mirror of
https://github.com/vincentmli/bpfire.git
synced 2026-04-15 13:32:59 +02:00
c7e583d0f2
Excerpt from changelog: "6.0.14 -- 2023-09-13 Security #6289: Crash in SMTP parser during parsing of email (6.0.x backport) Security #6196: process exit in hyperscan error handling (6.0.x backport) Security #6156: dcerpc: max-tx config parameter, also for UDP (6.0.x backport) Bug #6285: community-id: Fix IPv6 address sorting not respecting byte order (6.0.x backport) Bug #6248: Multi-tenancy: crash under test mode when tenant signature load fails (6.0.x backport) Bug #6245: tcp: RST with data used in reassembly (6.0.x backport) Bug #6236: if protocol dcerpc first packet type is Alter_context, it will not parse dcerpc (6.0.x backport) Bug #6228: ips/af-packet: crash when copy-iface is the same as the interface (6.0.x backport) Bug #6227: windows: lua script path truncated (6.0.x backport) Bug #6226: Decode-events of IPv6 GRE are not triggered (6.0.x backport) Bug #6224: base64: complete support for RFC2045 (6.0.x backport) Bug #6220: Backport tenant_id conversion to uint32_t Bug #6213: file.magic: rule reload can lead to crashes (6.0.x backport) Bug #6193: smtp: Attachment not being md5 matched (6.0.x backport) Bug #6192: smtp: use every byte to compute email.body_md5 (6.0.x backport) Bug #6182: log-pcap: fix segfault on lz4 compressed pcaps (6.0.x backport) Bug #6181: eve/alert: deprecated fields can have unexpected side affects (6.0.x backport) Bug #6174: FTP bounce detection doesn't work for big-endian platforms (6.0.x backport) Bug #6166: http2: fileinfo events log http2 object instead of http object as alerts and http2 do (6.0.x backport) Bug #6139: smb: wrong offset when parse SMB_COM_WRITE_ANDX record (6.0.x backport) Bug #6082: pcap: device reopen broken (6.0.x backport) Bug #6068: pcap: memory leaks (6.0.x backport) Bug #6045: detect: multi-tenancy leaks memory if more than 1 tenant registered (6.0.x backport) Bug #6035: stream.midstream: if enabled breaks exception policy (6.0.x backport) Bug #5915: rfb: parser returns error on unimplemented record types (6.0.x backport) Bug #5794: eve: if alert and drop rules match for a packet, "alert.action" is ambigious (6.0.x backport) Bug #5439: Invalid certificate when Issuer is not present. Optimization #6229: Performance impact of Cisco Fabricpath (6.0.x backport) Optimization #6203: detect: modernize filename fileext filemagic (6.0.x backport) Optimization #6153: suricatasc: Gracefully handle unsupported commands (6.0.x backport) Feature #6282: dns/eve: add 'HTTPS' type logging (6.0.x backport) Feature #5935: ips: add 'master switch' to enable dropping on traffic (handling) exceptions (6.0.x backport) Documentation #6234: userguide: add installation from Ubuntu PPA section (6.0.x backport)" Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
138 lines
5.1 KiB
Plaintext
138 lines
5.1 KiB
Plaintext
###############################################################################
|
|
# #
|
|
# IPFire.org - A linux based firewall #
|
|
# Copyright (C) 2007-2023 IPFire Team <info@ipfire.org> #
|
|
# #
|
|
# This program is free software: you can redistribute it and/or modify #
|
|
# it under the terms of the GNU General Public License as published by #
|
|
# the Free Software Foundation, either version 3 of the License, or #
|
|
# (at your option) any later version. #
|
|
# #
|
|
# This program is distributed in the hope that it will be useful, #
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of #
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
|
|
# GNU General Public License for more details. #
|
|
# #
|
|
# You should have received a copy of the GNU General Public License #
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>. #
|
|
# #
|
|
###############################################################################
|
|
|
|
###############################################################################
|
|
# Definitions
|
|
###############################################################################
|
|
|
|
include Config
|
|
|
|
VER = 6.0.14
|
|
|
|
THISAPP = suricata-$(VER)
|
|
DL_FILE = $(THISAPP).tar.gz
|
|
DL_FROM = $(URL_IPFIRE)
|
|
DIR_APP = $(DIR_SRC)/$(THISAPP)
|
|
TARGET = $(DIR_INFO)/$(THISAPP)
|
|
|
|
###############################################################################
|
|
# Top-level Rules
|
|
###############################################################################
|
|
|
|
objects = $(DL_FILE)
|
|
|
|
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
|
|
|
|
$(DL_FILE)_BLAKE2 = 7e14f16f04bdd632d26f4249c328ea918cc4edf96cc07be6a92722d4457353a36662e0041fd2b9669a104deaa010a093cb8195eb2604ed8145ab38f93a8b7124
|
|
|
|
install : $(TARGET)
|
|
|
|
check : $(patsubst %,$(DIR_CHK)/%,$(objects))
|
|
|
|
download :$(patsubst %,$(DIR_DL)/%,$(objects))
|
|
|
|
b2 : $(subst %,%_BLAKE2,$(objects))
|
|
|
|
###############################################################################
|
|
# Downloading, checking, b2sum
|
|
###############################################################################
|
|
|
|
$(patsubst %,$(DIR_CHK)/%,$(objects)) :
|
|
@$(CHECK)
|
|
|
|
$(patsubst %,$(DIR_DL)/%,$(objects)) :
|
|
@$(LOAD)
|
|
|
|
$(subst %,%_BLAKE2,$(objects)) :
|
|
@$(B2SUM)
|
|
|
|
###############################################################################
|
|
# Installation Details
|
|
###############################################################################
|
|
|
|
$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
|
|
@$(PREBUILD)
|
|
@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE)
|
|
cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/suricata/suricata-disable-sid-2210059.patch
|
|
cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/suricata/suricata-5.0.8-fix-level1-cache-line-size-detection.patch
|
|
cd $(DIR_APP) && LDFLAGS="$(LDFLAGS)" ./configure \
|
|
--prefix=/usr \
|
|
--sysconfdir=/etc \
|
|
--localstatedir=/var \
|
|
--enable-gccprotect \
|
|
--disable-gccmarch-native \
|
|
--enable-non-bundled-htp \
|
|
--enable-nfqueue \
|
|
--disable-static \
|
|
--disable-python \
|
|
--with-libjansson-libraries=/usr/lib \
|
|
--with-libjansson-includes=/usr/include \
|
|
--disable-suricata-update \
|
|
--enable-rust
|
|
|
|
cd $(DIR_APP) && make $(MAKETUNING)
|
|
cd $(DIR_APP) && make install
|
|
cd $(DIR_APP) && make install-conf
|
|
|
|
# Remove default suricata config file.
|
|
rm -rvf /etc/suricata/suricata.yaml
|
|
|
|
# Install IPFire related config file.
|
|
install -m 0644 $(DIR_SRC)/config/suricata/suricata.yaml /etc/suricata
|
|
|
|
# Create emtpy rules directory.
|
|
-mkdir -p /var/lib/suricata
|
|
|
|
# Create empty cache directory.
|
|
-mkdir -p /var/cache/suricata
|
|
|
|
# Move config files for references, threshold and classification
|
|
# to the rules directory.
|
|
rm -rfv /etc/suricata/*.config
|
|
|
|
# Set correct ownership for the classifiction config file.
|
|
# (File has to be writeable for the nobody user)
|
|
chown nobody:nobody /usr/share/suricata/classification.config
|
|
|
|
# Create empty threshold config file.
|
|
touch /usr/share/suricata/threshold.config
|
|
|
|
# Set correct ownership for the threshold.config file.
|
|
chown nobody:nobody /usr/share/suricata/threshold.config
|
|
|
|
# Set correct ownership for /var/lib/suricata and the
|
|
# contained files
|
|
chown -R nobody:nobody /var/lib/suricata
|
|
|
|
# Set correct ownership for the cache directory.
|
|
chown nobody:nobody /var/cache/suricata
|
|
|
|
# Create logging directory.
|
|
-mkdir -p /var/log/suricata
|
|
|
|
# Set correct ownership for /var/log/suricata.
|
|
chown suricata:suricata /var/log/suricata
|
|
|
|
# Install converter script needed for Core Update 167
|
|
install -m 0755 $(DIR_SRC)/config/suricata/convert-ids-backend-files /usr/sbin/convert-ids-backend-files
|
|
|
|
@rm -rf $(DIR_APP)
|
|
@$(POSTBUILD)
|