Index: Makefile
===================================================================
RCS file: /cvs/ports/security/portsentry/Makefile,v
diff -u -p -r1.14 Makefile
--- Makefile 27 Sep 2023 16:34:35 -0000 1.14
+++ Makefile 24 Jun 2025 09:51:20 -0000
@@ -1,41 +1,31 @@
COMMENT= port scan detection and active defense
-DISTNAME= portsentry-1.2
-CATEGORIES= security
-REVISION = 0
+V= 2.0.1
+DISTNAME= portsentry-$V-src
+PKGNAME= portsentry-$V
+EXTRACT_SUFX= .tar.xz
-# Common Public License
-PERMIT_PACKAGE= Yes
-WANTLIB= c
+HOMEPAGE= https://portsentry.xyz/
+SITES= https://github.com/portsentry/portsentry/releases/download/v$V/
-SITES= ${SITE_SOURCEFORGE:=sentrytools/}
+CATEGORIES= security
-WRKDIST= ${WRKDIR}/portsentry_beta
+# "Common Public License", see LICENSE, has patent "no litigation" terms
+PERMIT_PACKAGE= Yes
-ALL_TARGET= openbsd
-MAKE_FLAGS= CFLAGS="${CFLAGS}"
+WANTLIB= c pcap
-DOCS= README.install README.methods README.stealth
+MODULES= devel/cmake
+CONFIGURE_ARGS= -DBUILD_TESTS=On
-pre-build:
- @perl -pi -e "s,/usr/local/psionic,${SYSCONFDIR}," \
- ${WRKSRC}/portsentry.conf
- @perl -pi -e "s,/usr/local/psionic,${SYSCONFDIR}," \
- ${WRKSRC}/portsentry_config.h
+BUILD_DEPENDS= textproc/lowdown
-do-install:
- ${INSTALL_DATA_DIR} ${PREFIX}/share/examples/portsentry
+post-install:
${INSTALL_DATA_DIR} ${PREFIX}/share/doc/portsentry
- ${INSTALL_PROGRAM} ${WRKSRC}/portsentry ${PREFIX}/bin
- ${INSTALL_DATA} ${WRKSRC}/portsentry.conf \
- ${PREFIX}/share/examples/portsentry/
- ${INSTALL_DATA} ${WRKSRC}/portsentry.ignore \
- ${PREFIX}/share/examples/portsentry/
-
-.for i in ${DOCS}
- ${INSTALL_DATA} ${WRKSRC}/${i} ${PREFIX}/share/doc/portsentry/
-.endfor
+ ${INSTALL_DATA} ${WRKSRC}/docs/*.md ${PREFIX}/share/doc/portsentry/
+ lowdown -s -t man -m section=8 -m title=portsentry -m volume=''
${WRKSRC}/docs/Manual.md > ${PREFIX}/man/man8/portsentry.8
+ lowdown -s -t man -m section=5 -m title=portsentry.conf -m volume=''
${WRKSRC}/docs/portsentry.conf.md > ${PREFIX}/man/man5/portsentry.conf.5
-NO_TEST= Yes
+#lowdown -s -tman -m section=${sec} -mtitle=${name} -mvolume=''
${WRKSRC}/man/${name}.${sec}.md > ${PREFIX}/man/man${sec}/${name}.${sec
-.include <bsd.port.mk>
+.include <bsd.port.mk>
Index: distinfo
===================================================================
RCS file: /cvs/ports/security/portsentry/distinfo,v
diff -u -p -r1.5 distinfo
--- distinfo 18 Jan 2015 03:15:06 -0000 1.5
+++ distinfo 24 Jun 2025 09:51:20 -0000
@@ -1,2 +1,2 @@
-SHA256 (portsentry-1.2.tar.gz) = 3R7c/PLZ23tXIt5PHaNq5FcDvwWRevZXq290kb5/pS4=
-SIZE (portsentry-1.2.tar.gz) = 48054
+SHA256 (portsentry-2.0.1-src.tar.xz) =
6TLDX/gqsnFvgSGXXd5VLW+hK38LTXKudaQr3QgNZXk=
+SIZE (portsentry-2.0.1-src.tar.xz) = 138376
Index: patches/patch-CMakeLists_txt
===================================================================
RCS file: patches/patch-CMakeLists_txt
diff -N patches/patch-CMakeLists_txt
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ patches/patch-CMakeLists_txt 24 Jun 2025 09:51:20 -0000
@@ -0,0 +1,37 @@
+Index: CMakeLists.txt
+--- CMakeLists.txt.orig
++++ CMakeLists.txt
+@@ -9,18 +9,11 @@ option(USE_PCAP "Build with pcap code and link with li
+ set(CONFIG_FILE "\"/etc/portsentry/portsentry.conf\"" CACHE STRING "Path to
portsentry config file")
+ set(WRAPPER_HOSTS_DENY "\"/etc/hosts.deny\"" CACHE STRING "Path to hosts.deny
file")
+
+-set(STANDARD_COMPILE_OPTS -Wall -Wextra -pedantic -Werror -Wformat
-Wformat-security -Wstack-protector -Wshadow -Wredundant-decls
-Wdisabled-optimization -Wnested-externs -Wstrict-overflow=2 -fPIE
-fstack-protector-strong -fstrict-aliasing -fno-common -fno-strict-overflow
-D_FORTIFY_SOURCE=2)
++set(STANDARD_COMPILE_OPTS -Wall -Wextra -pedantic -Werror -Wformat
-Wformat-security -Wstack-protector -Wshadow -Wredundant-decls
-Wdisabled-optimization -Wnested-externs -Wstrict-overflow=2
-fstack-protector-strong -fstrict-aliasing -fno-common -fno-strict-overflow
-D_FORTIFY_SOURCE=2)
+
+-check_c_compiler_flag("-fcf-protection=full" COMPILER_SUPPORTS_CFI_PROTECTION)
+-
+-if (COMPILER_SUPPORTS_CFI_PROTECTION)
+- set(STANDARD_COMPILE_OPTS ${STANDARD_COMPILE_OPTS} -fcf-protection=full)
+-endif()
+-
+-set(STANDARD_LINK_OPTS -pie -Wl,-z,noexecstack -Wl,-z,now -Wl,-z,relro
-Wl,-z,defs -Wl,--no-undefined)
++set(STANDARD_LINK_OPTS -Wl,-z,noexecstack -Wl,-z,now -Wl,-z,relro -Wl,-z,defs
-Wl,--no-undefined)
+ set(CORE_SOURCE_FILES src/config_data.c src/configfile.c src/io.c src/util.c
src/state_machine.c src/cmdline.c src/sentry_connect.c src/sighandler.c
src/port.c src/packet_info.c src/ignore.c src/sentry.c src/block.c)
+
+-execute_process(COMMAND git log -1 --format=%h WORKING_DIRECTORY
${CMAKE_SOURCE_DIR} OUTPUT_VARIABLE GIT_COMMIT_HASH
OUTPUT_STRIP_TRAILING_WHITESPACE)
+ add_definitions("-DGIT_COMMIT_HASH=\"${GIT_COMMIT_HASH}\"")
+
+ if (USE_PCAP)
+@@ -63,9 +56,9 @@ if (USE_PCAP)
+ endif()
+
+ # INSTALL TARGETS for portsentry program
+-install(TARGETS portsentry DESTINATION usr/sbin)
+-install(FILES examples/portsentry.conf DESTINATION etc/portsentry)
+-install(FILES examples/portsentry.ignore DESTINATION etc/portsentry)
++install(TARGETS portsentry DESTINATION sbin)
++install(FILES examples/portsentry.conf DESTINATION share/examples/portsentry)
++install(FILES examples/portsentry.ignore DESTINATION
share/examples/portsentry)
+
+
+ # PORTCON - helper test program used in system tests
Index: patches/patch-docs_portsentry_conf_md
===================================================================
RCS file: patches/patch-docs_portsentry_conf_md
diff -N patches/patch-docs_portsentry_conf_md
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ patches/patch-docs_portsentry_conf_md 24 Jun 2025 09:51:20 -0000
@@ -0,0 +1,9 @@
+Index: docs/portsentry.conf.md
+--- docs/portsentry.conf.md.orig
++++ docs/portsentry.conf.md
+@@ -1,4 +1,4 @@
+-% portsentry.conf(8) | System Manager's Manual
++% portsentry.conf(5) | System Manager's Manual
+
+ # NAME
+
Index: patches/patch-examples_portsentry_conf
===================================================================
RCS file: patches/patch-examples_portsentry_conf
diff -N patches/patch-examples_portsentry_conf
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ patches/patch-examples_portsentry_conf 24 Jun 2025 09:51:20 -0000
@@ -0,0 +1,29 @@
+Index: examples/portsentry.conf
+--- examples/portsentry.conf.orig
++++ examples/portsentry.conf
+@@ -166,12 +166,15 @@ BLOCKED_FILE="/tmp/portsentry.blocked"
+ # is cleaner than the above option.
+ #KILL_ROUTE="/sbin/route add -host $TARGET$ reject"
+
+-# Generic BSD (BSDI, OpenBSD, NetBSD, FreeBSD)
++# Generic BSD
+ #KILL_ROUTE="/sbin/route add $TARGET$ 333.444.555.666"
+
+ # FreeBSD
+ #KILL_ROUTE="route add -net $TARGET$ -netmask 255.255.255.255 127.0.0.1
-blackhole"
+
++# OpenBSD
++#KILL_ROUTE="route add $TARGET$ 127.0.0.1 -reject"
++
+ # iptables support for Linux
+ #KILL_ROUTE="/usr/local/bin/iptables -I INPUT -s $TARGET$ -j DROP"
+
+@@ -183,7 +186,7 @@ BLOCKED_FILE="/tmp/portsentry.blocked"
+
+ # For those running pf (OpenBSD, etc.)
+ # NOTE THAT YOU NEED TO CHANGE external_interface to a valid interface
+-#KILL_ROUTE="/bin/echo 'block in log on external_interface from $TARGET$/32 to
any' | /sbin/pfctl -f -"
++#KILL_ROUTE="/bin/echo 'block in log on external_interface from $TARGET$/32 to
any' | /sbin/pfctl -a portsentry -f -"
+
+
+ ################
Index: patches/patch-portsentry_c
===================================================================
RCS file: patches/patch-portsentry_c
diff -N patches/patch-portsentry_c
--- patches/patch-portsentry_c 11 Mar 2022 19:53:52 -0000 1.2
+++ /dev/null 1 Jan 1970 00:00:00 -0000
@@ -1,12 +0,0 @@
---- portsentry.c.orig Wed Oct 25 07:17:38 2006
-+++ portsentry.c Wed Oct 25 07:18:02 2006
-@@ -1581,8 +1581,7 @@ void
- Usage (void)
- {
- printf ("PortSentry - Port Scan Detector.\n");
-- printf ("Copyright 1997-2003 Craig H. Rowland <craigrowland at users dot
--sourceforget dot net>\n");
-+ printf ("Copyright 1997-2003 Craig H. Rowland <craigrowland at users dot
sourceforget dot net>\n");
- printf ("Licensing restrictions apply. Please see documentation\n");
- printf ("Version: %s\n\n", VERSION);
- #ifdef SUPPORT_STEALTH
Index: patches/patch-portsentry_conf
===================================================================
RCS file: patches/patch-portsentry_conf
diff -N patches/patch-portsentry_conf
--- patches/patch-portsentry_conf 11 Mar 2022 19:53:52 -0000 1.2
+++ /dev/null 1 Jan 1970 00:00:00 -0000
@@ -1,15 +0,0 @@
---- portsentry.conf.orig Fri May 23 20:10:13 2003
-+++ portsentry.conf Wed Oct 25 22:02:13 2006
-@@ -211,10 +211,10 @@ BLOCK_TCP="1"
- #KILL_ROUTE="/sbin/ipfw add 1 deny all from $TARGET$:255.255.255.255 to any"
- #
- #
--# For those running ipfilt (OpenBSD, etc.)
-+# For those running pf (OpenBSD, etc.)
- # NOTE THAT YOU NEED TO CHANGE external_interface TO A VALID INTERFACE!!
- #
--#KILL_ROUTE="/bin/echo 'block in log on external_interface from $TARGET$/32 to
any' | /sbin/ipf -f -"
-+#KILL_ROUTE="/bin/echo 'block in log on external_interface from $TARGET$/32 to
any' | /sbin/pfctl -f -"
-
-
- ###############
Index: pkg/DESCR
===================================================================
RCS file: /cvs/ports/security/portsentry/pkg/DESCR,v
diff -u -p -r1.2 DESCR
--- pkg/DESCR 14 Aug 2003 02:52:04 -0000 1.2
+++ pkg/DESCR 24 Jun 2025 09:51:20 -0000
@@ -1,5 +1,17 @@
-PortSentry is part of the Abacus Project suite of security tools.
-It is a program designed to detect and respond to port scans against
-a target host in real-time. There are other port scan detectors that
-perform similar detection of scans, but PortSentry has some unique
-features that may make it worth looking into
+Portsentry monitors network traffic to detect port scans in real-time.
+It can identify several types of scan, including TCP, UDP, SYN, FIN,
+XMAS, and NULL scans.
+
+Upon detecting a port scan, Portsentry can respond in several ways to
+mitigate the threat:
+
+- Blocking the attacker: It can automatically add the attacker's IP
+address to the system's firewall or access control list, effectively
+blocking any further connections from that IP.
+
+- Logging: Portsentry logs the details of the scan attempt, including
+the source IP address, timestamp, and type of scan detected. This
+information can be useful for forensic analysis and monitoring.
+
+- Notification: It can send alerts to system administrators via email
+or other messaging systems to notify them of the detected scan.
Index: pkg/PLIST
===================================================================
RCS file: /cvs/ports/security/portsentry/pkg/PLIST,v
diff -u -p -r1.7 PLIST
--- pkg/PLIST 11 Mar 2022 19:53:52 -0000 1.7
+++ pkg/PLIST 24 Jun 2025 09:51:20 -0000
@@ -1,8 +1,18 @@
-bin/portsentry
+@man man/man5/portsentry.conf.5
+@man man/man8/portsentry.8
+@bin sbin/portsentry
share/doc/portsentry/
-share/doc/portsentry/README.install
-share/doc/portsentry/README.methods
-share/doc/portsentry/README.stealth
+share/doc/portsentry/Acknowledgement.md
+@comment share/doc/portsentry/Contributing.md
+@comment share/doc/portsentry/HOWTO-Compile.md
+@comment share/doc/portsentry/HOWTO-Docker.md
+@comment share/doc/portsentry/HOWTO-Fail2Ban.md
+share/doc/portsentry/HOWTO-Logfile.md
+share/doc/portsentry/HOWTO-Use-Cases.md
+share/doc/portsentry/HOWTO-Use.md
+@comment share/doc/portsentry/Manual.md
+@comment share/doc/portsentry/README.md
+@comment share/doc/portsentry/portsentry.conf.md
share/examples/portsentry/
@sample ${SYSCONFDIR}/portsentry/
share/examples/portsentry/portsentry.conf
