snort 2.9.2.1_1 security =141

Lightweight network intrusion detection system
Maintained by: zi@FreeBSD.org
Port Added: unknown
License: GPLv2

Snort is a libpcap-based packet sniffer/logger which can be used as a 
lightweight network intrusion detection system. It features rules based logging
and can perform content searching/matching in addition to being used to detect 
a variety of other attacks and probes, such as buffer overflows, stealth port
scans, CGI attacks, SMB probes, and much more. Snort has a real-time alerting 
capability, with alerts being sent to syslog, a separate "alert" file, or even
to a Windows computer via Samba.

Packets are logged in their decoded form to directories which are generated
based upon the IP address of the remote peer.  This allows Snort to be used as
a sort of "poor man's intrusion detection system" if you specify what traffic
you want to record and what to let through.

For instance, I use it to record traffic of interest to the six computers in 
my office at work while I'm away on travel or gone for the weekend.  It's 
also nice for debugging network code since it shows you most of the Important 
Stuff(TM) about your packets (as I see it anyway).  The code is pretty easy
to modify to provide more complete packet decoding, so feel free to make 
suggestions.

WWW: http://www.snort.org/

CVSWeb : Sources : Main Web Site : Distfiles Availability : PortsMon

---

NOTE: FreshPorts displays only required dependencies information. Optional dependencies are not covered.
Required To Build: net/daq, net/libnet, devel/libtool
Required To Run: net/daq, net/libnet
Required Libraries: devel/pcre
There are no ports dependent upon this port

---

To install the port: cd /usr/ports/security/snort/ && make install clean
To add the package: pkg_add -r snort

---

Configuration Options

===> The following configuration options are available for snort-2.9.2.1_1:
     IPV6=on (default) "Enable IPv6 support"
     MPLS=on (default) "Enable MPLS support"
     GRE=on (default) "Enable GRE support"
     TARGETBASED=off (default) "Enable Targetbased support"
     DECODERPRE=on (default) "Enable Decoded-Preprocessor-Rules"
     ZLIB=on (default) "Enable GZIP support"
     NORMALIZER=on (default) "Enable Normalizer"
     REACT=on (default) "Enable React"
     PERFPROFILE=on (default) "Enable Performance Profiling"
     FLEXRESP3=on (default) "Flexible response to events (version 3)"
     MYSQL=off (default) "Enable MySQL support"
     ODBC=off (default) "Enable ODBC support"
     POSTGRESQL=off (default) "Enable PostgreSQL support"
     PRELUDE=off (default) "Enable Prelude NIDS integration"
     LRGPCAP=off (default) "Enable pcaps larger than 2GB"
     SNORTSAM=off (default) "Unofficial Snortsam Patch"
     SOURCEFIRE=on (default) "Enable Sourcefire specific build options"
     DBGSNORT=off (default) "Enable debugging symbols+core dumps"
===> Use 'make config' to modify these settings

---

Master Sites:

http://heanet.dl.sourceforge.net/project/snort/snort/

http://sunet.dl.sourceforge.net/project/snort/snort/

http://iweb.dl.sourceforge.net/project/snort/snort/

http://switch.dl.sourceforge.net/project/snort/snort/

http://surfnet.dl.sourceforge.net/project/snort/snort/

http://kent.dl.sourceforge.net/project/snort/snort/

http://freefr.dl.sourceforge.net/project/snort/snort/

http://voxel.dl.sourceforge.net/project/snort/snort/

http://jaist.dl.sourceforge.net/project/snort/snort/

http://osdn.dl.sourceforge.net/project/snort/snort/

http://nchc.dl.sourceforge.net/project/snort/snort/

http://ncu.dl.sourceforge.net/project/snort/snort/

http://transact.dl.sourceforge.net/project/snort/snort/

http://softlayer.dl.sourceforge.net/project/snort/snort/

http://internode.dl.sourceforge.net/project/snort/snort/

http://ufpr.dl.sourceforge.net/project/snort/snort/

http://waix.dl.sourceforge.net/project/snort/snort/

http://people.rit.edu/rpsfa/distfiles/

ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/distfiles/

- Chase unixODBC shlib bump

- Fix issue when NOPORTDOCS and SNORTSAM are both defined

- Update to 2.9.2.1
- Fix issue when NOPORTDOCS is defined

In the rc.d scripts, change assignments to rcvar to use the
literal name_enable wherever possible, and ${name}_enable
when it's not, to prepare for the demise of set_rcvar().

In cases where I had to hand-edit unusual instances also
modify formatting slightly to be more uniform (and in
some cases, correct). This includes adding some $FreeBSD$
tags, and most importantly moving rcvar= to right after
name= so it's clear that one is derived from the other.

- Cleanup snortsam integration

- Update to 2.9.2

- Bring back snortsam patches
- Do not bump PORTREVISION

PR:             ports/162740
Submitted by:   Michael Scheidell <scheidell@freebsd.org>
Feature safe:   yes

- Introduce multi-interface/instance support in rc script

PR:             ports/161286
Submitted by:   Michael Scheidell <scheidell@secnap.net>
Feature safe:   yes

- Revert previous commit

Feature safe:   yes

- Update hash to reflect file deployed to the official mirrors.  (source code
was diff'd--no code changes detected)
- Not bumping PORTREVISION

Feature safe:   yes

- Make SOURCEFIRE option enabled by default to ensure all rules function out of
the box.

Requested by:   Dean Freeman <wfreeman@sourcefire.com>

- Rename SRCFIRE OPTION to SOURCEFIRE

- Add additional MASTER_SITES

- Update to 2.9.1.2
- Add debugging OPTION to build snort with debug symbols, etc.
- Add sourcefire OPTION to build snort with --enable-sourcefire
- Take maintainership per private email conversation with current maintainer

PR:             ports/161876
Submitted by:   Ryan Steinmetz <zi@FreeBSD.org>
Approved by:    Dean Freeman <wfreeman@sourcefire.com> (maintainer)

- Update to 2.9.1.1

PR:             ports/161347
Submitted by:   Ryan Steinmetz <zi@FreeBSD.org>
Approved by:    Dean Freeman <wfreeman@sourcefire.com> (maintainer)

- Add LDFLAGS to CONFIGURE_ENV and MAKE_ENV (as it was done with LDFLAGS)
- Fix all ports that add {CPP,LD}FLAGS to *_ENV to modify flags instead

PR:             157936
Submitted by:   myself
Exp-runs by:    pav
Approved by:    pav

Update to 2.9.1
Add LICENSE

PR:             ports/160044
Submitted by:   zi@
Approved by:    wxs (mentor), maintainer timeout

- Forget to add SNORTSAM patchset to distinfo,
  Users fail to build snort when WITH_SNORTSAM is set.

Reported by:    sunpoet@

- Update to 2.9.0.5

PR:             ports/156334
Submitted by:   Dean Freeman <wfreeman@sourcefire.com> (maintainer)

Update to libtool 2.4

Tested by:      pav (multiple -exp runs)

Apply two patches:

- Fix build when --enable-dynamicplugins is not given to configure. [1]
- Fix a segfault in HttpInspect

PR:             ports/154868
Submitted by:   Dean Freeman <wfreeman@sourcefire.com> (maintainer)
                [1]: Michael Scheidell

- Remove stray cmd from plist that created bogus file on pkg_add

Reported by:    pointyhat

- Update MAINTAINER address

- Update to 2.9.0.4
- Update snortsam checksum
- Fix LIBNET_CONFIG issue
- Pet portlint

Changes:        http://www.snort.org/downloads/740
PR:             ports/154668
Submitted by:   Dean Freeman <wfreeman@sourcefire.com> (maintainer)

- Update to 2.9.0.3 [1]
- pass maintainership to William Freeman <wfreeman_AT_sourcefire dot com>

Note: This attached patch replaces the one in ports/153998.
      Also fixes the location of the dynamic libs/rules in ports/153224.
PR:             ports/154514 [1], ports/153998 [2]
Submitted by:   Michael Scheidell <scheidell_AT_secnap dot net>

- add IPv6 option

PR:             ports/152009
Submitted by:   Trond Endrestøl <Trond dot Endrestol_AT_ximalas dot info>

Sync to new bsd.autotools.mk

Unbreak the build when the SNORTSAM option is selected.
Change a manual build depend line on automake110 (which is dead)
to a autotools line.

PR:             ports/152171
Submitted by:   "Tom Judge" <tom@tomjudge.com>
Approved by:    maintainer timeout (clsung, 21 days)

Autotools update.   Read ports/UPDATING 20100915 for details.

Approved by:    portmgr (for Mk/bsd.port.mk part)
Tested by:      Multiple -exp runs

- Update snort to version 2.8.6.1.
- From the release notes:
  * Eliminate false positives when using fast_pattern:only and having only
  one http content in the pattern matcher.

  * Address false positives in FTP preprocessor with string format verification.
  Also addressed issue with handling of response codes to data transfer
  commands where the response code didn't contain a message.

PR:             ports/148878
Submitted by:   olli hauer <ohauer_AT_gmx dot de>

- source tar ball go to LOCAL
- fix WITH_SNORTSAM knob

PR:             ports/148484, ports/148516
Submitted by:   Sunpoet Po-Chuan Hsieh <sunpoet_AT_sunpoet dot net>

- distinfo is not updated with last commit

Failed by:     me

- Update to 2.8.6
- name for one patch has changed from patch-snort.conf to patch-etc__snort.conf
  (easier to build diffs with 'make makepatch')
- snort.conf was replaced with the version shiped in the rules tarball
  (Maybe users shoud be pointed to the Changelog)

PR:             ports/146155
Submitted by:   olli hauer <ohauer_AT_gmx dot de>

- bump PORTREVISION
- Fix build WITH_SNORTSAM knob
- Use an updated patch from www.snortsam.net

PR:             ports/148449
Submitted by:   lioux

- fix LIB_DEPENDS about libnet
- snortsam patch for snort has changed
  - ref:
http://lists.snortsam.net/pipermail/snortsam-discussion/2010-March/000502.html
- bump PORTREVISION

PR:             ports/145632
Submitted by:   olli hauer <ohauer_AT_gmx dot de>

Begin the process of deprecating sysutils/rc_subr by
s#. %%RC_SUBR%%#. /etc/rc.subr#

- restore snortsam checksum

PR:             ports/144715
Submitted by:   olli hauer <ohauer_AT_gmx dot de>

- Update to 2.8.5.3

- update snort to version 2.8.5.2

RELEASE.NOTES
2009-12-15 - Snort 2.8.5.2

[*] Improvements
* Improvements to HTTP Inspect for handling of pipelined requests
and chunked encodings.

* Updated the documentation for output plugins and log limits.

* Fixed building on AIX 6.

* Fixed reloading of auto-iface variables when privileges had been dropped.

* Fixed issues at startup and perfstats rotation with old versions of
libc (2.2, 2.3) & linux threads.

PR:             ports/142885
Submitted by:   olli hauer <ohauer_AT_gmx dot de>

- fix default flags setting
- bump PORTREVISION

Submitted by:   Andrea Venturoli <ml_AT_netfence dot it>

- Update to 2.8.5.1

- Mark MAKE_JOBS_UNSAFE, as it fails with forced jobs
- bump PORTREVISION

PR:             ports/138644
Submitted by:   Dmitry Marakasov <amdmi3_AT_amdmi3 dot ru>

- Fix fetch

Reported by:    pointyhat
Hat:            portmgr
Feature safe:   yes

- Chase libprelude update

Feature safe:   yes

- Re-enable plugin snortsam
- bump PORTREVISION

PR:             ports/137765
Submitted by:   Danton Dorati <danton_AT_freebsdbrasil dot com dot br>

- Fix fetch

-Repocopy devel/libtool15 -> libtool22 and libltdl15 -> libltdl22.
-Update libtool and libltdl to 2.2.6a.
-Remove devel/libtool15 and devel/libltdl15.
-Fix ports build with libtool22/libltdl22.
-Bump ports that depend on libltdl22 due to shared library version change.
-Explain what to do update in the UPDATING.

It has been tested with GNOME2, XFCE4, KDE3, KDE4 and other many wm/desktop
and applications in the runtime.

With help:      marcus and kwm
Pointyhat-exp:  a few times by pav
Tested by:      pgollucci, "Romain Tartière" <romain@blogreen.org>, and
                a few MarcusCom CVS users. Also, I might have missed a few.
Repocopy by:    marcus
Approved by:    portmgr

- Update to 2.8.4.1

Fix plist with -DNOPORT*.

Prompted by:    QAT QA run
Approved by:    maintainer timeout on QATMail

- Chase security/libprelude shlib version bump

PR:             131286, 131585 (partial)
Submitted by:   Vladimir Korkodinov <viper at perm dot raid dot ru>

- Add mysql/postgresql to REQUIRE: in rc.script for correct start order

PR:             127954
Submitted by:   Helmut Schneider <jumper99 at gmx dot de>
Approved by:    maintainer timeout

- Remove conditional checks for FreeBSD 5.x and older

- bump PORTREVISION
- fix libprelude version
One of the config options for security/snort is WITH_PRELUDE. Last
time libprelude has changed to new version, but Makefile for snort is not
updated. This patch corrects this issue.

PointyHat to:   beech (ports/127339)
PR:             ports/127818
Submitted by:   Krzysztof Stryjek <wtp_AT_bsdguru dot org>

- Update to 2.8.2.2

- patch for enable feature to output plugin snortsam
- bump PORTREVISION

PR:             ports/126506
Submitted by:   Danton Dorati <danton_AT_freebsdbrasil dot com dot br>

Update CONFIGURE_ARGS for how we pass CONFIGURE_TARGET to configure script.
Specifically, newer autoconf (> 2.13) has different semantic of the
configure target. In short, one should use --build=CONFIGURE_TARGET
instead of CONFIGURE_TARGET directly. Otherwise, you will get a warning
and the old semantic may be removed in later autoconf releases.

To workaround this issue, many ports hack the CONFIGURE_TARGET variable
so that it contains the ``--build='' prefix.

To solve this issue, under the fact that some ports still have
configure script generated by the old autoconf, we use runtime detection
in the do-configure target so that the proper argument can be used.

Changes to Mk/*:
 - Add runtime detection magic in bsd.port.mk

- Update to 2.8.2.1
- 2008-06-12 - Snort 2.8.2.1

  [*] Improvements
  * Fix support for pass rules that sometimes did not take precedence
  over alert and/or drop rules.

PR:             ports/124717
Submitted by:   Michael Scheidell <scheidell_AT_secnap dot net>

- typo in files/pkg-message.in
- bump PORTREVISION

Submitted by:   kevlo

- Update to 2.8.2

- Snort now includes an updated version of FLEXRESP2 in the main snort source
code and no longer needs to be patched.
- bump PORTREVISION

PR:             ports/124048
Submitted by:   "Scot W. Hetzel" <swhetzel_AT_gmail dot com>

- Update libprelude dependency

PR:             ports/123659
Submitted by:   Robin Gruyters <r dot gruyters_AT_yirdis dot nl>

- add Performance Profiling option
- bump PORTREVISION

PR:             by mail
Submitted by:   Scott MacGregor <shadowbq_AT_gmail dot com>

- Update to 2.8.1

- Update to 2.8.0.2

PR:             ports/121103
Submitted by:   Jo Rhett <jrhett_AT_netconsonance dot com>
Reviewed by:    clsung

- update prelude library dependency

PR:             ports/116111
Submitted by:   Robin Gruyters <r dot gruyters_AT_yirdis dot nl>

- Update to 2.7.0.1

Tested on two systems, and until works perfectly.

Changelog snort-2.7.0.1:
* etc/snort.conf:
  Turn off flow since Stream5 is now enabled by default.
* src/snort.c:
  Fix printing of threshold counts until after all rules are read.
  This issue did not affect thresholding, only display of thresholding.
  Thanks to Jeffrey Denton for reporting the problem.
* src/sfutil/ipobj.c:
  Fix free of invalid pointer when using a negated IP list.
  This is used by sfportscan preprocessor configuration parsing.
  Thanks to Anders Ostrem for reporting the problem.

- Remove the DESTDIR modifications from individual ports as we have a new,
  fully chrooted DESTDIR, which does not need such any more.

Sponsored by:   Google Summer of Code 2007
Approved by:    portmgr (pav)

- Update to 2.7.0

Update includes:
- Target-based stream reassembly, including handling of TCP dataoverlaps and
  anomalous TCP header flags on a per-destination basis. 11 different
  target-based policies are supported. See README.stream5 for specific
  configuration options for operating system targets.
- UDP session tracking
- Option to emulate Stream4 flushing behaviour
- Stream5 replaces BOTH Stream4 and Flow -- should disable both of these when
  Stream5 is enabled.
- Security and memory footprint improvements

PR:             ports/114806
Submitted by:   Robin Gruyters <r dot gruyters_AT_yirdis dot nl>

- Update to 2.6.1.5

PR:             ports/114123
Submitted by:   Robin Gruyters <r dot gruyters_AT_yirdis dot nl>

- optional pcap filter in rc.conf.

  Example:
snort_expression="not net after.nat.addr.ess/24"
- bump PORTREVISION

PR:             ports/113551
Submitted by:   Tomoyuki Sakurai <cherry_AT_trombik dot org>

- Update libprelude to 0.9.14.
- Update dependent ports accordingly.
- Bump PORTVERSION to force rebuild.

PR:             ports/112703
Submitted by:   Marcelo Araujo <araujo@FreeBSD.org>
Approved by:    stas (mentor)

- Update to 2.6.1.4
- Fix initial copy of configuration files.

PR:             ports/111533
Submitted by:   Robin Gruyters <r dot gruyters_AT_yirdis dot nl>

- fix build error when configured with FLEXRESP2

PR:             ports/109830
Submitted by:   alfss<alfss_AT_netco dot ru>

- Update to 2.6.1.3
- security update

Security:       http://www.snort.org/docs/advisory-2007-02-19.html

- pet tinderbox

- fix configure errors when WITH_FLEXRESP, WITH_FLEXRESP2
- bump PORTREVISION

- Patch net/libnet* to versioned libraries and header files, so they can
  coexist

PR:             ports/103861
Submitted by:   alepulver
Tested by:      pointyhat
With hat:       portmgr

Remove USE_GPG from all effected ports. This knob is a no-op and the way it
was supposed to work is useless, because if we can't trust the distfile from
the remote machine, we can't trust the signature from the same machine either.
Our MD5 and SHA256 are good for checking both the sanity and the
trustiness of distfiles.

Approved by:    portmgr (erwin), erwin (mentor)

- updated prelude version;
- bump PORTREVISION

PR:             ports/107987
Submitted by:   Robin Gruyters <r dot gruyters_AT_yirdis dot nl>

- Update to 2.6.1.2

- Update snort to latest version (2.6.1.1)

PR:             ports/106368
Submitted by:   Sunpoet Po-Chuan Hsieh <sunpoet_AT_sunpoet dot net>

- Update to 0.9.11
- library version update of related ports

Changelog libprelude:
- Hook class comparison function. Accept NULL, equal, not equal operator.
- Introduce better error checking in the idmef-class API, which is now
  considered public and might be used by external application. Rename
  error code to reflect the API.
- Change to the way IDMEF listed element are handled. Specifying negative
  number as the position of the element from the low level API now allow
  to position the element at the specified (reversed) index. Using the
  high level API a negative index permit to address a list of element
  backward (replace an element).
- Build fixes for SWIG > 1.3.27.
- Modify idmef_value_match() so that it always unroll listed value
  (do it for both val1 and val2. Remove assertion, and let
  idmef_value_type_compare() return an error code in case there is an issue.
- Handle path using IDMEF_LIST_APPEND or IDMEF_LIST_PREPEND as
  path using an undefined list index on idmef_path_get() call.
- Make criteria parser accept (*) list index.
- Implement comparison function for all IDMEF object.

PR:             ports/104328
Submitted by:   maintainer (Robin Gruyters)
Approved by:    portmgr (pav)

- Update to 2.6.0.2
- let snort to packet sniff several different network interfaces
  - Contributed by Matthew Seaman <matthew dot seaman_AT_thebunker dot net>

- fix build error in 4.x
  "cvs update - sys/types.h should be before socket.h"

PR:             ports/102922
Submitted by:   Jez Hancock <jez.hancock_AT_munk dot me dot uk>

- fix location entry in snort.conf
- bump PORTREVISION

PR:             ports/102909
Submitted by:   Richard Bejtlich <taosecurity_AT_gmail dot com>

- Update to 2.6.0
- I'll maintain it now.

PR:             ports/99862
Submitted by:   Linh Pham <question+fbsdports_AT_closedsrc dot org>

- Release maintainership:

I have jumped in over my head with maintaining the port, both in terms of my
skills with significantly modifying a port (particularly in getting the port
from 2.4.5 to 2.6.0), not using snort enough to really test the full package,
and not enough time to improve the port.

With that said, there still is ports/99862 that is still open (re: bring
security/snort to 2.6.0) which I have it the wall on trying to get the port
to deinstall cleanly due to the optional nature of some components. I will
continue to help out with other ports that I can take on and those that I
can still take on maintainership.

PR:             ports/101526
Submitted by:   Linh Pham <question+fbsdports@closedsrc.org> (maintainer)

- Update to 2.4.5

PR:             ports/98773
Submitted by:   Linh Pham <question+fbsdports@closedsrc.org> (maintainer)

Remove USE_REINPLACE from all categories starting with S

- Chase libprelude version
- Bump PORTREVISION

PR:             ports/96758, ports/96759, ports/96760
Submitted by:   maintainer

- Tarball was rerolled

SourceFire, the maintainers of Snort, have updated the tarball for Snort
2.4.4 to include support for building binaries. The updated tarball has a
different size and checksum and I have verified with the Snort team that the
change is in fact valid.

PR:             ports/96017
Submitted by:   maintainer

- Update to 2.4.4 [1]
- Chase libprelude version [2]

PR:             ports/94275 [1], ports/94412 [2]
Submitted by:   maintainer [1] [2]

Replace ugly "@unexec rmdir %D... 2>/dev/null || true" with @dirrmtry

Approved by:    krion@
PR:             ports/88711 (related)

- Fix dependency on prelude (shlib version has been bumped recently).

PR:             ports/89191
Submitted by:   Krzysztof Stryjek <wtp+snort@bsdguru.org>
Approved by:    maintainer

libnet update:
- move 1.0 obsoleted version to net/libnet10
  net/libnet is latest Stable Version
  net/libnet is latest Beta Version

- Fix all depended ports with a new DEPENDS scheme

- While I'm here fix security/yersinia build on 4.x
  (getopt_long and ncurses issues)

PR:             ports/85519 (based on)
Submitted by:   Stas Yakovlev <stas.yakovlev_at_gmail.com>

Add SHA256

PR:             88945
Submitted by:   maintainer

- Update to 2.4.3, which includes a fix for a potential buffer overflow
  in the Back Orifice preprocessor.
- Transfer maintainership to the submitter, who seems to be tracking
  Snort development much closer than I do, and submitted most of
  the Snort update PRs in last couple of years

PR:             ports/87628
Submitted by:   Linh Pham <question+fbsdports@closedsrc.org>

- Update to 2.4.1
- Snort distribution no longer includes rules - download them seperately
  (or consider using security/oinkmaster to simplify that process)
- Change default config dir to ${PREFIX}/etc/snort (to avoid cluttering)
- Install database schemas scripts into EXAMPLESDIR

- Update to 2.3.3
- Update MASTER_SITE path for Prelude patch

PR:             ports/80338
Submitted by:   Linh Pham <question+fbsdports@closedsrc.org>

- Add checksum for Prelude patch to distinfo (forgotten in 2.3.2 upgrade)

PR:             ports/79188
Submitted by:   Greg Panula <greg.panula@lexisnexis.com>

14 vulnerabilities affecting 32 ports have been reported in the past 14 days

^* - modified, not new

All vulnerabilities