Re: UPDATE: Suricata-6.0.6

ping

On Thu, 11 Aug 2022 at 10:44:12 +0200, Gonzalo L. Rodriguez wrote:
> Hello,
>
> Update for Suricata to 6.0.6:
>
> https://github.com/OISF/suricata/releases/tag/suricata-6.0.6
>
> OK? Comments?
>
> Cheers.-
>
>
> Index: Makefile
> ===================================================================
> RCS file: /cvs/ports/security/suricata/Makefile,v
> retrieving revision 1.49
> diff -u -p -r1.49 Makefile
> --- Makefile 16 May 2022 20:12:15 -0000 1.49
> +++ Makefile 10 Aug 2022 20:52:36 -0000
> @@ -1,7 +1,7 @@
> COMMENT = high performance network IDS, IPS and security monitoring
>
> -SURICATA_V = 6.0.4
> -SUPDATE_V = 1.2.3
> +SURICATA_V = 6.0.6
> +SUPDATE_V = 1.2.4
>
> DISTNAME = suricata-${SURICATA_V}
> CATEGORIES = security
> Index: distinfo
> ===================================================================
> RCS file: /cvs/ports/security/suricata/distinfo,v
> retrieving revision 1.17
> diff -u -p -r1.17 distinfo
> --- distinfo 21 Dec 2021 11:01:07 -0000 1.17
> +++ distinfo 10 Aug 2022 20:52:36 -0000
> @@ -1,2 +1,2 @@
> -SHA256 (suricata-6.0.4.tar.gz) = qPGX4z0WeGieu/e8Gr6Ek0xGXSLFBMR8LH6bdKoELQ0=
> -SIZE (suricata-6.0.4.tar.gz) = 32498036
> +SHA256 (suricata-6.0.6.tar.gz) = ABc2NPp2ruY244qQscAmFskD5CFzEH1HtBFJYLX76Dk=
> +SIZE (suricata-6.0.6.tar.gz) = 32651139
> Index: patches/patch-configure_ac
> ===================================================================
> RCS file: /cvs/ports/security/suricata/patches/patch-configure_ac,v
> retrieving revision 1.8
> diff -u -p -r1.8 patch-configure_ac
> --- patches/patch-configure_ac 11 Mar 2022 19:54:07 -0000 1.8
> +++ patches/patch-configure_ac 10 Aug 2022 20:52:36 -0000
> @@ -3,7 +3,7 @@ To remove the pid file, its directory mu
> Index: configure.ac
> --- configure.ac.orig
> +++ configure.ac
> -@@ -2753,7 +2753,7 @@ if test "$WINDOWS_PATH" = "yes"; then
> +@@ -2770,7 +2770,7 @@ if test "$WINDOWS_PATH" = "yes"; then
> fi
> else
> EXPAND_VARIABLE(localstatedir, e_logdir, "/log/suricata/")
> Index: patches/patch-src_suricata_c
> ===================================================================
> RCS file: /cvs/ports/security/suricata/patches/patch-src_suricata_c,v
> retrieving revision 1.10
> diff -u -p -r1.10 patch-src_suricata_c
> --- patches/patch-src_suricata_c 11 Mar 2022 19:54:07 -0000 1.10
> +++ patches/patch-src_suricata_c 10 Aug 2022 20:52:36 -0000
> @@ -4,7 +4,7 @@ Suricata uses libcap-ng on Linux and run
> Index: src/suricata.c
> --- src/suricata.c.orig
> +++ src/suricata.c
> -@@ -2834,6 +2834,7 @@ int SuricataMain(int argc, char **argv)
> +@@ -2926,6 +2926,7 @@ int SuricataMain(int argc, char **argv)
>
> PostRunStartedDetectSetup(&suricata);
>
> Index: patches/patch-suricata_yaml_in
> ===================================================================
> RCS file: /cvs/ports/security/suricata/patches/patch-suricata_yaml_in,v
> retrieving revision 1.14
> diff -u -p -r1.14 patch-suricata_yaml_in
> --- patches/patch-suricata_yaml_in 16 May 2022 20:12:15 -0000 1.14
> +++ patches/patch-suricata_yaml_in 10 Aug 2022 20:52:36 -0000
> @@ -9,7 +9,7 @@ about downloading rules.
> Index: suricata.yaml.in
> --- suricata.yaml.in.orig
> +++ suricata.yaml.in
> -@@ -77,6 +77,7 @@ outputs:
> +@@ -80,6 +80,7 @@ outputs:
> - fast:
> enabled: yes
> filename: fast.log
> @@ -17,7 +17,7 @@ Index: suricata.yaml.in
> append: yes
> #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'
>
> -@@ -85,6 +86,7 @@ outputs:
> +@@ -88,6 +89,7 @@ outputs:
> enabled: @e_enable_evelog@
> filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
> filename: eve.json
> @@ -25,7 +25,7 @@ Index: suricata.yaml.in
> # Enable for multi-threaded eve.json output; output files are amended with
> # with an identifier, e.g., eve.9.json
> #threaded: false
> -@@ -304,6 +306,7 @@ outputs:
> +@@ -307,6 +309,7 @@ outputs:
> - http-log:
> enabled: no
> filename: http.log
> @@ -33,7 +33,7 @@ Index: suricata.yaml.in
> append: yes
> #extended: yes # enable this for extended logging information
> #custom: yes # enable the custom logging format (defined by customformat)
> -@@ -314,6 +317,7 @@ outputs:
> +@@ -317,6 +320,7 @@ outputs:
> - tls-log:
> enabled: no # Log TLS connections.
> filename: tls.log # File to store TLS logs.
> @@ -41,7 +41,7 @@ Index: suricata.yaml.in
> append: yes
> #extended: yes # Log extended information like fingerprint
> #custom: yes # enabled the custom logging format (defined by customformat)
> -@@ -361,6 +365,7 @@ outputs:
> +@@ -364,6 +368,7 @@ outputs:
> - pcap-log:
> enabled: no
> filename: log.pcap
> @@ -49,7 +49,7 @@ Index: suricata.yaml.in
>
> # File size limit. Can be specified in kb, mb, gb. Just a number
> # is parsed as bytes.
> -@@ -396,6 +401,7 @@ outputs:
> +@@ -399,6 +404,7 @@ outputs:
> - alert-debug:
> enabled: no
> filename: alert-debug.log
> @@ -57,7 +57,7 @@ Index: suricata.yaml.in
> append: yes
> #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'
>
> -@@ -411,6 +417,7 @@ outputs:
> +@@ -414,6 +420,7 @@ outputs:
> - stats:
> enabled: yes
> filename: stats.log
> @@ -65,7 +65,7 @@ Index: suricata.yaml.in
> append: yes # append to file (yes) or overwrite it (no)
> totals: yes # stats for all threads merged together
> threads: no # per thread stats
> -@@ -504,6 +511,7 @@ outputs:
> +@@ -507,6 +514,7 @@ outputs:
> enabled: no
> type: file
> filename: tcp-data.log
> @@ -73,7 +73,7 @@ Index: suricata.yaml.in
>
> # Log HTTP body data after normalization, de-chunking and unzipping.
> # Two types: file or dir.
> -@@ -517,6 +525,7 @@ outputs:
> +@@ -520,6 +528,7 @@ outputs:
> enabled: no
> type: file
> filename: http-data.log
> @@ -81,7 +81,7 @@ Index: suricata.yaml.in
>
> # Lua Output Support - execute lua script to generate alert and event
> # output.
> -@@ -558,12 +567,12 @@ logging:
> +@@ -566,12 +575,12 @@ logging:
> enabled: yes
> # type: json
> - file:
> @@ -96,7 +96,7 @@ Index: suricata.yaml.in
> facility: local5
> format: "[%i] <%d> -- "
> # type: json
> -@@ -994,9 +1003,9 @@ asn1-max-frames: 256
> +@@ -1002,9 +1011,9 @@ asn1-max-frames: 256
> ##
>
> # Run Suricata with a specific user-id and group-id:
> @@ -109,7 +109,7 @@ Index: suricata.yaml.in
>
> # Some logging modules will use that name in event as identifier. The default
> # value is the hostname
> -@@ -1005,7 +1014,7 @@ asn1-max-frames: 256
> +@@ -1013,7 +1022,7 @@ asn1-max-frames: 256
> # Default location of the pid file. The pid file is only used in
> # daemon mode (start Suricata with -D). If not running in daemon mode
> # the --pidfile command line option must be used to create a pid file.
> @@ -118,7 +118,7 @@ Index: suricata.yaml.in
>
> # Daemon working directory
> # Suricata will change directory to this one if provided
> -@@ -1865,14 +1874,38 @@ napatech:
> +@@ -1885,14 +1894,38 @@ napatech:
> #
> hashmode: hash5tuplesorted
>
> Index: pkg/PLIST
> ===================================================================
> RCS file: /cvs/ports/security/suricata/pkg/PLIST,v
> retrieving revision 1.20
> diff -u -p -r1.20 PLIST
> --- pkg/PLIST 11 Mar 2022 19:54:07 -0000 1.20
> +++ pkg/PLIST 10 Aug 2022 20:52:36 -0000
> @@ -200,6 +200,7 @@ share/suricata/rules/smb-events.rules
> @sample ${SYSCONFDIR}/suricata/rules/smb-events.rules
> share/suricata/rules/smtp-events.rules
> @sample ${SYSCONFDIR}/suricata/rules/smtp-events.rules
> +share/suricata/rules/ssh-events.rules
> share/suricata/rules/stream-events.rules
> @sample ${SYSCONFDIR}/suricata/rules/stream-events.rules
> share/suricata/rules/tls-events.rules
> --
>
> %gonzalo
>

--

%gonzalo