[meta-security][PATCH 01/10] suricata: don't start service in postinst

[meta-security][PATCH 01/10] suricata: don't start service in postinst

[Koen Kooi]

Apart from hardcoding the wrong networking device it won't survive device restart

Signed-off-by: Koen Kooi <koen.kooi@linaro.org>
---
 recipes-security/suricata/suricata_4.0.0.bb | 1 -
 1 file changed, 1 deletion(-)

diff --git a/recipes-security/suricata/suricata_4.0.0.bb b/recipes-security/suricata/suricata_4.0.0.bb
index e163486..3f88920 100644
--- a/recipes-security/suricata/suricata_4.0.0.bb
+++ b/recipes-security/suricata/suricata_4.0.0.bb
@@ -50,7 +50,6 @@ pkg_postinst_ontarget_${PN} () {
 if [ -e /etc/init.d/populate-volatile.sh ] ; then
     ${sysconfdir}/init.d/populate-volatile.sh update
 fi
-    ${bindir}/suricata -c ${sysconfdir}/suricata.yaml -i eth0 
 }
 
 PACKAGES += "${PN}-python"
-- 
2.9.5

[meta-security][PATCH 02/10] suricata: fix packaging

[Koen Kooi]

Move ${PN}-python in front so ${PN} can use default packaging rules.

Signed-off-by: Koen Kooi <koen.kooi@linaro.org>
---
 recipes-security/suricata/suricata_4.0.0.bb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/recipes-security/suricata/suricata_4.0.0.bb b/recipes-security/suricata/suricata_4.0.0.bb
index 3f88920..4a39325 100644
--- a/recipes-security/suricata/suricata_4.0.0.bb
+++ b/recipes-security/suricata/suricata_4.0.0.bb
@@ -52,8 +52,8 @@ if [ -e /etc/init.d/populate-volatile.sh ] ; then
 fi
 }
 
-PACKAGES += "${PN}-python"
-FILES_${PN} = "${bindir}/suricata ${sysconfdir}/default ${sysconfdir}/suricata ${logdir}/suricata"
+PACKAGES =+ "${PN}-python"
+FILES_${PN} += "${logdir}/suricata"
 FILES_${PN}-python = "${bindir}/suricatasc ${PYTHON_SITEPACKAGES_DIR}"
 
 RDEPENDS_${PN}-python = "python"
-- 
2.9.5

[meta-security][PATCH 03/10] suricata: mark config file as CONFFILE

[Koen Kooi]

This preserves user edits during package upgrades.

Signed-off-by: Koen Kooi <koen.kooi@linaro.org>
---
 recipes-security/suricata/suricata_4.0.0.bb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/recipes-security/suricata/suricata_4.0.0.bb b/recipes-security/suricata/suricata_4.0.0.bb
index 4a39325..73f4af6 100644
--- a/recipes-security/suricata/suricata_4.0.0.bb
+++ b/recipes-security/suricata/suricata_4.0.0.bb
@@ -56,4 +56,6 @@ PACKAGES =+ "${PN}-python"
 FILES_${PN} += "${logdir}/suricata"
 FILES_${PN}-python = "${bindir}/suricatasc ${PYTHON_SITEPACKAGES_DIR}"
 
+CONFFILES_${PN} = "${sysconfdir}/suricata/suricata.yaml"
+
 RDEPENDS_${PN}-python = "python"
-- 
2.9.5

[meta-security][PATCH 04/10] suricata: add 'nfq' PACKAGECONFIG

[Koen Kooi]

For inline IPS nfqueue is nice to have, so add a PACKAGECONFIG entry for
it.

Signed-off-by: Koen Kooi <koen.kooi@linaro.org>
---
 recipes-security/suricata/suricata_4.0.0.bb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/recipes-security/suricata/suricata_4.0.0.bb b/recipes-security/suricata/suricata_4.0.0.bb
index 73f4af6..7ab3077 100644
--- a/recipes-security/suricata/suricata_4.0.0.bb
+++ b/recipes-security/suricata/suricata_4.0.0.bb
@@ -28,6 +28,7 @@ PACKAGECONFIG[pcap] = "--with-libpcap-includes=${STAGING_INCDIR} --with-libpcap-
 PACKAGECONFIG[cap-ng] = "--with-libcap_ng-includes=${STAGING_INCDIR} --with-libcap_ng-libraries=${STAGING_LIBDIR}, ,libcap-ng , "
 PACKAGECONFIG[net] = "--with-libnet-includes=${STAGING_INCDIR} --with-libnet-libraries=${STAGING_LIBDIR}, , libnet," 
 PACKAGECONFIG[nfnetlink] = "--with-libnfnetlink-includes=${STAGING_INCDIR} --with-libnfnetlink-libraries=${STAGING_LIBDIR}, ,libnfnetlink ,"
+PACKAGECONFIG[nfq] = "--enable-nfqueue, --disable-nfqueue,libnetfilter-queue,"
 
 PACKAGECONFIG[jansson] = "--with-libjansson-includes=${STAGING_INCDIR} --with-libjansson-libraries=${STAGING_LIBDIR},,jansson, jansson"
 PACKAGECONFIG[file] = ",,file, file"
-- 
2.9.5

[meta-security][PATCH 05/10] suricata: add systemd unit

[Koen Kooi]

Based on the debian systemd unit.

Signed-off-by: Koen Kooi <koen.kooi@linaro.org>
---
 recipes-security/suricata/files/suricata.service | 20 ++++++++++++++++++++
 recipes-security/suricata/suricata_4.0.0.bb      | 17 +++++++++++++++--
 2 files changed, 35 insertions(+), 2 deletions(-)
 create mode 100644 recipes-security/suricata/files/suricata.service

diff --git a/recipes-security/suricata/files/suricata.service b/recipes-security/suricata/files/suricata.service
new file mode 100644
index 0000000..a99a76e
--- /dev/null
+++ b/recipes-security/suricata/files/suricata.service
@@ -0,0 +1,20 @@
+[Unit]
+Description=Suricata IDS/IDP daemon
+After=network.target
+Requires=network.target
+Documentation=man:suricata(8) man:suricatasc(8)
+Documentation=https://redmine.openinfosecfoundation.org/projects/suricata/wiki
+
+[Service]
+Type=simple
+CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW
+RestrictAddressFamilies=
+ExecStart=/usr/bin/suricata -c /etc/suricata/suricata.yaml eth0
+ExecReload=/bin/kill -HUP $MAINPID
+PrivateTmp=yes
+ProtectHome=yes
+ProtectSystem=yes
+
+[Install]
+WantedBy=multi-user.target
+
diff --git a/recipes-security/suricata/suricata_4.0.0.bb b/recipes-security/suricata/suricata_4.0.0.bb
index 7ab3077..91136bf 100644
--- a/recipes-security/suricata/suricata_4.0.0.bb
+++ b/recipes-security/suricata/suricata_4.0.0.bb
@@ -7,9 +7,10 @@ LIC_FILES_CHKSUM = "file://LICENSE;beginline=1;endline=2;md5=c70d8d3310941dcdfcd
 SRC_URI += " \
            file://volatiles.03_suricata \
            file://suricata.yaml \
+           file://suricata.service \
            "
 
-inherit autotools-brokensep pkgconfig python-dir 
+inherit autotools-brokensep pkgconfig python-dir systemd 
 
 CFLAGS += "-D_DEFAULT_SOURCE"
 
@@ -45,6 +46,16 @@ do_install_append () {
     install -m 644 reference.config ${D}${sysconfdir}/suricata
     install -m 644 ${WORKDIR}/suricata.yaml ${D}${sysconfdir}/suricata
     install -m 0644 ${WORKDIR}/volatiles.03_suricata  ${D}${sysconfdir}/default/volatiles/volatiles.03_suricata
+
+    install -d ${D}${systemd_unitdir}/system
+    sed  -e s:/etc:${sysconfdir}:g \
+         -e s:/var/run:/run:g \
+         -e s:/var:${localstatedir}:g \
+         -e s:/usr/bin:${bindir}:g \
+         -e s:/bin/kill:${base_bindir}/kill:g \
+         -e s:/usr/lib:${libdir}:g \
+         ${WORKDIR}/suricata.service > ${D}${systemd_unitdir}/system/suricata.service
+
 }
 
 pkg_postinst_ontarget_${PN} () {
@@ -53,8 +64,10 @@ if [ -e /etc/init.d/populate-volatile.sh ] ; then
 fi
 }
 
+SYSTEMD_PACKAGES = "${PN}"
+
 PACKAGES =+ "${PN}-python"
-FILES_${PN} += "${logdir}/suricata"
+FILES_${PN} += "${logdir}/suricata ${systemd_unitdir}"
 FILES_${PN}-python = "${bindir}/suricatasc ${PYTHON_SITEPACKAGES_DIR}"
 
 CONFFILES_${PN} = "${sysconfdir}/suricata/suricata.yaml"
-- 
2.9.5

[meta-security][PATCH 06/10] suricate: create and package logdir

[Koen Kooi]

This fixes the following error preventing startup:

  suricata[18771]: 31/7/2018 -- 13:08:21 - <Error> - [ERRCODE: SC_ERR_LOGDIR_CONFIG(116)] - The logging directory "/var/log/suricata/" supplied by /etc/suricata/suricata.yaml (default-log-dir) doesn't exist. Shut>

Signed-off-by: Koen Kooi <koen.kooi@linaro.org>
---
 recipes-security/suricata/suricata_4.0.0.bb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/recipes-security/suricata/suricata_4.0.0.bb b/recipes-security/suricata/suricata_4.0.0.bb
index 91136bf..928cb07 100644
--- a/recipes-security/suricata/suricata_4.0.0.bb
+++ b/recipes-security/suricata/suricata_4.0.0.bb
@@ -47,6 +47,8 @@ do_install_append () {
     install -m 644 ${WORKDIR}/suricata.yaml ${D}${sysconfdir}/suricata
     install -m 0644 ${WORKDIR}/volatiles.03_suricata  ${D}${sysconfdir}/default/volatiles/volatiles.03_suricata
 
+    install -d ${D}${logdir}/suricata
+
     install -d ${D}${systemd_unitdir}/system
     sed  -e s:/etc:${sysconfdir}:g \
          -e s:/var/run:/run:g \
-- 
2.9.5

[meta-security][PATCH 07/10] suricata: enable syslog output

[Koen Kooi]

This fixes the following error preventing startup in daemon mode:

  suricata[20485]: 31/7/2018 -- 13:19:48 - <Error> - [ERRCODE: SC_ERR_MISSING_CONFIG_PARAM(118)] - NO logging compatible with daemon mode selected, suricata won't be able to log. Please update  'logging.outputs'

Signed-off-by: Koen Kooi <koen.kooi@linaro.org>
---
 recipes-security/suricata/files/suricata.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/recipes-security/suricata/files/suricata.yaml b/recipes-security/suricata/files/suricata.yaml
index 90417b0..8d06a27 100644
--- a/recipes-security/suricata/files/suricata.yaml
+++ b/recipes-security/suricata/files/suricata.yaml
@@ -787,7 +787,7 @@ logging:
       enabled: no
       filename: /var/log/suricata.log
   - syslog:
-      enabled: no
+      enabled: yes
       facility: local5
       format: "[%i] <%d> -- "
 
-- 
2.9.5

[meta-security][PATCH 08/10] suricata: install and package rules

[Koen Kooi]

This fixes the following warning during startup:

  suricata[22707]: 31/7/2018 -- 13:34:40 - <Warning> - [ERRCODE: SC_ERR_NO_RULES_LOADED(43)] - 47 rule files specified, but no rule was loaded at all!

Signed-off-by: Koen Kooi <koen.kooi@linaro.org>
---
 recipes-security/suricata/suricata_4.0.0.bb | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/recipes-security/suricata/suricata_4.0.0.bb b/recipes-security/suricata/suricata_4.0.0.bb
index 928cb07..df5621b 100644
--- a/recipes-security/suricata/suricata_4.0.0.bb
+++ b/recipes-security/suricata/suricata_4.0.0.bb
@@ -40,6 +40,9 @@ PACKAGECONFIG[python] = "--enable-python, --disable-python, python, python"
 export logdir = "${localstatedir}/log"
 
 do_install_append () {
+
+    oe_runmake install-rules DESTDIR=${D}
+
     install -d ${D}${sysconfdir}/suricata
     install -d ${D}${sysconfdir}/suricata ${D}${sysconfdir}/default/volatiles
     install -m 644 classification.config ${D}${sysconfdir}/suricata
-- 
2.9.5

[meta-security][PATCH 09/10] suricata: install and package threshold.config

[Koen Kooi]

This fixes the following warning during startup:

  suricata[24522]: 31/7/2018 -- 13:47:15 - <Warning> - [ERRCODE: SC_ERR_FOPEN(44)] - Error opening file: "/etc/suricata//threshold.config": No such file or directory

Signed-off-by: Koen Kooi <koen.kooi@linaro.org>
---
 recipes-security/suricata/suricata_4.0.0.bb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/recipes-security/suricata/suricata_4.0.0.bb b/recipes-security/suricata/suricata_4.0.0.bb
index df5621b..8ea1486 100644
--- a/recipes-security/suricata/suricata_4.0.0.bb
+++ b/recipes-security/suricata/suricata_4.0.0.bb
@@ -50,6 +50,8 @@ do_install_append () {
     install -m 644 ${WORKDIR}/suricata.yaml ${D}${sysconfdir}/suricata
     install -m 0644 ${WORKDIR}/volatiles.03_suricata  ${D}${sysconfdir}/default/volatiles/volatiles.03_suricata
 
+    install -m 0644 ${S}/threshold.config ${D}${sysconfdir}/suricata
+
     install -d ${D}${logdir}/suricata
 
     install -d ${D}${systemd_unitdir}/system
-- 
2.9.5

[meta-security][PATCH 10/10] suricata: rename ${PN}-python to ${PN}-socketcontrol

[Koen Kooi]

This describes the content a lot better. RDEPENDS are still missing, so it's still as non-working as before :/

Signed-off-by: Koen Kooi <koen.kooi@linaro.org>
---
 recipes-security/suricata/suricata_4.0.0.bb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/recipes-security/suricata/suricata_4.0.0.bb b/recipes-security/suricata/suricata_4.0.0.bb
index 8ea1486..6efa351 100644
--- a/recipes-security/suricata/suricata_4.0.0.bb
+++ b/recipes-security/suricata/suricata_4.0.0.bb
@@ -73,9 +73,9 @@ fi
 
 SYSTEMD_PACKAGES = "${PN}"
 
-PACKAGES =+ "${PN}-python"
+PACKAGES =+ "${PN}-socketcontrol"
 FILES_${PN} += "${logdir}/suricata ${systemd_unitdir}"
-FILES_${PN}-python = "${bindir}/suricatasc ${PYTHON_SITEPACKAGES_DIR}"
+FILES_${PN}-socketcontrol = "${bindir}/suricatasc ${PYTHON_SITEPACKAGES_DIR}"
 
 CONFFILES_${PN} = "${sysconfdir}/suricata/suricata.yaml"
 
-- 
2.9.5

Re: [meta-security][PATCH 01/10] suricata: don't start service in postinst

[akuster808]

On 08/01/2018 01:09 AM, Koen Kooi wrote:
> Apart from hardcoding the wrong networking device it won't survive device restart
>
> Signed-off-by: Koen Kooi <koen.kooi@linaro.org>
series merged. thanks,
armin
> ---
>  recipes-security/suricata/suricata_4.0.0.bb | 1 -
>  1 file changed, 1 deletion(-)
>
> diff --git a/recipes-security/suricata/suricata_4.0.0.bb b/recipes-security/suricata/suricata_4.0.0.bb
> index e163486..3f88920 100644
> --- a/recipes-security/suricata/suricata_4.0.0.bb
> +++ b/recipes-security/suricata/suricata_4.0.0.bb
> @@ -50,7 +50,6 @@ pkg_postinst_ontarget_${PN} () {
>  if [ -e /etc/init.d/populate-volatile.sh ] ; then
>      ${sysconfdir}/init.d/populate-volatile.sh update
>  fi
> -    ${bindir}/suricata -c ${sysconfdir}/suricata.yaml -i eth0 
>  }
>  
>  PACKAGES += "${PN}-python"