Patch up the code to work properly under start-stop-daemon, and with the builtin chroot support. Also include Gentoo init.d support finally, modelled after the flow-tools init.d script.

(Portage version: 2.1.4.4)

6 files changed, 236 insertions, 2 deletions

diff --git a/net-analyzer/fprobe/ChangeLog b/net-analyzer/fprobe/ChangeLog
index 6bb214af818f..17345d9262ed 100644
--- a/net-analyzer/fprobe/ChangeLog
+++ b/net-analyzer/fprobe/ChangeLog
@@ -1,6 +1,15 @@
 # ChangeLog for net-analyzer/fprobe
-# Copyright 1999-2007 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/net-analyzer/fprobe/ChangeLog,v 1.12 2007/02/09 04:01:40 flameeyes Exp $
+# Copyright 1999-2008 Gentoo Foundation; Distributed under the GPL v2
+# $Header: /var/cvsroot/gentoo-x86/net-analyzer/fprobe/ChangeLog,v 1.13 2008/03/17 08:41:11 robbat2 Exp $
+
+*fprobe-1.1-r1 (17 Mar 2008)
+
+  17 Mar 2008; Robin H. Johnson <robbat2@gentoo.org>
+  +files/fprobe-1.1-pidfile-sanity.patch, +files/fprobe-1.1-setgroups.patch,
+  +files/conf.d-fprobe, +files/init.d-fprobe, +fprobe-1.1-r1.ebuild:
+  Patch up the code to work properly under start-stop-daemon, and with the
+  builtin chroot support. Also include Gentoo init.d support finally, modelled
+  after the flow-tools init.d script.
 
   09 Feb 2007; Diego Pettenò <flameeyes@gentoo.org> ChangeLog:
   Regenerate digest in Manifest2 format.
diff --git a/net-analyzer/fprobe/files/conf.d-fprobe b/net-analyzer/fprobe/files/conf.d-fprobe
new file mode 100644
index 000000000000..f73ccf4c5803
--- /dev/null
+++ b/net-analyzer/fprobe/files/conf.d-fprobe
@@ -0,0 +1,71 @@
+# Config file for /etc/init.d/fprobe
+
+# Do we want the interface in promiscous mode [yes/no]
+#PROMISC=no
+
+# Interface
+IFACE=eth0
+
+# If configured, only capture packets matching this tcpdump expression
+#FILTER=""
+
+# Flow state timers
+#TIMER_EXPIRED=5
+#TIMER_FRAGMENTED=30
+#TIMER_IDLE=60
+#TIMER_ACTIVE=300
+
+# This is the default and should be left unless you know what you are doing
+#FLOW_VER=5
+
+# local ip. if configured fprobe will use this as the source IP for sending ALL flow data
+# If you want to specify a specific source address per collecter, customize it below
+#LOCALIP=
+
+# SNMP iface id
+SNMP_IFACE="${IFACE//eth}"
+
+# Maximum number of concurrent flows to track
+# using a specified amount of memory
+#MEMBULK=10000
+#MEMLIMIT=
+
+# Pending queue
+#PENDING=100
+
+# Kernel capture buffer size (kB)
+#KERNBUF=1024
+
+# Realtime priority [0=disabled, 1..99]
+#RTPRIO=0
+
+# Delay N nanoseconds after each B bytes
+#DELAY="0:0"
+
+# How much of the start of each packet to grab
+#SNAPLEN=256
+
+# chroot() to this location after startup
+CHROOT="/var/empty"
+
+# User to run as. must have perms to the pidfile directory /var/run/fprobe/
+USER=nobody
+
+# logging level for syslog (0=EMERG, ..., 6=INFO, 7=DEBUG)
+#LOGLEVEL=6
+
+# If you want to run multiple instances of fprobe,
+# You MUST set this variable to a unique INTEGER for each one!
+PIDFILE_ID=''
+
+# remote ip. this is where we send flows
+REMOTEIP=127.0.0.1
+# port to listen on
+PORT=2055
+# Collector type, see the manpage for valid types
+TYPE=''
+
+# If you want multiple collectors, just specify each one here
+COLLECTORS="${REMOTEIP}:${PORT}/${LOCALIP}/${TYPE}"
+
+# vim:ft=gentoo-conf-d:
diff --git a/net-analyzer/fprobe/files/fprobe-1.1-pidfile-sanity.patch b/net-analyzer/fprobe/files/fprobe-1.1-pidfile-sanity.patch
new file mode 100644
index 000000000000..e7c10bd98d0d
--- /dev/null
+++ b/net-analyzer/fprobe/files/fprobe-1.1-pidfile-sanity.patch
@@ -0,0 +1,48 @@
+If we are using the chroot() option or the setuid options, we must create the
+pidfile before doing the chroot OR the setreuid. It's actually best for
+start-stop-daemon if we create the pidfile from the master side of the fork()
+before it exits, since most of the startup checks happen after the chroot()
+unfortunetly.
+
+Signed-off-by: Robin H. Johnson <robbat2@gentoo.org>
+
+diff -Nuar fprobe-1.1.orig/src/fprobe.c fprobe-1.1/src/fprobe.c
+--- fprobe-1.1.orig/src/fprobe.c	2005-01-30 08:43:35.000000000 +0000
++++ fprobe-1.1/src/fprobe.c	2008-03-16 20:51:24.000000000 +0000
+@@ -1379,7 +1379,8 @@
+ 
+ 	my_log_open(ident, verbosity, log_dest);
+ 	if (!(log_dest & 2)) {
+-		switch (fork()) {
++		pid_t childpid = fork();
++		switch (childpid) {
+ 			case -1:
+ 				fprintf(stderr, "fork(): %s", strerror(errno));
+ 				exit(1);
+@@ -1392,6 +1393,12 @@
+ 				break;
+ 
+ 			default:
++				if (!(pidfile = fopen(pidfilepath, "w")))
++					my_log(LOG_ERR, "Can't create pid file. fopen(): %s", strerror(errno));
++				else {
++					fprintf(pidfile, "%ld\n", (long) childpid);
++					fclose(pidfile);
++				}
+ 				exit(0);
+ 		}
+ 	} else {
+@@ -1548,13 +1555,6 @@
+ 		}
+ 	}
+ 
+-	if (!(pidfile = fopen(pidfilepath, "w")))
+-		my_log(LOG_ERR, "Can't create pid file. fopen(): %s", strerror(errno));
+-	else {
+-		fprintf(pidfile, "%ld\n", (long) pid);
+-		fclose(pidfile);
+-	}
+-
+ 	my_log(LOG_INFO, "pid: %d", pid);
+ 	my_log(LOG_INFO, "interface: %s, datalink: %s (%d)",
+ 		dev, dlt[link_type_idx].descr, link_type);
diff --git a/net-analyzer/fprobe/files/fprobe-1.1-setgroups.patch b/net-analyzer/fprobe/files/fprobe-1.1-setgroups.patch
new file mode 100644
index 000000000000..969681243788
--- /dev/null
+++ b/net-analyzer/fprobe/files/fprobe-1.1-setgroups.patch
@@ -0,0 +1,19 @@
+This seems to fail after the chroot(), so just squelch the exit for now.
+
+Signed-off-by: Robin H. Johnson <robbat2@gentoo.org>
+
+diff -Nuar fprobe-1.1/src/fprobe.c fprobe-1.1.new/src/fprobe.c
+--- fprobe-1.1/src/fprobe.c	2008-03-17 00:06:43.000000000 +0000
++++ fprobe-1.1.new/src/fprobe.c	2008-03-17 00:07:30.000000000 +0000
+@@ -1541,10 +1541,10 @@
+ 	}
+ 
+ 	if (pw) {
+		if (setgroups(0, NULL) < 0) {
+			my_log(LOG_CRIT, "setgroups: %s", strerror(errno));
+-			exit(1);
++			//exit(1);
+		}
+ 		if (setregid(pw->pw_gid, pw->pw_gid)) {
+ 			my_log(LOG_CRIT, "setregid(%u): %s", pw->pw_gid, strerror(errno));
+ 			exit(1);
diff --git a/net-analyzer/fprobe/files/init.d-fprobe b/net-analyzer/fprobe/files/init.d-fprobe
new file mode 100644
index 000000000000..72ff8901399d
--- /dev/null
+++ b/net-analyzer/fprobe/files/init.d-fprobe
@@ -0,0 +1,41 @@
+#!/sbin/runscript
+# Copyright 1999-2008 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+depend() {
+	need net
+}
+
+BIN=/usr/sbin/fprobe
+PIDFILE_EXTRA=""
+[ -n "$PIDFILE_ID" ] && PIDFILE_EXTRA="[$PIDFILE_ID]"
+PIDFILE="/var/run/fprobe$PIDFILE_EXTRA.pid"
+
+start() {
+	ebegin "Starting fprobe"
+	local OPTS=""
+	[ "${PROMISC}" == "yes" ] && OPTS="${OPTS} -p"
+	[ -n "${FILTER}" ] && OPTS="${OPTS} -f '${FILTER}'"
+	for optname in i:IFACE s:TIMER_EXPIRED g:TIME_FRAGMENTED d:TIMER_IDLE \
+		e:TIMER_ACTIVE n:FLOW_VER a:LOCALIP x:SNMP_IFACE b:MEMBULK \
+		m:MEMLIMIT q:PENDING B:KERNBUF r:RTPRIO t:DELAY S:SNAPLEN \
+		c:CHROOT u:USER v:LOGLEVEL ; do
+	    opt="${optname/:*}"	optvar="${optname/*:}"
+	    optvalue="${!optvar}"
+	    [ -n "$optvalue" ] && OPTS="${OPTS} -${opt} ${optvalue}"
+	done
+	OPTS="${OPTS} -l 1:${PIDFILE_ID} ${COLLECTORS}"
+	start-stop-daemon --start --exec $BIN \
+		--pidfile ${PIDFILE} \
+		-- ${OPTS}
+	eend $?
+}
+
+stop() {
+	ebegin "Stopping fprobe"
+	start-stop-daemon --stop --quiet --exec $BIN \
+		--pidfile ${PIDFILE}
+	eend $?
+}
+
+# vim:ft=gentoo-init-d:
diff --git a/net-analyzer/fprobe/fprobe-1.1-r1.ebuild b/net-analyzer/fprobe/fprobe-1.1-r1.ebuild
new file mode 100644
index 000000000000..055a80aa9298
--- /dev/null
+++ b/net-analyzer/fprobe/fprobe-1.1-r1.ebuild
@@ -0,0 +1,46 @@
+# Copyright 1999-2008 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-analyzer/fprobe/fprobe-1.1-r1.ebuild,v 1.1 2008/03/17 08:41:11 robbat2 Exp $
+
+inherit eutils
+
+DESCRIPTION="A libpcap-based tool to collect network traffic data and emit it as NetFlow flows"
+HOMEPAGE="http://fprobe.sourceforge.net"
+LICENSE="GPL-2"
+
+SRC_URI="mirror://sourceforge/fprobe/${P}.tar.bz2"
+SLOT="0"
+KEYWORDS="~amd64 ~ppc ~x86"
+
+IUSE="debug messages"
+
+DEPEND="net-libs/libpcap"
+
+src_unpack() {
+	unpack ${A}
+	# The pidfile should be created by the parent process, before the
+	# setuid/chroot # is executed.
+	epatch "${FILESDIR}"/fprobe-1.1-pidfile-sanity.patch
+	# This seems to fail, uncertain why. 
+	epatch "${FILESDIR}"/fprobe-1.1-setgroups.patch
+}
+
+src_compile() {
+	econf \
+		$(use_enable debug) \
+		$(use_enable messages) \
+		|| die "configure failed"
+
+	emake || die "make failed"
+}
+
+src_install() {
+	make DESTDIR="${D}" install || die "install failed"
+
+	dodoc AUTHORS NEWS README TODO
+	docinto contrib
+	dodoc contrib/tg.sh
+
+	newinitd "${FILESDIR}"/init.d-fprobe fprobe
+	newconfd "${FILESDIR}"/conf.d-fprobe fprobe
+}