Pullup ticket 267 - requested by Adrian Portelli

security fix for snort

Revisions pulled up:
- pkgsrc/net/snort/Makefile.common  1.17
- pkgsrc/net/snort/PLIST            1.18
- pkgsrc/net/snort/distinfo         1.24
- pkgsrc/net/snort-mysql/Makefile   1.12
- pkgsrc/net/snort-contrib/DESCR    removed
- pkgsrc/net/snort-contrib/Makefile removed
- pkgsrc/net/snort-contrib/PLIST    removed
- pkgsrc/net/snort-contrib/distinfo removed

   Module Name:		pkgsrc
   Committed By:	adrianp
   Date:		Fri Jan 28 23:02:41 UTC 2005

   Modified Files:
   	pkgsrc/net/snort: Makefile Makefile.common PLIST

   Log Message:
   Update to snort 2.3.0

   2005-01-25 - Snort 2.3.0 Final Released

   * Fixed issue with sfPortscan reporting incorrect IP datagram length.
     Thanks Jon Hart for the test case and finding the bug, and Marc Norton
     for resolving the issue.

   * Threshold/Suppression now prints properly when logging to syslog.
     Thanks Sekure for pointing out the problem. Thanks Steve Sturges for
     working on the fix.

   * Threshold memcap argument now correctly handles non-integer input.
     Thanks nnposter for the patch.

   * Fixed issue reported by Allan Jensen, where on MacOS X, ppp links were
     not decoded properly. Thanks Dan Roelker for the fix.

   * Snort manual and FAQ are updated for 2.3. Thanks Jen Harvey for your
     work on putting it all together.

   2004-12-15 - Snort 2.3.0 RC2 Released

   * Small performance improvement to arpspoof and also fixed a problem
     where the list of configured IP/MAC entries would contain only one
     entry and leaked memory (Jeff Nathan).

   * Fixed a problem affecting MacOS X where linking may fail with
     non-standard libraries when global symbols are encountered multiple
     times (Jeff Nathan).

   * Ignore RST|ACK midstream pickup case so we don't get an evasive TCP
     alerts.  Thanks for the report, Sekure. Thanks Dan Roelker for the fix.

   * Moved CheckLogDir() to after parsing snort.conf (for IDS mode) so the
     logdir config will work if the default or command-line logdir does not
     exist on the system. Thanks Dan Roelker.

   * Fixed bug when setting the doe_ptr on a successful pcre match.
     It is now set relative to base_ptr. Thanks Steve Sturges for the
     fix.

   * Added from_beginning and multiplier options for byte_jump.
     from_beginning skips bytes from the beginning of the content,
     instead of from the location immediately following the number
     of bytes to skip.  multiplier takes a numeric argument, and
     skips x times that number of bytes. Thanks again to Steve Sturges.

   * In "fast" output, now log only actual packet contents when UDP
     data length is greater than actual data length. Thanks Brian
     Caswell for spotting this, and Andrew Mullican for working on the fix.

   * Please check the ChangeLog for further details.

   2004-11-18 - Snort 2.3.0 RC1 Released

   * Added IPS functionality from Snort-Inline.  A big thanks to the
     Snort-Inline guys (Jed Haile, Rob McMillen, William Metcalf, and Victor
     Julien).  Also, Thanks Dan Roelker for doing the integrating of
     Snort-Inline into the official Snort project.

   * Added new portscan detector.  The design and implementation was headed
     up by Dan Roelker, and included Marc Norton and Jeremy Hewlett.

   * Numerous changes for better 64bit Snort support from Jeremy Hewlett and
     Marc Norton.  Additionally, an --enable-64bit-gcc option was added to
     configure.  However, there are still some memory alignment issues to
     work out before 64bit mode is fully functional, patches are welcomed.
     Thanks Chris Baker for doing 64bit testing.

   * Added not_established keyword to the flow detection option.  This allows
     snort to do dynamic firewall rulesets.  Experimental for now.

   * Added an enforce_state keyword to stream4 so we won't pick up midstream
     sessions.  This works well for asynchronous links and also for
     just monitoring legitimate traffic.

   * Relocated ./contrib files to http://www.snort.org/dl/contrib as many
     are not maintained by Sourcefire and are out of date. The rpm and
     schema files have been relocated in their respective 'rpm' and 'schemas'
     directories under the snort parent directory.

   * perfmonitor config line can now be configured with "accumulate" or
     "reset."  Thanks Marc Norton for the feature, and Barry Basselgia for
     pointing out the issue.  Thanks Scott Dexter and Andreas Ostling for
     doing some initial testing.

   * Fixed 64-bit bug in sfmemcap.c found and tested by Ryan Matteson
     and Clay McClure.  Thanks guys.

   * Fixed reference times to match log time for first packet, for an event
     generated by a reassembled packet.  Incremented event ID to give
     unique ID for each packet.  Also made unified logging compatible with
     Windows.  Thanks Andrew Mullican for the fix.

   * Fixed linux perfmonitoring stats for the 2.6 kernel.  Thanks to
     everyone that reported this bug.  Thanks Dan Roelker for the fix.

   * Get thresholding/suppression to work for alerts that do not
     contain an ip header (primarily decode alerts).  Thanks
     Brian Caswell.

   * Fix conditions where snort would log double web alerts that
     contained only content options (no uricontents).  Thanks to kawa for
     finding and reporting this bug.

   * Fix suppression/thresholding bug for non-rule alerts.  Thanks to
     Alex Butcher for reporting it to us.

   * Many other bug fixes, please check the ChangeLog for details.
---
   Module Name:		pkgsrc
   Committed By:	taca
   Date:		Sat Jan 29 03:27:58 UTC 2005

   Modified Files:
   	pkgsrc/net/snort: distinfo

   Log Message:
   Update distinfo for snort-2.3.0.
---
   Module Name:		pkgsrc
   Committed By:	adrianp
   Date:		Fri Jan 28 23:03:59 UTC 2005

   Modified Files:
   	pkgsrc/net/snort-mysql: Makefile

   Log Message:
   Sync and minor tidy up for snort 2.3.0 release.
---
   Module Name:		pkgsrc
   Committed By:	adrianp
   Date:		Fri Jan 28 22:51:27 UTC 2005

   Removed Files:
   	pkgsrc/net/snort-contrib: DESCR Makefile PLIST distinfo

   Log Message:
   As of snort 2.3.0 all contrib files are now available from:
   http://www.snort.org/dl/contrib/

9 files changed, 431 insertions, 110 deletions

diff --git a/net/Makefile b/net/Makefile
index 11858eb8817..a09fae42d43 100644
--- a/net/Makefile
+++ b/net/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.521 2004/12/09 15:43:13 wiz Exp $
+# $NetBSD: Makefile,v 1.521.2.1 2005/02/04 08:02:37 salo Exp $
 #
 
 COMMENT=	Networking tools
@@ -332,7 +332,6 @@ SUBDIR+=	slurm
 SUBDIR+=	smokeping
 SUBDIR+=	sniffit
 SUBDIR+=	snort
-SUBDIR+=	snort-contrib
 SUBDIR+=	snort-mysql
 SUBDIR+=	snort-pgsql
 SUBDIR+=	socat
diff --git a/net/snort-contrib/DESCR b/net/snort-contrib/DESCR
deleted file mode 100644
index fcbc7ba35e4..00000000000
--- a/net/snort-contrib/DESCR
+++ /dev/null
@@ -1,13 +0,0 @@
-  Snort is a libpcap-based packet sniffer/logger which can be used
-as a lightweight network intrusion detection system.  It features
-rules based logging and can perform protocol analysis, content
-searching/matching and can be used to detect a variety of attacks
-and probes, such as buffer overflows, stealth port scans, CGI
-attacks, SMB probes, OS fingerprinting attempts, and much more.
-
-  Snort has a real-time alerting capability, with alerts being sent
-to syslog or a separate "alert" file.   As of version 1.1 it can
-also send WinPopup messages via Samba.
-
-This package contains the files from the contrib directory of the snort
-tarball.
diff --git a/net/snort-contrib/Makefile b/net/snort-contrib/Makefile
deleted file mode 100644
index 2be8f49f5ce..00000000000
--- a/net/snort-contrib/Makefile
+++ /dev/null
@@ -1,54 +0,0 @@
-# $NetBSD: Makefile,v 1.1.1.1 2004/09/22 15:01:35 adrianp Exp $
-
-DISTNAME=	snort-2.2.0
-PKGNAME=	${DISTNAME:S/-/-contrib-/}
-CATEGORIES=	net security
-MASTER_SITES=	http://www.snort.org/dl/ \
-		ftp://the.wiretapped.net/pub/security/network-intrusion-detection/snort/ \
-		ftp://gd.tuwien.ac.at/infosys/security/snort/dl/
-
-MAINTAINER=	adrianp@NetBSD.org
-HOMEPAGE=	http://www.snort.org/
-COMMENT=	Network Intrusion Detection System (contrib files)
-
-USE_BUILDLINK3=	NO
-NO_CONFIGURE=	YES
-NO_BUILD=	YES
-USE_PERL5=	YES
-
-SNORTDIR=	${PREFIX}/share/snort
-CONTRIBDIR=	${WRKSRC}/contrib
-REPLACE_PERL=	contrib/regen-sidmap contrib/snort-sort.pl \
-		contrib/snort2html.pl contrib/snort_stat.pl snortlog
-
-SUBST_CLASSES=		paths
-SUBST_STAGE.paths=	post-patch
-SUBST_FILES.paths=	contrib/address_config.sh contrib/S99snort
-SUBST_SED.paths=	-e "s|/bin/sh|${SH}|g" \
-			-e "s|/usr/local/bin|${PREFIX}/bin|g" \
-			-e "s|/bin/bash|${SH}|g" \
-			-e "s|/usr/local/share/snort/snort.conf|${PKG_SYSCONFDIR}|g" \
-
-do-install:
-	${INSTALL_DATA_DIR} ${SNORTDIR}
-	${INSTALL_SCRIPT} ${CONTRIBDIR}/S99snort ${SNORTDIR}
-	${INSTALL_SCRIPT} ${CONTRIBDIR}/address_config.sh ${SNORTDIR}
-	${INSTALL_DATA} ${CONTRIBDIR}/ms_unicode_generator.c ${SNORTDIR}
-	${INSTALL_DATA} ${CONTRIBDIR}/mysql.php3 ${SNORTDIR}
-	${INSTALL_DATA} ${CONTRIBDIR}/Spade-092200.1.tar.gz ${SNORTDIR}
-	${INSTALL_DATA} ${CONTRIBDIR}/Guardian.tar.gz ${SNORTDIR}
-	${INSTALL_DATA} ${CONTRIBDIR}/Net-SnortLog-0.1.tar.gz ${SNORTDIR}
-	${INSTALL_DATA} ${CONTRIBDIR}/passiveOS.tar.gz ${SNORTDIR}
-	${INSTALL_DATA} ${CONTRIBDIR}/perfstats.c ${SNORTDIR}
-	${INSTALL_DATA} ${CONTRIBDIR}/pgsql.php3 ${SNORTDIR}
-	${INSTALL_SCRIPT} ${CONTRIBDIR}/regen-sidmap ${SNORTDIR}
-	${INSTALL_SCRIPT} ${CONTRIBDIR}/snort-sort.pl ${SNORTDIR}
-	${INSTALL_SCRIPT} ${CONTRIBDIR}/snort2html.pl ${SNORTDIR}
-	${INSTALL_SCRIPT} ${CONTRIBDIR}/snort_stat.pl ${SNORTDIR}
-	${INSTALL_SCRIPT} ${CONTRIBDIR}/snortlog ${SNORTDIR}
-	${INSTALL_DATA} ${CONTRIBDIR}/snortdb-extra.gz ${SNORTDIR}
-	${INSTALL_DATA} ${CONTRIBDIR}/snortnet.tar.gz ${SNORTDIR}
-	${INSTALL_DATA} ${CONTRIBDIR}/snortpp.c ${SNORTDIR}
-	${INSTALL_DATA} ${CONTRIBDIR}/snortwatch-0.7.tar.gz ${SNORTDIR}
-
-.include "../../mk/bsd.pkg.mk"
diff --git a/net/snort-contrib/PLIST b/net/snort-contrib/PLIST
deleted file mode 100644
index 7a8f00f129b..00000000000
--- a/net/snort-contrib/PLIST
+++ /dev/null
@@ -1,21 +0,0 @@
-@comment $NetBSD: PLIST,v 1.1.1.1 2004/09/22 15:01:36 adrianp Exp $
-share/snort/Guardian.tar.gz
-share/snort/Net-SnortLog-0.1.tar.gz
-share/snort/S99snort
-share/snort/Spade-092200.1.tar.gz
-share/snort/address_config.sh
-share/snort/ms_unicode_generator.c
-share/snort/mysql.php3
-share/snort/passiveOS.tar.gz
-share/snort/perfstats.c
-share/snort/pgsql.php3
-share/snort/regen-sidmap
-share/snort/snort-sort.pl
-share/snort/snort2html.pl
-share/snort/snort_stat.pl
-share/snort/snortdb-extra.gz
-share/snort/snortlog
-share/snort/snortnet.tar.gz
-share/snort/snortpp.c
-share/snort/snortwatch-0.7.tar.gz
-@unexec ${RMDIR} %D/share/snort 2>/dev/null || ${TRUE}
diff --git a/net/snort-contrib/distinfo b/net/snort-contrib/distinfo
deleted file mode 100644
index c359d07f65c..00000000000
--- a/net/snort-contrib/distinfo
+++ /dev/null
@@ -1,4 +0,0 @@
-$NetBSD: distinfo,v 1.1.1.1 2004/09/22 15:01:36 adrianp Exp $
-
-SHA1 (snort-2.2.0.tar.gz) = 80975f71ac2e6d123b881b60b49e97b96264045d
-Size (snort-2.2.0.tar.gz) = 2498466 bytes
diff --git a/net/snort-mysql/Makefile b/net/snort-mysql/Makefile
index 4c99e4158f0..e9449a11e20 100644
--- a/net/snort-mysql/Makefile
+++ b/net/snort-mysql/Makefile
@@ -1,9 +1,8 @@
-# $NetBSD: Makefile,v 1.11 2004/10/29 05:59:24 jdolecek Exp $
+# $NetBSD: Makefile,v 1.11.2.1 2005/02/04 08:02:38 salo Exp $
 
 .include "../../net/snort/Makefile.common"
 
 PKGNAME=	${DISTNAME:S/-/-mysql-/}
-PKGREVISION=	1
 
 COMMENT=	Network Intrusion Detection System (with MySQL support)
 
@@ -19,5 +18,4 @@ CONFIGURE_ARGS+=	--with-mysql=${BUILDLINK_PREFIX.mysql-client}
 LDFLAGS+=		${BUILDLINK_LDFLAGS.mysql-client}
 
 .include "../../mk/mysql.buildlink3.mk"
-
 .include "../../mk/bsd.pkg.mk"
diff --git a/net/snort/Makefile.common b/net/snort/Makefile.common
index 2ceb8ae63ed..81ed9ec8bf7 100644
--- a/net/snort/Makefile.common
+++ b/net/snort/Makefile.common
@@ -1,7 +1,7 @@
-# $NetBSD: Makefile.common,v 1.16 2004/09/21 15:50:26 adrianp Exp $
+# $NetBSD: Makefile.common,v 1.16.2.1 2005/02/04 08:02:37 salo Exp $
 #
 
-DISTNAME=		snort-2.2.0
+DISTNAME=		snort-2.3.0
 CATEGORIES=		net security
 MASTER_SITES=		http://www.snort.org/dl/ \
 			ftp://the.wiretapped.net/pub/security/network-intrusion-detection/snort/ \
@@ -80,7 +80,6 @@ post-install:
 		${INSTALL_DATA} $$i ${PREFIX}/share/snort/rules ; \
 	done
 	${INSTALL_MAN} ${WRKSRC}/snort.8 ${PREFIX}/man/man8
-	${INSTALL_DATA} ${WRKSRC}/contrib/create_* ${SNORTDIR}
 
 .include "../../devel/pcre/buildlink3.mk"
 .include "../../net/libpcap/buildlink3.mk"
diff --git a/net/snort/PLIST b/net/snort/PLIST
index ed0086acde6..7492f1aa5e7 100644
--- a/net/snort/PLIST
+++ b/net/snort/PLIST
@@ -1,15 +1,15 @@
-@comment $NetBSD: PLIST,v 1.17 2004/09/23 20:01:34 adrianp Exp $
+@comment $NetBSD: PLIST,v 1.17.2.1 2005/02/04 08:02:38 salo Exp $
 bin/snort
 man/man8/snort.8
 share/doc/snort/AUTHORS
 share/doc/snort/BUGS
 share/doc/snort/CREDITS
-share/doc/snort/FAQ
 share/doc/snort/INSTALL
 share/doc/snort/NEWS
 share/doc/snort/PROBLEMS
 share/doc/snort/README
 share/doc/snort/README.FLEXRESP
+share/doc/snort/README.INLINE
 share/doc/snort/README.PLUGINS
 share/doc/snort/README.UNSOCK
 share/doc/snort/README.WIN32
@@ -22,12 +22,15 @@ share/doc/snort/README.flow
 share/doc/snort/README.flow-portscan
 share/doc/snort/README.flowbits
 share/doc/snort/README.http_inspect
+share/doc/snort/README.sfportscan
 share/doc/snort/README.thresholding
 share/doc/snort/README.wireless
 share/doc/snort/RULES.todo
 share/doc/snort/TODO
 share/doc/snort/USAGE
 share/doc/snort/WISHLIST
+share/doc/snort/faq.pdf
+share/doc/snort/faq.tex
 share/doc/snort/signatures/1000.txt
 share/doc/snort/signatures/1001.txt
 share/doc/snort/signatures/1002.txt
@@ -141,6 +144,23 @@ share/doc/snort/signatures/1106.txt
 share/doc/snort/signatures/1107.txt
 share/doc/snort/signatures/1108.txt
 share/doc/snort/signatures/1109.txt
+share/doc/snort/signatures/111-1.txt
+share/doc/snort/signatures/111-10.txt
+share/doc/snort/signatures/111-11.txt
+share/doc/snort/signatures/111-12.txt
+share/doc/snort/signatures/111-13.txt
+share/doc/snort/signatures/111-14.txt
+share/doc/snort/signatures/111-15.txt
+share/doc/snort/signatures/111-16.txt
+share/doc/snort/signatures/111-17.txt
+share/doc/snort/signatures/111-2.txt
+share/doc/snort/signatures/111-3.txt
+share/doc/snort/signatures/111-4.txt
+share/doc/snort/signatures/111-5.txt
+share/doc/snort/signatures/111-6.txt
+share/doc/snort/signatures/111-7.txt
+share/doc/snort/signatures/111-8.txt
+share/doc/snort/signatures/111-9.txt
 share/doc/snort/signatures/111.txt
 share/doc/snort/signatures/1110.txt
 share/doc/snort/signatures/1111.txt
@@ -1765,43 +1785,444 @@ share/doc/snort/signatures/2652.txt
 share/doc/snort/signatures/2653.txt
 share/doc/snort/signatures/2654.txt
 share/doc/snort/signatures/2655.txt
+share/doc/snort/signatures/2656.txt
+share/doc/snort/signatures/2657.txt
+share/doc/snort/signatures/2658.txt
+share/doc/snort/signatures/2659.txt
 share/doc/snort/signatures/266.txt
+share/doc/snort/signatures/2660.txt
+share/doc/snort/signatures/2661.txt
+share/doc/snort/signatures/2662.txt
+share/doc/snort/signatures/2663.txt
+share/doc/snort/signatures/2664.txt
+share/doc/snort/signatures/2665.txt
+share/doc/snort/signatures/2666.txt
+share/doc/snort/signatures/2667.txt
+share/doc/snort/signatures/2668.txt
+share/doc/snort/signatures/2669.txt
 share/doc/snort/signatures/267.txt
+share/doc/snort/signatures/2670.txt
+share/doc/snort/signatures/2671.txt
+share/doc/snort/signatures/2672.txt
+share/doc/snort/signatures/2673.txt
+share/doc/snort/signatures/2674.txt
+share/doc/snort/signatures/2675.txt
+share/doc/snort/signatures/2676.txt
+share/doc/snort/signatures/2677.txt
+share/doc/snort/signatures/2678.txt
+share/doc/snort/signatures/2679.txt
 share/doc/snort/signatures/268.txt
+share/doc/snort/signatures/2680.txt
+share/doc/snort/signatures/2681.txt
+share/doc/snort/signatures/2682.txt
+share/doc/snort/signatures/2683.txt
+share/doc/snort/signatures/2684.txt
+share/doc/snort/signatures/2685.txt
+share/doc/snort/signatures/2686.txt
+share/doc/snort/signatures/2687.txt
+share/doc/snort/signatures/2688.txt
+share/doc/snort/signatures/2689.txt
 share/doc/snort/signatures/269.txt
+share/doc/snort/signatures/2690.txt
+share/doc/snort/signatures/2691.txt
+share/doc/snort/signatures/2692.txt
+share/doc/snort/signatures/2693.txt
+share/doc/snort/signatures/2694.txt
+share/doc/snort/signatures/2695.txt
+share/doc/snort/signatures/2696.txt
+share/doc/snort/signatures/2697.txt
+share/doc/snort/signatures/2698.txt
+share/doc/snort/signatures/2699.txt
 share/doc/snort/signatures/270.txt
+share/doc/snort/signatures/2700.txt
+share/doc/snort/signatures/2701.txt
+share/doc/snort/signatures/2702.txt
+share/doc/snort/signatures/2703.txt
+share/doc/snort/signatures/2704.txt
+share/doc/snort/signatures/2705.txt
+share/doc/snort/signatures/2706.txt
+share/doc/snort/signatures/2707.txt
+share/doc/snort/signatures/2708.txt
+share/doc/snort/signatures/2709.txt
 share/doc/snort/signatures/271.txt
+share/doc/snort/signatures/2710.txt
+share/doc/snort/signatures/2711.txt
+share/doc/snort/signatures/2712.txt
+share/doc/snort/signatures/2713.txt
+share/doc/snort/signatures/2714.txt
+share/doc/snort/signatures/2715.txt
+share/doc/snort/signatures/2716.txt
+share/doc/snort/signatures/2717.txt
+share/doc/snort/signatures/2718.txt
+share/doc/snort/signatures/2719.txt
 share/doc/snort/signatures/272.txt
+share/doc/snort/signatures/2720.txt
+share/doc/snort/signatures/2721.txt
+share/doc/snort/signatures/2722.txt
+share/doc/snort/signatures/2723.txt
+share/doc/snort/signatures/2724.txt
+share/doc/snort/signatures/2725.txt
+share/doc/snort/signatures/2726.txt
+share/doc/snort/signatures/2727.txt
+share/doc/snort/signatures/2728.txt
+share/doc/snort/signatures/2729.txt
 share/doc/snort/signatures/273.txt
+share/doc/snort/signatures/2730.txt
+share/doc/snort/signatures/2731.txt
+share/doc/snort/signatures/2732.txt
+share/doc/snort/signatures/2733.txt
+share/doc/snort/signatures/2734.txt
+share/doc/snort/signatures/2735.txt
+share/doc/snort/signatures/2736.txt
+share/doc/snort/signatures/2737.txt
+share/doc/snort/signatures/2738.txt
+share/doc/snort/signatures/2739.txt
 share/doc/snort/signatures/274.txt
+share/doc/snort/signatures/2740.txt
+share/doc/snort/signatures/2741.txt
+share/doc/snort/signatures/2742.txt
+share/doc/snort/signatures/2743.txt
+share/doc/snort/signatures/2744.txt
+share/doc/snort/signatures/2745.txt
+share/doc/snort/signatures/2746.txt
+share/doc/snort/signatures/2747.txt
+share/doc/snort/signatures/2748.txt
+share/doc/snort/signatures/2749.txt
 share/doc/snort/signatures/275.txt
+share/doc/snort/signatures/2750.txt
+share/doc/snort/signatures/2751.txt
+share/doc/snort/signatures/2752.txt
+share/doc/snort/signatures/2753.txt
+share/doc/snort/signatures/2754.txt
+share/doc/snort/signatures/2755.txt
+share/doc/snort/signatures/2756.txt
+share/doc/snort/signatures/2757.txt
+share/doc/snort/signatures/2758.txt
+share/doc/snort/signatures/2759.txt
 share/doc/snort/signatures/276.txt
+share/doc/snort/signatures/2760.txt
+share/doc/snort/signatures/2761.txt
+share/doc/snort/signatures/2762.txt
+share/doc/snort/signatures/2763.txt
+share/doc/snort/signatures/2764.txt
+share/doc/snort/signatures/2765.txt
+share/doc/snort/signatures/2766.txt
+share/doc/snort/signatures/2767.txt
+share/doc/snort/signatures/2768.txt
+share/doc/snort/signatures/2769.txt
 share/doc/snort/signatures/277.txt
+share/doc/snort/signatures/2770.txt
+share/doc/snort/signatures/2771.txt
+share/doc/snort/signatures/2772.txt
+share/doc/snort/signatures/2773.txt
+share/doc/snort/signatures/2774.txt
+share/doc/snort/signatures/2775.txt
+share/doc/snort/signatures/2776.txt
+share/doc/snort/signatures/2777.txt
+share/doc/snort/signatures/2778.txt
+share/doc/snort/signatures/2779.txt
 share/doc/snort/signatures/278.txt
+share/doc/snort/signatures/2780.txt
+share/doc/snort/signatures/2781.txt
+share/doc/snort/signatures/2782.txt
+share/doc/snort/signatures/2783.txt
+share/doc/snort/signatures/2784.txt
+share/doc/snort/signatures/2785.txt
+share/doc/snort/signatures/2786.txt
+share/doc/snort/signatures/2787.txt
+share/doc/snort/signatures/2788.txt
+share/doc/snort/signatures/2789.txt
 share/doc/snort/signatures/279.txt
+share/doc/snort/signatures/2790.txt
+share/doc/snort/signatures/2791.txt
+share/doc/snort/signatures/2792.txt
+share/doc/snort/signatures/2793.txt
+share/doc/snort/signatures/2794.txt
+share/doc/snort/signatures/2795.txt
+share/doc/snort/signatures/2796.txt
+share/doc/snort/signatures/2797.txt
+share/doc/snort/signatures/2798.txt
+share/doc/snort/signatures/2799.txt
+share/doc/snort/signatures/2800.txt
+share/doc/snort/signatures/2801.txt
+share/doc/snort/signatures/2802.txt
+share/doc/snort/signatures/2803.txt
+share/doc/snort/signatures/2804.txt
+share/doc/snort/signatures/2805.txt
+share/doc/snort/signatures/2806.txt
+share/doc/snort/signatures/2807.txt
+share/doc/snort/signatures/2808.txt
+share/doc/snort/signatures/2809.txt
 share/doc/snort/signatures/281.txt
+share/doc/snort/signatures/2810.txt
+share/doc/snort/signatures/2811.txt
+share/doc/snort/signatures/2812.txt
+share/doc/snort/signatures/2813.txt
+share/doc/snort/signatures/2814.txt
+share/doc/snort/signatures/2815.txt
+share/doc/snort/signatures/2816.txt
+share/doc/snort/signatures/2817.txt
+share/doc/snort/signatures/2818.txt
+share/doc/snort/signatures/2819.txt
 share/doc/snort/signatures/282.txt
+share/doc/snort/signatures/2820.txt
+share/doc/snort/signatures/2821.txt
+share/doc/snort/signatures/2822.txt
+share/doc/snort/signatures/2823.txt
+share/doc/snort/signatures/2824.txt
+share/doc/snort/signatures/2825.txt
+share/doc/snort/signatures/2826.txt
+share/doc/snort/signatures/2827.txt
+share/doc/snort/signatures/2828.txt
+share/doc/snort/signatures/2829.txt
 share/doc/snort/signatures/283.txt
+share/doc/snort/signatures/2830.txt
+share/doc/snort/signatures/2831.txt
+share/doc/snort/signatures/2832.txt
+share/doc/snort/signatures/2833.txt
+share/doc/snort/signatures/2834.txt
+share/doc/snort/signatures/2835.txt
+share/doc/snort/signatures/2836.txt
+share/doc/snort/signatures/2837.txt
+share/doc/snort/signatures/2838.txt
+share/doc/snort/signatures/2839.txt
 share/doc/snort/signatures/284.txt
+share/doc/snort/signatures/2840.txt
+share/doc/snort/signatures/2841.txt
+share/doc/snort/signatures/2842.txt
+share/doc/snort/signatures/2843.txt
+share/doc/snort/signatures/2844.txt
+share/doc/snort/signatures/2845.txt
+share/doc/snort/signatures/2846.txt
+share/doc/snort/signatures/2847.txt
+share/doc/snort/signatures/2848.txt
+share/doc/snort/signatures/2849.txt
 share/doc/snort/signatures/285.txt
+share/doc/snort/signatures/2850.txt
+share/doc/snort/signatures/2851.txt
+share/doc/snort/signatures/2852.txt
+share/doc/snort/signatures/2853.txt
+share/doc/snort/signatures/2854.txt
+share/doc/snort/signatures/2855.txt
+share/doc/snort/signatures/2856.txt
+share/doc/snort/signatures/2857.txt
+share/doc/snort/signatures/2858.txt
+share/doc/snort/signatures/2859.txt
 share/doc/snort/signatures/286.txt
+share/doc/snort/signatures/2860.txt
+share/doc/snort/signatures/2861.txt
+share/doc/snort/signatures/2862.txt
+share/doc/snort/signatures/2863.txt
+share/doc/snort/signatures/2864.txt
+share/doc/snort/signatures/2865.txt
+share/doc/snort/signatures/2866.txt
+share/doc/snort/signatures/2867.txt
+share/doc/snort/signatures/2868.txt
+share/doc/snort/signatures/2869.txt
 share/doc/snort/signatures/287.txt
+share/doc/snort/signatures/2870.txt
+share/doc/snort/signatures/2871.txt
+share/doc/snort/signatures/2872.txt
+share/doc/snort/signatures/2873.txt
+share/doc/snort/signatures/2874.txt
+share/doc/snort/signatures/2875.txt
+share/doc/snort/signatures/2876.txt
+share/doc/snort/signatures/2877.txt
+share/doc/snort/signatures/2878.txt
+share/doc/snort/signatures/2879.txt
 share/doc/snort/signatures/288.txt
+share/doc/snort/signatures/2880.txt
+share/doc/snort/signatures/2881.txt
+share/doc/snort/signatures/2882.txt
+share/doc/snort/signatures/2883.txt
+share/doc/snort/signatures/2884.txt
+share/doc/snort/signatures/2885.txt
+share/doc/snort/signatures/2886.txt
+share/doc/snort/signatures/2887.txt
+share/doc/snort/signatures/2888.txt
+share/doc/snort/signatures/2889.txt
 share/doc/snort/signatures/289.txt
+share/doc/snort/signatures/2890.txt
+share/doc/snort/signatures/2891.txt
+share/doc/snort/signatures/2892.txt
+share/doc/snort/signatures/2893.txt
+share/doc/snort/signatures/2894.txt
+share/doc/snort/signatures/2895.txt
+share/doc/snort/signatures/2896.txt
+share/doc/snort/signatures/2897.txt
+share/doc/snort/signatures/2898.txt
+share/doc/snort/signatures/2899.txt
 share/doc/snort/signatures/290.txt
+share/doc/snort/signatures/2900.txt
+share/doc/snort/signatures/2901.txt
+share/doc/snort/signatures/2902.txt
+share/doc/snort/signatures/2903.txt
+share/doc/snort/signatures/2904.txt
+share/doc/snort/signatures/2905.txt
+share/doc/snort/signatures/2906.txt
+share/doc/snort/signatures/2907.txt
+share/doc/snort/signatures/2908.txt
+share/doc/snort/signatures/2909.txt
 share/doc/snort/signatures/291.txt
+share/doc/snort/signatures/2910.txt
+share/doc/snort/signatures/2911.txt
+share/doc/snort/signatures/2912.txt
+share/doc/snort/signatures/2913.txt
+share/doc/snort/signatures/2914.txt
+share/doc/snort/signatures/2915.txt
+share/doc/snort/signatures/2916.txt
+share/doc/snort/signatures/2917.txt
+share/doc/snort/signatures/2918.txt
+share/doc/snort/signatures/2919.txt
 share/doc/snort/signatures/292.txt
+share/doc/snort/signatures/2921.txt
+share/doc/snort/signatures/2922.txt
+share/doc/snort/signatures/2923.txt
+share/doc/snort/signatures/2924.txt
+share/doc/snort/signatures/2925.txt
+share/doc/snort/signatures/2926.txt
+share/doc/snort/signatures/2927.txt
+share/doc/snort/signatures/2928.txt
+share/doc/snort/signatures/2929.txt
+share/doc/snort/signatures/2930.txt
+share/doc/snort/signatures/2931.txt
+share/doc/snort/signatures/2932.txt
+share/doc/snort/signatures/2933.txt
+share/doc/snort/signatures/2934.txt
+share/doc/snort/signatures/2935.txt
+share/doc/snort/signatures/2936.txt
+share/doc/snort/signatures/2937.txt
+share/doc/snort/signatures/2938.txt
+share/doc/snort/signatures/2939.txt
+share/doc/snort/signatures/2940.txt
+share/doc/snort/signatures/2941.txt
+share/doc/snort/signatures/2942.txt
+share/doc/snort/signatures/2943.txt
+share/doc/snort/signatures/2944.txt
+share/doc/snort/signatures/2945.txt
+share/doc/snort/signatures/2946.txt
+share/doc/snort/signatures/2947.txt
+share/doc/snort/signatures/2948.txt
+share/doc/snort/signatures/2949.txt
 share/doc/snort/signatures/295.txt
+share/doc/snort/signatures/2950.txt
+share/doc/snort/signatures/2951.txt
+share/doc/snort/signatures/2952.txt
+share/doc/snort/signatures/2953.txt
+share/doc/snort/signatures/2954.txt
+share/doc/snort/signatures/2955.txt
+share/doc/snort/signatures/2956.txt
+share/doc/snort/signatures/2957.txt
+share/doc/snort/signatures/2958.txt
+share/doc/snort/signatures/2959.txt
 share/doc/snort/signatures/296.txt
+share/doc/snort/signatures/2960.txt
+share/doc/snort/signatures/2961.txt
+share/doc/snort/signatures/2962.txt
+share/doc/snort/signatures/2963.txt
+share/doc/snort/signatures/2964.txt
+share/doc/snort/signatures/2965.txt
+share/doc/snort/signatures/2966.txt
+share/doc/snort/signatures/2967.txt
+share/doc/snort/signatures/2968.txt
+share/doc/snort/signatures/2969.txt
 share/doc/snort/signatures/297.txt
+share/doc/snort/signatures/2970.txt
+share/doc/snort/signatures/2971.txt
+share/doc/snort/signatures/2972.txt
+share/doc/snort/signatures/2973.txt
+share/doc/snort/signatures/2974.txt
+share/doc/snort/signatures/2975.txt
+share/doc/snort/signatures/2976.txt
+share/doc/snort/signatures/2977.txt
+share/doc/snort/signatures/2978.txt
+share/doc/snort/signatures/2979.txt
 share/doc/snort/signatures/298.txt
+share/doc/snort/signatures/2980.txt
+share/doc/snort/signatures/2981.txt
+share/doc/snort/signatures/2982.txt
+share/doc/snort/signatures/2983.txt
+share/doc/snort/signatures/2984.txt
+share/doc/snort/signatures/2985.txt
+share/doc/snort/signatures/2986.txt
+share/doc/snort/signatures/2987.txt
+share/doc/snort/signatures/2988.txt
+share/doc/snort/signatures/2989.txt
 share/doc/snort/signatures/299.txt
+share/doc/snort/signatures/2990.txt
+share/doc/snort/signatures/2991.txt
+share/doc/snort/signatures/2992.txt
+share/doc/snort/signatures/2993.txt
+share/doc/snort/signatures/2994.txt
+share/doc/snort/signatures/2995.txt
+share/doc/snort/signatures/2996.txt
+share/doc/snort/signatures/2997.txt
+share/doc/snort/signatures/2998.txt
+share/doc/snort/signatures/2999.txt
 share/doc/snort/signatures/300.txt
+share/doc/snort/signatures/3000.txt
+share/doc/snort/signatures/3001.txt
+share/doc/snort/signatures/3002.txt
+share/doc/snort/signatures/3003.txt
+share/doc/snort/signatures/3004.txt
+share/doc/snort/signatures/3005.txt
+share/doc/snort/signatures/3006.txt
+share/doc/snort/signatures/3007.txt
+share/doc/snort/signatures/3008.txt
+share/doc/snort/signatures/3009.txt
 share/doc/snort/signatures/301.txt
+share/doc/snort/signatures/3010.txt
+share/doc/snort/signatures/3011.txt
+share/doc/snort/signatures/3012.txt
+share/doc/snort/signatures/3013.txt
+share/doc/snort/signatures/3014.txt
+share/doc/snort/signatures/3015.txt
+share/doc/snort/signatures/3016.txt
+share/doc/snort/signatures/3017.txt
+share/doc/snort/signatures/3018.txt
+share/doc/snort/signatures/3019.txt
 share/doc/snort/signatures/302.txt
+share/doc/snort/signatures/3020.txt
+share/doc/snort/signatures/3021.txt
+share/doc/snort/signatures/3022.txt
+share/doc/snort/signatures/3023.txt
+share/doc/snort/signatures/3024.txt
+share/doc/snort/signatures/3025.txt
+share/doc/snort/signatures/3026.txt
+share/doc/snort/signatures/3027.txt
+share/doc/snort/signatures/3028.txt
+share/doc/snort/signatures/3029.txt
 share/doc/snort/signatures/303.txt
+share/doc/snort/signatures/3030.txt
+share/doc/snort/signatures/3031.txt
+share/doc/snort/signatures/3032.txt
+share/doc/snort/signatures/3033.txt
+share/doc/snort/signatures/3034.txt
+share/doc/snort/signatures/3035.txt
+share/doc/snort/signatures/3036.txt
+share/doc/snort/signatures/3037.txt
+share/doc/snort/signatures/3038.txt
+share/doc/snort/signatures/3039.txt
 share/doc/snort/signatures/304.txt
+share/doc/snort/signatures/3040.txt
+share/doc/snort/signatures/3041.txt
+share/doc/snort/signatures/3042.txt
+share/doc/snort/signatures/3043.txt
+share/doc/snort/signatures/3044.txt
+share/doc/snort/signatures/3045.txt
+share/doc/snort/signatures/3046.txt
+share/doc/snort/signatures/3047.txt
+share/doc/snort/signatures/3048.txt
+share/doc/snort/signatures/3049.txt
 share/doc/snort/signatures/305.txt
+share/doc/snort/signatures/3050.txt
+share/doc/snort/signatures/3051.txt
+share/doc/snort/signatures/3052.txt
+share/doc/snort/signatures/3053.txt
+share/doc/snort/signatures/3054.txt
+share/doc/snort/signatures/3055.txt
+share/doc/snort/signatures/3056.txt
+share/doc/snort/signatures/3057.txt
 share/doc/snort/signatures/306.txt
 share/doc/snort/signatures/307.txt
 share/doc/snort/signatures/308.txt
@@ -2411,10 +2832,6 @@ share/examples/snort/sid-msg.map
 share/examples/snort/snort.conf.default
 share/examples/snort/threshold.conf
 share/examples/snort/unicode.map
-share/snort/create_mssql
-share/snort/create_mysql
-share/snort/create_oracle.sql
-share/snort/create_postgresql
 share/snort/rules/attack-responses.rules
 share/snort/rules/backdoor.rules
 share/snort/rules/bad-traffic.rules
@@ -2464,7 +2881,7 @@ share/snort/rules/web-misc.rules
 share/snort/rules/web-php.rules
 share/snort/rules/x11.rules
 @dirrm share/snort/rules
-@unexec ${RMDIR} %D/share/snort 2>/dev/null || ${TRUE}
+@dirrm share/snort
 @dirrm share/examples/snort
 @dirrm share/doc/snort/signatures
 @dirrm share/doc/snort
diff --git a/net/snort/distinfo b/net/snort/distinfo
index 120df437186..2d2d34f5284 100644
--- a/net/snort/distinfo
+++ b/net/snort/distinfo
@@ -1,7 +1,7 @@
-$NetBSD: distinfo,v 1.23 2004/09/21 15:50:26 adrianp Exp $
+$NetBSD: distinfo,v 1.23.2.1 2005/02/04 08:02:38 salo Exp $
 
-SHA1 (snort-2.2.0.tar.gz) = 80975f71ac2e6d123b881b60b49e97b96264045d
-Size (snort-2.2.0.tar.gz) = 2498466 bytes
+SHA1 (snort-2.3.0.tar.gz) = 49defb3abaa312bf54f430bba167f38f20866eb9
+Size (snort-2.3.0.tar.gz) = 2633245 bytes
 SHA1 (patch-aa) = 08bbfc795c7db4d06f1a1a887369df2c6b1a0a79
 SHA1 (patch-ab) = 0ea7deb91de5d3d68558a30e80dcbd8bd81f8a5e
 SHA1 (patch-ac) = 6cdf26fcaeb8dad9cd9562b77377bd56b49c9f38