From mboxrd@z Thu Jan 1 00:00:00 1970
Return-Path: <gentoo-commits+bounces-1430163-garchives=archives.gentoo.org@lists.gentoo.org>
Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (2048 bits))
(No client certificate requested)
by finch.gentoo.org (Postfix) with ESMTPS id 03C3D158094
for <garchives@archives.gentoo.org>; Wed, 24 Aug 2022 15:36:34 +0000 (UTC)
Received: from pigeon.gentoo.org (localhost [127.0.0.1])
by pigeon.gentoo.org (Postfix) with SMTP id 738B4E0817;
Wed, 24 Aug 2022 15:36:31 +0000 (UTC)
Received: from smtp.gentoo.org (woodpecker.gentoo.org [140.211.166.183])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (4096 bits))
(No client certificate requested)
by pigeon.gentoo.org (Postfix) with ESMTPS id AEFD7E07EF
for <gentoo-commits@lists.gentoo.org>; Wed, 24 Aug 2022 15:36:27 +0000 (UTC)
Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256)
(No client certificate requested)
by smtp.gentoo.org (Postfix) with ESMTPS id 01CE833BEFE
for <gentoo-commits@lists.gentoo.org>; Wed, 24 Aug 2022 15:36:26 +0000 (UTC)
Received: from localhost.localdomain (localhost [IPv6:::1])
by oystercatcher.gentoo.org (Postfix) with ESMTP id 596F259E
for <gentoo-commits@lists.gentoo.org>; Wed, 24 Aug 2022 15:36:24 +0000 (UTC)
From: "Marek Szuba" <marecki@gentoo.org>
To: gentoo-commits@lists.gentoo.org
Content-Transfer-Encoding: 8bit
Content-type: text/plain; charset=UTF-8
Reply-To: gentoo-dev@lists.gentoo.org, "Marek Szuba" <marecki@gentoo.org>
Message-ID: <1661355378.cfb2e41c5dff7fa16debdb27c58fcdfb66f3c5b8.marecki@gentoo>
Subject: [gentoo-commits] repo/gentoo:master commit in: net-analyzer/suricata/files/, net-analyzer/suricata/
X-VCS-Repository: repo/gentoo
X-VCS-Files: net-analyzer/suricata/files/suricata.confd net-analyzer/suricata/files/suricata.initd net-analyzer/suricata/suricata-6.0.6-r1.ebuild net-analyzer/suricata/suricata-6.0.6.ebuild
X-VCS-Directories: net-analyzer/suricata/files/ net-analyzer/suricata/
X-VCS-Committer: marecki
X-VCS-Committer-Name: Marek Szuba
X-VCS-Revision: cfb2e41c5dff7fa16debdb27c58fcdfb66f3c5b8
X-VCS-Branch: master
Date: Wed, 24 Aug 2022 15:36:24 +0000 (UTC)
Precedence: bulk
List-Post: <mailto:gentoo-commits@lists.gentoo.org>
List-Help: <mailto:gentoo-commits+help@lists.gentoo.org>
List-Unsubscribe: <mailto:gentoo-commits+unsubscribe@lists.gentoo.org>
List-Subscribe: <mailto:gentoo-commits+subscribe@lists.gentoo.org>
List-Id: Gentoo Linux mail <gentoo-commits.gentoo.org>
X-BeenThere: gentoo-commits@lists.gentoo.org
X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply
X-Archives-Salt: 104ee56e-bda0-404d-8265-0c751e94e857
X-Archives-Hash: 72229b0a89d175a0c48a18c91f7f3490
commit: cfb2e41c5dff7fa16debdb27c58fcdfb66f3c5b8
Author: Marek Szuba <marecki <AT> gentoo <DOT> org>
AuthorDate: Wed Aug 24 15:34:28 2022 +0000
Commit: Marek Szuba <marecki <AT> gentoo <DOT> org>
CommitDate: Wed Aug 24 15:36:18 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=cfb2e41c
net-analyzer/suricata: remove bashisms from the init script
Closes: https://bugs.gentoo.org/840945
Signed-off-by: Marek Szuba <marecki <AT> gentoo.org>
net-analyzer/suricata/files/suricata.confd | 62 +++++++++
net-analyzer/suricata/files/suricata.initd | 147 +++++++++++++++++++++
...icata-6.0.6.ebuild => suricata-6.0.6-r1.ebuild} | 4 +-
3 files changed, 211 insertions(+), 2 deletions(-)
diff --git a/net-analyzer/suricata/files/suricata.confd b/net-analyzer/suricata/files/suricata.confd
new file mode 100644
index 000000000000..7f22113dbf0d
--- /dev/null
+++ b/net-analyzer/suricata/files/suricata.confd
@@ -0,0 +1,62 @@
+# Config file for /etc/init.d/suricata*
+
+# Where config files are stored. Default:
+
+# SURICATA_DIR="/etc/suricata"
+
+# Pass options to each suricata service.
+#
+# You can launch more than one service at the same time with different options.
+# This can be useful in a multi-queue gateway, for example.
+# You can expand on the Suricata inline example found at:
+# http://suricata.readthedocs.io/en/latest/setting-up-ipsinline-for-linux.html
+# Instead of configuring iptables to send traffic to just one queue, you can configure it to "load balance"
+# on several queues. You can then have a Suricata instance processing traffic for each queue.
+# This should help improve performance on the gateway/firewall.
+#
+# Suppose you configured iptables to use queues 0 and 1 named q0 and q1. You can now do the following:
+# ln -s /etc/init.d/suricata /etc/init.d/suricata.q0
+# ln -s /etc/init.d/suricata /etc/init.d/suricata.q1
+# cp /etc/suricata/suricata.yaml /etc/suricata/suricata-q0.yaml
+# cp /etc/suricata/suricata.yaml /etc/suricata/suricata-q1.yaml
+#
+# Edit both suricata-q{0,1}.yaml files and set values accordingly.
+# You can override these yaml config file names with SURICATA_CONF* below (optional).
+# This allows you to use the same yaml config file for multiple instances as long as you override
+# sensible options such as the log file paths.
+# SURICATA_CONF_q0="suricata-queues.yaml"
+# SURICATA_CONF_q1="suricata-queues.yaml"
+# SURICATA_CONF="suricata.yaml"
+
+# You can define the options here:
+# NB: avoid using -l, -c, --user, --group and setting logging.outputs.1.file.filename as the init script will try to set them for you.
+
+# SURICATA_OPTS_q0="-q 0"
+# SURICATA_OPTS_q1="-q 1"
+
+# If you want to use ${SURICATA_DIR}/suricata.yaml and start the service with /etc/init.d/suricata
+# then you can set:
+
+SURICATA_OPTS="--af-packet"
+
+# Log paths listed here will be created by the init script and will override the log path
+# set in the yaml file, if present.
+# SURICATA_LOG_FILE_q0="/var/log/suricata/q0/suricata.log"
+# SURICATA_LOG_FILE_q1="/var/log/suricata/q1/suricata.log"
+# SURICATA_LOG_FILE="/var/log/suricata/suricata.log"
+
+# Run as user/group.
+# Do not define if you want to run as root or as the user defined in the yaml config file (run-as).
+# The ebuild should have created the dedicated user/group suricata:suricata for you to specify here below.
+# SURICATA_USER_q0="suricata"
+# SURICATA_GROUP_q0="suricata"
+# SURICATA_USER_q1="suricata"
+# SURICATA_GROUP_q1="suricata"
+# SURICATA_USER="suricata"
+# SURICATA_GROUP="suricata"
+
+# Suricata processes can take a long time to shut down.
+# If necessary, adjust timeout in seconds to be used when calling stop from the init script.
+# Examples:
+# SURICATA_MAX_WAIT_ON_STOP="300"
+# SURICATA_MAX_WAIT_ON_STOP="SIGTERM/30"
diff --git a/net-analyzer/suricata/files/suricata.initd b/net-analyzer/suricata/files/suricata.initd
new file mode 100644
index 000000000000..154636ef828e
--- /dev/null
+++ b/net-analyzer/suricata/files/suricata.initd
@@ -0,0 +1,147 @@
+#!/sbin/openrc-run
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+SURICATA_BIN=/usr/bin/suricata
+SURICATA_DIR=${SURICATA_DIR:-/etc/suricata}
+SURICATA=${SVCNAME#*.}
+SURICATAID=$(shell_var "${SURICATA}")
+if [ -n "${SURICATA}" ] && [ ${SVCNAME} != "suricata" ]; then
+ eval SURICATACONF=\$SURICATA_CONF_${SURICATAID}
+ [ ${#SURICATACONF} -eq 0 ] && SURICATACONF="${SURICATA_DIR}/suricata-${SURICATA}.yaml" || SURICATACONF="${SURICATA_DIR}/${SURICATACONF}"
+ SURICATAPID="/run/suricata/suricata.${SURICATA}.pid"
+ eval SURICATAOPTS=\$SURICATA_OPTS_${SURICATAID}
+ eval SURICATALOGPATH=\$SURICATA_LOG_FILE_${SURICATAID}
+ eval SURICATAUSER=\$SURICATA_USER_${SURICATAID}
+ eval SURICATAGROUP=\$SURICATA_GROUP_${SURICATAID}
+else
+ SURICATACONF=${SURICATA_CONF}
+ [ ${#SURICATACONF} -eq 0 ] && SURICATACONF="${SURICATA_DIR}/suricata.yaml" || SURICATACONF="${SURICATA_DIR}/${SURICATACONF}"
+ SURICATAPID="/run/suricata/suricata.pid"
+ SURICATAOPTS=${SURICATA_OPTS}
+ SURICATALOGPATH=${SURICATA_LOG_FILE}
+ SURICATAUSER=${SURICATA_USER}
+ SURICATAGROUP=${SURICATA_GROUP}
+fi
+SURICATAUSER=${SURICATAUSER:-${SURICATA_USER}}
+SURICATAGROUP=${SURICATAGROUP:-${SURICATA_GROUP}}
+[ -e ${SURICATACONF} ] && SURICATAOPTS="-c ${SURICATACONF} ${SURICATAOPTS}"
+[ -z "${SURICATA_MAX_WAIT_ON_STOP}" ] || SURICATA_RETRY="--retry ${SURICATA_MAX_WAIT_ON_STOP}"
+
+description="Suricata IDS/IPS"
+extra_commands="checkconfig dump"
+description_checkconfig="Check config for ${SVCNAME}"
+description_dump="List all config values that can be used with --set"
+extra_started_commands="reload relog"
+description_reload="Live rule and config reload"
+description_relog="Close and re-open all log files"
+
+depend() {
+ need net
+ after mysql
+ after postgresql
+}
+
+checkconfig() {
+ if [ ! -d "/run/suricata" ] ; then
+ checkpath -d /run/suricata
+ fi
+ if [ ${#SURICATALOGPATH} -gt 0 ]; then
+ SURICATALOGFILE=$( basename ${SURICATALOGPATH} )
+ SURICATALOGFILE=${SURICATALOGFILE:-suricata.log}
+ SURICATALOGPATH=$( dirname ${SURICATALOGPATH} )
+ if [ ! -d "${SURICATALOGPATH}" ] ; then
+ checkpath -d "${SURICATALOGPATH}"
+ fi
+ if [ ${#SURICATAUSER} -gt 0 ] && [ ${#SURICATAGROUP} -gt 0 ] && [ -e "${SURICATALOGPATH}" ]; then
+ chown ${SURICATAUSER}:${SURICATAGROUP} "${SURICATALOGPATH}" || return 1
+ chown ${SURICATAUSER}:${SURICATAGROUP} "${SURICATALOGPATH}"/* >/dev/null 2>&1 3>&1
+ fi
+ SURICATAOPTS="${SURICATAOPTS} --set logging.outputs.1.file.filename=${SURICATALOGPATH}/${SURICATALOGFILE}"
+ SURICATALOGPATH="-l ${SURICATALOGPATH}"
+ fi
+ if [ ! -e ${SURICATACONF} ] ; then
+ einfo "The configuration file ${SURICATACONF} was not found."
+ einfo "If this is OK then make sure you set enough options for ${SVCNAME} in /etc/conf.d/suricata."
+ einfo "Take a look at the suricata arguments --set and --dump-config."
+ fi
+ if [ ${#SURICATAUSER} -gt 0 ] && [ ${#SURICATAGROUP} -gt 0 ]; then
+ einfo "${SVCNAME} will run as user ${SURICATAUSER}:${SURICATAGROUP}."
+ SURICATAOPTS="${SURICATAOPTS} --user=${SURICATAUSER} --group=${SURICATAGROUP}"
+ fi
+}
+
+initpidinfo() {
+ [ -e ${SURICATAPID} ] && SUR_PID="$(cat ${SURICATAPID})"
+ if [ ${#SUR_PID} -gt 0 ]; then
+ SUR_PID_CHECK="$(ps -eo pid | grep -c ${SUR_PID})"
+ SUR_USER="$(ps -p ${SUR_PID} --no-headers -o user)"
+ fi
+}
+
+checkpidinfo() {
+ initpidinfo
+ if [ ! -e ${SURICATAPID} ]; then
+ eerror "${SVCNAME} isn't running"
+ return 1
+ elif [ ${#SUR_PID} -eq 0 ] || [ $((SUR_PID_CHECK)) -ne 1 ]; then
+ eerror "Could not determine PID of ${SVCNAME}! Did the service crash?"
+ return 1
+ elif [ ${#SUR_USER} -eq 0 ]; then
+ eerror "Unable to determine user running ${SVCNAME}!"
+ return 1
+ elif [ "x${SUR_USER}" != "xroot" ]; then
+ ewarn "${SVCNAME} may need to be running as root or as a priviledged user for the extra commands reload and relog to work."
+ fi
+}
+
+start() {
+ checkconfig || return 1
+ ebegin "Starting ${SVCNAME}"
+ start-stop-daemon --start --quiet --exec ${SURICATA_BIN} \
+ -- --pidfile ${SURICATAPID} -D ${SURICATAOPTS} ${SURICATALOGPATH} >/dev/null 2>&1
+ local SUR_EXIT=$?
+ if [ $((SUR_EXIT)) -ne 0 ]; then
+ einfo "Could not start ${SURICATA_BIN} with:"
+ einfo "--pidfile ${SURICATAPID} -D ${SURICATAOPTS} ${SURICATALOGPATH}"
+ einfo "Exit code ${SUR_EXIT}"
+ fi
+ eend ${SUR_EXIT}
+}
+
+stop() {
+ ebegin "Stopping ${SVCNAME}"
+ start-stop-daemon --stop ${SURICATA_RETRY} --quiet --pidfile ${SURICATAPID} >/dev/null 2>&1
+ eend $?
+}
+
+reload() {
+ checkpidinfo || return 1
+ checkconfig || return 1
+ ebegin "Sending USR2 signal to ${SVCNAME} to perform a live rule and config reload."
+ if [ ${#SURICATAUSER} -gt 0 ] && [ ${#SURICATAGROUP} -gt 0 ]; then
+ start-stop-daemon --user ${SURICATAUSER} --group ${SURICATAGROUP} --signal USR2 --pidfile ${SURICATAPID}
+ else
+ start-stop-daemon --signal USR2 --pidfile ${SURICATAPID}
+ fi
+ eend $?
+}
+
+relog() {
+ checkpidinfo || return 1
+ checkconfig || return 1
+ ebegin "Sending HUP signal to ${SVCNAME} to close and re-open all log files."
+ if [ ${#SURICATAUSER} -gt 0 ] && [ ${#SURICATAGROUP} -gt 0 ]; then
+ start-stop-daemon --user ${SURICATAUSER} --group ${SURICATAGROUP} --signal HUP --pidfile ${SURICATAPID}
+ else
+ start-stop-daemon --signal HUP --pidfile ${SURICATAPID}
+ fi
+ eend $?
+}
+
+dump() {
+ checkconfig || return 1
+ ebegin "Dumping ${SVCNAME} config values and quitting."
+ ${SURICATA_BIN} --dump-config --pidfile ${SURICATAPID} ${SURICATAOPTS} ${SURICATALOGPATH}
+ eend $?
+}
diff --git a/net-analyzer/suricata/suricata-6.0.6.ebuild b/net-analyzer/suricata/suricata-6.0.6-r1.ebuild
similarity index 98%
rename from net-analyzer/suricata/suricata-6.0.6.ebuild
rename to net-analyzer/suricata/suricata-6.0.6-r1.ebuild
index 054eb7c52431..aa3162a55d94 100644
--- a/net-analyzer/suricata/suricata-6.0.6.ebuild
+++ b/net-analyzer/suricata/suricata-6.0.6-r1.ebuild
@@ -145,8 +145,8 @@ src_install() {
fperms 750 "/var/lib/${PN}" "/var/log/${PN}" "/etc/${PN}"
fperms 2750 "/var/lib/${PN}/rules" "/var/lib/${PN}/update"
- newinitd "${FILESDIR}/${PN}-5.0.1-init" ${PN}
- newconfd "${FILESDIR}/${PN}-5.0.1-conf" ${PN}
+ newinitd "${FILESDIR}/${PN}.initd" ${PN}
+ newconfd "${FILESDIR}/${PN}.confd" ${PN}
systemd_dounit "${FILESDIR}"/${PN}.service
newtmpfiles "${FILESDIR}"/${PN}.tmpfiles ${PN}.conf