added ebuild for p0f

3 files changed, 59 insertions, 0 deletions

diff --git a/net-analyzer/p0f/files/digest-p0f-1.8.2 b/net-analyzer/p0f/files/digest-p0f-1.8.2
new file mode 100644
index 000000000000..4f8cdc1bf001
--- /dev/null
+++ b/net-analyzer/p0f/files/digest-p0f-1.8.2
@@ -0,0 +1 @@
+MD5 fdc811dda8e0d261a5564d1f3ad5c24c p0f-1.8.2.tgz 23969
diff --git a/net-analyzer/p0f/files/p0f-1.8.2-makefile.patch b/net-analyzer/p0f/files/p0f-1.8.2-makefile.patch
new file mode 100644
index 000000000000..5f322360a5da
--- /dev/null
+++ b/net-analyzer/p0f/files/p0f-1.8.2-makefile.patch
@@ -0,0 +1,12 @@
+--- Makefil	2002-02-14 21:47:28.000000000 +0200
++++ Makefile	2002-02-14 21:49:57.000000000 +0200
+@@ -17,8 +17,7 @@
+ all: $(FILE) strip	
+ 
+ $(FILE): p0f.c
+-	$(CC) $(CFLAGS) -DVER=\"$(VERSION)\" -o $@ p0f.c $(CLIBS) \
+-	`uname|egrep -i 'sunos|solar' >/dev/null && echo "$(SUNLIBS)"`  
++	$(CC) $(CFLAGS) -DVER=\"$(VERSION)\" -o $@ p0f.c $(CLIBS)
+ 
+ strip:
+ 	strip $(FILE) || true
diff --git a/net-analyzer/p0f/files/p0f-1.8.2.init b/net-analyzer/p0f/files/p0f-1.8.2.init
new file mode 100644
index 000000000000..8c3c670c1ec6
--- /dev/null
+++ b/net-analyzer/p0f/files/p0f-1.8.2.init
@@ -0,0 +1,46 @@
+#!/sbin/runscript
+# Based upon a script copyrighted under LGPL
+# Modified by Ilian Zarov <coder@descom.com>
+# description: p0f - the p0f monitoring program.
+# processname: p0f
+# pidfile: /var/run/p0f.pid
+
+PATH=/usr/bin:/sbin:/bin:/usr/sbin
+export PATH
+export P0FLOGFILE=/var/log/p0f
+
+# Source function library.
+source /etc/init.d/functions.sh
+
+start() {
+	ebegin "Starting p0f"
+	# The 'tcp and tcp[13] & 2 = 2' requires at least syn set.
+	# An alternative would be 'tcp and tcp[13] & 0x3f = 2', which
+	# is syn and no other major flags (but ECN enabled packets are OK)
+	if [ -z "$BpfFilter" ]; then
+		BpfFilter='tcp and tcp[13] & 2 = 2'
+	else
+		BpfFilter="$BpfFilter and tcp and tcp[13] & 2 = 2"
+	fi
+
+	# The command in backticks returns all the local IP addresses on this machine.
+	for OneIP in `/sbin/ifconfig 2>/dev/null | grep 'inet addr' | sed -e 's/.*addr://' -e 's/ .*//'` ; do
+		BpfFilter="$BpfFilter and not src host $OneIP"
+	done
+	
+	# Create a lock file.
+	mkdir -p /var/lock/subsys
+	touch /var/lock/subsys/p0f
+	
+	# Start up p0f and filter out all packets originating from any of this machines IP's.
+	einfo "Logfile: ${P0FLOGFILE}"
+	start-stop-daemon --start --quiet --exec /usr/sbin/p0f -- -v "$BpfFilter" >>"$P0FLOGFILE" 2>&1 &
+	eend ${?}
+}
+
+stop() {
+	ebegin "Stopping p0f"
+	start-stop-daemon --stop --quiet --exec /usr/sbin/p0f
+	rm -f /var/lock/subsys/p0f
+	eend ${?}
+}
\ No newline at end of file