suricara: Added systemd file and fixed reference-config-file option.

Systemd needs to support ExecStopPre to delete the chain.

diff --git a/suricata/suricata.conf b/suricata/suricata.conf
index 22d0218a744aacacb64bb6d9ebe6a8d744f125f2..672a306966d1e644cca3fa74c386e5ce61a78ad1 100644 (file)
--- a/suricata/suricata.conf
+++ b/suricata/suricata.conf
@@ -1,6 +1,7 @@
 %YAML 1.1
 ---
 # Suricata Emergingthreats Pro Open Rulesets Recommended
+reference-config-file: /etc/suricata/reference.config
 
 # Number of packets allowed to be processed simultaneously.  Default is a
 # conservative 50. a higher number will make sure CPU's/CPU cores will be

diff --git a/suricata/suricata.nm b/suricata/suricata.nm
index b1deb7901a1a4b02bc2c55f2bc394a11af7aea15..c676d0c5f018f23519d02d39bac57fe1a3bc58f4 100644 (file)
--- a/suricata/suricata.nm
+++ b/suricata/suricata.nm
@@ -5,7 +5,7 @@
 
 name       = suricata
 version    = 1.1beta3
-release    = 3
+release    = 4
 
 groups     = Networking/IDS
 url        = http://www.openinfosecfoundation.org/
@@ -51,6 +51,31 @@ end
 
 packages
        package %{name}
+
+               prerquires = systemd-units
+
+               configfiles
+                       /etc/suricata/suricata.conf
+               end
+
+               script postin
+                       /bin/systemctl daemon-reload >/dev/null 2>&1 || :
+               end
+
+               script preun
+                       /bin/systemctl --no-reload disable suricata.service >/dev/null 2>&1 || :
+                       /bin/systemctl stop suricata.service >/dev/null 2>&1 || :
+               end
+
+               script postun
+                       /bin/systemctl daemon-reload >/dev/null 2>&1 || :
+               end
+
+               script postup
+                       /bin/systemctl daemon-reload >/dev/null 2>&1 || :
+                       /bin/systemctl try-restart suricata.service >/dev/null 2>&1 || :
+               end
+
        end
        
        package %{name}-devel

diff --git a/suricata/systemd/suricata.service b/suricata/systemd/suricata.service
new file mode 100644 (file)
index 0000000..2c2ceca
--- /dev/null
+++ b/suricata/systemd/suricata.service
@@ -0,0 +1,14 @@
+[Unit]
+Description=Open Source Next Generation Intrusion Detection and Prevention Engine
+After=syslog.target network.target
+
+[Service]
+Type=forking
+ExecStart=/usr/bin/suricata -c /etc/suricata/suricata.conf -q 0 -q 1 -D
+ExecStartPost=/sbin/iptables -I INPUT -j NFQUEUE -–queue-balance 0:1
+ExecReload=/bin/kill -HUP $MAINPID
+ExecStopPre=/sbin/iptables -D INPUT -j NFQUEUE -–queue-balance 0:1
+ExecStop=/bin/kill $MAINPID
+
+[Install]
+WantedBy=multi-user.target