diff options
Diffstat (limited to 'meta-security/recipes-ids')
17 files changed, 342 insertions, 233 deletions
diff --git a/meta-security/recipes-ids/aide/aide_0.17.3.bb b/meta-security/recipes-ids/aide/aide_0.17.3.bb index 522cd85fe..fbfa8a7d0 100644 --- a/meta-security/recipes-ids/aide/aide_0.17.3.bb +++ b/meta-security/recipes-ids/aide/aide_0.17.3.bb @@ -25,7 +25,7 @@ PACKAGECONFIG[gcrypt] = "--with-gcrypt, --without-gcrypt, libgcrypt, libgcrypt" PACKAGECONFIG[mhash] = "--with-mhash, --without-mhash, libmhash, libmhash" PACKAGECONFIG[e2fsattrs] = "--with-e2fsattrs, --without-e2fsattrs, e2fsprogs, e2fsprogs" -do_install_append () { +do_install:append () { install -d ${D}${libdir}/${PN}/logs install -d ${D}${sysconfdir} install ${WORKDIR}/aide.conf ${D}${sysconfdir}/ @@ -33,9 +33,9 @@ do_install_append () { CONF_FILE = "${sysconfdir}/aide.conf" -FILES_${PN} += "${libdir}/${PN} ${sysconfdir}/aide.conf" +FILES:${PN} += "${libdir}/${PN} ${sysconfdir}/aide.conf" -pkg_postinst_ontarget_${PN} () { +pkg_postinst_ontarget:${PN} () { /usr/bin/aide -i } RDPENDS_${PN} = "bison, libpcre" diff --git a/meta-security/recipes-ids/crowdsec/crowdsec_1.1.1.bb b/meta-security/recipes-ids/crowdsec/crowdsec_1.1.1.bb new file mode 100644 index 000000000..887c75df8 --- /dev/null +++ b/meta-security/recipes-ids/crowdsec/crowdsec_1.1.1.bb @@ -0,0 +1,42 @@ +SUMMARY = "CrowdSec is a free, modern & collaborative behavior detection engine, coupled with a global IP reputation network." + +LICENSE = "MIT" +LIC_FILES_CHKSUM = "file://src/import/LICENSE;md5=105e75b680b2ab82fa5718661b41f3bf" + +SRC_URI = "git://github.com/crowdsecurity/crowdsec.git;branch=master" +SRCREV = "73e0bbaf93070f4a640eb5a22212b5dcf26699de" + +DEPENDS = "jq-native" + +GO_IMPORT = "import" + +inherit go + +S = "${WORKDIR}/git" + +do_compile() { + export GOARCH="${TARGET_GOARCH}" + export GOROOT="${STAGING_LIBDIR_NATIVE}/${TARGET_SYS}/go" + + # Pass the needed cflags/ldflags so that cgo + # can find the needed headers files and libraries + export CGO_ENABLED="1" + export CFLAGS="" + export LDFLAGS="" + export CGO_CFLAGS="${BUILDSDK_CFLAGS} --sysroot=${STAGING_DIR_TARGET}" + export CGO_LDFLAGS="${BUILDSDK_LDFLAGS} --sysroot=${STAGING_DIR_TARGET}" + + cd ${S}/src/import + oe_runmake release +} + +do_install_ () { + chmod +x -R --silent ${B}/pkg +} + + +INSANE_SKIP:${PN} = "already-stripped" +INSANE_SKIP:${PN}-dev = "ldflags" + +RDEPENDS:${PN} = "go" +RDEPENDS:${PN}-dev = "bash" diff --git a/meta-security/recipes-ids/ossec/ossec-hids_3.6.0.bb b/meta-security/recipes-ids/ossec/ossec-hids_3.6.0.bb index 778278b47..309ca5234 100644 --- a/meta-security/recipes-ids/ossec/ossec-hids_3.6.0.bb +++ b/meta-security/recipes-ids/ossec/ossec-hids_3.6.0.bb @@ -44,7 +44,7 @@ do_install(){ install -m 640 ${D}/${sysconfdir}/ossec-init.conf ${D}/var/ossec/${sysconfdir}/ossec-init.conf } -pkg_postinst_ontarget_${PN} () { +pkg_postinst_ontarget:${PN} () { DIR="/var/ossec" usermod -g ossec -G ossec -a root @@ -157,9 +157,9 @@ pkg_postinst_ontarget_${PN} () { } USERADD_PACKAGES = "${PN}" -USERADD_PARAM_${PN} = "--system --home-dir /var/ossec -g ossec --shell /bin/false ossec" -GROUPADD_PARAM_${PN} = "--system ossec" +USERADD_PARAM:${PN} = "--system --home-dir /var/ossec -g ossec --shell /bin/false ossec" +GROUPADD_PARAM:${PN} = "--system ossec" -RDEPENDS_${PN} = "openssl bash" +RDEPENDS:${PN} = "openssl bash" -COMPATIBLE_HOST_libc-musl = "null" +COMPATIBLE_HOST:libc-musl = "null" diff --git a/meta-security/recipes-ids/samhain/samhain-client.bb b/meta-security/recipes-ids/samhain/samhain-client.bb index 0f53a8cde..2b99e2016 100644 --- a/meta-security/recipes-ids/samhain/samhain-client.bb +++ b/meta-security/recipes-ids/samhain/samhain-client.bb @@ -8,5 +8,5 @@ EXTRA_OECONF += " \ --with-port=${SAMHAIN_PORT} \ " -RDEPENDS_${PN} = "acl zlib attr bash" -RCONFLICTS_${PN} = "samhain-standalone" +RDEPENDS:${PN} = "acl zlib attr bash" +RCONFLICTS:${PN} = "samhain-standalone" diff --git a/meta-security/recipes-ids/samhain/samhain-server.bb b/meta-security/recipes-ids/samhain/samhain-server.bb index e7a3aa623..51bce07cd 100644 --- a/meta-security/recipes-ids/samhain/samhain-server.bb +++ b/meta-security/recipes-ids/samhain/samhain-server.bb @@ -10,7 +10,7 @@ SRC_URI += "file://samhain-server-volatiles \ TARGET_CC_ARCH += "${LDFLAGS}" -do_install_append() { +do_install:append() { if ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d)}; then install -d ${D}${sysconfdir}/tmpfiles.d install -m 0644 ${WORKDIR}/samhain-server-volatiles.conf \ @@ -25,5 +25,5 @@ do_install_append() { init/samhain.startLSB ${D}/var/lib/samhain } -RDEPENDS_${PN} += "gmp bash perl" -RCONFLICTS_${PN} = "samhain-standalone" +RDEPENDS:${PN} += "gmp bash perl" +RCONFLICTS:${PN} = "samhain-standalone" diff --git a/meta-security/recipes-ids/samhain/samhain-standalone.bb b/meta-security/recipes-ids/samhain/samhain-standalone.bb index 4fed9e9e9..445cb99b7 100644 --- a/meta-security/recipes-ids/samhain/samhain-standalone.bb +++ b/meta-security/recipes-ids/samhain/samhain-standalone.bb @@ -6,7 +6,7 @@ SRC_URI += "file://samhain-not-run-ptest-on-host.patch \ PROVIDES += "samhain" -SYSTEMD_SERVICE_${PN} = "samhain.service" +SYSTEMD_SERVICE:${PN} = "samhain.service" inherit ptest @@ -18,7 +18,7 @@ do_compile() { oe_runmake "$@" } -do_install_append() { +do_install:append() { ln -sf ${INITSCRIPT_NAME} ${D}${sysconfdir}/init.d/samhain } @@ -27,5 +27,5 @@ do_install_ptest() { install ${S}/cutest ${D}${PTEST_PATH} } -RPROVIDES_${PN} += "samhain" -RCONFLICTS_${PN} = "samhain-client samhain-server" +RPROVIDES:${PN} += "samhain" +RCONFLICTS:${PN} = "samhain-client samhain-server" diff --git a/meta-security/recipes-ids/samhain/samhain.inc b/meta-security/recipes-ids/samhain/samhain.inc index 0148e46cf..97f5f2ddc 100644 --- a/meta-security/recipes-ids/samhain/samhain.inc +++ b/meta-security/recipes-ids/samhain/samhain.inc @@ -37,7 +37,7 @@ INITSCRIPT_NAME = "${BPN}" INITSCRIPT_PARAMS ?= "defaults" SYSTEMD_PACKAGES = "${PN}" -SYSTEMD_SERVICE_${PN} = "${INITSCRIPT_NAME}.service" +SYSTEMD_SERVICE:${PN} = "${INITSCRIPT_NAME}.service" SYSTEMD_AUTO_ENABLE = "disable" # mode mapping: @@ -67,23 +67,23 @@ PACKAGECONFIG[acl] = " --enable-posix-acl , --disable-posix-acl, acl" PACKAGECONFIG[audit] = "ac_cv_header_auparse_h=yes,ac_cv_header_auparse_h=no,audit" PACKAGECONFIG[ps] = "--with-ps-path=${base_bindir}/ps,,,procps" -EXTRA_OEMAKE_append_aarch64 = " CPPFLAGS+=-DCONFIG_ARCH_AARCH64=1" -EXTRA_OEMAKE_append_mips64 = " CPPFLAGS+=-DCONFIG_ARCH_MIPS64=1" +EXTRA_OEMAKE:append:aarch64 = " CPPFLAGS+=-DCONFIG_ARCH_AARCH64=1" +EXTRA_OEMAKE:append:mips64 = " CPPFLAGS+=-DCONFIG_ARCH_MIPS64=1" do_unpack_samhain() { cd ${WORKDIR} tar -xzvf samhain-${PV}.tar.gz } -python do_unpack_append() { +python do_unpack:append() { bb.build.exec_func('do_unpack_samhain', d) } -do_configure_prepend_arm() { +do_configure:prepend:arm() { export sh_cv___va_copy=yes } -do_configure_prepend_aarch64() { +do_configure:prepend:aarch64() { export sh_cv___va_copy=yes } @@ -91,7 +91,7 @@ do_configure_prepend_aarch64() { # use the prefix --oldincludedir=/usr/include which is not # recognized by Samhain's configure script and would invariably # throw back the error "unrecognized option: --oldincludedir=/usr/include" -do_configure_prepend () { +do_configure:prepend () { cat << EOF > ${S}/config-site.${BP} ssp_cv_lib=no sh_cv_va_copy=yes @@ -124,13 +124,13 @@ do_configure () { ${EXTRA_OECONF} } -do_compile_prepend_libc-musl () { +do_compile:prepend:libc-musl () { sed -i 's/^#define HAVE_MALLOC_H.*//' ${B}/config.h } # Install the init script, it's default file, and the extraneous # documentation. -do_install_append () { +do_install:append () { oe_runmake install DESTDIR='${D}' INSTALL=install-boot install -D -m 755 ${WORKDIR}/${INITSCRIPT_NAME}.init \ @@ -165,4 +165,4 @@ do_install_append () { rm -rf ${D}${localstatedir}/log } -FILES_${PN} += "${systemd_system_unitdir}" +FILES:${PN} += "${systemd_system_unitdir}" diff --git a/meta-security/recipes-ids/suricata/files/0001-af-packet-fix-build-on-recent-Linux-kernels.patch b/meta-security/recipes-ids/suricata/files/0001-af-packet-fix-build-on-recent-Linux-kernels.patch deleted file mode 100644 index 530568b19..000000000 --- a/meta-security/recipes-ids/suricata/files/0001-af-packet-fix-build-on-recent-Linux-kernels.patch +++ /dev/null @@ -1,26 +0,0 @@ -From b37554e0bc3cf383e6547c5c6a69c6f6849c09e3 Mon Sep 17 00:00:00 2001 -From: Eric Leblond <eric@regit.org> -Date: Wed, 17 Jul 2019 12:35:12 +0200 -Subject: [PATCH] af-packet: fix build on recent Linux kernels - -Upstream-Status: Backport -Signed-off-by: Armin kuster <akuster808@gmail.com> ---- - src/source-af-packet.c | 4 ++++ - 1 file changed, 4 insertions(+) - -Index: suricata-4.1.5/src/source-af-packet.c -=================================================================== ---- suricata-4.1.5.orig/src/source-af-packet.c -+++ suricata-4.1.5/src/source-af-packet.c -@@ -68,6 +68,10 @@ - #include <linux/sockios.h> - #endif - -+#if HAVE_LINUX_SOCKIOS_H -+#include <linux/sockios.h> -+#endif -+ - #ifdef HAVE_PACKET_EBPF - #include "util-ebpf.h" - #include <bpf/libbpf.h> diff --git a/meta-security/recipes-ids/suricata/files/fixup.patch b/meta-security/recipes-ids/suricata/files/fixup.patch new file mode 100644 index 000000000..fc44ce68f --- /dev/null +++ b/meta-security/recipes-ids/suricata/files/fixup.patch @@ -0,0 +1,32 @@ +Skip pkg Makefile from using its own rust steps + +Upstream-Status: OE Specific + +Signed-off-by: Armin Kuster <akuster808@gmail.com> + +Index: suricata-6.0.2/Makefile.am +=================================================================== +--- suricata-6.0.2.orig/Makefile.am ++++ suricata-6.0.2/Makefile.am +@@ -7,7 +7,7 @@ EXTRA_DIST = ChangeLog COPYING LICENSE s + $(SURICATA_UPDATE_DIR) \ + lua \ + acsite.m4 +-SUBDIRS = $(HTP_DIR) rust src qa rules doc contrib etc python ebpf \ ++SUBDIRS = $(HTP_DIR) src qa rules doc contrib etc python ebpf \ + $(SURICATA_UPDATE_DIR) + + CLEANFILES = stamp-h[0-9]* +Index: suricata-6.0.2/Makefile.in +=================================================================== +--- suricata-6.0.2.orig/Makefile.in ++++ suricata-6.0.2/Makefile.in +@@ -426,7 +426,7 @@ EXTRA_DIST = ChangeLog COPYING LICENSE s + lua \ + acsite.m4 + +-SUBDIRS = $(HTP_DIR) rust src qa rules doc contrib etc python ebpf \ ++SUBDIRS = $(HTP_DIR) src qa rules doc contrib etc python ebpf \ + $(SURICATA_UPDATE_DIR) + + CLEANFILES = stamp-h[0-9]* diff --git a/meta-security/recipes-ids/suricata/files/no_libhtp_build.patch b/meta-security/recipes-ids/suricata/files/no_libhtp_build.patch deleted file mode 100644 index 2ebf021fc..000000000 --- a/meta-security/recipes-ids/suricata/files/no_libhtp_build.patch +++ /dev/null @@ -1,38 +0,0 @@ -Upstream-Status: Inappropriate [configuration] - -Signed-of_by: Armin Kuster <akuster808@gmail.com> - -Index: suricata-2.0.5/Makefile.am -=================================================================== ---- suricata-2.0.5.orig/Makefile.am -+++ suricata-2.0.5/Makefile.am -@@ -5,7 +5,7 @@ ACLOCAL_AMFLAGS = -I m4 - EXTRA_DIST = ChangeLog COPYING LICENSE suricata.yaml.in \ - classification.config threshold.config \ - reference.config --SUBDIRS = $(HTP_DIR) src qa rules doc contrib scripts -+SUBDIRS = src qa rules doc contrib scripts - - CLEANFILES = stamp-h[0-9]* - -Index: suricata-2.0.5/Makefile.in -=================================================================== ---- suricata-2.0.5.orig/Makefile.in -+++ suricata-2.0.5/Makefile.in -@@ -229,7 +229,6 @@ HAVE_PCAP_CONFIG = @HAVE_PCAP_CONFIG@ - HAVE_PKG_CONFIG = @HAVE_PKG_CONFIG@ - HAVE_PYTHON_CONFIG = @HAVE_PYTHON_CONFIG@ - HAVE_WGET = @HAVE_WGET@ --HTP_DIR = @HTP_DIR@ - HTP_LDADD = @HTP_LDADD@ - INSTALL = @INSTALL@ - INSTALL_DATA = @INSTALL_DATA@ -@@ -369,7 +368,7 @@ EXTRA_DIST = ChangeLog COPYING LICENSE s - classification.config threshold.config \ - reference.config - --SUBDIRS = $(HTP_DIR) src qa rules doc contrib scripts -+SUBDIRS = src qa rules doc contrib scripts - CLEANFILES = stamp-h[0-9]* - all: config.h - $(MAKE) $(AM_MAKEFLAGS) all-recursive diff --git a/meta-security/recipes-ids/suricata/libhtp_0.5.36.bb b/meta-security/recipes-ids/suricata/libhtp_0.5.36.bb deleted file mode 100644 index 8305f7010..000000000 --- a/meta-security/recipes-ids/suricata/libhtp_0.5.36.bb +++ /dev/null @@ -1,15 +0,0 @@ -SUMMARY = "LibHTP is a security-aware parser for the HTTP protocol and the related bits and pieces." - -require suricata.inc - -LIC_FILES_CHKSUM = "file://../LICENSE;beginline=1;endline=2;md5=c70d8d3310941dcdfcd1e02800a1f548" - -DEPENDS = "zlib" - -inherit autotools pkgconfig - -CFLAGS += "-D_DEFAULT_SOURCE" - -S = "${WORKDIR}/suricata-${VER}/${BPN}" - -RDEPENDS_${PN} += "zlib" diff --git a/meta-security/recipes-ids/suricata/libhtp_0.5.38.bb b/meta-security/recipes-ids/suricata/libhtp_0.5.38.bb new file mode 100644 index 000000000..2a0c93ccc --- /dev/null +++ b/meta-security/recipes-ids/suricata/libhtp_0.5.38.bb @@ -0,0 +1,27 @@ +SUMMARY = "LibHTP is a security-aware parser for the HTTP protocol and the related bits and pieces." + +require suricata.inc + +LIC_FILES_CHKSUM = "file://LICENSE;beginline=1;endline=2;md5=596ab7963a1a0e5198e5a1c4aa621843" + +SRC_URI = "git://github.com/OISF/libhtp.git;protocol=https;branch=0.5.x" +SRCREV = "fca44158911a1642880ea5c774151a33ad33d906" + +DEPENDS = "zlib" + +inherit autotools-brokensep pkgconfig + +CFLAGS += "-D_DEFAULT_SOURCE" + +#S = "${WORKDIR}/suricata-${VER}/${BPN}" + +S = "${WORKDIR}/git" + +do_configure () { + cd ${S} + ./autogen.sh + oe_runconf +} + +RDEPENDS:${PN} += "zlib" + diff --git a/meta-security/recipes-ids/suricata/python3-suricata-update_1.2.1.bb b/meta-security/recipes-ids/suricata/python3-suricata-update_1.2.1.bb deleted file mode 100644 index bbdce69ab..000000000 --- a/meta-security/recipes-ids/suricata/python3-suricata-update_1.2.1.bb +++ /dev/null @@ -1,17 +0,0 @@ -SUMMARY = "The tool for updating your Suricata rules. " -HOMEPAGE = "http://suricata-ids.org/" -SECTION = "security Monitor/Admin" -LICENSE = "GPLv2" - -LIC_FILES_CHKSUM = "file://LICENSE;beginline=1;endline=2;md5=c70d8d3310941dcdfcd1e02800a1f548" - -SRCREV = "50e857f75e576e239d8306a6ac55946a1ce252a6" -SRC_URI = "git://github.com/OISF/suricata-update;branch='master-1.2.x'" - -S = "${WORKDIR}/git" - -inherit python3native python3targetconfig setuptools3 - -RDEPENDS_${PN} = "python3-pyyaml python3-logging python3-compression" - -BBCLASSEXTEND = "native nativesdk" diff --git a/meta-security/recipes-ids/suricata/suricata.inc b/meta-security/recipes-ids/suricata/suricata.inc index 1ce0d74a8..5754617fb 100644 --- a/meta-security/recipes-ids/suricata/suricata.inc +++ b/meta-security/recipes-ids/suricata/suricata.inc @@ -2,7 +2,4 @@ HOMEPAGE = "http://suricata-ids.org/" SECTION = "security Monitor/Admin" LICENSE = "GPLv2" -VER = "4.1.10" -SRC_URI = "http://www.openinfosecfoundation.org/download/suricata-${VER}.tar.gz" - -SRC_URI[sha256sum] = "4013cb13a2f3f7854328cf072319bba41896fad86d6b85b1cff4004f82aa7276" +COMPATIBLE_HOST:powerpc = 'null' diff --git a/meta-security/recipes-ids/suricata/suricata_4.1.10.bb b/meta-security/recipes-ids/suricata/suricata_4.1.10.bb deleted file mode 100644 index bf088433a..000000000 --- a/meta-security/recipes-ids/suricata/suricata_4.1.10.bb +++ /dev/null @@ -1,99 +0,0 @@ -SUMMARY = "The Suricata Engine is an Open Source Next Generation Intrusion Detection and Prevention Engine" - -require suricata.inc - -LIC_FILES_CHKSUM = "file://LICENSE;beginline=1;endline=2;md5=c70d8d3310941dcdfcd1e02800a1f548" - -SRC_URI += " \ - file://volatiles.03_suricata \ - file://tmpfiles.suricata \ - file://suricata.yaml \ - file://suricata.service \ - file://run-ptest \ - " - -UPSTREAM_CHECK_URI = "www.openinfosecfoundation.org/download" - -inherit autotools-brokensep pkgconfig python3-dir systemd ptest - -CFLAGS += "-D_DEFAULT_SOURCE -fcommon" - -CACHED_CONFIGUREVARS = "ac_cv_header_htp_htp_h=yes ac_cv_lib_htp_htp_conn_create=yes \ - ac_cv_path_HAVE_WGET=no ac_cv_path_HAVE_CURL=no " - -EXTRA_OECONF += " --disable-debug \ - --enable-non-bundled-htp \ - --disable-gccmarch-native \ - --disable-suricata-update \ - " - -PACKAGECONFIG ??= "htp jansson file pcre yaml pcap cap-ng net nfnetlink nss nspr" -PACKAGECONFIG_append = " ${@bb.utils.contains('DISTRO_FEATURES', 'ptest', 'unittests', '', d)}" - -PACKAGECONFIG[htp] = "--with-libhtp-includes=${STAGING_INCDIR} --with-libhtp-libraries=${STAGING_LIBDIR}, ,libhtp," -PACKAGECONFIG[pcre] = "--with-libpcre-includes=${STAGING_INCDIR} --with-libpcre-libraries=${STAGING_LIBDIR}, ,libpcre ," -PACKAGECONFIG[yaml] = "--with-libyaml-includes=${STAGING_INCDIR} --with-libyaml-libraries=${STAGING_LIBDIR}, ,libyaml ," -PACKAGECONFIG[pcap] = "--with-libpcap-includes=${STAGING_INCDIR} --with-libpcap-libraries=${STAGING_LIBDIR}, ,libpcap ," -PACKAGECONFIG[cap-ng] = "--with-libcap_ng-includes=${STAGING_INCDIR} --with-libcap_ng-libraries=${STAGING_LIBDIR}, ,libcap-ng , " -PACKAGECONFIG[net] = "--with-libnet-includes=${STAGING_INCDIR} --with-libnet-libraries=${STAGING_LIBDIR}, , libnet," -PACKAGECONFIG[nfnetlink] = "--with-libnfnetlink-includes=${STAGING_INCDIR} --with-libnfnetlink-libraries=${STAGING_LIBDIR}, ,libnfnetlink ," -PACKAGECONFIG[nfq] = "--enable-nfqueue, --disable-nfqueue,libnetfilter-queue," - -PACKAGECONFIG[jansson] = "--with-libjansson-includes=${STAGING_INCDIR} --with-libjansson-libraries=${STAGING_LIBDIR},,jansson, jansson" -PACKAGECONFIG[file] = ",,file, file" -PACKAGECONFIG[nss] = "--with-libnss-includes=${STAGING_INCDIR} --with-libnss-libraries=${STAGING_LIBDIR}, nss, nss," -PACKAGECONFIG[nspr] = "--with-libnspr-includes=${STAGING_INCDIR} --with-libnspr-libraries=${STAGING_LIBDIR}, nspr, nspr," -PACKAGECONFIG[python] = "--enable-python, --disable-python, python3, python3" -PACKAGECONFIG[unittests] = "--enable-unittests, --disable-unittests," - -export logdir = "${localstatedir}/log" - -do_install_append () { - - install -d ${D}${sysconfdir}/suricata - - oe_runmake install-conf DESTDIR=${D} - - oe_runmake install-rules DESTDIR=${D} - - install -d ${D}${sysconfdir}/suricata ${D}${sysconfdir}/default/volatiles - install -m 0644 ${WORKDIR}/volatiles.03_suricata ${D}${sysconfdir}/default/volatiles/03_suricata - - install -m 0644 ${S}/threshold.config ${D}${sysconfdir}/suricata - - if ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d)}; then - install -d ${D}${sysconfdir}/tmpfiles.d - install -m 0644 ${WORKDIR}/tmpfiles.suricata ${D}${sysconfdir}/tmpfiles.d/suricata.conf - - install -d ${D}${systemd_unitdir}/system - sed -e s:/etc:${sysconfdir}:g \ - -e s:/var/run:/run:g \ - -e s:/var:${localstatedir}:g \ - -e s:/usr/bin:${bindir}:g \ - -e s:/bin/kill:${base_bindir}/kill:g \ - -e s:/usr/lib:${libdir}:g \ - ${WORKDIR}/suricata.service > ${D}${systemd_unitdir}/system/suricata.service - fi - - # Remove /var/run as it is created on startup - rm -rf ${D}${localstatedir}/run - -} - -pkg_postinst_ontarget_${PN} () { -if command -v systemd-tmpfiles >/dev/null; then - systemd-tmpfiles --create ${sysconfdir}/tmpfiles.d/suricata.conf -elif [ -e ${sysconfdir}/init.d/populate-volatile.sh ]; then - ${sysconfdir}/init.d/populate-volatile.sh update -fi -} - -SYSTEMD_PACKAGES = "${PN}" - -PACKAGES =+ "${PN}-socketcontrol" -FILES_${PN} += "${systemd_unitdir} ${sysconfdir}/tmpfiles.d" -FILES_${PN}-socketcontrol = "${bindir}/suricatasc ${PYTHON_SITEPACKAGES_DIR}" - -CONFFILES_${PN} = "${sysconfdir}/suricata/suricata.yaml" - -RDEPENDS_${PN}-python = "python" diff --git a/meta-security/recipes-ids/suricata/suricata_6.0.3.bb b/meta-security/recipes-ids/suricata/suricata_6.0.3.bb new file mode 100644 index 000000000..ca9e03e32 --- /dev/null +++ b/meta-security/recipes-ids/suricata/suricata_6.0.3.bb @@ -0,0 +1,206 @@ +SUMMARY = "The Suricata Engine is an Open Source Next Generation Intrusion Detection and Prevention Engine" + +require suricata.inc + +LIC_FILES_CHKSUM = "file://LICENSE;beginline=1;endline=2;md5=c70d8d3310941dcdfcd1e02800a1f548" + +SRC_URI = "http://www.openinfosecfoundation.org/download/suricata-${PV}.tar.gz" +SRC_URI[sha256sum] = "daf134bb2d7c980035e9ae60f7aaf313323a809340009f26e48110ccde81f602" + +DEPENDS = "lz4 libhtp" + +SRC_URI += " \ + file://volatiles.03_suricata \ + file://tmpfiles.suricata \ + file://suricata.yaml \ + file://suricata.service \ + file://run-ptest \ + file://fixup.patch \ + " + +SRC_URI += " \ + crate://crates.io/autocfg/1.0.1 \ + crate://crates.io/semver-parser/0.7.0 \ + crate://crates.io/arrayvec/0.4.12 \ + crate://crates.io/ryu/1.0.5 \ + crate://crates.io/libc/0.2.86 \ + crate://crates.io/bitflags/1.2.1 \ + crate://crates.io/version_check/0.9.2 \ + crate://crates.io/memchr/2.3.4 \ + crate://crates.io/nodrop/0.1.14 \ + crate://crates.io/cfg-if/0.1.9 \ + crate://crates.io/static_assertions/0.3.4 \ + crate://crates.io/getrandom/0.1.16 \ + crate://crates.io/cfg-if/1.0.0 \ + crate://crates.io/siphasher/0.3.3 \ + crate://crates.io/ppv-lite86/0.2.10 \ + crate://crates.io/proc-macro-hack/0.5.19 \ + crate://crates.io/proc-macro2/0.4.30 \ + crate://crates.io/unicode-xid/0.1.0 \ + crate://crates.io/syn/0.15.44 \ + crate://crates.io/build_const/0.2.1 \ + crate://crates.io/num-derive/0.2.5 \ + crate://crates.io/base64/0.11.0 \ + crate://crates.io/widestring/0.4.3 \ + crate://crates.io/md5/0.7.0 \ + crate://crates.io/uuid/0.8.2 \ + crate://crates.io/byteorder/1.4.2 \ + crate://crates.io/semver/0.9.0 \ + crate://crates.io/nom/5.1.1 \ + crate://crates.io/num-traits/0.2.14 \ + crate://crates.io/num-integer/0.1.44 \ + crate://crates.io/num-bigint/0.2.6 \ + crate://crates.io/num-bigint/0.3.1 \ + crate://crates.io/num-rational/0.2.4 \ + crate://crates.io/num-complex/0.2.4 \ + crate://crates.io/num-iter/0.1.42 \ + crate://crates.io/phf_shared/0.8.0 \ + crate://crates.io/crc/1.8.1 \ + crate://crates.io/rustc_version/0.2.3 \ + crate://crates.io/phf/0.8.0 \ + crate://crates.io/lexical-core/0.6.7 \ + crate://crates.io/time/0.1.44 \ + crate://crates.io/quote/0.6.13 \ + crate://crates.io/rand_core/0.5.1 \ + crate://crates.io/rand_chacha/0.2.2 \ + crate://crates.io/rand_pcg/0.2.1 \ + crate://crates.io/num-traits/0.1.43 \ + crate://crates.io/rand/0.7.3 \ + crate://crates.io/enum_primitive/0.1.1 \ + crate://crates.io/phf_generator/0.8.0 \ + crate://crates.io/phf_codegen/0.8.0 \ + crate://crates.io/tls-parser/0.9.4 \ + crate://crates.io/num/0.2.1 \ + crate://crates.io/rusticata-macros/2.1.0 \ + crate://crates.io/ntp-parser/0.4.0 \ + crate://crates.io/der-oid-macro/0.2.0 \ + crate://crates.io/der-parser/3.0.4 \ + crate://crates.io/ipsec-parser/0.5.0 \ + crate://crates.io/x509-parser/0.6.5 \ + crate://crates.io/der-parser/4.1.0 \ + crate://crates.io/snmp-parser/0.6.0 \ + crate://crates.io/kerberos-parser/0.5.0 \ + crate://crates.io/wasi/0.10.0+wasi-snapshot-preview1 \ + crate://crates.io/winapi/0.3.9 \ + crate://crates.io/winapi-i686-pc-windows-gnu/0.4.0 \ + crate://crates.io/winapi-x86_64-pc-windows-gnu/0.4.0 \ + crate://crates.io/log/0.4.0 \ + crate://crates.io/rand_hc/0.2.0 \ + crate://crates.io/wasi/0.9.0+wasi-snapshot-preview1 \ + crate://crates.io/sawp/0.5.0 \ + crate://crates.io/sawp-modbus/0.5.0 \ + crate://crates.io/brotli/3.3.0 \ + crate://crates.io/flate2/1.0.20 \ + crate://crates.io/alloc-no-stdlib/2.0.1 \ + crate://crates.io/alloc-stdlib/0.2.1 \ + crate://crates.io/brotli-decompressor/2.3.1 \ + crate://crates.io/crc32fast/1.2.1 \ + crate://crates.io/miniz_oxide/0.4.4 \ + crate://crates.io/adler/1.0.2 \ + " + +# test case support +SRC_URI += " \ + crate://crates.io/test-case/1.0.1 \ + crate://crates.io/proc-macro2/1.0.1 \ + crate://crates.io/quote/1.0.1 \ + crate://crates.io/syn/1.0.1 \ + crate://crates.io/unicode-xid/0.2.0 \ + " + +inherit autotools pkgconfig python3native systemd ptest cargo + +EXTRA_OECONF += " --disable-debug \ + --disable-gccmarch-native \ + --enable-non-bundled-htp \ + --disable-suricata-update \ + --with-libhtp-includes=${STAGING_INCDIR} --with-libhtp-libraries=${STAGING_LIBDIR} \ + " + +CARGO_SRC_DIR = "rust" + +B = "${S}" + +PACKAGECONFIG ??= "jansson file pcre yaml python pcap cap-ng net nfnetlink nss nspr " +PACKAGECONFIG:append = " ${@bb.utils.contains('DISTRO_FEATURES', 'ptest', 'unittests', '', d)}" + +PACKAGECONFIG[pcre] = "--with-libpcre-includes=${STAGING_INCDIR} --with-libpcre-libraries=${STAGING_LIBDIR}, ,libpcre ," +PACKAGECONFIG[yaml] = "--with-libyaml-includes=${STAGING_INCDIR} --with-libyaml-libraries=${STAGING_LIBDIR}, ,libyaml ," +PACKAGECONFIG[pcap] = "--with-libpcap-includes=${STAGING_INCDIR} --with-libpcap-libraries=${STAGING_LIBDIR}, ,libpcap" +PACKAGECONFIG[cap-ng] = "--with-libcap_ng-includes=${STAGING_INCDIR} --with-libcap_ng-libraries=${STAGING_LIBDIR}, ,libcap-ng , " +PACKAGECONFIG[net] = "--with-libnet-includes=${STAGING_INCDIR} --with-libnet-libraries=${STAGING_LIBDIR}, , libnet," +PACKAGECONFIG[nfnetlink] = "--with-libnfnetlink-includes=${STAGING_INCDIR} --with-libnfnetlink-libraries=${STAGING_LIBDIR}, ,libnfnetlink ," +PACKAGECONFIG[nfq] = "--enable-nfqueue, --disable-nfqueue,libnetfilter-queue," + +PACKAGECONFIG[jansson] = "--with-libjansson-includes=${STAGING_INCDIR} --with-libjansson-libraries=${STAGING_LIBDIR},,jansson, jansson" +PACKAGECONFIG[file] = ",,file, file" +PACKAGECONFIG[nss] = "--with-libnss-includes=${STAGING_INCDIR} --with-libnss-libraries=${STAGING_LIBDIR}, nss, nss," +PACKAGECONFIG[nspr] = "--with-libnspr-includes=${STAGING_INCDIR} --with-libnspr-libraries=${STAGING_LIBDIR}, nspr, nspr," +PACKAGECONFIG[python] = "--enable-python, --disable-python, python3, python3-core" +PACKAGECONFIG[unittests] = "--enable-unittests, --disable-unittests," + +export logdir = "${localstatedir}/log" + +CACHED_CONFIGUREVARS = "ac_cv_func_malloc_0_nonnull=yes ac_cv_func_realloc_0_nonnull=yes" + +do_configure:prepend () { + oe_runconf +} + +do_compile () { + # we do this to bypass the make provided by this pkg + # patches Makefile to skip the subdir + cargo_do_compile + + # Finish building + cd ${S} + make +} + +do_install () { + install -d ${D}${sysconfdir}/suricata + + oe_runmake install DESTDIR=${D} + + install -d ${D}${sysconfdir}/suricata ${D}${sysconfdir}/default/volatiles + install -m 0644 ${WORKDIR}/volatiles.03_suricata ${D}${sysconfdir}/default/volatiles/03_suricata + + install -m 0644 ${S}/threshold.config ${D}${sysconfdir}/suricata + install -m 0644 ${S}/suricata.yaml ${D}${sysconfdir}/suricata + + if ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d)}; then + install -d ${D}${sysconfdir}/tmpfiles.d + install -m 0644 ${WORKDIR}/tmpfiles.suricata ${D}${sysconfdir}/tmpfiles.d/suricata.conf + + install -d ${D}${systemd_unitdir}/system + sed -e s:/etc:${sysconfdir}:g \ + -e s:/var/run:/run:g \ + -e s:/var:${localstatedir}:g \ + -e s:/usr/bin:${bindir}:g \ + -e s:/bin/kill:${base_bindir}/kill:g \ + -e s:/usr/lib:${libdir}:g \ + ${WORKDIR}/suricata.service > ${D}${systemd_unitdir}/system/suricata.service + fi + + # Remove /var/run as it is created on startup + rm -rf ${D}${localstatedir}/run + + sed -i -e "s:#!.*$:#!${USRBINPATH}/env ${PYTHON_PN}:g" ${D}${bindir}/suricatasc + sed -i -e "s:#!.*$:#!${USRBINPATH}/env ${PYTHON_PN}:g" ${D}${bindir}/suricatactl +} + +pkg_postinst_ontarget:${PN} () { +if command -v systemd-tmpfiles >/dev/null; then + systemd-tmpfiles --create ${sysconfdir}/tmpfiles.d/suricata.conf +elif [ -e ${sysconfdir}/init.d/populate-volatile.sh ]; then + ${sysconfdir}/init.d/populate-volatile.sh update +fi +} + +SYSTEMD_PACKAGES = "${PN}" + +PACKAGES =+ "${PN}-python" +FILES:${PN} += "${systemd_unitdir} ${sysconfdir}/tmpfiles.d" +FILES:${PN}-python = "${bindir}/suricatasc ${PYTHON_SITEPACKAGES_DIR}" + +CONFFILES:${PN} = "${sysconfdir}/suricata/suricata.yaml" diff --git a/meta-security/recipes-ids/tripwire/tripwire_2.4.3.7.bb b/meta-security/recipes-ids/tripwire/tripwire_2.4.3.7.bb index 36e5d00b7..3a9bc1de2 100644 --- a/meta-security/recipes-ids/tripwire/tripwire_2.4.3.7.bb +++ b/meta-security/recipes-ids/tripwire/tripwire_2.4.3.7.bb @@ -60,18 +60,18 @@ do_install () { install -m 0644 ${WORKDIR}/tripwire.txt ${D}${docdir}/${BPN} } -do_install_ptest_append () { +do_install_ptest:append () { install -d ${D}${PTEST_PATH}/tests cp -a ${S}/src/test-harness/* ${D}${PTEST_PATH} sed -i -e 's@../../../../bin@${sbindir}@' ${D}${PTEST_PATH}/twtools.pm } -FILES_${PN} += "${libdir} ${docdir}/${PN}/*" -FILES_${PN}-dbg += "${sysconfdir}/${PN}/.debug" -FILES_${PN}-staticdev += "${localstatedir}/lib/${PN}/lib*.a" -FILES_${PN}-ptest += "${PTEST_PATH}/tests " +FILES:${PN} += "${libdir} ${docdir}/${PN}/*" +FILES:${PN}-dbg += "${sysconfdir}/${PN}/.debug" +FILES:${PN}-staticdev += "${localstatedir}/lib/${PN}/lib*.a" +FILES:${PN}-ptest += "${PTEST_PATH}/tests " -RDEPENDS_${PN} += " perl nano msmtp cronie" -RDEPENDS_${PN}-ptest = " perl lib-perl perl-modules " +RDEPENDS:${PN} += " perl nano msmtp cronie" +RDEPENDS:${PN}-ptest = " perl lib-perl perl-modules " PNBLACKLIST[tripwire] ?= "Upsteram project appears to be abondoned, fails to build with gcc11" |