea783bd276257a20df5b6537d3ff5d49 files/snort-drop-calculation.diff 4957
-MD5 fe6a25fdd3c6d4b527d89c51d78b8f36 files/2.0.6-libnet-1.0.patch 2753
-MD5 202dd3be05b16c852303a04284eba720 files/digest-snort-2.0.6 150
+MD5 8f7efafcf47ffd44442415a23c2bfd3b snort-2.1.3.ebuild 4393
+MD5 79c65309534877dc5d339016e74d8bb8 snort-2.2.0.ebuild 4400
+MD5 5113e6b8d2be20961efc2da19bb88b18 snort-2.3.0_rc2.ebuild 3956
+MD5 adb06030008559b14998b8790156c4d6 snort-2.0.6.ebuild 3141
 MD5 ca486c6119dbf106f900a3b51e4f3985 files/digest-snort-2.1.3 129
+MD5 513637a4fadce14177bf85e97e5931f8 files/snort-2.1.3-gcc3.patch 350
 MD5 a654db9256f89b77a9ce482c976dc896 files/digest-snort-2.2.0 129
+MD5 08107e2e3ce78a19d7df4c78b9461303 files/digest-snort-2.3.0_rc2 221
+MD5 270fa0a1b924d18956af354e18036eb5 files/2.3.0_rc2-libnet-1.0.patch 4714
+MD5 202dd3be05b16c852303a04284eba720 files/digest-snort-2.0.6 150
 MD5 513637a4fadce14177bf85e97e5931f8 files/snort-2.0.6-gcc3.patch 350
+MD5 ea783bd276257a20df5b6537d3ff5d49 files/snort-drop-calculation.diff 4957
 MD5 446f8d2b3435b8a6be738da978670605 files/snort.confd 423
-MD5 fe6a25fdd3c6d4b527d89c51d78b8f36 files/2.1.2-libnet-1.0.patch 2753
+MD5 919058894f4983c35900bc8bb98a96d4 files/snort.rc6 764
+MD5 fe6a25fdd3c6d4b527d89c51d78b8f36 files/2.0.6-libnet-1.0.patch 2753
 MD5 513637a4fadce14177bf85e97e5931f8 files/snort-2.1.2-gcc3.patch 350
-MD5 513637a4fadce14177bf85e97e5931f8 files/snort-2.1.3-gcc3.patch 350
+MD5 fe6a25fdd3c6d4b527d89c51d78b8f36 files/2.1.2-libnet-1.0.patch 2753
 -----BEGIN PGP SIGNATURE-----
-Version: GnuPG v1.2.6 (GNU/Linux)
+Version: GnuPG v1.4.0 (GNU/Linux)
 
-iD8DBQFBqe3qT+MN7JbqCpMRAkSAAJ9FA1TaFyZgtBySpwvl03HTqfURtACdGkME
-xaHSZk/4xvzkToV7YDC5R5k=
-=AFxt
+iD8DBQFB4pJMmdTrptrqvGERAs2bAJ9Urw4Jkj04GnkmiI96sdO2R2oTigCdExJM
+n17mz9kFM6x8klWWTpPQT5Q=
+=ADtV
 -----END PGP SIGNATURE-----
diff --git a/net-analyzer/snort/files/2.3.0_rc2-libnet-1.0.patch b/net-analyzer/snort/files/2.3.0_rc2-libnet-1.0.patch
new file mode 100644
index 000000000000..64c326ddad14
--- /dev/null
+++ b/net-analyzer/snort/files/2.3.0_rc2-libnet-1.0.patch
@@ -0,0 +1,124 @@
+--- configure.in.orig	2005-01-10 23:05:06.867089352 +0930
++++ configure.in	2005-01-10 23:07:32.461660456 +0930
+@@ -686,20 +686,20 @@
+         fi
+ 
+         LIBNET_INC_DIR=""
+-        AC_MSG_CHECKING("for libnet.h version 1.0.x")
++        AC_MSG_CHECKING("for libnet-1.0.h version 1.0.x")
+         libnet_dir="/usr/include /usr/local/include"
+         for i in $libnet_dir; do
+-            if test -r $i/libnet.h; then
++            if test -r $i/libnet-1.0.h; then
+                 LIBNET_INC_DIR=$i
+             fi
+         done
+ 
+         if test "$LIBNET_INC_DIR" != ""; then
+-            if eval "grep LIBNET_VERSION $LIBNET_INC_DIR/libnet.h | grep -v 1.0 >/dev/null"; then
+-                FAIL_MESSAGE("libnet 1.0.x (libnet.h)", $tmp)
++            if eval "grep LIBNET_VERSION $LIBNET_INC_DIR/libnet-1.0.h | grep -v 1.0 >/dev/null"; then
++                FAIL_MESSAGE("libnet 1.0.x (libnet-1.0.h)", $tmp)
+             fi
+-            CFLAGS="${CFLAGS} `libnet-config --defines` `libnet-config --cflags`"
+-            LIBS="${LIBS} `libnet-config --libs`"
++            CFLAGS="${CFLAGS} `libnet-1.0-config --defines` `libnet-1.0-config --cflags`"
++            LIBS="${LIBS} `libnet-1.0-config --libs`"
+             CPPFLAGS="${CPPFLAGS} -I${LIBNET_INC_DIR}"
+             AC_MSG_RESULT($i)
+         else
+@@ -711,26 +711,26 @@
+ 
+ AC_ARG_ENABLE(flexresp,
+ [  --enable-flexresp       Flexible Responses on hostile connection attempts],
+-[ CPPFLAGS="${CPPFLAGS} -DENABLE_RESPONSE `libnet-config --defines --cflags`" LDFLAGS="${LDFLAGS} `libnet-config --libs`"],)
++[ CPPFLAGS="${CPPFLAGS} -DENABLE_RESPONSE `libnet-1.0-config --defines --cflags`" LDFLAGS="${LDFLAGS} `libnet-1.0-config --libs`"],)
+                 
+ 
+ if test "$enable_flexresp" != "no" -a "$enable_flexresp" = "yes"; then
+ 
+-  if test `libnet-config --cflags | wc -c` = "1"; then
++  if test `libnet-1.0-config --cflags | wc -c` = "1"; then
+     CPPFLAGS="${CPPFLAGS} -I/usr/local/include -I/sw/include"
+     LIBNET_CONFIG_BROKEN_CFLAGS=yes
+   fi
+ 
+-  if test `libnet-config --libs | wc -c` = "1"; then
+-    AC_MSG_WARN(libnet-config --libs is broken on your system.  If you)
++  if test `libnet-1.0-config --libs | wc -c` = "1"; then
++    AC_MSG_WARN(libnet-1.0-config --libs is broken on your system.  If you)
+     AC_MSG_WARN(are using a precompiled package please notify the) 
+     AC_MSG_WARN(maintainer.)
+     LDFLAGS="${LDFLAGS} -L/usr/local/lib -L/sw/lib"
+-    LIBS="${LIBS} -lnet"
++    LIBS="${LIBS} -lnet-1.0"
+   fi
+ 
+   LNET=""
+-  AC_CHECK_HEADERS(libnet.h,, LNET="no")
++  AC_CHECK_HEADERS(libnet-1.0.h,, LNET="no")
+   if test "$LNET" = "no"; then
+     echo
+     echo "   ERROR!  Libnet header not found, go get it from"
+@@ -748,33 +748,33 @@
+       libnet_dir="/usr/include /usr/local/include /sw/include"
+     fi
+   else
+-    libnet_dir=`libnet-config --cflags | cut -dI -f2`
++    libnet_dir=`libnet-1.0-config --cflags | cut -dI -f2`
+   fi
+ 
+   LIBNET_INC_DIR=""
+   for i in $libnet_dir; do
+-    if test -r $i/libnet.h; then
++    if test -r $i/libnet-1.0.h; then
+       LIBNET_INC_DIR=$i
+     fi
+   done
+ 
+   if test "$LIBNET_INC_DIR" != ""; then
+-    if eval "grep LIBNET_VERSION $LIBNET_INC_DIR/libnet.h | grep -v 1.0.2a >/dev/null"; then
++    if eval "grep LIBNET_VERSION $LIBNET_INC_DIR/libnet-1.0.h | grep -v 1.0.2a >/dev/null"; then
+       AC_MSG_RESULT(no)
+       echo
+       echo "   ERROR!  Snort with --enable-flexresp will *only* work with"
+       echo "   libnet version 1.0.2a, go get it from"
+       echo "   http://www.packetfactory.net/projects/libnet/"
+-      FAIL_MESSAGE("libnet 1.0.2a (libnet.h)", $LIBNET_INC_DIR)
++      FAIL_MESSAGE("libnet 1.0.2a (libnet-1.0.h)", $LIBNET_INC_DIR)
+     fi
+     AC_MSG_RESULT(yes)
+   else
+     AC_MSG_RESULT(no)
+-    FAIL_MESSAGE("libnet 1.0.2a (libnet.h)", $libnet_dir)
++    FAIL_MESSAGE("libnet 1.0.2a (libnet-1.0.h)", $libnet_dir)
+   fi
+ 
+   LNET=""
+-  AC_CHECK_LIB(net, libnet_build_ip,, LNET="no")
++  AC_CHECK_LIB(net-1.0, libnet_build_ip,, LNET="no")
+   if test "$LNET" = "no"; then
+     echo
+     echo "   ERROR!  Libnet library not found, go get it from"
+--- ./src/detection-plugins/sp_react.c.orig	2005-01-10 23:11:17.253602680 +0930
++++ ./src/detection-plugins/sp_react.c	2005-01-10 23:12:01.073940976 +0930
+@@ -57,7 +57,7 @@
+ #include <stdlib.h>
+ #include <string.h>
+ #include <ctype.h>
+-#include <libnet.h>
++#include <libnet-1.0.h>
+ 
+ #include "rules.h"
+ #include "decode.h"
+--- ./src/detection-plugins/sp_respond.c.orig	2005-01-10 23:11:29.457747368 +0930
++++ ./src/detection-plugins/sp_respond.c	2005-01-10 23:12:01.074940824 +0930
+@@ -34,7 +34,7 @@
+ 
+ 
+ #ifdef ENABLE_RESPONSE
+-#include <libnet.h>
++#include <libnet-1.0.h>
+ 
+ #include "decode.h"
+ #include "rules.h"
diff --git a/net-analyzer/snort/files/digest-snort-2.3.0_rc2 b/net-analyzer/snort/files/digest-snort-2.3.0_rc2
new file mode 100644
index 000000000000..2507641b7486
--- /dev/null
+++ b/net-analyzer/snort/files/digest-snort-2.3.0_rc2
@@ -0,0 +1,3 @@
+MD5 0c980ae53823305bd58e651cb5fd1a41 snort-2.3.0RC2.tar.gz 2251772
+MD5 2eeef1a7a040d67c3afaf9d749905e47 snortsam-20050110.tar.gz 29395
+MD5 323ab2956a59de113aa13099917f0d3a snort-prelude-reporting-patch-0.3.6.tar.gz 21964
diff --git a/net-analyzer/snort/snort-2.0.6.ebuild b/net-analyzer/snort/snort-2.0.6.ebuild
index 42a2c8b572a4..39a59f632528 100644
--- a/net-analyzer/snort/snort-2.0.6.ebuild
+++ b/net-analyzer/snort/snort-2.0.6.ebuild
@@ -1,6 +1,6 @@
-# Copyright 1999-2004 Gentoo Foundation
+# Copyright 1999-2005 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/net-analyzer/snort/snort-2.0.6.ebuild,v 1.6 2004/07/01 20:18:32 squinky86 Exp $
+# $Header: /var/cvsroot/gentoo-x86/net-analyzer/snort/snort-2.0.6.ebuild,v 1.7 2005/01/10 14:33:42 dragonheart Exp $
 
 inherit eutils
 
diff --git a/net-analyzer/snort/snort-2.1.3.ebuild b/net-analyzer/snort/snort-2.1.3.ebuild
index f78ee35938d1..c59d153c6a06 100644
--- a/net-analyzer/snort/snort-2.1.3.ebuild
+++ b/net-analyzer/snort/snort-2.1.3.ebuild
@@ -1,6 +1,6 @@
-# Copyright 1999-2004 Gentoo Foundation
+# Copyright 1999-2005 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/net-analyzer/snort/snort-2.1.3.ebuild,v 1.7 2004/11/28 15:32:00 eldad Exp $
+# $Header: /var/cvsroot/gentoo-x86/net-analyzer/snort/snort-2.1.3.ebuild,v 1.8 2005/01/10 14:33:42 dragonheart Exp $
 
 inherit eutils gnuconfig
 
diff --git a/net-analyzer/snort/snort-2.2.0.ebuild b/net-analyzer/snort/snort-2.2.0.ebuild
index 674a97f96efd..e60253cad706 100644
--- a/net-analyzer/snort/snort-2.2.0.ebuild
+++ b/net-analyzer/snort/snort-2.2.0.ebuild
@@ -1,6 +1,6 @@
-# Copyright 1999-2004 Gentoo Foundation
+# Copyright 1999-2005 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/net-analyzer/snort/snort-2.2.0.ebuild,v 1.5 2004/11/28 15:32:00 eldad Exp $
+# $Header: /var/cvsroot/gentoo-x86/net-analyzer/snort/snort-2.2.0.ebuild,v 1.6 2005/01/10 14:33:42 dragonheart Exp $
 
 inherit eutils gnuconfig
 
diff --git a/net-analyzer/snort/snort-2.3.0_rc2.ebuild b/net-analyzer/snort/snort-2.3.0_rc2.ebuild
new file mode 100644
index 000000000000..dff19f61c73d
--- /dev/null
+++ b/net-analyzer/snort/snort-2.3.0_rc2.ebuild
@@ -0,0 +1,138 @@
+# Copyright 1999-2005 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-analyzer/snort/snort-2.3.0_rc2.ebuild,v 1.1 2005/01/10 14:33:42 dragonheart Exp $
+
+inherit eutils gnuconfig
+
+MY_P=${P/_rc/RC}
+
+DESCRIPTION="Libpcap-based packet sniffer/logger/lightweight IDS"
+HOMEPAGE="http://www.snort.org/"
+SRC_URI="http://www.snort.org/dl/${MY_P}.tar.gz
+	snortsam? ( mirror://gentoo/snortsam-20050110.tar.gz )
+	prelude? ( http://www.prelude-ids.org/download/releases/snort-prelude-reporting-patch-0.3.6.tar.gz )"
+
+#	snortsam? ( http://www.snortsam.net/files/snort-plugin/snortsam-patch.tar.gz )
+# Gentoo mirrored because of naming conflict with previous version
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~x86 ~sparc -alpha ~amd64 ~ppc"
+IUSE="ssl postgres mysql flexresp selinux snortsam odbc prelude"
+
+S=${WORKDIR}/${MY_P}
+
+# Local useflag snortsam: patch snort for use with snortsam package.
+
+
+DEPEND="virtual/libc
+	>=dev-libs/libpcre-4.2-r1
+	>=net-libs/libpcap-0.7
+	flexresp? ( ~net-libs/libnet-1.0.2a )
+	postgres? ( >=dev-db/postgresql-7.2 )
+	mysql? ( >=dev-db/mysql-3.23.26 )
+	ssl? ( >=dev-libs/openssl-0.9.6b )
+	prelude? ( >=dev-libs/libprelude-0.8 )
+	odbc? ( dev-db/unixODBC )"
+
+RDEPEND="${DEPEND}
+	dev-lang/perl
+	selinux? ( sec-policy/selinux-snort )
+	snortsam? ( net-analyzer/snortsam )"
+
+src_unpack() {
+	unpack ${A}
+	cd ${S}
+	gnuconfig_update
+
+	if use flexresp
+	then
+		epatch ${FILESDIR}/${PV}-libnet-1.0.patch || die "libnet patch failed"
+	fi
+
+	einfo "Patching /etc/snort.conf"
+	sed -i "s:var RULE_PATH ../rules:var RULE_PATH /etc/snort:" etc/snort.conf
+
+	if use prelude
+	then
+		epatch ../snort-2.2.0-prelude-0.3.6.diff || die "prelude patch failed"
+		sed -i -e "s:AC_PROG_RANLIB:AC_PROG_LIBTOOL:" configure.in
+	fi
+	# need to pick up prelude and or flexresp patches
+	einfo "Regenerating autoconf/automake files"
+	sh ./autogen.sh
+
+	if use snortsam
+	then
+		cd ..
+		einfo "Applying snortsam patch"
+		./patchsnort.sh ${S} || die "snortsam patch failed"
+		cd ${S}
+	fi
+}
+
+src_compile() {
+	local myconf
+
+	# There is no --diable-flexresp, cannot use use_enable
+	use flexresp && myconf="${myconf} --enable-flexresp"
+
+	econf \
+		`use_with postgres postgresql` \
+		`use_with mysql` \
+		`use_with ssl openssl` \
+		`use_with odbc` \
+		--without-oracle \
+		`use_with prelude` \
+		${myconf} || die "bad ./configure"
+
+	emake || die "compile problem"
+}
+
+pkg_preinst() {
+	enewgroup snort
+	enewuser snort -1 /dev/null /var/log/snort snort
+	usermod -d "/var/log/snort" snort || die "usermod problem"
+	usermod -g "snort" snort || die "usermod problem"
+	usermod -s "/dev/null" snort || die "usermod problem"
+	echo "ignore any message about CREATE_HOME above..."
+}
+
+src_install() {
+	make DESTDIR=${D} install || die
+
+	keepdir /var/log/snort/
+
+	dodoc COPYING LICENSE doc/*
+	docinto schemas ; dodoc schemas/*
+
+	insinto /etc/snort
+	doins etc/reference.config etc/classification.config rules/*.rules etc/*.map etc/threshold.conf
+	newins etc/snort.conf snort.conf.distrib
+
+	use prelude && doins etc/prelude-classification.config
+
+	exeinto /etc/init.d ; newexe ${FILESDIR}/snort.rc6 snort
+	insinto /etc/conf.d ; newins ${FILESDIR}/snort.confd snort
+
+	chown snort:snort ${D}/var/log/snort
+	chmod 0770 ${D}/var/log/snort
+}
+
+pkg_postinst() {
+	if use mysql || use postgres || use odbc
+	then
+		einfo "To use a database as a backend for snort you will have to"
+		einfo "import the correct tables to the database."
+		einfo "You will have to setup a database called snort first."
+		einfo ""
+		use mysql && \
+			einfo "  MySQL: zcat /usr/share/doc/${PF}/schema/create_mysql.gz | mysql -p snort"
+		use postgres && \
+			einfo "  PostgreSQL: import /usr/share/doc/${PF}/schemas/create_postgresql.gz"
+		use odbc && einfo "SQL tables need to be created - look at /usr/share/doc/${PF}/schemas/"
+		einfo ""
+		einfo "Also, read the following Gentoo forums article:"
+		einfo '   http://forums.gentoo.org/viewtopic.php?t=78718'
+	fi
+}