Bug 211813 - [NEW PORT] security/snort2pfcd: Snort alert to pf blocker
Summary: [NEW PORT] security/snort2pfcd: Snort alert to pf blocker
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Only Me
Assignee: Ben Woods
URL:
Keywords: feature, needs-qa
Depends on:
Blocks:
 
Reported: 2016-08-13 16:59 UTC by Samee Shahzada
Modified: 2016-09-03 14:31 UTC (History)
2 users (show)

See Also:
koobs: maintainer-feedback? (onestsam)


Attachments
new port shar (3.17 KB, text/plain)
2016-08-13 16:59 UTC, Samee Shahzada
no flags Details
fixed a tiny bug but now with new makesum (sorry) (3.00 KB, text/plain)
2016-08-14 06:24 UTC, Samee Shahzada
no flags Details
new port v0.2 shar (3.03 KB, text/plain)
2016-08-19 06:16 UTC, Samee Shahzada
no flags Details
new port v0.2 shar (3.24 KB, text/plain)
2016-08-19 07:33 UTC, Samee Shahzada
no flags Details
new port v0.3 shar (3.24 KB, text/plain)
2016-08-25 01:21 UTC, Samee Shahzada
no flags Details
new port v0.4 shar (3.24 KB, text/plain)
2016-08-25 06:35 UTC, Samee Shahzada
no flags Details
port update v0.5 shar (2.98 KB, text/plain)
2016-08-28 14:47 UTC, Samee Shahzada
no flags Details
port update v0.6 shar (3.13 KB, text/plain)
2016-08-31 06:09 UTC, Samee Shahzada
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Samee Shahzada 2016-08-13 16:59:19 UTC
Created attachment 173633 [details]
new port shar

New port written for freebsd pf with snort. Please review.
Comment 1 Samee Shahzada 2016-08-14 06:24:06 UTC
Created attachment 173648 [details]
fixed a tiny bug but now with new makesum (sorry)
Comment 2 Samee Shahzada 2016-08-19 06:16:39 UTC
Created attachment 173844 [details]
new port v0.2 shar

Should be production ready now
Comment 3 Samee Shahzada 2016-08-19 07:33:38 UTC
Created attachment 173848 [details]
new port v0.2 shar
Comment 4 Samee Shahzada 2016-08-25 01:21:03 UTC
Created attachment 174038 [details]
new port v0.3 shar
Comment 5 Samee Shahzada 2016-08-25 06:35:04 UTC
Created attachment 174046 [details]
new port v0.4 shar
Comment 6 Kubilay Kocak freebsd_committer freebsd_triage 2016-08-25 08:13:55 UTC
Thank you Samee.

Please confirm this port passes QA (portlint, poudriere). For more details and instructions see: 

https://www.freebsd.org/doc/en_US.ISO8859-1/books/porters-handbook/testing.html
Comment 7 Samee Shahzada 2016-08-25 16:58:09 UTC
(In reply to Kubilay Kocak from comment #6)
Passed portlint as far as I could tell. No errors, make install reinstall deinstall all function correctly and the port successfully registers itself.
Comment 8 Samee Shahzada 2016-08-28 14:47:44 UTC
Created attachment 174158 [details]
port update v0.5 shar
Comment 9 Samee Shahzada 2016-08-28 14:53:52 UTC
(In reply to Kubilay Kocak from comment #6)

Hi Koobs :)
When I respond to your comments in bugzilla, do you receive them via email? Just wondering. I think I fixed the qa bug in v0.5 but not sure. Also polished the program a little. 

And should I be posting updates to this bugzilla page?
Thanks.

Samee
Comment 10 commit-hook freebsd_committer freebsd_triage 2016-08-30 23:38:18 UTC
A commit references this bug:

Author: woodsb02
Date: Tue Aug 30 23:37:48 UTC 2016
New revision: 421135
URL: https://svnweb.freebsd.org/changeset/ports/421135

Log:
  Add new port security/snort2pfcd, which analyzes snort alert output and
  blocks ip addresses using pf for a specified period of time.

  PR:		211813
  Submitted by:	onestsam@gmail.com
  Reviewed by:	adamw, mat (mentors)
  Approved by:	koobs (mentor)
  Differential Revision:	https://reviews.freebsd.org/D7712

Changes:
  head/security/Makefile
  head/security/snort2pfcd/
  head/security/snort2pfcd/Makefile
  head/security/snort2pfcd/distinfo
  head/security/snort2pfcd/files/
  head/security/snort2pfcd/files/patch-Makefile
  head/security/snort2pfcd/files/snort2pfcd.in
  head/security/snort2pfcd/pkg-descr
Comment 11 Ben Woods freebsd_committer freebsd_triage 2016-08-30 23:41:10 UTC
Committed - thanks for your work on this Samee.

Some possible future improvements you could consider as maintainer:
- Get the security/snort2pfcd/files/patch-Makefile patch incorporated in the upstream code.
- Get this code submitted this code to a source code repository (e.g. GitHub)
- Create a website and add to pkg-descr with WWW: (could link to GitHub page)
Comment 12 Ben Woods freebsd_committer freebsd_triage 2016-08-30 23:54:57 UTC
A couple of other things Samee:

- I created a copy of the snort2pfcd rc script, and put it in the ports tree. This is so that we can patch out the /usr/local using %%LOCALBASE%%. The rc script is probably not something that applies to any other operating systems anyway, so it is better placed in the ports tree than in the upstream code - it can be removed from your upstream code in the future if you like (it is not being used by the port).

- I simplified your port a lot, have a look at the committed port Makefile, and compare it to the one you had prepared (using diff) to see for yourself (for future ports).

Thanks again for submitting this!
Comment 13 Samee Shahzada 2016-08-31 04:50:52 UTC
Thank you very, very much Ben! Working on applying all of your changes now.
Comment 14 Samee Shahzada 2016-08-31 06:09:10 UTC
Created attachment 174239 [details]
port update v0.6 shar
Comment 15 Ben Woods freebsd_committer freebsd_triage 2016-08-31 09:40:35 UTC
(In reply to Samee Shahzada from comment #14)
Hi Samee,

This bug report is now closed as the port has been committed to the ports tree. Please submit all future changes, and your current proposed change, as a separate bug report. It should have the title "security/snort2pfcd: Update to 0.6" or similar.

Also, the .shar format should only be used to propose a new port. Once a port exists in the tree, the preferred format is patches in the unified diff format. This can be generated using diff(1) command "diff -ru" to compare a copy of your port to that which is already in the ports tree, or preferably by making your changes directly into your local copy of the ports tree that was checked out using subversion, as using "svn diff /usr/ports/security/snort2pfcd > ~/snort2pfcd.patch" to generate a patch file in your home directory.

Thanks,
Ben
Comment 16 Ben Woods freebsd_committer freebsd_triage 2016-08-31 09:41:27 UTC
PS: you can feel free to CC me on the new bug report when you create it.
Comment 17 Ben Woods freebsd_committer freebsd_triage 2016-09-03 02:21:19 UTC
Hi Samee,

I can see you have uploaded the source to GitHub - that's great! Could you please do me a favour and tag the current commit as release 0.6? It would be nice to populate the README.md file also.
https://github.com/onestsam/snort2pfcd

I will then update the port for you.

Thanks,
Ben
Comment 18 Samee Shahzada 2016-09-03 14:31:50 UTC
(In reply to Ben Woods from comment #17)

Thanks Ben, 

Im still trying to figure out git. I uploaded the files to git but they were symlinks on my computer and as I discovered, git just uploaded the symlinks and did not follow them. 

Samee