suricata 2.0.2

[Schamschula (Marius Schamschula)]

suricata version 2.0.2.

Suricata is a high performance Network IDS, IPS and Network Security Monitoring engine. Open Source and owned by a community run non-profit foundation, the Open Information Security Foundation (OISF).

[ryandesign (Ryan Carsten Schmidt)]

Thanks. Some initial comments:

• The tabs should be converted to spaces to conform to the modeline. Make sure the columns line up and that indentations are at multiples of 4 spaces.
• I see a dependency on port:file. Does the port really use the file program, or does it use the magic library? If the latter, depend on port:libmagic.
• I see an ipfw variant that only adds a configure arg to enable an optional feature. Having fewer variants is better. To that end, is there a reason why this optional feature shouldn't be enabled all the time?
• I see a geoip variant. I haven't tested it yet, but make sure that the port does *not* use libgeoip if the geoip variant is *not* selected, even if the libgeoip port is already installed.
• I see patches that add #define HAVE_STRLCPY 1. Is that correct for all versions of OS X? I thought that had only been added to OS X recently. Isn't that kind of #define supposed to get set in config.h by running ./configure?
• I see another patch that adds DESTDIR support. Have these issues been reported to the developers already? If so, include URLs to those bug reports. (I usually put them in the patchfiles themselves, in the first line.)

[Schamschula (Marius Schamschula)]

Ryan,

A bunch of great catches. I fixed the following:

• Detabed and cleaned up some whitespace issues
• Substituted libmagic for file (outside of MacPorts they are one and the same)
• Removed the ipfw variant.
• Made sure geoip is not enabled by default (actually needed to add configure.args for default)
• Added comment to patch-Makefile.in.diff to note open issue regarding ${DESTDIR} upstream.

The only unresolved issues are the matters of HAVE_STRLCAT and HAVE_STRLCPY: ./configure does not test for these. This issue was reported by the Homebrew maintainer on 5/15/2014: ​https://redmine.openinfosecfoundation.org/issues/1192 and will be resolved by the next release (2.0.3). I currently only have access to Mavericks MacPorts machines, so I have no way of testing on older OSs. Of course, this is a clang issue, so a Mountain Lion machine with the current version of Xcode will see this issue as well.

[ryandesign (Ryan Carsten Schmidt)]

Replying to mschamschula@…:

• Substituted libmagic for file (outside of MacPorts they are one and the same)

You changed the dependency to "magic", which is an unrelated software package for circuit design. You want "libmagic" instead.

Replying to mschamschula@…:

• Made sure geoip is not enabled by default (actually needed to add configure.args for default)

You used configure.args-remove, which is not a MacPorts command; configure.args-delete is; however, consider using configure.args-replace instead.

[Schamschula (Marius Schamschula)]

Fixed the incorrect lib name and replaced the two configure.args statements with configure.args-replace.

[ryandesign (Ryan Carsten Schmidt)]

Configure fails:

checking for HASH_Begin in -lnss3... no

   ERROR!  libnss library not found, go get it
   from Mozilla or your distribution:

   Ubuntu: apt-get install libnss3-dev
   Fedora: yum install nss-devel

I do have the nss port installed.

[jul_bsd@…]

Duplicate work cf #42858 which has 1.x, 2.0.x and 2.1/-devel: I merged part of the patch