reinit the tree, so we can have metadata

7 files changed, 320 insertions, 0 deletions

diff --git a/net-analyzer/sguil-sensor/Manifest b/net-analyzer/sguil-sensor/Manifest
new file mode 100644
index 000000000000..f7842bdb2656
--- /dev/null
+++ b/net-analyzer/sguil-sensor/Manifest
@@ -0,0 +1,10 @@
+AUX log_packets.confd 527 SHA256 e0ce40a3d98eea3e95813dcf0980dd6ae078838f93cce8e0cd1070fa7de879dc SHA512 a4f9ed9abb050184773c59271d7e13f6bcbf853341dd31c72909ee6d31bb92990d84f31bf3111d8950fb4311747694c714498552eb26ca8a82ed3cb645847e82 WHIRLPOOL bc6bc9f7c0b453feac78adf0a585c36bf844213697e2476a1cc6a38b3beebfbb0a82eef1391e6849b9e198db3a463cce402daf5186c4a270bf476aeb7d9bdb5d
+AUX log_packets.initd 2093 SHA256 ae7536d81faa08eaf1f1130c913ea36cff6bd179de4546bee44446a33ec9b2f5 SHA512 43bc027f4769e986641a9820a1dfcb8a794ae417cb49efe333fd6a960953e1f9854c660e95ae9c0e14f4c1ec59da9e3096ae7352bbbb77805dc71729ed76514d WHIRLPOOL c89b429c33ae0005109d8b0f934861f18fd5f244ebddf200b7565a3d72cf81859b1fc98e93e0e23caa53ebc0fc1f50abce83319dc8f4e94d380acafd275c37aa
+AUX sensor_agent.initd 742 SHA256 b8994ad76a4cdf48de3c8a518226e78b44e90586fe4b0399bad5bbd022d87dad SHA512 3a025479579ee9eec6a26d2a2c70efc362d37b7821dfa211236d8fe9dc2ea7b7b0694dccfd9b208655702401c1b0e3ecb08bac9e3b177ee77f161e5c774c1611 WHIRLPOOL d91475b75556bacf6dd77a986b74ceb68b405b4195d78414b1fc4972842f924f7e2563cef7baeca3e88d7b146046272a4e79136baa0d39711976400961b50f4c
+DIST sguil-0.9.0.tar.gz 464204 SHA256 412be894d67a6487312dd16a98a580dda8c38cff2e24f7a6c25405857769782b SHA512 3f300901d0f0260fbc950b4c7604e3dc3eeb2d088ff45171db84e2d58e281242bf3582eac51162968f1f3766961aec4d0a7af54e85773102ee643a52e879cfa6 WHIRLPOOL eaaef918819ed781505abc727c65e08a9e6d6d0e53f842b5aa6ec4cd1278dc902375a45794b3989488c3507bc34e288593cd892c8a94293d8a7723bbdb6cef4e
+DIST sguil-sensor-0.8.0.tar.gz 142829 SHA256 aa4617c4f9cf1d598c6d728afed50cd6f90dc5d1516a6eda8126401b7bba4be5 SHA512 9b90598f2a3fdcf8652ccb92123944ffbda61c00f131bc951b12a95002f84f555f8c63cc1235fd7bb90875d00edbecbda02750bcca3bba7d16e1b1a150eb74ae WHIRLPOOL aa7108158053e84b3229b4daf4a2108fe1b2ef0290fd82267c5ea82067faff8e82372e50af0f4d9057f611b6584b526d70c67ced2b93eb5e82927065b58c2eb4
+EBUILD sguil-sensor-0.8.0.ebuild 2129 SHA256 bad359be24fcb2f5fa476d44fddddc89233e4cc52c72e5f712f5f3c856892bd0 SHA512 5f8b73a592c21266b4cab281861f5c4173443a0bb05a91498394f5dc2561776e30152d790710448583555f0ebb91575335811d7a644cbed4c4c59e3e4491a9c9 WHIRLPOOL 45af50bef9c1f2dae218bcb512a3a6b15d7cab0dd8769cdc95b9cc1afa19c8aa0d4e3a360874bf065f775fadbed73b84dc9a6ae8c2abd4eb4644ea6af20abf02
+EBUILD sguil-sensor-0.9.0.ebuild 2161 SHA256 edbb264c8375e73f215a484e02959bd460599b891b6dc31242dc07b258446b8c SHA512 8f9934b42fa92264c4eef6c6436b10b4686de6d612e26ee458cf4cba170ce172f66e40dbda3730f74410341a8d95101f6ca396e931bc03fc9abf6fee8c4abccb WHIRLPOOL f4facd223ed66a6a21ece1c6fb91352144b5190875ca7cb5549bab03a470674f7da74542541524bae9417922aef8f45ba3faec4253413393cfd799fad60ab72f
+MISC ChangeLog 3297 SHA256 24e9c97fdd9e089361104c83b23d97dccf678ead9cddd19afd3f0d8bda9d45bd SHA512 1f74aee2efd7d186cc1275816e378803bc55c7c71785c5610cca9b385f8ecba3408d70eaaf775b0a1fa68ff9a82f6f7744dac5b9f18c5cc80afb60a2a2891073 WHIRLPOOL e738b7a4be4063197551942b91112ba995360d516873d5f1f9c4306163f389e3deff73e2b55bf5b78dc4fc70dc6bd0ae932658e398b214e39609502062f62e45
+MISC ChangeLog-2015 3157 SHA256 199e9f67722c7842f6e5c8d862b6bd628a149e69d76e4efcbad61c77a4edfa3b SHA512 a99c724452e1ce8d4d39da2392320aa993f11f28d92b00b2c328c74da15332abb568304cb280d4ab673ce0ba333f5ae5923ea819a8a12d9563a3217fc539a42e WHIRLPOOL 8c73ac3510d2f82835dbc1839a69d58af6c5d800ca4a2b567f963274fe6f2961e10118bbd603a75881e309f1d7557a9a374691488115e5b73d8e65425a431216
+MISC metadata.xml 418 SHA256 0be32877ea9dae6f000b93301bf6ba94b139f53032a34e758ab806e688722bb6 SHA512 bbe71ed5ce17f337808f82d4fe54ef68b94723a808c597a52d049b88b7334be9abb066911accf9175886405f3f02d37d838422a933afe8e00eeeac2c74ba5ed3 WHIRLPOOL 96fbf0ca145124d0c2e5419589dd84d6e292d4859b0145a4344090522edbe2026f500bdbbc7bb8f3d37122f54acf1339dd57ced7b5e86be7a289ca9ff2786b4e
diff --git a/net-analyzer/sguil-sensor/files/log_packets.confd b/net-analyzer/sguil-sensor/files/log_packets.confd
new file mode 100644
index 000000000000..93bdc772bff7
--- /dev/null
+++ b/net-analyzer/sguil-sensor/files/log_packets.confd
@@ -0,0 +1,18 @@
+# Config file for /etc/init.d/log_packets
+# Copyright 1999-2014 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+# This tell snort which interface to listen on (any for every interface)
+IFACE=eth1
+
+# Make sure this matches your IFACE
+PIDFILE=/run/sguil-log_packets_$IFACE.pid
+
+# You probably don't want to change this, but in case you do
+LOGDIR="/var/lib/sguil"
+
+# Percentage of disk to try and maintain
+MAX_DISK_USE=95
+
+# This pulls in the options above
+OPTIONS="-m 122 -u sguil -g sguil"
diff --git a/net-analyzer/sguil-sensor/files/log_packets.initd b/net-analyzer/sguil-sensor/files/log_packets.initd
new file mode 100644
index 000000000000..f372c82c905b
--- /dev/null
+++ b/net-analyzer/sguil-sensor/files/log_packets.initd
@@ -0,0 +1,91 @@
+#!/sbin/openrc-run
+# Copyright 1999-2014 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+extra_commands="cleandisk"
+
+LOG_DIR="${LOGDIR}/${HOSTNAME}/dailylogs"
+
+start() {
+	ebegin "Starting Log_packest"
+	if [ ! -x /usr/bin/snort ]
+	then
+		eerror "No snort - cannot start"
+		eend 1
+		return 1
+	fi
+
+	if [ ! -d ${LOG_DIR} ]
+	then
+		mkdir -p ${LOG_DIR}
+		chmod 770 ${LOG_DIR}
+	fi
+
+	today=$(date '+%Y-%m-%d')
+
+	if [ ! -d "${LOG_DIR}/${today}" ]
+	then
+		mkdir "${LOG_DIR}/${today}"
+		chmod 770 "${LOG_DIR}/${today}"
+		chown root:sguil "${LOG_DIR}/${today}"
+	fi
+	start-stop-daemon --start --quiet -b -m --pidfile "${PIDFILE}" \
+		--exec /usr/bin/snort \
+		-- ${OPTIONS} -l "${LOG_DIR}/${today}" -b -i "${IFACE}" "${FILTER}"
+	real_cleandisk
+	eend $?
+}
+
+stop() {
+	ebegin "Stopping Sensor Agent"
+	start-stop-daemon --stop --quiet --pidfile "${PIDFILE}"
+	eend $?
+}
+
+cleandisk() {
+	ebegin "Cleaning Disk"
+	real_cleandisk
+	eend $?
+}
+
+# This func checks the current space being used by LOG_DIR
+# and rm's data as necessary.
+real_cleandisk() {
+	einfo "Checking disk space (limited to ${MAX_DISK_USE}%)..."
+	# grep, awk, tr...woohoo!
+	CUR_USE=$(df -P ${LOG_DIR} | grep -v -i filesystem | awk '{print $5}' | tr -d %)
+	einfo "  Current Disk Use: ${CUR_USE}%"
+	
+	if [ ${CUR_USE} -gt ${MAX_DISK_USE} ]
+	then
+		# If we are here then we passed our disk limit
+		# First find the oldest DIR
+		cd "${LOG_DIR}"
+		# Can't use -t on the ls since the mod time changes each time we
+		# delete a file. Good thing we use YYYY-MM-DD so we can sort.
+		OLDEST_DIR=$(ls | sort | head -n 1)
+		cd "${OLDEST_DIR}"
+
+		OLDEST_FILE=$(ls -t | tail -n 1)
+
+		if [ -f "${OLDEST_FILE}" ]
+		then
+			einfo "  Removing file: ${OLDEST_DIR}/${OLDEST_FILE}"
+			rm -f "${OLDEST_FILE}"
+		else
+			einfo "  Removing empty dir: ${OLDEST_DIR}"
+			cd ..
+			rm -rf "${OLDEST_DIR}"
+		fi
+		
+		# Run cleandisk again as rm'ing one file might been enough
+		# but we wait 5 secs in hopes any open writes are done.
+		sync
+		einfo "  Waiting 5 secs for disk to sync..."
+		sleep 5
+		real_cleandisk
+	else
+		einfo "Done."
+	fi
+}
+
diff --git a/net-analyzer/sguil-sensor/files/sensor_agent.initd b/net-analyzer/sguil-sensor/files/sensor_agent.initd
new file mode 100644
index 000000000000..08b45e511f8c
--- /dev/null
+++ b/net-analyzer/sguil-sensor/files/sensor_agent.initd
@@ -0,0 +1,29 @@
+#!/sbin/openrc-run
+# Copyright 1999-2014 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+depend() {
+        need net
+}
+
+checkconfig() {
+        if [ ! -e /etc/sguil/sensor_agent.conf ] ; then
+                eerror "You need an /etc/snort/sensor_agent.conf to run the Sensor Agent"
+                return 1
+        fi
+}
+
+start() {
+        checkconfig || return 1
+        ebegin "Starting Sensor Agent"
+        start-stop-daemon --start -c sguil --quiet --exec /usr/bin/sensor_agent.tcl \
+		-- -D -c "/etc/sguil/sensor_agent.conf">/dev/null 2>&1
+        eend $?
+}
+
+stop() {
+        ebegin "Stopping Sensor Agent"
+        start-stop-daemon --stop --quiet --pidfile /run/sguil-sensor.pid
+        eend $?
+}
+
diff --git a/net-analyzer/sguil-sensor/metadata.xml b/net-analyzer/sguil-sensor/metadata.xml
new file mode 100644
index 000000000000..ca324d618d91
--- /dev/null
+++ b/net-analyzer/sguil-sensor/metadata.xml
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="project">
+    <email>netmon@gentoo.org</email>
+    <name>Gentoo network monitoring and analysis project</name>
+  </maintainer>
+  <upstream>
+    <remote-id type="github">bammv/sguil</remote-id>
+    <remote-id type="sourceforge">sguil</remote-id>
+  </upstream>
+</pkgmetadata>
diff --git a/net-analyzer/sguil-sensor/sguil-sensor-0.8.0.ebuild b/net-analyzer/sguil-sensor/sguil-sensor-0.8.0.ebuild
new file mode 100644
index 000000000000..2589f9861647
--- /dev/null
+++ b/net-analyzer/sguil-sensor/sguil-sensor-0.8.0.ebuild
@@ -0,0 +1,80 @@
+# Copyright 1999-2015 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+inherit user
+
+MY_PV="${PV/_p/p}"
+DESCRIPTION="Sensor part of sguil Network Security Monitoring"
+HOMEPAGE="http://sguil.sourceforge.net"
+SRC_URI="mirror://sourceforge/sguil/sguil-sensor-${MY_PV}.tar.gz"
+
+LICENSE="GPL-2 QPL"
+SLOT="0"
+KEYWORDS="~x86"
+IUSE=""
+
+RDEPEND="
+	>=dev-lang/tcl-8.3:0=[-threads]
+	>=dev-tcltk/tclx-8.3
+	>=net-analyzer/barnyard-0.2.0-r1
+	>=net-analyzer/snort-2.4.1-r1
+	dev-ml/pcre-ocaml
+	net-analyzer/sancp
+"
+
+S="${WORKDIR}/sguil-${MY_PV}"
+
+pkg_setup() {
+	enewgroup sguil
+	enewuser sguil -1 -1 /var/lib/sguil sguil
+}
+
+src_prepare() {
+	sed -i \
+		-e "s:gateway:${HOSTNAME}:" \
+		-e 's:/snort_data:/var/lib/sguil:' \
+		-e 's:DAEMON 0:DAEMON 1:' \
+		-e 's:DEBUG 1:DEBUG 0:g' \
+		sensor/sensor_agent.conf || die
+	sed -i \
+		-e 's:/run/sensor_agent.pid:/run/sguil-sensor.pid:' \
+		sensor/sensor_agent.tcl || die
+}
+
+src_install() {
+	dodoc doc/*
+
+	dobin sensor/sensor_agent.tcl
+
+	newinitd "${FILESDIR}/log_packets.initd" log_packets
+	newinitd "${FILESDIR}/sensor_agent.initd" sensor_agent
+	newconfd "${FILESDIR}/log_packets.confd" log_packets
+	insinto /etc/sguil
+	doins sensor/sensor_agent.conf
+
+	# Create the directory structure
+	diropts -g sguil -o sguil
+	keepdir /var/lib/sguil /var/lib/sguil/archive \
+		"/var/lib/sguil/${HOSTNAME}" \
+		"/var/lib/sguil/${HOSTNAME}/portscans" \
+		"/var/lib/sguil/${HOSTNAME}/ssn_logs" \
+		"/var/lib/sguil/${HOSTNAME}/dailylogs" \
+		"/var/lib/sguil/${HOSTNAME}/sancp"
+
+}
+
+pkg_postinst() {
+	elog
+	elog "You should check /etc/sguil/sensor_agent.conf and"
+	elog "/etc/init.d/logpackets and ensure that they are accurate"
+	elog "for your environment. They should work providing that you"
+	elog "are running the sensor on the same machine as the server."
+	elog "This ebuild assumes that you are running a single sensor"
+	elog "environment, if this is not the case then you must make sure"
+	elog "to modify /etc/sguil/sensor_agent.conf and change the HOSTNAME variable."
+	elog "You should crontab the /etc/init.d/log_packets script to restart"
+	elog "each hour."
+	elog
+}
diff --git a/net-analyzer/sguil-sensor/sguil-sensor-0.9.0.ebuild b/net-analyzer/sguil-sensor/sguil-sensor-0.9.0.ebuild
new file mode 100644
index 000000000000..3235c34d475a
--- /dev/null
+++ b/net-analyzer/sguil-sensor/sguil-sensor-0.9.0.ebuild
@@ -0,0 +1,80 @@
+# Copyright 1999-2015 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+inherit user
+
+MY_PV="${PV/_p/p}"
+DESCRIPTION="Sensor part of sguil Network Security Monitoring"
+HOMEPAGE="http://sguil.sourceforge.net"
+SRC_URI="https://github.com/bammv/${PN/-sensor}/archive/v${PV}.tar.gz -> ${P/-sensor}.tar.gz"
+
+LICENSE="GPL-2 QPL"
+SLOT="0"
+KEYWORDS="~x86"
+IUSE=""
+
+RDEPEND="
+	>=dev-lang/tcl-8.3:0=[-threads]
+	>=dev-tcltk/tclx-8.3
+	>=net-analyzer/barnyard-0.2.0-r1
+	>=net-analyzer/snort-2.4.1-r1
+	dev-ml/pcre-ocaml
+	net-analyzer/sancp
+"
+
+S="${WORKDIR}/sguil-${MY_PV}"
+
+pkg_setup() {
+	enewgroup sguil
+	enewuser sguil -1 -1 /var/lib/sguil sguil
+}
+
+src_prepare() {
+	sed -i \
+		-e "s:gateway:${HOSTNAME}:" \
+		-e 's:/snort_data:/var/lib/sguil:' \
+		-e 's:DAEMON 0:DAEMON 1:' \
+		-e 's:DEBUG 1:DEBUG 0:g' \
+		sensor/sensor_agent.conf || die
+	sed -i \
+		-e 's:/var/run/sensor_agent.pid:/run/sguil-sensor.pid:' \
+		sensor/sensor_agent.tcl || die
+}
+
+src_install() {
+	dodoc doc/*
+
+	dobin sensor/sensor_agent.tcl
+
+	newinitd "${FILESDIR}/log_packets.initd" log_packets
+	newinitd "${FILESDIR}/sensor_agent.initd" sensor_agent
+	newconfd "${FILESDIR}/log_packets.confd" log_packets
+	insinto /etc/sguil
+	doins sensor/sensor_agent.conf
+
+	# Create the directory structure
+	diropts -g sguil -o sguil
+	keepdir /var/lib/sguil /var/lib/sguil/archive \
+		"/var/lib/sguil/${HOSTNAME}" \
+		"/var/lib/sguil/${HOSTNAME}/portscans" \
+		"/var/lib/sguil/${HOSTNAME}/ssn_logs" \
+		"/var/lib/sguil/${HOSTNAME}/dailylogs" \
+		"/var/lib/sguil/${HOSTNAME}/sancp"
+
+}
+
+pkg_postinst() {
+	elog
+	elog "You should check /etc/sguil/sensor_agent.conf and"
+	elog "/etc/init.d/logpackets and ensure that they are accurate"
+	elog "for your environment. They should work providing that you"
+	elog "are running the sensor on the same machine as the server."
+	elog "This ebuild assumes that you are running a single sensor"
+	elog "environment, if this is not the case then you must make sure"
+	elog "to modify /etc/sguil/sensor_agent.conf and change the HOSTNAME variable."
+	elog "You should crontab the /etc/init.d/log_packets script to restart"
+	elog "each hour."
+	elog
+}