Snort is a libpcap-based packet sniffer/logger which can be used as a
lightweight network intrusion detection system. It features rules based logging
and can perform content searching/matching in addition to being used to detect
a variety of other attacks and probes, such as buffer overflows, stealth port
scans, CGI attacks, SMB probes, and much more. Snort has a real-time alerting
capability, with alerts being sent to syslog, a separate "alert" file, or even
to a Windows computer via Samba.
Packets are logged in their decoded form to directories which are generated
based upon the IP address of the remote peer. This allows Snort to be used as
a sort of "poor man's intrusion detection system" if you specify what traffic
you want to record and what to let through.
For instance, I use it to record traffic of interest to the six computers in
my office at work while I'm away on travel or gone for the weekend. It's
also nice for debugging network code since it shows you most of the Important
Stuff(TM) about your packets (as I see it anyway). The code is pretty easy
to modify to provide more complete packet decoding, so feel free to make
suggestions.
===> The following configuration options are available for snort-2.9.20_5:
APPID=off: Build with application id support (EXPERIMENTAL)
DOCS=on: Build and/or install documentation
FILEINSPECT=off: Build with extended file inspection features (EXPERIMENTAL)
GRE=on: GRE support
HA=off: Enable high-availability state sharing (EXPERIMENTAL)
IPV6=on: IPv6 in snort.conf
LRGPCAP=off: Pcaps larger than 2GB
NONETHER=off: Non-Ethernet Decoders
NORMALIZER=on: Normalizer
PERFPROFILE=on: Performance profiling
SOURCEFIRE=on: Sourcefire recommended build options
====> Depend on 3rd party addons
PULLEDPORK=on: Depend on pulledpork
====> Developer options
DBGSNORT=off: Enable debugging symbols
COREDUMPS=off: Enable core dumps
===> Use 'make config' to modify these settings
security/snort: Use libpcap from ports
Summary:
Add explicit lib version to force port to use libpcap from ports and
avoid it rebuilding every time base packages are upgraded
Sponsored by: Rubicon Communications, LLC ("Netgate")
Reviewed By: dvl
Differential Revision: https://reviews.freebsd.org/D60381
lang/luajit: update to v2.1
Disconnect lang/luajit-devel from the build, will be removed soon.
Bump PORTREVISIONs for the consumers.
Discussed with: adamw
PR: 225342
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
(Only the first 15 lines of the commit message are shown above )
security: remove 'Created by' lines
A big Thank You to the original contributors of these ports:
* <ports@c0decafe.net>
* Aaron Dalton <aaron@FreeBSD.org>
* Adam Weinberger <adamw@FreeBSD.org>
* Ade Lovett <ade@FreeBSD.org>
* Aldis Berjoza <aldis@bsdroot.lv>
* Alex Dupre <ale@FreeBSD.org>
* Alex Kapranoff <kappa@rambler-co.ru>
* Alex Samorukov <samm@freebsd.org>
* Alexander Botero-Lowry <alex@foxybanana.com>
* Alexander Kriventsov <avk@vl.ru>
* Alexander Leidinger <netchild@FreeBSD.org>
(Only the first 15 lines of the commit message are shown above )
security/snort: Update to 2.9.20
[*] New Additions
Added support for dns root queries and underflow.
Added support to get extra data from SMTP and HTTP into IPS event.
Added support for login success and failure eventing for IMAP and POP3.
Added support to handle empty string for SNI/CN/SAN/ORG.
[*] Improvements / Fix
Fixed a scenario where SSL traffic was not detected correctly.
Fixed security zones info in intrusion events.
Fixed URL lookup failure.
security/snort: Fixes for aarch64 and armv6/7
This patch does a few things:
1. Update depends to a newer version of net/daq, in the ports tree for a
long time already, but explicitly depend on it.
2. Split out corefiles separate from debug options
3. Switch from luajit to luajit-openresty so that snort can build on
aarch64
4. Fix crashing on armv7 due to misaligned memory access (from mjg@)
While here, in pkg-plist change deprecated @unexec to @postunexec
PR: 257747
Reported by: brd
security/snort: add another master site which unbreaks fetch
When a new release comes out, the old tarball gets moved to the
archive/snort directory. This change stops the port from breaking
when that move happens.
Update to 2.9.15
[*] New Additions
* Added new debugs to print detection, file_processing and Preproc time
consumption info and verdict.
* Added support to detect new Korean file formats .egg and .alg in the file
preprocessor.
* Added support to detect new RAR file-type in the file preprocessor.
[*] Improvements / Fix
* Fix to generate ALERT if TEID value is zero in GTP v1 and v2 packets.
* Fix to whitelist ftp data sessions when no file policy exists.
* Fix RTF file magic to a more generic value to prevent evasions.
Undeprecate the BARNYARD option now that the dependent ports
(security/barnyard and security/bro) have been undeprecated.
PR: 235724
Approved by: zi (maintainer), matthew (mentor, implicit)
Install net/libnet headers and libraries back in the location where other
ports expect it. The files were put in a different location to avoid a
conflict with net/libnet10 but this port has been removed a while ago now.
PR: 208122
Exp-run by: antoine
Approved by: portmgr (antoine)
- Fix plist to have proper 'rmdir DIR' ordering.
Pkgng will not detect the directory otherwise. This was due to
incorrectly advise in the check-stagedir.sh script, fixed in
r351587
With hat: portmgr
- Update to 2.9.5.6
- Add STAGE support [1]
- Remove SNORTSAM support due to lack of upstream support [1]
- Makefile cleanup [1]
- Use new configure magic [1]
PR: ports/185274 [1]
Submitted by: ohauer@ [1]
Eradicate USE_GNOME=pkgconfig from security
While here:
- Trim headers
- Convert USE_GMAKE to USES=gmake
- Convert USE_GNOME=gnomehack to USES=pathfix
- Convert USE_PERL5 to USES=perl5
- Do not install examples whenever NOPORTEXAMPLES is defined [1]
- Do not install duplicate sample config files
- Do not bump PORTREVISION
PR: ports/165800 [1]
Submitted by: Michael Scheidell <scheidell@FreeBSD.org> [1]
Feature safe: yes
- Do not install examples whenever NOPORTEXAMPLES is defined [1]
- Do not install duplicate sample config files
- Do not bump PORTREVISION
PR: ports/165800 [1]
Submitted by: Michael Scheidell <scheidell@FreeBSD.org> [1]
Feature safe: yes
In the rc.d scripts, change assignments to rcvar to use the
literal name_enable wherever possible, and ${name}_enable
when it's not, to prepare for the demise of set_rcvar().
In cases where I had to hand-edit unusual instances also
modify formatting slightly to be more uniform (and in
some cases, correct). This includes adding some $FreeBSD$
tags, and most importantly moving rcvar= to right after
name= so it's clear that one is derived from the other.
- Update hash to reflect file deployed to the official mirrors. (source code
was diff'd--no code changes detected)
- Not bumping PORTREVISION
Feature safe: yes
