snort 2.8.4.1 security =140

Lightweight network intrusion detection system
Maintained by: clsung@FreeBSD.org
Port Added: unknown

---

---

Snort is a libpcap-based packet sniffer/logger which can be used as a 
lightweight network intrusion detection system. It features rules based logging
and can perform content searching/matching in addition to being used to detect 
a variety of other attacks and probes, such as buffer overflows, stealth port
scans, CGI attacks, SMB probes, and much more. Snort has a real-time alerting 
capability, with alerts being sent to syslog, a separate "alert" file, or even
to a Windows computer via Samba.

Packets are logged in their decoded form to directories which are generated
based upon the IP address of the remote peer.  This allows Snort to be used as
a sort of "poor man's intrusion detection system" if you specify what traffic
you want to record and what to let through.

For instance, I use it to record traffic of interest to the six computers in 
my office at work while I'm away on travel or gone for the weekend.  It's 
also nice for debugging network code since it shows you most of the Important 
Stuff(TM) about your packets (as I see it anyway).  The code is pretty easy
to modify to provide more complete packet decoding, so feel free to make 
suggestions.

WWW: http://www.snort.org/

CVSWeb : Sources : Main Web Site : Distfiles Availability : PortsMon

---

Required To Build: devel/libtool15
Required Libraries: devel/pcre

---

To install the port: cd /usr/ports/security/snort/ && make install clean
To add the package: pkg_add -r snort

---

Configuration Options

===> The following configuration options are available for snort-2.8.4.1:
     DYNAMIC=on (default) "Enable dynamic plugin support"
     FLEXRESP=off (default) "Flexible response to events"
     FLEXRESP2=off (default) "Flexible response to events (version 2)"
     MYSQL=off (default) "Enable MySQL support"
     ODBC=off (default) "Enable ODBC support"
     POSTGRESQL=off (default) "Enable PostgreSQL support"
     PRELUDE=off (default) "Enable Prelude NIDS integration"
     PERPROFILE=off (default) "Enable Performance Profiling"
===> Use 'make config' to modify these settings

---

Master Sites:

http://www.snort.org/dl/

ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/distfiles/

• port moved here from security/prelude-nids on 2005-11-21
  REASON: Deprecated in favor of using Snort
  

- Update to 2.8.4.1

Fix plist with -DNOPORT*.

Prompted by:    QAT QA run
Approved by:    maintainer timeout on QATMail

- Chase security/libprelude shlib version bump

PR:             131286, 131585 (partial)
Submitted by:   Vladimir Korkodinov <viper at perm dot raid dot ru>

- Add mysql/postgresql to REQUIRE: in rc.script for correct start order

PR:             127954
Submitted by:   Helmut Schneider <jumper99 at gmx dot de>
Approved by:    maintainer timeout

- Remove conditional checks for FreeBSD 5.x and older

- bump PORTREVISION
- fix libprelude version
One of the config options for security/snort is WITH_PRELUDE. Last
time libprelude has changed to new version, but Makefile for snort is not
updated. This patch corrects this issue.

PointyHat to:   beech (ports/127339)
PR:             ports/127818
Submitted by:   Krzysztof Stryjek <wtp_AT_bsdguru dot org>

- Update to 2.8.2.2

- patch for enable feature to output plugin snortsam
- bump PORTREVISION

PR:             ports/126506
Submitted by:   Danton Dorati <danton_AT_freebsdbrasil dot com dot br>

Update CONFIGURE_ARGS for how we pass CONFIGURE_TARGET to configure script.
Specifically, newer autoconf (> 2.13) has different semantic of the
configure target. In short, one should use --build=CONFIGURE_TARGET
instead of CONFIGURE_TARGET directly. Otherwise, you will get a warning
and the old semantic may be removed in later autoconf releases.

To workaround this issue, many ports hack the CONFIGURE_TARGET variable
so that it contains the ``--build='' prefix.

To solve this issue, under the fact that some ports still have
configure script generated by the old autoconf, we use runtime detection
in the do-configure target so that the proper argument can be used.

Changes to Mk/*:
 - Add runtime detection magic in bsd.port.mk

- Update to 2.8.2.1
- 2008-06-12 - Snort 2.8.2.1

  [*] Improvements
  * Fix support for pass rules that sometimes did not take precedence
  over alert and/or drop rules.

PR:             ports/124717
Submitted by:   Michael Scheidell <scheidell_AT_secnap dot net>

- typo in files/pkg-message.in
- bump PORTREVISION

Submitted by:   kevlo

- Update to 2.8.2

- Snort now includes an updated version of FLEXRESP2 in the main snort source
code and no longer needs to be patched.
- bump PORTREVISION

PR:             ports/124048
Submitted by:   "Scot W. Hetzel" <swhetzel_AT_gmail dot com>

- Update libprelude dependency

PR:             ports/123659
Submitted by:   Robin Gruyters <r dot gruyters_AT_yirdis dot nl>

- add Performance Profiling option
- bump PORTREVISION

PR:             by mail
Submitted by:   Scott MacGregor <shadowbq_AT_gmail dot com>

- Update to 2.8.1

- Update to 2.8.0.2

PR:             ports/121103
Submitted by:   Jo Rhett <jrhett_AT_netconsonance dot com>
Reviewed by:    clsung

- update prelude library dependency

PR:             ports/116111
Submitted by:   Robin Gruyters <r dot gruyters_AT_yirdis dot nl>

- Update to 2.7.0.1

Tested on two systems, and until works perfectly.

Changelog snort-2.7.0.1:
* etc/snort.conf:
  Turn off flow since Stream5 is now enabled by default.
* src/snort.c:
  Fix printing of threshold counts until after all rules are read.
  This issue did not affect thresholding, only display of thresholding.
  Thanks to Jeffrey Denton for reporting the problem.
* src/sfutil/ipobj.c:
  Fix free of invalid pointer when using a negated IP list.
  This is used by sfportscan preprocessor configuration parsing.
  Thanks to Anders Ostrem for reporting the problem.

- Remove the DESTDIR modifications from individual ports as we have a new,
  fully chrooted DESTDIR, which does not need such any more.

Sponsored by:   Google Summer of Code 2007
Approved by:    portmgr (pav)

- Update to 2.7.0

Update includes:
- Target-based stream reassembly, including handling of TCP dataoverlaps and
  anomalous TCP header flags on a per-destination basis. 11 different
  target-based policies are supported. See README.stream5 for specific
  configuration options for operating system targets.
- UDP session tracking
- Option to emulate Stream4 flushing behaviour
- Stream5 replaces BOTH Stream4 and Flow -- should disable both of these when
  Stream5 is enabled.
- Security and memory footprint improvements

PR:             ports/114806
Submitted by:   Robin Gruyters <r dot gruyters_AT_yirdis dot nl>

- Update to 2.6.1.5

PR:             ports/114123
Submitted by:   Robin Gruyters <r dot gruyters_AT_yirdis dot nl>

- optional pcap filter in rc.conf.

  Example:
snort_expression="not net after.nat.addr.ess/24"
- bump PORTREVISION

PR:             ports/113551
Submitted by:   Tomoyuki Sakurai <cherry_AT_trombik dot org>

- Update libprelude to 0.9.14.
- Update dependent ports accordingly.
- Bump PORTVERSION to force rebuild.

PR:             ports/112703
Submitted by:   Marcelo Araujo <araujo@FreeBSD.org>
Approved by:    stas (mentor)

- Update to 2.6.1.4
- Fix initial copy of configuration files.

PR:             ports/111533
Submitted by:   Robin Gruyters <r dot gruyters_AT_yirdis dot nl>

- fix build error when configured with FLEXRESP2

PR:             ports/109830
Submitted by:   alfss<alfss_AT_netco dot ru>

- Update to 2.6.1.3
- security update

Security:       http://www.snort.org/docs/advisory-2007-02-19.html

- pet tinderbox

- fix configure errors when WITH_FLEXRESP, WITH_FLEXRESP2
- bump PORTREVISION

- Patch net/libnet* to versioned libraries and header files, so they can
  coexist

PR:             ports/103861
Submitted by:   alepulver
Tested by:      pointyhat
With hat:       portmgr

Remove USE_GPG from all effected ports. This knob is a no-op and the way it
was supposed to work is useless, because if we can't trust the distfile from
the remote machine, we can't trust the signature from the same machine either.
Our MD5 and SHA256 are good for checking both the sanity and the
trustiness of distfiles.

Approved by:    portmgr (erwin), erwin (mentor)

- updated prelude version;
- bump PORTREVISION

PR:             ports/107987
Submitted by:   Robin Gruyters <r dot gruyters_AT_yirdis dot nl>

- Update to 2.6.1.2

- Update snort to latest version (2.6.1.1)

PR:             ports/106368
Submitted by:   Sunpoet Po-Chuan Hsieh <sunpoet_AT_sunpoet dot net>

- Update to 0.9.11
- library version update of related ports

Changelog libprelude:
- Hook class comparison function. Accept NULL, equal, not equal operator.
- Introduce better error checking in the idmef-class API, which is now
  considered public and might be used by external application. Rename
  error code to reflect the API.
- Change to the way IDMEF listed element are handled. Specifying negative
  number as the position of the element from the low level API now allow
  to position the element at the specified (reversed) index. Using the
  high level API a negative index permit to address a list of element
  backward (replace an element).
- Build fixes for SWIG > 1.3.27.
- Modify idmef_value_match() so that it always unroll listed value
  (do it for both val1 and val2. Remove assertion, and let
  idmef_value_type_compare() return an error code in case there is an issue.
- Handle path using IDMEF_LIST_APPEND or IDMEF_LIST_PREPEND as
  path using an undefined list index on idmef_path_get() call.
- Make criteria parser accept (*) list index.
- Implement comparison function for all IDMEF object.

PR:             ports/104328
Submitted by:   maintainer (Robin Gruyters)
Approved by:    portmgr (pav)

- Update to 2.6.0.2
- let snort to packet sniff several different network interfaces
  - Contributed by Matthew Seaman <matthew dot seaman_AT_thebunker dot net>

- fix build error in 4.x
  "cvs update - sys/types.h should be before socket.h"

PR:             ports/102922
Submitted by:   Jez Hancock <jez.hancock_AT_munk dot me dot uk>

- fix location entry in snort.conf
- bump PORTREVISION

PR:             ports/102909
Submitted by:   Richard Bejtlich <taosecurity_AT_gmail dot com>

- Update to 2.6.0
- I'll maintain it now.

PR:             ports/99862
Submitted by:   Linh Pham <question+fbsdports_AT_closedsrc dot org>

- Release maintainership:

I have jumped in over my head with maintaining the port, both in terms of my
skills with significantly modifying a port (particularly in getting the port
from 2.4.5 to 2.6.0), not using snort enough to really test the full package,
and not enough time to improve the port.

With that said, there still is ports/99862 that is still open (re: bring
security/snort to 2.6.0) which I have it the wall on trying to get the port
to deinstall cleanly due to the optional nature of some components. I will
continue to help out with other ports that I can take on and those that I
can still take on maintainership.

PR:             ports/101526
Submitted by:   Linh Pham <question+fbsdports@closedsrc.org> (maintainer)

- Update to 2.4.5

PR:             ports/98773
Submitted by:   Linh Pham <question+fbsdports@closedsrc.org> (maintainer)

Remove USE_REINPLACE from all categories starting with S

- Chase libprelude version
- Bump PORTREVISION

PR:             ports/96758, ports/96759, ports/96760
Submitted by:   maintainer

- Tarball was rerolled

SourceFire, the maintainers of Snort, have updated the tarball for Snort
2.4.4 to include support for building binaries. The updated tarball has a
different size and checksum and I have verified with the Snort team that the
change is in fact valid.

PR:             ports/96017
Submitted by:   maintainer

- Update to 2.4.4 [1]
- Chase libprelude version [2]

PR:             ports/94275 [1], ports/94412 [2]
Submitted by:   maintainer [1] [2]

Replace ugly "@unexec rmdir %D... 2>/dev/null || true" with @dirrmtry

Approved by:    krion@
PR:             ports/88711 (related)

- Fix dependency on prelude (shlib version has been bumped recently).

PR:             ports/89191
Submitted by:   Krzysztof Stryjek <wtp+snort@bsdguru.org>
Approved by:    maintainer

libnet update:
- move 1.0 obsoleted version to net/libnet10
  net/libnet is latest Stable Version
  net/libnet is latest Beta Version

- Fix all depended ports with a new DEPENDS scheme

- While I'm here fix security/yersinia build on 4.x
  (getopt_long and ncurses issues)

PR:             ports/85519 (based on)
Submitted by:   Stas Yakovlev <stas.yakovlev_at_gmail.com>

Add SHA256

PR:             88945
Submitted by:   maintainer

- Update to 2.4.3, which includes a fix for a potential buffer overflow
  in the Back Orifice preprocessor.
- Transfer maintainership to the submitter, who seems to be tracking
  Snort development much closer than I do, and submitted most of
  the Snort update PRs in last couple of years

PR:             ports/87628
Submitted by:   Linh Pham <question+fbsdports@closedsrc.org>

- Update to 2.4.1
- Snort distribution no longer includes rules - download them seperately
  (or consider using security/oinkmaster to simplify that process)
- Change default config dir to ${PREFIX}/etc/snort (to avoid cluttering)
- Install database schemas scripts into EXAMPLESDIR

- Update to 2.3.3
- Update MASTER_SITE path for Prelude patch

PR:             ports/80338
Submitted by:   Linh Pham <question+fbsdports@closedsrc.org>

- Add checksum for Prelude patch to distinfo (forgotten in 2.3.2 upgrade)

PR:             ports/79188
Submitted by:   Greg Panula <greg.panula@lexisnexis.com>

At Kris's request, back out the MACHINE_ARCH spelling correction until
after 5.4-RELEASE.

Assist getting more ports working on AMD64 by obeying the
Ports Collection documentation and use 'ARCH' rather than 'MACHINE_ARCH'.

- Update to 2.3.2:
  - Removed end-of-line parser fix (introduced in 2.3.1) in favor of
    completely reworking this at the next parser overhaul.

PR:             ports/78846
Submitted by:   Linh Pham <question+fbsdports@closedsrc.org>

- Update to 2.3.1
- Update MASTER_SITES

Prompted by:    Fafa Diliha Romanova <fteg@london.com>

- Upgrade to 2.3.0 [1]
- Add WITH_PRELUDE knob to enable integration with Prelude IDS [2]

PR:             ports/76679 [1]
Submitted by:   Linh Pham <question+fbsdports@closedsrc.org> [1]
Prompted by:    Roberto Bosticardo <roberto.bosticardo@csp.it> [2]

Split the postgresql ports into a server and a client part.

All ports depending on postgresql shall use the USE_PGSQL=yes knob
defined in Mk/bsd.ports.mk. Bumping portrevisions where needed.

PR:             75344
Approved by:    portmgr@ (kris), ade & sean (mentors)

- Upgrade to 2.2.0 [1]
- Prevent local.rules from being clobbered [2]
- Revive OPTIONS - the time has come... ;)

PR:             ports/70332 [1], ports/70814 [2]
Submitted by:   Linh Pham <question+freebsdpr@closedsrc.org> [1],
                Jez Hancock <jez.hancock@munk.nu> [2]

- Update to 2.1.3 [1]
- Use rcNG startup script [2]

PR:             ports/67842 [1], ports/67935 [2]
Submitted by:   Linh Pham <question+freebsdpr@closedsrc.org> [1],
                Renato Botelho <renato@galle.com.br> [2]

- Rename WITH_POSTGRES knob to WITH_POSTGRESQL to be consistent
  with other ports

PR:             ports/62557 (part)
Submitted by:   Ulrich Spoerlein <q@uni.de>

- Update to 2.1.2

PR:             ports/65373
Submitted by:   Linh Pham <question+freebsdpr@closedsrc.org>

- Update to 2.1.1
- Remove patches not needed anymore

PR:             ports/63373
Submitted by:   Linh Pham <question+freebsdpr@closedsrc.org>

SIZE *DOES* MATTER.

Comment out OPTIONS for now.
Let's wait till the dust settles. ;)

Sometimes it helps when you read freebsd-ports *before* committing...

Oops - marcus did add OPTIONS already <blush>
I still prefer to have near the top of the Makefile -
right after the dependencies section

Use OPTIONS infrastructure from bsd.port.mk

Here come the patches!

* Add ghostscript knobs [1]
* Add per-port persistent build options with a menu-driven front-end [2]
* Allow porters to override the message generated when do-configure fails [3]
* Add patch to obviate many pkg-plist files [4]
* Fix the PKG_DBDIR comment [5]
* Make ports framework more robust with regard to make index [6]
* Add new command macros to bsd.port.mk [7]
* Remove direct command use from bsd.port.mk [8]
* Make the ports system respect WITHOUT_CPU_CFLAGS [9]
* Break the SDL code out into bsd.sdl.mk [10]
* Add working support for USE_SIZE [11]
* Fix RANDOMIZE_MASTER_SITES on -CURRENT [12]
* Convert some spaces to tabs [13]

- Install missing config files: unicode.map and threshold.conf
  (snort fails to run without them present in ${PREFIX}/etc)
- Bump PORTREVISION

Noticed by:     Kirby Kuehl <kkuehl@cisco.com>

- Add missing dependency on devel/pcre (mandatory)
- Bump PORTREVISION

PR:             60520
Submitted by:   Kenneth Ingham <freebsdpr@i-pi.com>

While I'm here:
- Fix configure's search for libnet (needed for WITH_FLEXRESP)
  when LOCALBASE != /usr/local
- Add CONFIGURE_TARGET to silence warning
- Use DOCSDIR in pkg-plist and re-sort
- Take maintainership (until someone else step up)

- Update to 2.1.0 [1]
- Install some additional documentation [1]
- Fix WITH_MYSQL, WITH_ODBC and WITH_POSTGRES knobs [2]

PR:             60400 [1], 59445 [2]
Submitted by:   Nicolas Jombart <ecu@ipv42.net> [1],
                Ken Stailey <kstailey@yahoo.com> [2]

Update to 2.0.5 [1]
Use %%DOCSDIR%% and %%DATADIR%% macros [2]

Submitted by:   Linh Pham <question@closedsrc.org> [1], osa [2]
PR:             59510

Update security/snort from 2.0.2 to 2.0.4

PR:             59148
Submitted by:   Linh Pham

Update to 2.0.2.

PR:             ports/57604
Submitted by:   Alex Dupre <sysadmin@alexdupre.com>

Drop maintainership.

irc.d script for security/snort

        This is a sample script for ${PREFIX}/etc/rc.d that will
        wake snort up on boot, and take it down on shutdown. Nothing
        fancy here.  This is needed, because I'm planning on teaching
        ACID many new things, and ACID expects snort to help itself.
        There is only one thing that requires thinking here: This
        should run only after {MySQL|PostgreSQL} server is up, as
        snort might want to report to the local server.

PR:             ports/49047
Submitted by:   Yonatan@xpert.com <Yonatan@xpert.com>
Approved by:    maintainer timeout

Update to snort 2.0.1

PR:             ports/55218
Submitted by:   mharo

Fix detection of sparc64.

Obtained from:  OpenBSD

Fix a couple of typos.

Update to snort 2.0.0.  This fixes a security vulnerability:

  The Sourcefire Vulnerability Research Team has learned of an integer
  overflow in the Snort stream4 preprocessor used by the Sourcefire
  Network Sensor product line. The Snort stream4 preprocessor
  (spp_stream4) incorrectly calculates segment size parameters during
  stream reassembly for certain sequence number ranges which can lead to
  an integer overflow that can be expanded to a heap overflow.

PR:     51106
Submitted by:   Sergey A. Osokin <osa@FreeBSD.org.ru>

Add a patch to fix runtime problems when snort is built with -DWITH_MYSQL

Submitted by:   Mike Harding <mvh@ix.netcom.com>
Obtained from:  snort CVS

Clear moonlight beckons.
Requiem mors pacem pkg-comment,
And be calm ports tree.

E Nomini Patri, E Fili, E Spiritu Sancti.

Update to snort-1.9.1.  This is an important security update:

A buffer overflow has been found in the snort RPC normalization
routines by ISS X-Force. This can cause snort to execute
arbitrary code embedded within sniffed network packets. This
preprocessor is enabled by default.

Chase libpq version bump.

Update to snort 1.9.0.  Tweak the default config files so it can actually
find its installed ruleset [1].  Install config files by default if there is
not already one present, and remove on deinstall if they are unchanged
from the default.

Submitted by:   The Anarcat <anarcat@anarcat.dyndns.org> [1] (based on)
PR:             ports/33887 [1]

Update to snort-1.8.7

Submitted by:   Paul Marquis <pmarquis@pobox.com>
PR:             ports/40528

Update to snort-1.8.7

Submitted by:   Paul Marquis <pmarquis@pobox.com>
PR:             ports/40528

#include <sys/param.h> instead of <machine/param.h> to fix build on
-current.

Upgrade to snort 1.8.6.  The previous two versions (1.8.4 and 1.8.5) were
buggy and short-lived; hopefully this one is better.

Update to snort 1.8.3, a stability and bugfix release.    

Update to snort 1.8.2, a bugfix/stability release.    

Remove a stray line-continuation which was breaking the fetch.    

Take maintainership    

Drop maintainership.    

Update to 1.8.1-RELEASE.    

Upgrade to 1.8p1.    

Upgrade to 1.8-RELEASE.    

Fix WITH_MYSQL, WITH_ODBC and WITH_POSTGRES.    

-pthread --> ${PTHREAD_LIBS}   -D_THREAD_SAFE --> ${PTHREAD_CFLAGS}    

6 vulnerabilities affecting 11 ports have been reported in the past 14 days

^* - modified, not new

All vulnerabilities