package/snort: new package

PATCH New Romain Naour 2 participants 2 messages Apr 1, 2018

lore

Share & tools

lore

Romain Naour

author

2018-04-01 15:16 UTC #0 lore raw

PATCH v5 1/1 package/snort: new package

From: Sergio Prado <[email protected]>

Tested on Beaglebone Black.

Build-tested with test-pkg.

Patch to fix cross-compilation errors submitted upstream [1].

[1] https://lists.snort.org/pipermail/snort-devel/2018-January/011025.html

Signed-off-by Sergio Prado <[email protected]>

[Romain:
- split patch by build issues
- convert AC_RUN_IFELSE to AC_CHECK_MEMBERS (ThomasP)
- convert AC_RUN_IFELSE to AC_COMPILE_IFELSE (ThomasP)
- remove most make variable from SNORT_CONF_ENV
- remove SNORT_SOURCE default value]

Signed-off-by Romain Naour <[email protected]>

Cc Thomas Petazzoni <[email protected]>

---
Sergio, snort install some shared libraries and a snort.pc file. Does it make sens to add "SNORT_INSTALL_STAGING = YES"?

Changes v4 -> v5
- fix the patch 0004 changes while converting to AC_COMPILE_IFELSE (ThomasP)

Changes v3 -> v4
- split patch by build issues
- convert AC_RUN_IFELSE to AC_CHECK_MEMBERS (ThomasP)
- convert AC_RUN_IFELSE to AC_COMPILE_IFELSE (ThomasP)
- remove most make variable from SNORT_CONF_ENV
- remove SNORT_SOURCE default value

Changes v2 -> v3
- using AC_CACHE_CHECK() in configure.in to preseed the variable value from the environment and avoid the AC_TRY_RUN() when cross compiling (as suggested by Thomas Petazzoni)
- since now daq has an optional dependency on libdnet, snort must depend on it.

Changes v1 -> v2 (as reviewed by Thomas Petazzoni):
- patching configure.in instead of configure
- using STAGING_DIR to pass libpcap headers location to configure

---
 DEVELOPERS                                         |   1 +
 package/Config.in                                  |   1 +
 ...gure.in-Avoid-path-poisoning-with-libpcap.patch |  35 +++
 ...n-Allow-to-override-the-INADDR_NONE-check.patch |  44 ++++
 ...n-convert-AC_RUN_IFELSE-to-AC_CHECK_MEMBE.patch | 239 +++++++++++++++++++++
 ...n-convert-AC_RUN_IFELSE-to-AC_COMPILE_IFE.patch |  48 +++++
 package/snort/Config.in                            |  25 +++
 package/snort/snort.hash                           |   6 +
 package/snort/snort.mk                             |  32 +++
 9 files changed, 431 insertions(+)
 create mode 100644 package/snort/0001-configure.in-Avoid-path-poisoning-with-libpcap.patch
 create mode 100644 package/snort/0002-configure.in-Allow-to-override-the-INADDR_NONE-check.patch
 create mode 100644 package/snort/0003-configure.in-convert-AC_RUN_IFELSE-to-AC_CHECK_MEMBE.patch
 create mode 100644 package/snort/0004-configure.in-convert-AC_RUN_IFELSE-to-AC_COMPILE_IFE.patch
 create mode 100644 package/snort/Config.in
 create mode 100644 package/snort/snort.hash
 create mode 100644 package/snort/snort.mk

DEVELOPERS +1 -0

index 035376eca8..d97259e73a 100644
@@ -1681,6 +1681,7 @@ F:	package/daq/
 F:	package/libgdiplus/
 F:	package/mongodb/
 F:	package/pimd/
+F:	package/snort/
 F:	package/stella/
 F:	package/traceroute/
 F:	package/tunctl/

package/Config.in +1 -0

index b98f661783..e9f671ddb2 100644
@@ -1833,6 +1833,7 @@ endif
 	source "package/shellinabox/Config.in"
 	source "package/smcroute/Config.in"
 	source "package/sngrep/Config.in"
+	source "package/snort/Config.in"
 	source "package/socat/Config.in"
 	source "package/socketcand/Config.in"
 	source "package/softether/Config.in"

package/snort/0001-configure.in-Avoid-path-poisoning-with-libpcap.patch new file +35 -0

new file mode 100644
index 0000000000..286b6f5883
@@ -0,0 +1,35 @@
+From 732459ca3423799ae3386df3de3f5d6ea2af1b95 Mon Sep 17 00:00:00 2001
+From: Romain Naour <[email protected]>
+Date: Sun, 1 Apr 2018 15:18:51 +0200
+Subject: [PATCH] configure.in: Avoid path poisoning with libpcap
+
+Prevent usage of unsafe libpcap header path when cross compiling.
+
+Signed-off-by: Romain Naour <[email protected]>
+Cc: Sergio Prado <[email protected]>
+---
+From http://patchwork.ozlabs.org/patch/860363/
+---
+ configure.in | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/configure.in b/configure.in
+index 4b3a5db..1e940b1 100644
+--- a/configure.in
++++ b/configure.in
+@@ -70,8 +70,10 @@ case "$host" in
+   *-linux*)
+     linux="yes"
+     AC_DEFINE([LINUX],[1],[Define if Linux])
+-    AC_SUBST(extra_incl)
+-    extra_incl="-I/usr/include/pcap"
++    if test -z "x$with_libpcap_includes"; then
++        AC_SUBST(extra_incl)
++        extra_incl="-I/usr/include/pcap"
++    fi
+     ;;
+   *-hpux10*|*-hpux11*)
+     AC_DEFINE([HPUX],[1],[Define if HP-UX 10 or 11])
+-- 
+2.14.3
+

package/snort/0002-configure.in-Allow-to-override-the-INADDR_NONE-check.patch new file +44 -0

44 lines not on this page · raw message

package/snort/0003-configure.in-convert-AC_RUN_IFELSE-to-AC_CHECK_MEMBE.patch new file +239 -0

239 lines not on this page · raw message

package/snort/0004-configure.in-convert-AC_RUN_IFELSE-to-AC_COMPILE_IFE.patch new file +48 -0

48 lines not on this page · raw message

package/snort/Config.in new file +25 -0

new file mode 100644
index 0000000000..d1a59d5050
@@ -0,0 +1,25 @@
+config BR2_PACKAGE_SNORT
+	bool "snort"
+	depends on BR2_USE_WCHAR
+	depends on BR2_USE_MMU # fork()
+	depends on !BR2_STATIC_LIBS # daq
+	depends on BR2_TOOLCHAIN_HAS_NATIVE_RPC || BR2_TOOLCHAIN_HAS_THREADS # libtirpc
+	select BR2_PACKAGE_LIBPCAP
+	select BR2_PACKAGE_DAQ
+	select BR2_PACKAGE_PCRE
+	select BR2_PACKAGE_LIBTIRPC if !BR2_TOOLCHAIN_HAS_NATIVE_RPC
+	help
+	  Snort is a free and open source network intrusion
+	  prevention system (IPS) and network intrusion detection
+	  system (IDS). It can perform protocol analysis, content
+	  searching/matching, and can be used to detect a variety
+	  of attacks and probes, such as buffer overflows, stealth
+	  port scans, CGI attacks, SMB probes, OS fingerprinting
+	  attempts, and much more.
+
+	  https://www.snort.org
+
+comment "snort needs a toolchain w/ wchar, threads, dynamic library"
+	depends on BR2_USE_MMU
+	depends on !BR2_USE_WCHAR || BR2_STATIC_LIBS || \
+		!(BR2_TOOLCHAIN_HAS_THREADS || BR2_TOOLCHAIN_HAS_NATIVE_RPC)

package/snort/snort.hash new file +6 -0

new file mode 100644
index 0000000000..211e862b7f
@@ -0,0 +1,6 @@
+# Locally computed:
+sha256 9f6b3aeac5a109f55504bd370564ac431cb1773507929dc461626898f33f46cd  snort-2.9.11.1.tar.gz
+
+# Hash for license files:
+sha256 f98260a6d3e5ef4ede8a2a6b698e5ac91d64c09243f7171e1c5b17b920a835c7  LICENSE
+sha256 3f1cbfb20bb2c608e1a474421880d08b8cba6abb00ab7736d22c481d71656a6d  COPYING

package/snort/snort.mk new file +32 -0

new file mode 100644
index 0000000000..13f16b3b0f
@@ -0,0 +1,32 @@
+################################################################################
+#
+# snort
+#
+################################################################################
+
+SNORT_VERSION = 2.9.11.1
+SNORT_SITE = https://www.snort.org/downloads/snort
+SNORT_LICENSE = GPL-2.0
+SNORT_LICENSE_FILES = LICENSE COPYING
+
+SNORT_DEPENDENCIES = libpcap libdnet daq pcre
+
+# patching configure.in
+SNORT_AUTORECONF = YES
+
+SNORT_CONF_OPTS = \
+	--with-libpcap-includes=$(STAGING_DIR)/usr/include/pcap \
+	--disable-static-daq
+
+ifeq ($(BR2_PACKAGE_LIBTIRPC),y)
+SNORT_DEPENDENCIES += libtirpc host-pkgconf
+SNORT_CFLAGS += `$(PKG_CONFIG_HOST_BINARY) --cflags libtirpc`
+SNORT_LIBS += `$(PKG_CONFIG_HOST_BINARY) --libs libtirpc`
+endif
+
+SNORT_CONF_ENV = \
+	CFLAGS="$(TARGET_CFLAGS) $(SNORT_CFLAGS)" \
+	LIBS="$(SNORT_LIBS)" \
+	have_inaddr_none=yes
+
+$(eval $(autotools-package))

Signature · 1 line

2.14.3

Thomas Petazzoni

Applied

2018-04-01 16:44 UTC #1 lore raw

PATCH v5 1/1 package/snort: new package

Hello,

Quoted 17 lines · Romain Naour

From: Sergio Prado <[email protected]>
Tested on Beaglebone Black.
Build-tested with test-pkg.
Patch to fix cross-compilation errors submitted upstream [1].
[1] https://lists.snort.org/pipermail/snort-devel/2018-January/011025.html
Signed-off-by Sergio Prado <[email protected]>
[Romain:
- split patch by build issues
- convert AC_RUN_IFELSE to AC_CHECK_MEMBERS (ThomasP)
- convert AC_RUN_IFELSE to AC_COMPILE_IFELSE (ThomasP)
- remove most make variable from SNORT_CONF_ENV
- remove SNORT_SOURCE default value]

Quoted 5 lines

Signed-off-by Romain Naour <[email protected]>
Cc Thomas Petazzoni <[email protected]>
---
Sergio, snort install some shared libraries and a snort.pc file. Does it make sens to add "SNORT_INSTALL_STAGING = YES"?

Applied to master, thanks Romain for finishing this patch!

Thomas

Signature · 3 lines

Thomas Petazzoni, CTO, Bootlin (formerly Free Electrons)
Embedded Linux and Kernel engineering
https://bootlin.com