proj/gentoo: Initial commit

This commit represents a new era for Gentoo:
Storing the gentoo-x86 tree in Git, as converted from CVS.

This commit is the start of the NEW history.
Any historical data is intended to be grafted onto this point.

Creation process:
1. Take final CVS checkout snapshot
2. Remove ALL ChangeLog* files
3. Transform all Manifests to thin
4. Remove empty Manifests
5. Convert all stale $Header$/$Id$ CVS keywords to non-expanded Git $Id$
5.1. Do not touch files with -kb/-ko keyword flags.

Signed-off-by: Robin H. Johnson <robbat2@gentoo.org>
X-Thanks: Alec Warner <antarus@gentoo.org> - did the GSoC 2006 migration tests
X-Thanks: Robin H. Johnson <robbat2@gentoo.org> - infra guy, herding this project
X-Thanks: Nguyen Thai Ngoc Duy <pclouds@gentoo.org> - Former Gentoo developer, wrote Git features for the migration
X-Thanks: Brian Harring <ferringb@gentoo.org> - wrote much python to improve cvs2svn
X-Thanks: Rich Freeman <rich0@gentoo.org> - validation scripts
X-Thanks: Patrick Lauer <patrick@gentoo.org> - Gentoo dev, running new 2014 work in migration
X-Thanks: Michał Górny <mgorny@gentoo.org> - scripts, QA, nagging
X-Thanks: All of other Gentoo developers - many ideas and lots of paint on the bikeshed

13 files changed, 2481 insertions, 0 deletions

diff --git a/net-analyzer/snort/Manifest b/net-analyzer/snort/Manifest
new file mode 100644
index 000000000000..20d8bf973adc
--- /dev/null
+++ b/net-analyzer/snort/Manifest
@@ -0,0 +1,9 @@
+DIST snort-2.9.4.6.tar.gz 5338762 SHA256 cfaa5390b1840aaaa68a6c05a7077dd92cb916e6186a014baa451d43cdb0b3bc SHA512 e35e22cab3b98bbd42ffb4b88c4c4cc9b1c11e35952a9f3f4f684c02c81ca8604b45d16f42b3d0a6c792eeab86a8e319d8ebdd7b1a5215f93ec0e70b6ef53f98 WHIRLPOOL d029b7519e4ea2d9039fba289bf3785f60edaa22da643196b44772a99c1c9833431840845c51c627d7fce3c77758ea68f205df1a2e32a779440c3a651d2f06a3
+DIST snort-2.9.5.6.tar.gz 5049188 SHA256 69ed09077c1fa2268f814c8eff6e613b7fe8876a138df1cd6579cffbb747db55 SHA512 2a77c25f4eddd82315ea55efe046bd002f35d808fdaef2ed60d8944818e24019f9819ec2042252485b0f8dd793b6a7f52ee3f721ea4446025a81ea6147c49311 WHIRLPOOL 2dafec6f4929fe9d5a31387dcbea810fb51a7cb58af0fd1a5c34be13923efd5dcc2670f88e57038a9db9a4da568f90966dca1403295afc0ddb1a0e840ded1740
+DIST snort-2.9.6.0.tar.gz 5189146 SHA256 3cc6c8a9b52f4c863a5736a73b4012aff340b50b5e002771b04d4877f47cd19e SHA512 8af7ce53019c3a13745d2a92b4e8fd93d32431349cd3265034ad8e4a7312c73c034d6773e63eaa96e909c4b9d2a8c2c275533b9cc661cbc02375fb9cf815f995 WHIRLPOOL 3c1b77f5436b8513037e575465d77b6522ac57407a0704a051753aac0d7b2c5698c205efe3d7a50ccba07a936251798e943f8665707376b6e89c0a99a8e43773
+DIST snort-2.9.6.1.tar.gz 5226869 SHA256 119e4c5df83fe36a8d465e72a0347fe31e7771704da286f04115b0c5baa5f7b8 SHA512 455b92900efa098ca85f81290f2b4bfff756d6db1b7f85352f3d17e24e4139c69bde27b4d250aa1291146773f54b891dc8ed877d1bb82fa354bd3e5b8db572a7 WHIRLPOOL 0803e9c3d19fd731820d8d95c81aabdf409db9300c72c5d94384c0e1066bbdd1a4c05cac8b8fa66455358f76e4de24a30b86d4df3992c0c9336def3f6e67d738
+DIST snort-2.9.6.2.tar.gz 5229232 SHA256 8e1d7fc5e1523a786d845ca0102cc474abfcebfcc7e964a1653680034b5b5d77 SHA512 f7ed5dc7777fb330c048d3b14c6fa4b13988ecb3bea7990e04e496dcca7ba28eae976e60838504198a98b9fd3992e021aece5c3142385efebb05a33014afb1c4 WHIRLPOOL fed94a69c69bf5b0e456c272512f77452247168f0a29d5a4bcec43f9b596fe631df3669cea0b90165e573ac875f3d0e1408449d7c99803ef07b1238f4c5ba5a0
+DIST snort-2.9.7.0.tar.gz 6340553 SHA256 9738afea45d20b7f77997cc00055e7dd70f6aea0101209d87efec4bc4eace49b SHA512 f2cbdd2cf2ad15bd4cf3f8658c2a4880ee2069589db89c11aaea637984dde270ef6242c6dd43d5e12f829ed2464388950ee791dbbfa8df796843942c415fbc2f WHIRLPOOL d018f7f4cc9820057642bc691c0812866083a54f9399421f1b6eedfdb55e8cdfd42b0088c12e15facbfbeccd76a6df6351b0103eac35b5d5ca43900521ee274a
+DIST snort-2.9.7.2.tar.gz 6352738 SHA256 db57c532919d9ababac127f29dbdc05ed832394880e46cad81a5dde713ccb4be SHA512 4732014d0049671b1a81857e25a5ffbc3cbccb698be2b3406f69a45603a6b9f34343469ee14fa513199cf9b890a278cc777b42493850cff6fcb3493bb9b73dce WHIRLPOOL 2eec2345e0b945ff504025b2e552729bb5542d351bf1d92e2806be0f1e8d251283d4f984d89058731f5a0150bb1c2a7dd012e9bfbfbd0a3596bfc50321a93cb9
+DIST snort-2.9.7.3.tar.gz 6300073 SHA256 8cc3613b888fc54947a2beec773c76d9a20368f2659b31d45a9f0b11e66cc229 SHA512 949213d44d08c7f70bd45bc4947c9c35bfcd2ca3a54ec8a28d0c03e3868a485d2c208ec7850398f69d706c74fbad1389af445eb1107e678ff95714b5696f27b7 WHIRLPOOL 6d6e2da52f7f141bf6702c8604855ef351c055dbce2805341af16deafa5a0e288266e9632f770e29d209a59cce0d9c17f017bfb612f870dbf5b88c8c0d75e46d
+DIST snort-2.9.7.5.tar.gz 6312847 SHA256 ad03f11b5301b16642199a86aa90388eaa53f5003f83b0c5595745a490047be1 SHA512 fa1b299c72a44a8cb64361e8dab9fad5bfec36bbb05ebed2407002b2c5d97256d7d67599cb1f29406b5ee0916f2f85a173610d403cd34c57f74f7049c10eb038 WHIRLPOOL 6c7270d7edfc552f074fa2fb8ed067a12a48e4e159ceaa4be1f3c877996df5630aa42721aa637a846701072834e167445a67bbfa2deb93933048b1e4f70a8e1b
diff --git a/net-analyzer/snort/files/snort.confd.2 b/net-analyzer/snort/files/snort.confd.2
new file mode 100644
index 000000000000..780c91052d1d
--- /dev/null
+++ b/net-analyzer/snort/files/snort.confd.2
@@ -0,0 +1,16 @@
+# Config file for /etc/init.d/snort
+
+# The following options are now set in your snort.conf file:
+# config set_gid:
+# config set_uid:
+# config snaplen:
+# config bpf_file:
+# config logdir:
+
+# The only options that should be set here are SNORT_IFACE and SNORT_CONF.
+
+# This tell snort which interface to listen on (any for every interface)
+SNORT_IFACE="eth1"
+
+# Probably not this either
+SNORT_CONF="/etc/snort/snort.conf"
diff --git a/net-analyzer/snort/files/snort.rc12 b/net-analyzer/snort/files/snort.rc12
new file mode 100644
index 000000000000..803e1ad48b68
--- /dev/null
+++ b/net-analyzer/snort/files/snort.rc12
@@ -0,0 +1,61 @@
+#!/sbin/runscript
+# Copyright 1999-2013 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Id$
+
+extra_commands="checkconfig"
+extra_started_commands="reload"
+
+depend() {
+	need net
+	after mysql
+	after postgresql
+}
+
+checkconfig() {
+	if [ ! -e ${SNORT_CONF} ] ; then
+		eerror "You need a configuration file to run snort"
+		eerror "There is an example config in /etc/snort/snort.conf.distrib"
+		return 1
+	fi
+	if [ ! -d "/var/run/snort" ] ; then
+		checkpath -d /var/run/snort
+	fi
+}
+
+start() {
+	checkconfig || return 1
+	ebegin "Starting snort"
+	start-stop-daemon --start --quiet --exec /usr/bin/snort \
+		-- --nolock-pidfile --pid-path /var/run/snort -D -i ${SNORT_IFACE} \
+		 -c ${SNORT_CONF} >/dev/null 2>&1
+	eend $?
+}
+
+stop() {
+	ebegin "Stopping snort"
+	start-stop-daemon --stop --quiet --pidfile /var/run/snort/snort_${SNORT_IFACE}.pid
+	# Snort needs a few seconds to fully shutdown
+	sleep 15
+	eend $?
+}
+
+reload() {
+
+	local SNORT_PID="`cat /var/run/snort/snort_${SNORT_IFACE}.pid`"
+	local SNORT_USER="`ps -p ${SNORT_PID} --no-headers -o user`"
+
+        if [ ! -f /var/run/snort/snort_${SNORT_IFACE}.pid ]; then
+        	eerror "Snort isn't running"
+                return 1
+	elif [ ${SNORT_USER} != root ]; then
+		eerror "Snort must be running as root for reload to work!"
+		return 1
+	else
+		checkconfig || return 1
+		ebegin "Reloading Snort"
+		start-stop-daemon --signal HUP --pidfile /var/run/snort/snort_${SNORT_IFACE}.pid
+        fi
+}
+
+
diff --git a/net-analyzer/snort/metadata.xml b/net-analyzer/snort/metadata.xml
new file mode 100644
index 000000000000..084698b246da
--- /dev/null
+++ b/net-analyzer/snort/metadata.xml
@@ -0,0 +1,136 @@
+<?xml version="1.0" encoding="UTF-8"?>

+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">

+<pkgmetadata>

+	<herd>netmon</herd>

+	<herd>proxy-maintainers</herd>

+	<maintainer>

+		<email>patrick@gentoo.org</email>

+		<name>Patrick Lauer</name>

+		<description>Maintainer</description>

+	</maintainer>

+	<maintainer>

+		<email>jason.r.wallace@gmail.com</email>

+		<name>Jason Wallace</name>

+		<description>Proxy maintainer. CC him on bugs</description>

+	</maintainer>

+	<longdescription>

+		Snort is an open source network intrusion prevention and detection

+		system (IDS/IPS) developed by Sourcefire. Combining the benefits of

+		signature, protocol, and anomaly-based inspection, Snort is the most

+		widely deployed IDS/IPS technology worldwide. With millions of downloads

+		and approximately 300,000 registered users, Snort has become the de facto 

+		standard for IPS.

+	</longdescription>

+	<upstream>

+		<maintainer>

+			<email>snort-team@sourcefire.com</email>

+			<name>Snort Team</name>

+		</maintainer>

+		<changelog>http://www.snort.org/snort-downloads</changelog>

+		<doc>http://www.snort.org/docs</doc>

+		<bugs-to>http://www.snort.org/snort-downloads/submit-a-bug/</bugs-to>

+	</upstream>

+	<use>

+		<flag name='control-socket'>

+			Enables Snort's control socket.

+		</flag>

+		<flag name='dynamicplugin'>

+			Enable ability to dynamically load preprocessors, detection engine,

+			and rules library. This is required if you want to use shared 

+			object (SO) snort rules.

+		</flag>

+		<flag name='file-inspect'>

+			Enables extended file inspection capabilities.

+		</flag>

+		<flag name='gre'>

+			Enable support for inspecting and processing Generic Routing 

+			Encapsulation (GRE) packet headders. Only needed if you are

+			monitoring GRE tunnels.

+		</flag>

+		<flag name='high-availability'>

+			Enables high-availability state sharing.

+		</flag>

+		<flag name='inline-init-failopen'>

+			Enables support to allow traffic to pass (fail-open) through

+			inline deployments while snort is starting and not ready to begin

+			inspecting traffic. If this option is not enabled, network

+			traffic will not pass (fail-closed) until snort has fully started

+			and is ready to perform packet inspection.

+		</flag>

+		<flag name='linux-smp-stats'>

+			Enable accurate statistics reporting through /proc on systems with

+			multipule processors.

+		</flag>

+		<flag name='mpls'>

+			Enables support for processing and inspecting Multiprotocol Label 

+			Switching MPLS network network traffic. Only needed if you are

+			monitoring an MPLS network.

+		</flag>

+		<flag name='non-ether-decoders'>

+			Enable decoding of non-ethernet protocols such as TokenRing, FDDI,

+			IPX, etc.

+		</flag>

+		<flag name='perfprofiling'>

+			Enables support for preprocessor and rule performance profiling 

+			using the perfmonitor preprocessor.

+		</flag>

+		<flag name='ppm'>

+			Enables support for setting per rule or per packet latency limits.

+			Helps protect against introducing network latency with inline 

+			deployments.

+		</flag>

+		<flag name='react'>

+			Enables support for the react rule keyword. Supports interception,

+			termination, and redirection of HTTP connections.

+		</flag>

+		<flag name='shared-rep'>

+			Enables the use of shared memory for the Reputation Preprocessor

+			(Only available on Linux systems)

+		</flag>

+		<flag name='side-channel'>

+			Enables Snort's the side channel.

+		</flag>

+		<flag name='sourcefire'>

+			Enables Sourcefire specific build options, which include

+			--enable-perfprofiling and --enable-ppm.

+		</flag>

+		<flag name='targetbased'>

+			Enables support in snort for using a host attibute XML file 

+			(attribute_table.dtd). This file needs to be created by the user

+			and should define the IP address, operating system, and services

+			for all hosts on the monitored network. This is cumbersome, but

+			can improve intrusion detection accuracy.

+		</flag>

+		<flag name='reload-error-restart'>

+			Enables support for completely restarting snort if an error is 

+			detected durring a reload.

+		</flag>

+		<flag name='zlib'>

+			Enables HTTP inspection of compressed web traffic. Requires 

+			dynamicplugin be enabled.

+		</flag>

+		<flag name='active-response'>

+			Enables support for automatically sending TCP resets and ICMP 

+			unreachable messages to terminate connections. Used with inline

+			deployments.

+		</flag>

+		<flag name='normalizer'>

+			Enables support for normalizing packets in inline deployments to

+			help minimize the chances of detection evasion.

+		</flag>

+		<flag name='flexresp3'>

+			Enables support for new flexable response preprocessor for enabling

+			connection tearing for inline deployments. Replaces flexresp and 

+			flexresp2.

+		</flag>

+		<flag name='paf'>

+			Enables support for Protocol Aware Flushing. This allows Snort to

+			statefully scan a stream and reassemble a complete protocol data

+			unit regardless of segmentation.

+		</flag>

+		<flag name='large-pcap-64bit'>

+			Allows Snort to read pcap files that are larger than 2 GB. ONLY

+			VALID FOR 64bit SYSTEMS!

+		</flag>

+	</use>

+</pkgmetadata>

diff --git a/net-analyzer/snort/snort-2.9.4.6-r1.ebuild b/net-analyzer/snort/snort-2.9.4.6-r1.ebuild
new file mode 100644
index 000000000000..4f7967c6220d
--- /dev/null
+++ b/net-analyzer/snort/snort-2.9.4.6-r1.ebuild
@@ -0,0 +1,252 @@
+# Copyright 1999-2014 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Id$
+
+EAPI="5"
+inherit autotools multilib user
+
+DESCRIPTION="The de facto standard for intrusion detection/prevention"
+HOMEPAGE="http://www.snort.org/"
+SRC_URI="http://snort.org/downloads/2320 -> ${P}.tar.gz"
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~mips ~ppc ~ppc64 ~sparc ~x86"
+IUSE="static +dynamicplugin +zlib +gre +mpls +targetbased
++ppm +perfprofiling +non-ether-decoders control-socket
+shared-rep sourcefire linux-smp-stats inline-init-failopen
++threads debug +active-response +normalizer reload-error-restart
++react +flexresp3 +paf large-pcap-64bit selinux"
+
+DEPEND=">=net-libs/libpcap-1.3.0
+	>=net-libs/daq-2.0.0
+	>=dev-libs/libpcre-8.33
+	dev-libs/libdnet
+	zlib? ( sys-libs/zlib )"
+
+RDEPEND="${DEPEND}
+	selinux? ( sec-policy/selinux-snort )"
+
+REQUIRED_USE="zlib? ( dynamicplugin )
+	      !kernel_linux? ( !shared-rep )"
+
+pkg_setup() {
+
+	# pre_inst() is a better place to put this
+	# but we need it here for the 'fowners' statements in src_install()
+	enewgroup snort
+	enewuser snort -1 -1 /dev/null snort
+
+}
+
+src_prepare() {
+
+	# Multilib fix for the sf_engine
+	ebegin "Applying multilib fix"
+	sed -i -e 's|${exec_prefix}/lib|${exec_prefix}/'$(get_libdir)'|g' \
+		"${WORKDIR}/${P}/src/dynamic-plugins/sf_engine/Makefile.am" \
+		|| die "sed for sf_engine failed"
+
+	# Multilib fix for the curent set of dynamic-preprocessors
+	for i in ftptelnet smtp ssh dns ssl dcerpc2 sdf imap pop rzb_saac sip reputation gtp modbus dnp3; do
+		sed -i -e 's|${exec_prefix}/lib|${exec_prefix}/'$(get_libdir)'|g' \
+			"${WORKDIR}/${P}/src/dynamic-preprocessors/$i/Makefile.am" \
+			|| die "sed for $i failed."
+	done
+	eend
+
+	AT_M4DIR=m4 eautoreconf
+}
+
+src_configure() {
+
+	econf \
+		$(use_enable !static shared) \
+		$(use_enable static) \
+		$(use_enable static so-with-static-lib) \
+		$(use_enable dynamicplugin) \
+		$(use_enable zlib) \
+		$(use_enable gre) \
+		$(use_enable mpls) \
+		$(use_enable targetbased) \
+		$(use_enable control-socket) \
+		$(use_enable non-ether-decoders) \
+		$(use_enable shared-rep) \
+		$(use_enable sourcefire) \
+		$(use_enable ppm) \
+		$(use_enable perfprofiling) \
+		$(use_enable linux-smp-stats) \
+		$(use_enable inline-init-failopen) \
+		$(use_enable threads pthread) \
+		$(use_enable debug) \
+		$(use_enable debug debug-msgs) \
+		$(use_enable debug corefiles) \
+		$(use_enable !debug dlclose) \
+		$(use_enable active-response) \
+		$(use_enable normalizer) \
+		$(use_enable reload-error-restart) \
+		$(use_enable react) \
+		$(use_enable flexresp3) \
+		$(use_enable paf) \
+		$(use_enable large-pcap-64bit large-pcap) \
+		--enable-reload \
+		--disable-build-dynamic-examples \
+		--disable-profile \
+		--disable-ppm-test \
+		--disable-intel-soft-cpm \
+		--disable-static-daq \
+		--disable-rzb-saac
+}
+
+src_install() {
+
+	emake DESTDIR="${D}" install
+
+	dodir /var/log/snort \
+		/var/run/snort \
+		/etc/snort/rules \
+		/etc/snort/so_rules \
+		/usr/$(get_libdir)/snort_dynamicrules
+
+	# config.log and build.log are needed by Sourcefire
+	# to trouble shoot build problems and bug reports so we are
+	# perserving them incase the user needs upstream support.
+	dodoc RELEASE.NOTES ChangeLog \
+		doc/* \
+		tools/u2boat/README.u2boat
+
+	insinto /etc/snort
+	doins etc/attribute_table.dtd \
+		etc/classification.config \
+		etc/gen-msg.map \
+		etc/reference.config \
+		etc/threshold.conf \
+		etc/unicode.map
+
+	# We use snort.conf.distrib because the config file is complicated
+	# and the one shipped with snort can change drastically between versions.
+	# Users should migrate setting by hand and not with etc-update.
+	newins etc/snort.conf snort.conf.distrib
+
+	# config.log and build.log are needed by Sourcefire
+	# to troubleshoot build problems and bug reports so we are
+	# preserving them incase the user needs upstream support.
+	if [ -f "${WORKDIR}/${PF}/config.log" ]; then
+		dodoc "${WORKDIR}/${PF}/config.log"
+	fi
+	if [ -f "${T}/build.log" ]; then
+		dodoc "${T}/build.log"
+	fi
+
+	insinto /etc/snort/preproc_rules
+	doins preproc_rules/decoder.rules \
+		preproc_rules/preprocessor.rules \
+		preproc_rules/sensitive-data.rules
+
+	fowners -R snort:snort \
+		/var/log/snort \
+		/var/run/snort \
+		/etc/snort
+
+	newinitd "${FILESDIR}/snort.rc12" snort
+	newconfd "${FILESDIR}/snort.confd.2" snort
+
+	# Sourcefire uses Makefiles to install docs causing Bug #297190.
+	# This removes the unwanted doc directory and rogue Makefiles.
+	rm -rf "${D}"usr/share/doc/snort || die "Failed to remove SF doc directories"
+	rm "${D}"usr/share/doc/"${PF}"/Makefile* || die "Failed to remove doc make files"
+
+	#Remove unneeded .la files (Bug #382863)
+	rm "${D}"usr/$(get_libdir)/snort_dynamicengine/libsf_engine.la || die
+	rm "${D}"usr/$(get_libdir)/snort_dynamicpreprocessor/libsf_*_preproc.la || die "Failed to remove libsf_?_preproc.la"
+
+	# Set the correct lib path for dynamicengine, dynamicpreprocessor, and dynamicdetection
+	sed -i -e 's|/usr/local/lib|/usr/'$(get_libdir)'|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the correct rule location in the config
+	sed -i -e 's|RULE_PATH ../rules|RULE_PATH /etc/snort/rules|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the correct preprocessor/decoder rule location in the config
+	sed -i -e 's|PREPROC_RULE_PATH ../preproc_rules|PREPROC_RULE_PATH /etc/snort/preproc_rules|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Enable the preprocessor/decoder rules
+	sed -i -e 's|^# include $PREPROC_RULE_PATH|include $PREPROC_RULE_PATH|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	sed -i -e 's|^# dynamicdetection directory|dynamicdetection directory|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Just some clean up of trailing /'s in the config
+	sed -i -e 's|snort_dynamicpreprocessor/$|snort_dynamicpreprocessor|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Make it clear in the config where these are...
+	sed -i -e 's|^include classification.config|include /etc/snort/classification.config|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	sed -i -e 's|^include reference.config|include /etc/snort/reference.config|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Disable all rule files by default.
+	sed -i -e 's|^include $RULE_PATH|# include $RULE_PATH|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Disable normalizer preprocessor config if normalizer USE flag not set.
+	if ! use normalizer; then
+		sed -i -e 's|^preprocessor normalize|#preprocessor normalize|g' \
+			"${D}etc/snort/snort.conf.distrib" || die
+	fi
+
+	# Set the configured DAQ to afpacket
+	sed -i -e 's|^# config daq: <type>|config daq: afpacket|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the location of the DAQ modules
+	sed -i -e 's|^# config daq_dir: <dir>|config daq_dir: /usr/'$(get_libdir)'/daq|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the DAQ mode to passive
+	sed -i -e 's|^# config daq_mode: <mode>|config daq_mode: passive|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set snort to run as snort:snort
+	sed -i -e 's|^# config set_gid:|config set_gid: snort|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+	sed -i -e 's|^# config set_uid:|config set_uid: snort|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the default log dir
+	sed -i -e 's|^# config logdir:|config logdir: /var/log/snort/|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the correct so_rule location in the config
+	 sed -i -e 's|SO_RULE_PATH ../so_rules|SO_RULE_PATH /etc/snort/so_rules|g' \
+		 "${D}etc/snort/snort.conf.distrib" || die
+}
+
+pkg_postinst() {
+
+	einfo "There have been a number of improvements and new features"
+	einfo "added to ${P}. Please review the RELEASE.NOTES and"
+	einfo "ChangLog located in /usr/share/doc/${PF}."
+	einfo
+	elog "The Sourcefire Vulnerability Research Team (VRT) recommends that"
+	elog "users migrate their snort.conf customizations to the latest config"
+	elog "file released by the VRT. You can find the latest version of the"
+	elog "Snort config file in /etc/snort/snort.conf.distrib."
+	elog
+	elog "!! It is important that you migrate to this new snort.conf file !!"
+	elog
+	elog "This version of the ebuild includes an updated init.d file and"
+	elog "conf.d file that rely on options found in the latest Snort"
+	elog "config file provided by the VRT."
+
+	if use debug; then
+		elog "You have the 'debug' USE flag enabled. If this has been done to"
+		elog "troubleshoot an issue by producing a core dump or a back trace,"
+		elog "then you need to also ensure the FEATURES variable in make.conf"
+		elog "contains the 'nostrip' option."
+	fi
+}
diff --git a/net-analyzer/snort/snort-2.9.5.6.ebuild b/net-analyzer/snort/snort-2.9.5.6.ebuild
new file mode 100644
index 000000000000..e3e37f7c3214
--- /dev/null
+++ b/net-analyzer/snort/snort-2.9.5.6.ebuild
@@ -0,0 +1,251 @@
+# Copyright 1999-2014 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Id$
+
+EAPI="5"
+inherit autotools multilib user
+
+DESCRIPTION="The de facto standard for intrusion detection/prevention"
+HOMEPAGE="http://www.snort.org/"
+SRC_URI="http://snort.org/downloads/2665 -> ${P}.tar.gz"
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~mips ~ppc ~ppc64 ~sparc ~x86"
+IUSE="static +zlib +gre +mpls +targetbased +ppm +perfprofiling
++non-ether-decoders control-socket high-availability shared-rep
+side-channel sourcefire linux-smp-stats inline-init-failopen
++threads debug +active-response +normalizer reload-error-restart
++react +flexresp3 large-pcap-64bit selinux"
+
+DEPEND=">=net-libs/libpcap-1.3.0
+	>=net-libs/daq-2.0.1
+	>=dev-libs/libpcre-8.33
+	dev-libs/libdnet
+	zlib? ( sys-libs/zlib )"
+
+RDEPEND="${DEPEND}
+	selinux? ( sec-policy/selinux-snort )"
+
+REQUIRED_USE="!kernel_linux? ( !shared-rep )"
+
+pkg_setup() {
+
+	# pre_inst() is a better place to put this
+	# but we need it here for the 'fowners' statements in src_install()
+	enewgroup snort
+	enewuser snort -1 -1 /dev/null snort
+
+}
+
+src_prepare() {
+
+	# Multilib fix for the sf_engine
+	ebegin "Applying multilib fix"
+	sed -i -e 's|${exec_prefix}/lib|${exec_prefix}/'$(get_libdir)'|g' \
+		"${WORKDIR}/${P}/src/dynamic-plugins/sf_engine/Makefile.am" \
+		|| die "sed for sf_engine failed"
+
+	# Multilib fix for the curent set of dynamic-preprocessors
+	for i in ftptelnet smtp ssh dns ssl dcerpc2 sdf imap pop rzb_saac sip reputation gtp modbus dnp3; do
+		sed -i -e 's|${exec_prefix}/lib|${exec_prefix}/'$(get_libdir)'|g' \
+			"${WORKDIR}/${P}/src/dynamic-preprocessors/$i/Makefile.am" \
+			|| die "sed for $i failed."
+	done
+	eend
+
+	AT_M4DIR=m4 eautoreconf
+}
+
+src_configure() {
+
+	econf \
+		$(use_enable !static shared) \
+		$(use_enable static) \
+		$(use_enable static so-with-static-lib) \
+		$(use_enable zlib) \
+		$(use_enable gre) \
+		$(use_enable mpls) \
+		$(use_enable targetbased) \
+		$(use_enable control-socket) \
+		$(use_enable high-availability ha) \
+		$(use_enable non-ether-decoders) \
+		$(use_enable shared-rep) \
+		$(use_enable side-channel) \
+		$(use_enable sourcefire) \
+		$(use_enable ppm) \
+		$(use_enable perfprofiling) \
+		$(use_enable linux-smp-stats) \
+		$(use_enable inline-init-failopen) \
+		$(use_enable threads pthread) \
+		$(use_enable debug) \
+		$(use_enable debug debug-msgs) \
+		$(use_enable debug corefiles) \
+		$(use_enable !debug dlclose) \
+		$(use_enable active-response) \
+		$(use_enable normalizer) \
+		$(use_enable reload-error-restart) \
+		$(use_enable react) \
+		$(use_enable flexresp3) \
+		$(use_enable large-pcap-64bit large-pcap) \
+		--enable-reload \
+		--disable-build-dynamic-examples \
+		--disable-profile \
+		--disable-ppm-test \
+		--disable-intel-soft-cpm \
+		--disable-static-daq \
+		--disable-rzb-saac
+}
+
+src_install() {
+
+	emake DESTDIR="${D}" install
+
+	dodir /var/log/snort \
+		/var/run/snort \
+		/etc/snort/rules \
+		/etc/snort/so_rules \
+		/usr/$(get_libdir)/snort_dynamicrules
+
+	# config.log and build.log are needed by Sourcefire
+	# to trouble shoot build problems and bug reports so we are
+	# perserving them incase the user needs upstream support.
+	dodoc RELEASE.NOTES ChangeLog \
+		doc/* \
+		tools/u2boat/README.u2boat
+
+	insinto /etc/snort
+	doins etc/attribute_table.dtd \
+		etc/classification.config \
+		etc/gen-msg.map \
+		etc/reference.config \
+		etc/threshold.conf \
+		etc/unicode.map
+
+	# We use snort.conf.distrib because the config file is complicated
+	# and the one shipped with snort can change drastically between versions.
+	# Users should migrate setting by hand and not with etc-update.
+	newins etc/snort.conf snort.conf.distrib
+
+	# config.log and build.log are needed by Sourcefire
+	# to troubleshoot build problems and bug reports so we are
+	# preserving them incase the user needs upstream support.
+	if [ -f "${WORKDIR}/${PF}/config.log" ]; then
+		dodoc "${WORKDIR}/${PF}/config.log"
+	fi
+	if [ -f "${T}/build.log" ]; then
+		dodoc "${T}/build.log"
+	fi
+
+	insinto /etc/snort/preproc_rules
+	doins preproc_rules/decoder.rules \
+		preproc_rules/preprocessor.rules \
+		preproc_rules/sensitive-data.rules
+
+	fowners -R snort:snort \
+		/var/log/snort \
+		/var/run/snort \
+		/etc/snort
+
+	newinitd "${FILESDIR}/snort.rc12" snort
+	newconfd "${FILESDIR}/snort.confd.2" snort
+
+	# Sourcefire uses Makefiles to install docs causing Bug #297190.
+	# This removes the unwanted doc directory and rogue Makefiles.
+	rm -rf "${D}"usr/share/doc/snort || die "Failed to remove SF doc directories"
+	rm "${D}"usr/share/doc/"${PF}"/Makefile* || die "Failed to remove doc make files"
+
+	# Remove unneeded .la files (Bug #382863)
+	rm "${D}"usr/$(get_libdir)/snort_dynamicengine/libsf_engine.la || die
+	rm "${D}"usr/$(get_libdir)/snort_dynamicpreprocessor/libsf_*_preproc.la || die "Failed to remove libsf_?_preproc.la"
+
+	# Set the correct lib path for dynamicengine, dynamicpreprocessor, and dynamicdetection
+	sed -i -e 's|/usr/local/lib|/usr/'$(get_libdir)'|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the correct rule location in the config
+	sed -i -e 's|RULE_PATH ../rules|RULE_PATH /etc/snort/rules|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the correct preprocessor/decoder rule location in the config
+	sed -i -e 's|PREPROC_RULE_PATH ../preproc_rules|PREPROC_RULE_PATH /etc/snort/preproc_rules|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Enable the preprocessor/decoder rules
+	sed -i -e 's|^# include $PREPROC_RULE_PATH|include $PREPROC_RULE_PATH|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	sed -i -e 's|^# dynamicdetection directory|dynamicdetection directory|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Just some clean up of trailing /'s in the config
+	sed -i -e 's|snort_dynamicpreprocessor/$|snort_dynamicpreprocessor|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Make it clear in the config where these are...
+	sed -i -e 's|^include classification.config|include /etc/snort/classification.config|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	sed -i -e 's|^include reference.config|include /etc/snort/reference.config|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Disable all rule files by default.
+	sed -i -e 's|^include $RULE_PATH|# include $RULE_PATH|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Disable normalizer preprocessor config if normalizer USE flag not set.
+	if ! use normalizer; then
+		sed -i -e 's|^preprocessor normalize|#preprocessor normalize|g' \
+			"${D}etc/snort/snort.conf.distrib" || die
+	fi
+
+	# Set the configured DAQ to afpacket
+	sed -i -e 's|^# config daq: <type>|config daq: afpacket|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the location of the DAQ modules
+	sed -i -e 's|^# config daq_dir: <dir>|config daq_dir: /usr/'$(get_libdir)'/daq|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the DAQ mode to passive
+	sed -i -e 's|^# config daq_mode: <mode>|config daq_mode: passive|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set snort to run as snort:snort
+	sed -i -e 's|^# config set_gid:|config set_gid: snort|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+	sed -i -e 's|^# config set_uid:|config set_uid: snort|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the default log dir
+	sed -i -e 's|^# config logdir:|config logdir: /var/log/snort/|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the correct so_rule location in the config
+	 sed -i -e 's|SO_RULE_PATH ../so_rules|SO_RULE_PATH /etc/snort/so_rules|g' \
+		 "${D}etc/snort/snort.conf.distrib" || die
+}
+
+pkg_postinst() {
+
+	einfo "There have been a number of improvements and new features"
+	einfo "added to ${P}. Please review the RELEASE.NOTES and"
+	einfo "ChangLog located in /usr/share/doc/${PF}."
+	einfo
+	elog "The Sourcefire Vulnerability Research Team (VRT) recommends that"
+	elog "users migrate their snort.conf customizations to the latest config"
+	elog "file released by the VRT. You can find the latest version of the"
+	elog "Snort config file in /etc/snort/snort.conf.distrib."
+	elog
+	elog "!! It is important that you migrate to this new snort.conf file !!"
+	elog
+	elog "This version of the ebuild includes an updated init.d file and"
+	elog "conf.d file that rely on options found in the latest Snort"
+	elog "config file provided by the VRT."
+
+	if use debug; then
+		elog "You have the 'debug' USE flag enabled. If this has been done to"
+		elog "troubleshoot an issue by producing a core dump or a back trace,"
+		elog "then you need to also ensure the FEATURES variable in make.conf"
+		elog "contains the 'nostrip' option."
+	fi
+}
diff --git a/net-analyzer/snort/snort-2.9.6.0.ebuild b/net-analyzer/snort/snort-2.9.6.0.ebuild
new file mode 100644
index 000000000000..17833729377f
--- /dev/null
+++ b/net-analyzer/snort/snort-2.9.6.0.ebuild
@@ -0,0 +1,252 @@
+# Copyright 1999-2014 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Id$
+
+EAPI="5"
+inherit autotools multilib user
+
+DESCRIPTION="The de facto standard for intrusion detection/prevention"
+HOMEPAGE="http://www.snort.org/"
+SRC_URI="http://snort.org/downloads/2787 -> ${P}.tar.gz"
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~mips ~ppc ~ppc64 ~sparc ~x86"
+IUSE="static +zlib +gre +mpls +targetbased +ppm +perfprofiling
++non-ether-decoders control-socket file-inspect high-availability
+shared-rep side-channel sourcefire linux-smp-stats inline-init-failopen
++threads debug +active-response +normalizer reload-error-restart
++react +flexresp3 large-pcap-64bit selinux"
+
+DEPEND=">=net-libs/libpcap-1.3.0
+	>=net-libs/daq-2.0.2
+	>=dev-libs/libpcre-8.33
+	dev-libs/libdnet
+	zlib? ( sys-libs/zlib )"
+
+RDEPEND="${DEPEND}
+	selinux? ( sec-policy/selinux-snort )"
+
+REQUIRED_USE="!kernel_linux? ( !shared-rep )"
+
+pkg_setup() {
+
+	# pre_inst() is a better place to put this
+	# but we need it here for the 'fowners' statements in src_install()
+	enewgroup snort
+	enewuser snort -1 -1 /dev/null snort
+
+}
+
+src_prepare() {
+
+	# Multilib fix for the sf_engine
+	ebegin "Applying multilib fix"
+	sed -i -e 's|${exec_prefix}/lib|${exec_prefix}/'$(get_libdir)'|g' \
+		"${WORKDIR}/${P}/src/dynamic-plugins/sf_engine/Makefile.am" \
+		|| die "sed for sf_engine failed"
+
+	# Multilib fix for the curent set of dynamic-preprocessors
+	for i in file ftptelnet smtp ssh dns ssl dcerpc2 sdf imap pop rzb_saac sip reputation gtp modbus dnp3; do
+		sed -i -e 's|${exec_prefix}/lib|${exec_prefix}/'$(get_libdir)'|g' \
+			"${WORKDIR}/${P}/src/dynamic-preprocessors/$i/Makefile.am" \
+			|| die "sed for $i failed."
+	done
+	eend
+
+	AT_M4DIR=m4 eautoreconf
+}
+
+src_configure() {
+
+	econf \
+		$(use_enable !static shared) \
+		$(use_enable static) \
+		$(use_enable static so-with-static-lib) \
+		$(use_enable zlib) \
+		$(use_enable gre) \
+		$(use_enable mpls) \
+		$(use_enable targetbased) \
+		$(use_enable control-socket) \
+		$(use_enable file-inspect) \
+		$(use_enable high-availability ha) \
+		$(use_enable non-ether-decoders) \
+		$(use_enable shared-rep) \
+		$(use_enable side-channel) \
+		$(use_enable sourcefire) \
+		$(use_enable ppm) \
+		$(use_enable perfprofiling) \
+		$(use_enable linux-smp-stats) \
+		$(use_enable inline-init-failopen) \
+		$(use_enable threads pthread) \
+		$(use_enable debug) \
+		$(use_enable debug debug-msgs) \
+		$(use_enable debug corefiles) \
+		$(use_enable !debug dlclose) \
+		$(use_enable active-response) \
+		$(use_enable normalizer) \
+		$(use_enable reload-error-restart) \
+		$(use_enable react) \
+		$(use_enable flexresp3) \
+		$(use_enable large-pcap-64bit large-pcap) \
+		--enable-reload \
+		--disable-build-dynamic-examples \
+		--disable-profile \
+		--disable-ppm-test \
+		--disable-intel-soft-cpm \
+		--disable-static-daq \
+		--disable-rzb-saac
+}
+
+src_install() {
+
+	emake DESTDIR="${D}" install
+
+	dodir /var/log/snort \
+		/var/run/snort \
+		/etc/snort/rules \
+		/etc/snort/so_rules \
+		/usr/$(get_libdir)/snort_dynamicrules
+
+	# config.log and build.log are needed by Sourcefire
+	# to trouble shoot build problems and bug reports so we are
+	# perserving them incase the user needs upstream support.
+	dodoc RELEASE.NOTES ChangeLog \
+		doc/* \
+		tools/u2boat/README.u2boat
+
+	insinto /etc/snort
+	doins etc/attribute_table.dtd \
+		etc/classification.config \
+		etc/gen-msg.map \
+		etc/reference.config \
+		etc/threshold.conf \
+		etc/unicode.map
+
+	# We use snort.conf.distrib because the config file is complicated
+	# and the one shipped with snort can change drastically between versions.
+	# Users should migrate setting by hand and not with etc-update.
+	newins etc/snort.conf snort.conf.distrib
+
+	# config.log and build.log are needed by Sourcefire
+	# to troubleshoot build problems and bug reports so we are
+	# preserving them incase the user needs upstream support.
+	if [ -f "${WORKDIR}/${PF}/config.log" ]; then
+		dodoc "${WORKDIR}/${PF}/config.log"
+	fi
+	if [ -f "${T}/build.log" ]; then
+		dodoc "${T}/build.log"
+	fi
+
+	insinto /etc/snort/preproc_rules
+	doins preproc_rules/decoder.rules \
+		preproc_rules/preprocessor.rules \
+		preproc_rules/sensitive-data.rules
+
+	fowners -R snort:snort \
+		/var/log/snort \
+		/var/run/snort \
+		/etc/snort
+
+	newinitd "${FILESDIR}/snort.rc12" snort
+	newconfd "${FILESDIR}/snort.confd.2" snort
+
+	# Sourcefire uses Makefiles to install docs causing Bug #297190.
+	# This removes the unwanted doc directory and rogue Makefiles.
+	rm -rf "${D}"usr/share/doc/snort || die "Failed to remove SF doc directories"
+	rm "${D}"usr/share/doc/"${PF}"/Makefile* || die "Failed to remove doc make files"
+
+	# Remove unneeded .la files (Bug #382863)
+	rm "${D}"usr/$(get_libdir)/snort_dynamicengine/libsf_engine.la || die
+	rm "${D}"usr/$(get_libdir)/snort_dynamicpreprocessor/libsf_*_preproc.la || die "Failed to remove libsf_?_preproc.la"
+
+	# Set the correct lib path for dynamicengine, dynamicpreprocessor, and dynamicdetection
+	sed -i -e 's|/usr/local/lib|/usr/'$(get_libdir)'|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the correct rule location in the config
+	sed -i -e 's|RULE_PATH ../rules|RULE_PATH /etc/snort/rules|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the correct preprocessor/decoder rule location in the config
+	sed -i -e 's|PREPROC_RULE_PATH ../preproc_rules|PREPROC_RULE_PATH /etc/snort/preproc_rules|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Enable the preprocessor/decoder rules
+	sed -i -e 's|^# include $PREPROC_RULE_PATH|include $PREPROC_RULE_PATH|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	sed -i -e 's|^# dynamicdetection directory|dynamicdetection directory|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Just some clean up of trailing /'s in the config
+	sed -i -e 's|snort_dynamicpreprocessor/$|snort_dynamicpreprocessor|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Make it clear in the config where these are...
+	sed -i -e 's|^include classification.config|include /etc/snort/classification.config|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	sed -i -e 's|^include reference.config|include /etc/snort/reference.config|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Disable all rule files by default.
+	sed -i -e 's|^include $RULE_PATH|# include $RULE_PATH|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Disable normalizer preprocessor config if normalizer USE flag not set.
+	if ! use normalizer; then
+		sed -i -e 's|^preprocessor normalize|#preprocessor normalize|g' \
+			"${D}etc/snort/snort.conf.distrib" || die
+	fi
+
+	# Set the configured DAQ to afpacket
+	sed -i -e 's|^# config daq: <type>|config daq: afpacket|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the location of the DAQ modules
+	sed -i -e 's|^# config daq_dir: <dir>|config daq_dir: /usr/'$(get_libdir)'/daq|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the DAQ mode to passive
+	sed -i -e 's|^# config daq_mode: <mode>|config daq_mode: passive|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set snort to run as snort:snort
+	sed -i -e 's|^# config set_gid:|config set_gid: snort|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+	sed -i -e 's|^# config set_uid:|config set_uid: snort|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the default log dir
+	sed -i -e 's|^# config logdir:|config logdir: /var/log/snort/|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the correct so_rule location in the config
+	 sed -i -e 's|SO_RULE_PATH ../so_rules|SO_RULE_PATH /etc/snort/so_rules|g' \
+		 "${D}etc/snort/snort.conf.distrib" || die
+}
+
+pkg_postinst() {
+
+	einfo "There have been a number of improvements and new features"
+	einfo "added to ${P}. Please review the RELEASE.NOTES and"
+	einfo "ChangLog located in /usr/share/doc/${PF}."
+	einfo
+	elog "The Sourcefire Vulnerability Research Team (VRT) recommends that"
+	elog "users migrate their snort.conf customizations to the latest config"
+	elog "file released by the VRT. You can find the latest version of the"
+	elog "Snort config file in /etc/snort/snort.conf.distrib."
+	elog
+	elog "!! It is important that you migrate to this new snort.conf file !!"
+	elog
+	elog "This version of the ebuild includes an updated init.d file and"
+	elog "conf.d file that rely on options found in the latest Snort"
+	elog "config file provided by the VRT."
+
+	if use debug; then
+		elog "You have the 'debug' USE flag enabled. If this has been done to"
+		elog "troubleshoot an issue by producing a core dump or a back trace,"
+		elog "then you need to also ensure the FEATURES variable in make.conf"
+		elog "contains the 'nostrip' option."
+	fi
+}
diff --git a/net-analyzer/snort/snort-2.9.6.1.ebuild b/net-analyzer/snort/snort-2.9.6.1.ebuild
new file mode 100644
index 000000000000..0bb53d70e63e
--- /dev/null
+++ b/net-analyzer/snort/snort-2.9.6.1.ebuild
@@ -0,0 +1,252 @@
+# Copyright 1999-2014 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Id$
+
+EAPI="5"
+inherit autotools multilib user
+
+DESCRIPTION="The de facto standard for intrusion detection/prevention"
+HOMEPAGE="http://www.snort.org/"
+SRC_URI="http://snort.org/downloads/2911 -> ${P}.tar.gz"
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~mips ~ppc ~ppc64 ~sparc ~x86"
+IUSE="static +zlib +gre +mpls +targetbased +ppm +perfprofiling
++non-ether-decoders control-socket file-inspect high-availability
+shared-rep side-channel sourcefire linux-smp-stats inline-init-failopen
++threads debug +active-response +normalizer reload-error-restart
++react +flexresp3 large-pcap-64bit selinux"
+
+DEPEND=">=net-libs/libpcap-1.3.0
+	>=net-libs/daq-2.0.2
+	>=dev-libs/libpcre-8.33
+	dev-libs/libdnet
+	zlib? ( sys-libs/zlib )"
+
+RDEPEND="${DEPEND}
+	selinux? ( sec-policy/selinux-snort )"
+
+REQUIRED_USE="!kernel_linux? ( !shared-rep )"
+
+pkg_setup() {
+
+	# pre_inst() is a better place to put this
+	# but we need it here for the 'fowners' statements in src_install()
+	enewgroup snort
+	enewuser snort -1 -1 /dev/null snort
+
+}
+
+src_prepare() {
+
+	# Multilib fix for the sf_engine
+	ebegin "Applying multilib fix"
+	sed -i -e 's|${exec_prefix}/lib|${exec_prefix}/'$(get_libdir)'|g' \
+		"${WORKDIR}/${P}/src/dynamic-plugins/sf_engine/Makefile.am" \
+		|| die "sed for sf_engine failed"
+
+	# Multilib fix for the curent set of dynamic-preprocessors
+	for i in file ftptelnet smtp ssh dns ssl dcerpc2 sdf imap pop rzb_saac sip reputation gtp modbus dnp3; do
+		sed -i -e 's|${exec_prefix}/lib|${exec_prefix}/'$(get_libdir)'|g' \
+			"${WORKDIR}/${P}/src/dynamic-preprocessors/$i/Makefile.am" \
+			|| die "sed for $i failed."
+	done
+	eend
+
+	AT_M4DIR=m4 eautoreconf
+}
+
+src_configure() {
+
+	econf \
+		$(use_enable !static shared) \
+		$(use_enable static) \
+		$(use_enable static so-with-static-lib) \
+		$(use_enable zlib) \
+		$(use_enable gre) \
+		$(use_enable mpls) \
+		$(use_enable targetbased) \
+		$(use_enable control-socket) \
+		$(use_enable file-inspect) \
+		$(use_enable high-availability ha) \
+		$(use_enable non-ether-decoders) \
+		$(use_enable shared-rep) \
+		$(use_enable side-channel) \
+		$(use_enable sourcefire) \
+		$(use_enable ppm) \
+		$(use_enable perfprofiling) \
+		$(use_enable linux-smp-stats) \
+		$(use_enable inline-init-failopen) \
+		$(use_enable threads pthread) \
+		$(use_enable debug) \
+		$(use_enable debug debug-msgs) \
+		$(use_enable debug corefiles) \
+		$(use_enable !debug dlclose) \
+		$(use_enable active-response) \
+		$(use_enable normalizer) \
+		$(use_enable reload-error-restart) \
+		$(use_enable react) \
+		$(use_enable flexresp3) \
+		$(use_enable large-pcap-64bit large-pcap) \
+		--enable-reload \
+		--disable-build-dynamic-examples \
+		--disable-profile \
+		--disable-ppm-test \
+		--disable-intel-soft-cpm \
+		--disable-static-daq \
+		--disable-rzb-saac
+}
+
+src_install() {
+
+	emake DESTDIR="${D}" install
+
+	dodir /var/log/snort \
+		/var/run/snort \
+		/etc/snort/rules \
+		/etc/snort/so_rules \
+		/usr/$(get_libdir)/snort_dynamicrules
+
+	# config.log and build.log are needed by Sourcefire
+	# to trouble shoot build problems and bug reports so we are
+	# perserving them incase the user needs upstream support.
+	dodoc RELEASE.NOTES ChangeLog \
+		doc/* \
+		tools/u2boat/README.u2boat
+
+	insinto /etc/snort
+	doins etc/attribute_table.dtd \
+		etc/classification.config \
+		etc/gen-msg.map \
+		etc/reference.config \
+		etc/threshold.conf \
+		etc/unicode.map
+
+	# We use snort.conf.distrib because the config file is complicated
+	# and the one shipped with snort can change drastically between versions.
+	# Users should migrate setting by hand and not with etc-update.
+	newins etc/snort.conf snort.conf.distrib
+
+	# config.log and build.log are needed by Sourcefire
+	# to troubleshoot build problems and bug reports so we are
+	# preserving them incase the user needs upstream support.
+	if [ -f "${WORKDIR}/${PF}/config.log" ]; then
+		dodoc "${WORKDIR}/${PF}/config.log"
+	fi
+	if [ -f "${T}/build.log" ]; then
+		dodoc "${T}/build.log"
+	fi
+
+	insinto /etc/snort/preproc_rules
+	doins preproc_rules/decoder.rules \
+		preproc_rules/preprocessor.rules \
+		preproc_rules/sensitive-data.rules
+
+	fowners -R snort:snort \
+		/var/log/snort \
+		/var/run/snort \
+		/etc/snort
+
+	newinitd "${FILESDIR}/snort.rc12" snort
+	newconfd "${FILESDIR}/snort.confd.2" snort
+
+	# Sourcefire uses Makefiles to install docs causing Bug #297190.
+	# This removes the unwanted doc directory and rogue Makefiles.
+	rm -rf "${D}"usr/share/doc/snort || die "Failed to remove SF doc directories"
+	rm "${D}"usr/share/doc/"${PF}"/Makefile* || die "Failed to remove doc make files"
+
+	# Remove unneeded .la files (Bug #382863)
+	rm "${D}"usr/$(get_libdir)/snort_dynamicengine/libsf_engine.la || die
+	rm "${D}"usr/$(get_libdir)/snort_dynamicpreprocessor/libsf_*_preproc.la || die "Failed to remove libsf_?_preproc.la"
+
+	# Set the correct lib path for dynamicengine, dynamicpreprocessor, and dynamicdetection
+	sed -i -e 's|/usr/local/lib|/usr/'$(get_libdir)'|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the correct rule location in the config
+	sed -i -e 's|RULE_PATH ../rules|RULE_PATH /etc/snort/rules|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the correct preprocessor/decoder rule location in the config
+	sed -i -e 's|PREPROC_RULE_PATH ../preproc_rules|PREPROC_RULE_PATH /etc/snort/preproc_rules|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Enable the preprocessor/decoder rules
+	sed -i -e 's|^# include $PREPROC_RULE_PATH|include $PREPROC_RULE_PATH|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	sed -i -e 's|^# dynamicdetection directory|dynamicdetection directory|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Just some clean up of trailing /'s in the config
+	sed -i -e 's|snort_dynamicpreprocessor/$|snort_dynamicpreprocessor|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Make it clear in the config where these are...
+	sed -i -e 's|^include classification.config|include /etc/snort/classification.config|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	sed -i -e 's|^include reference.config|include /etc/snort/reference.config|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Disable all rule files by default.
+	sed -i -e 's|^include $RULE_PATH|# include $RULE_PATH|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Disable normalizer preprocessor config if normalizer USE flag not set.
+	if ! use normalizer; then
+		sed -i -e 's|^preprocessor normalize|#preprocessor normalize|g' \
+			"${D}etc/snort/snort.conf.distrib" || die
+	fi
+
+	# Set the configured DAQ to afpacket
+	sed -i -e 's|^# config daq: <type>|config daq: afpacket|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the location of the DAQ modules
+	sed -i -e 's|^# config daq_dir: <dir>|config daq_dir: /usr/'$(get_libdir)'/daq|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the DAQ mode to passive
+	sed -i -e 's|^# config daq_mode: <mode>|config daq_mode: passive|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set snort to run as snort:snort
+	sed -i -e 's|^# config set_gid:|config set_gid: snort|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+	sed -i -e 's|^# config set_uid:|config set_uid: snort|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the default log dir
+	sed -i -e 's|^# config logdir:|config logdir: /var/log/snort/|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the correct so_rule location in the config
+	 sed -i -e 's|SO_RULE_PATH ../so_rules|SO_RULE_PATH /etc/snort/so_rules|g' \
+		 "${D}etc/snort/snort.conf.distrib" || die
+}
+
+pkg_postinst() {
+
+	einfo "There have been a number of improvements and new features"
+	einfo "added to ${P}. Please review the RELEASE.NOTES and"
+	einfo "ChangLog located in /usr/share/doc/${PF}."
+	einfo
+	elog "The Sourcefire Vulnerability Research Team (VRT) recommends that"
+	elog "users migrate their snort.conf customizations to the latest config"
+	elog "file released by the VRT. You can find the latest version of the"
+	elog "Snort config file in /etc/snort/snort.conf.distrib."
+	elog
+	elog "!! It is important that you migrate to this new snort.conf file !!"
+	elog
+	elog "This version of the ebuild includes an updated init.d file and"
+	elog "conf.d file that rely on options found in the latest Snort"
+	elog "config file provided by the VRT."
+
+	if use debug; then
+		elog "You have the 'debug' USE flag enabled. If this has been done to"
+		elog "troubleshoot an issue by producing a core dump or a back trace,"
+		elog "then you need to also ensure the FEATURES variable in make.conf"
+		elog "contains the 'nostrip' option."
+	fi
+}
diff --git a/net-analyzer/snort/snort-2.9.6.2.ebuild b/net-analyzer/snort/snort-2.9.6.2.ebuild
new file mode 100644
index 000000000000..aa96708475a4
--- /dev/null
+++ b/net-analyzer/snort/snort-2.9.6.2.ebuild
@@ -0,0 +1,252 @@
+# Copyright 1999-2014 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Id$
+
+EAPI="5"
+inherit autotools multilib user
+
+DESCRIPTION="The de facto standard for intrusion detection/prevention"
+HOMEPAGE="http://www.snort.org/"
+SRC_URI="https://www.snort.org/downloads/${PN}/${P}.tar.gz"
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~mips ~ppc ~ppc64 ~sparc ~x86"
+IUSE="static +zlib +gre +mpls +targetbased +ppm +perfprofiling
++non-ether-decoders control-socket file-inspect high-availability
+shared-rep side-channel sourcefire linux-smp-stats inline-init-failopen
++threads debug +active-response +normalizer reload-error-restart
++react +flexresp3 large-pcap-64bit selinux"
+
+DEPEND=">=net-libs/libpcap-1.3.0
+	>=net-libs/daq-2.0.2
+	>=dev-libs/libpcre-8.33
+	dev-libs/libdnet
+	zlib? ( sys-libs/zlib )"
+
+RDEPEND="${DEPEND}
+	selinux? ( sec-policy/selinux-snort )"
+
+REQUIRED_USE="!kernel_linux? ( !shared-rep )"
+
+pkg_setup() {
+
+	# pre_inst() is a better place to put this
+	# but we need it here for the 'fowners' statements in src_install()
+	enewgroup snort
+	enewuser snort -1 -1 /dev/null snort
+
+}
+
+src_prepare() {
+
+	# Multilib fix for the sf_engine
+	ebegin "Applying multilib fix"
+	sed -i -e 's|${exec_prefix}/lib|${exec_prefix}/'$(get_libdir)'|g' \
+		"${WORKDIR}/${P}/src/dynamic-plugins/sf_engine/Makefile.am" \
+		|| die "sed for sf_engine failed"
+
+	# Multilib fix for the curent set of dynamic-preprocessors
+	for i in file ftptelnet smtp ssh dns ssl dcerpc2 sdf imap pop rzb_saac sip reputation gtp modbus dnp3; do
+		sed -i -e 's|${exec_prefix}/lib|${exec_prefix}/'$(get_libdir)'|g' \
+			"${WORKDIR}/${P}/src/dynamic-preprocessors/$i/Makefile.am" \
+			|| die "sed for $i failed."
+	done
+	eend
+
+	AT_M4DIR=m4 eautoreconf
+}
+
+src_configure() {
+
+	econf \
+		$(use_enable !static shared) \
+		$(use_enable static) \
+		$(use_enable static so-with-static-lib) \
+		$(use_enable zlib) \
+		$(use_enable gre) \
+		$(use_enable mpls) \
+		$(use_enable targetbased) \
+		$(use_enable control-socket) \
+		$(use_enable file-inspect) \
+		$(use_enable high-availability ha) \
+		$(use_enable non-ether-decoders) \
+		$(use_enable shared-rep) \
+		$(use_enable side-channel) \
+		$(use_enable sourcefire) \
+		$(use_enable ppm) \
+		$(use_enable perfprofiling) \
+		$(use_enable linux-smp-stats) \
+		$(use_enable inline-init-failopen) \
+		$(use_enable threads pthread) \
+		$(use_enable debug) \
+		$(use_enable debug debug-msgs) \
+		$(use_enable debug corefiles) \
+		$(use_enable !debug dlclose) \
+		$(use_enable active-response) \
+		$(use_enable normalizer) \
+		$(use_enable reload-error-restart) \
+		$(use_enable react) \
+		$(use_enable flexresp3) \
+		$(use_enable large-pcap-64bit large-pcap) \
+		--enable-reload \
+		--disable-build-dynamic-examples \
+		--disable-profile \
+		--disable-ppm-test \
+		--disable-intel-soft-cpm \
+		--disable-static-daq \
+		--disable-rzb-saac
+}
+
+src_install() {
+
+	emake DESTDIR="${D}" install
+
+	dodir /var/log/snort \
+		/var/run/snort \
+		/etc/snort/rules \
+		/etc/snort/so_rules \
+		/usr/$(get_libdir)/snort_dynamicrules
+
+	# config.log and build.log are needed by Sourcefire
+	# to trouble shoot build problems and bug reports so we are
+	# perserving them incase the user needs upstream support.
+	dodoc RELEASE.NOTES ChangeLog \
+		doc/* \
+		tools/u2boat/README.u2boat
+
+	insinto /etc/snort
+	doins etc/attribute_table.dtd \
+		etc/classification.config \
+		etc/gen-msg.map \
+		etc/reference.config \
+		etc/threshold.conf \
+		etc/unicode.map
+
+	# We use snort.conf.distrib because the config file is complicated
+	# and the one shipped with snort can change drastically between versions.
+	# Users should migrate setting by hand and not with etc-update.
+	newins etc/snort.conf snort.conf.distrib
+
+	# config.log and build.log are needed by Sourcefire
+	# to troubleshoot build problems and bug reports so we are
+	# preserving them incase the user needs upstream support.
+	if [ -f "${WORKDIR}/${PF}/config.log" ]; then
+		dodoc "${WORKDIR}/${PF}/config.log"
+	fi
+	if [ -f "${T}/build.log" ]; then
+		dodoc "${T}/build.log"
+	fi
+
+	insinto /etc/snort/preproc_rules
+	doins preproc_rules/decoder.rules \
+		preproc_rules/preprocessor.rules \
+		preproc_rules/sensitive-data.rules
+
+	fowners -R snort:snort \
+		/var/log/snort \
+		/var/run/snort \
+		/etc/snort
+
+	newinitd "${FILESDIR}/snort.rc12" snort
+	newconfd "${FILESDIR}/snort.confd.2" snort
+
+	# Sourcefire uses Makefiles to install docs causing Bug #297190.
+	# This removes the unwanted doc directory and rogue Makefiles.
+	rm -rf "${D}"usr/share/doc/snort || die "Failed to remove SF doc directories"
+	rm "${D}"usr/share/doc/"${PF}"/Makefile* || die "Failed to remove doc make files"
+
+	# Remove unneeded .la files (Bug #382863)
+	rm "${D}"usr/$(get_libdir)/snort_dynamicengine/libsf_engine.la || die
+	rm "${D}"usr/$(get_libdir)/snort_dynamicpreprocessor/libsf_*_preproc.la || die "Failed to remove libsf_?_preproc.la"
+
+	# Set the correct lib path for dynamicengine, dynamicpreprocessor, and dynamicdetection
+	sed -i -e 's|/usr/local/lib|/usr/'$(get_libdir)'|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the correct rule location in the config
+	sed -i -e 's|RULE_PATH ../rules|RULE_PATH /etc/snort/rules|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the correct preprocessor/decoder rule location in the config
+	sed -i -e 's|PREPROC_RULE_PATH ../preproc_rules|PREPROC_RULE_PATH /etc/snort/preproc_rules|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Enable the preprocessor/decoder rules
+	sed -i -e 's|^# include $PREPROC_RULE_PATH|include $PREPROC_RULE_PATH|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	sed -i -e 's|^# dynamicdetection directory|dynamicdetection directory|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Just some clean up of trailing /'s in the config
+	sed -i -e 's|snort_dynamicpreprocessor/$|snort_dynamicpreprocessor|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Make it clear in the config where these are...
+	sed -i -e 's|^include classification.config|include /etc/snort/classification.config|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	sed -i -e 's|^include reference.config|include /etc/snort/reference.config|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Disable all rule files by default.
+	sed -i -e 's|^include $RULE_PATH|# include $RULE_PATH|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Disable normalizer preprocessor config if normalizer USE flag not set.
+	if ! use normalizer; then
+		sed -i -e 's|^preprocessor normalize|#preprocessor normalize|g' \
+			"${D}etc/snort/snort.conf.distrib" || die
+	fi
+
+	# Set the configured DAQ to afpacket
+	sed -i -e 's|^# config daq: <type>|config daq: afpacket|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the location of the DAQ modules
+	sed -i -e 's|^# config daq_dir: <dir>|config daq_dir: /usr/'$(get_libdir)'/daq|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the DAQ mode to passive
+	sed -i -e 's|^# config daq_mode: <mode>|config daq_mode: passive|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set snort to run as snort:snort
+	sed -i -e 's|^# config set_gid:|config set_gid: snort|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+	sed -i -e 's|^# config set_uid:|config set_uid: snort|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the default log dir
+	sed -i -e 's|^# config logdir:|config logdir: /var/log/snort/|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the correct so_rule location in the config
+	 sed -i -e 's|SO_RULE_PATH ../so_rules|SO_RULE_PATH /etc/snort/so_rules|g' \
+		 "${D}etc/snort/snort.conf.distrib" || die
+}
+
+pkg_postinst() {
+
+	einfo "There have been a number of improvements and new features"
+	einfo "added to ${P}. Please review the RELEASE.NOTES and"
+	einfo "ChangLog located in /usr/share/doc/${PF}."
+	einfo
+	elog "The Sourcefire Vulnerability Research Team (VRT) recommends that"
+	elog "users migrate their snort.conf customizations to the latest config"
+	elog "file released by the VRT. You can find the latest version of the"
+	elog "Snort config file in /etc/snort/snort.conf.distrib."
+	elog
+	elog "!! It is important that you migrate to this new snort.conf file !!"
+	elog
+	elog "This version of the ebuild includes an updated init.d file and"
+	elog "conf.d file that rely on options found in the latest Snort"
+	elog "config file provided by the VRT."
+
+	if use debug; then
+		elog "You have the 'debug' USE flag enabled. If this has been done to"
+		elog "troubleshoot an issue by producing a core dump or a back trace,"
+		elog "then you need to also ensure the FEATURES variable in make.conf"
+		elog "contains the 'nostrip' option."
+	fi
+}
diff --git a/net-analyzer/snort/snort-2.9.7.0.ebuild b/net-analyzer/snort/snort-2.9.7.0.ebuild
new file mode 100644
index 000000000000..3c0716f6ab02
--- /dev/null
+++ b/net-analyzer/snort/snort-2.9.7.0.ebuild
@@ -0,0 +1,250 @@
+# Copyright 1999-2014 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Id$
+
+EAPI="5"
+inherit autotools multilib user
+
+DESCRIPTION="The de facto standard for intrusion detection/prevention"
+HOMEPAGE="http://www.snort.org/"
+SRC_URI="https://www.snort.org/downloads/${PN}/${P}.tar.gz"
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~mips ~ppc ~ppc64 ~sparc ~x86"
+IUSE="static +gre +mpls +targetbased +ppm +perfprofiling
++non-ether-decoders control-socket file-inspect high-availability
+shared-rep side-channel sourcefire linux-smp-stats inline-init-failopen
++threads debug +active-response +normalizer reload-error-restart
++react +flexresp3 large-pcap-64bit selinux"
+
+DEPEND=">=net-libs/libpcap-1.3.0
+	>=net-libs/daq-2.0.2
+	>=dev-libs/libpcre-8.33
+	dev-libs/libdnet
+	sys-libs/zlib"
+
+RDEPEND="${DEPEND}
+	selinux? ( sec-policy/selinux-snort )"
+
+REQUIRED_USE="!kernel_linux? ( !shared-rep )"
+
+pkg_setup() {
+
+	# pre_inst() is a better place to put this
+	# but we need it here for the 'fowners' statements in src_install()
+	enewgroup snort
+	enewuser snort -1 -1 /dev/null snort
+
+}
+
+src_prepare() {
+
+	# Multilib fix for the sf_engine
+	ebegin "Applying multilib fix"
+	sed -i -e 's|${exec_prefix}/lib|${exec_prefix}/'$(get_libdir)'|g' \
+		"${WORKDIR}/${P}/src/dynamic-plugins/sf_engine/Makefile.am" \
+		|| die "sed for sf_engine failed"
+
+	# Multilib fix for the curent set of dynamic-preprocessors
+	for i in file ftptelnet smtp ssh dns ssl dcerpc2 sdf imap pop sip reputation gtp modbus dnp3; do
+		sed -i -e 's|${exec_prefix}/lib|${exec_prefix}/'$(get_libdir)'|g' \
+			"${WORKDIR}/${P}/src/dynamic-preprocessors/$i/Makefile.am" \
+			|| die "sed for $i failed."
+	done
+	eend
+
+	AT_M4DIR=m4 eautoreconf
+}
+
+src_configure() {
+
+	econf \
+		$(use_enable !static shared) \
+		$(use_enable static) \
+		$(use_enable static so-with-static-lib) \
+		$(use_enable gre) \
+		$(use_enable mpls) \
+		$(use_enable targetbased) \
+		$(use_enable control-socket) \
+		$(use_enable file-inspect) \
+		$(use_enable high-availability ha) \
+		$(use_enable non-ether-decoders) \
+		$(use_enable shared-rep) \
+		$(use_enable side-channel) \
+		$(use_enable sourcefire) \
+		$(use_enable ppm) \
+		$(use_enable perfprofiling) \
+		$(use_enable linux-smp-stats) \
+		$(use_enable inline-init-failopen) \
+		$(use_enable threads pthread) \
+		$(use_enable debug) \
+		$(use_enable debug debug-msgs) \
+		$(use_enable debug corefiles) \
+		$(use_enable !debug dlclose) \
+		$(use_enable active-response) \
+		$(use_enable normalizer) \
+		$(use_enable reload-error-restart) \
+		$(use_enable react) \
+		$(use_enable flexresp3) \
+		$(use_enable large-pcap-64bit large-pcap) \
+		--enable-reload \
+		--disable-build-dynamic-examples \
+		--disable-profile \
+		--disable-ppm-test \
+		--disable-intel-soft-cpm \
+		--disable-static-daq
+}
+
+src_install() {
+
+	emake DESTDIR="${D}" install
+
+	dodir /var/log/snort \
+		/var/run/snort \
+		/etc/snort/rules \
+		/etc/snort/so_rules \
+		/usr/$(get_libdir)/snort_dynamicrules
+
+	# config.log and build.log are needed by Sourcefire
+	# to trouble shoot build problems and bug reports so we are
+	# perserving them incase the user needs upstream support.
+	dodoc RELEASE.NOTES ChangeLog \
+		doc/* \
+		tools/u2boat/README.u2boat
+
+	insinto /etc/snort
+	doins etc/attribute_table.dtd \
+		etc/classification.config \
+		etc/gen-msg.map \
+		etc/reference.config \
+		etc/threshold.conf \
+		etc/unicode.map
+
+	# We use snort.conf.distrib because the config file is complicated
+	# and the one shipped with snort can change drastically between versions.
+	# Users should migrate setting by hand and not with etc-update.
+	newins etc/snort.conf snort.conf.distrib
+
+	# config.log and build.log are needed by Sourcefire
+	# to troubleshoot build problems and bug reports so we are
+	# preserving them incase the user needs upstream support.
+	if [ -f "${WORKDIR}/${PF}/config.log" ]; then
+		dodoc "${WORKDIR}/${PF}/config.log"
+	fi
+	if [ -f "${T}/build.log" ]; then
+		dodoc "${T}/build.log"
+	fi
+
+	insinto /etc/snort/preproc_rules
+	doins preproc_rules/decoder.rules \
+		preproc_rules/preprocessor.rules \
+		preproc_rules/sensitive-data.rules
+
+	fowners -R snort:snort \
+		/var/log/snort \
+		/var/run/snort \
+		/etc/snort
+
+	newinitd "${FILESDIR}/snort.rc12" snort
+	newconfd "${FILESDIR}/snort.confd.2" snort
+
+	# Sourcefire uses Makefiles to install docs causing Bug #297190.
+	# This removes the unwanted doc directory and rogue Makefiles.
+	rm -rf "${D}"usr/share/doc/snort || die "Failed to remove SF doc directories"
+	rm "${D}"usr/share/doc/"${PF}"/Makefile* || die "Failed to remove doc make files"
+
+	# Remove unneeded .la files (Bug #382863)
+	rm "${D}"usr/$(get_libdir)/snort_dynamicengine/libsf_engine.la || die
+	rm "${D}"usr/$(get_libdir)/snort_dynamicpreprocessor/libsf_*_preproc.la || die "Failed to remove libsf_?_preproc.la"
+
+	# Set the correct lib path for dynamicengine, dynamicpreprocessor, and dynamicdetection
+	sed -i -e 's|/usr/local/lib|/usr/'$(get_libdir)'|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the correct rule location in the config
+	sed -i -e 's|RULE_PATH ../rules|RULE_PATH /etc/snort/rules|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the correct preprocessor/decoder rule location in the config
+	sed -i -e 's|PREPROC_RULE_PATH ../preproc_rules|PREPROC_RULE_PATH /etc/snort/preproc_rules|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Enable the preprocessor/decoder rules
+	sed -i -e 's|^# include $PREPROC_RULE_PATH|include $PREPROC_RULE_PATH|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	sed -i -e 's|^# dynamicdetection directory|dynamicdetection directory|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Just some clean up of trailing /'s in the config
+	sed -i -e 's|snort_dynamicpreprocessor/$|snort_dynamicpreprocessor|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Make it clear in the config where these are...
+	sed -i -e 's|^include classification.config|include /etc/snort/classification.config|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	sed -i -e 's|^include reference.config|include /etc/snort/reference.config|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Disable all rule files by default.
+	sed -i -e 's|^include $RULE_PATH|# include $RULE_PATH|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Disable normalizer preprocessor config if normalizer USE flag not set.
+	if ! use normalizer; then
+		sed -i -e 's|^preprocessor normalize|#preprocessor normalize|g' \
+			"${D}etc/snort/snort.conf.distrib" || die
+	fi
+
+	# Set the configured DAQ to afpacket
+	sed -i -e 's|^# config daq: <type>|config daq: afpacket|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the location of the DAQ modules
+	sed -i -e 's|^# config daq_dir: <dir>|config daq_dir: /usr/'$(get_libdir)'/daq|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the DAQ mode to passive
+	sed -i -e 's|^# config daq_mode: <mode>|config daq_mode: passive|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set snort to run as snort:snort
+	sed -i -e 's|^# config set_gid:|config set_gid: snort|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+	sed -i -e 's|^# config set_uid:|config set_uid: snort|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the default log dir
+	sed -i -e 's|^# config logdir:|config logdir: /var/log/snort/|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the correct so_rule location in the config
+	 sed -i -e 's|SO_RULE_PATH ../so_rules|SO_RULE_PATH /etc/snort/so_rules|g' \
+		 "${D}etc/snort/snort.conf.distrib" || die
+}
+
+pkg_postinst() {
+
+	einfo "There have been a number of improvements and new features"
+	einfo "added to ${P}. Please review the RELEASE.NOTES and"
+	einfo "ChangLog located in /usr/share/doc/${PF}."
+	einfo
+	elog "The Sourcefire Vulnerability Research Team (VRT) recommends that"
+	elog "users migrate their snort.conf customizations to the latest config"
+	elog "file released by the VRT. You can find the latest version of the"
+	elog "Snort config file in /etc/snort/snort.conf.distrib."
+	elog
+	elog "!! It is important that you migrate to this new snort.conf file !!"
+	elog
+	elog "This version of the ebuild includes an updated init.d file and"
+	elog "conf.d file that rely on options found in the latest Snort"
+	elog "config file provided by the VRT."
+
+	if use debug; then
+		elog "You have the 'debug' USE flag enabled. If this has been done to"
+		elog "troubleshoot an issue by producing a core dump or a back trace,"
+		elog "then you need to also ensure the FEATURES variable in make.conf"
+		elog "contains the 'nostrip' option."
+	fi
+}
diff --git a/net-analyzer/snort/snort-2.9.7.2.ebuild b/net-analyzer/snort/snort-2.9.7.2.ebuild
new file mode 100644
index 000000000000..dcc015235dbf
--- /dev/null
+++ b/net-analyzer/snort/snort-2.9.7.2.ebuild
@@ -0,0 +1,250 @@
+# Copyright 1999-2015 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Id$
+
+EAPI="5"
+inherit autotools multilib user
+
+DESCRIPTION="The de facto standard for intrusion detection/prevention"
+HOMEPAGE="http://www.snort.org/"
+SRC_URI="https://www.snort.org/downloads/${PN}/${P}.tar.gz"
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~mips ~ppc ~ppc64 ~sparc ~x86"
+IUSE="static +gre +mpls +targetbased +ppm +perfprofiling
++non-ether-decoders control-socket file-inspect high-availability
+shared-rep side-channel sourcefire linux-smp-stats inline-init-failopen
++threads debug +active-response +normalizer reload-error-restart
++react +flexresp3 large-pcap-64bit selinux"
+
+DEPEND=">=net-libs/libpcap-1.3.0
+	>=net-libs/daq-2.0.2
+	>=dev-libs/libpcre-8.33
+	dev-libs/libdnet
+	sys-libs/zlib"
+
+RDEPEND="${DEPEND}
+	selinux? ( sec-policy/selinux-snort )"
+
+REQUIRED_USE="!kernel_linux? ( !shared-rep )"
+
+pkg_setup() {
+
+	# pre_inst() is a better place to put this
+	# but we need it here for the 'fowners' statements in src_install()
+	enewgroup snort
+	enewuser snort -1 -1 /dev/null snort
+
+}
+
+src_prepare() {
+
+	# Multilib fix for the sf_engine
+	ebegin "Applying multilib fix"
+	sed -i -e 's|${exec_prefix}/lib|${exec_prefix}/'$(get_libdir)'|g' \
+		"${WORKDIR}/${P}/src/dynamic-plugins/sf_engine/Makefile.am" \
+		|| die "sed for sf_engine failed"
+
+	# Multilib fix for the curent set of dynamic-preprocessors
+	for i in file ftptelnet smtp ssh dns ssl dcerpc2 sdf imap pop sip reputation gtp modbus dnp3; do
+		sed -i -e 's|${exec_prefix}/lib|${exec_prefix}/'$(get_libdir)'|g' \
+			"${WORKDIR}/${P}/src/dynamic-preprocessors/$i/Makefile.am" \
+			|| die "sed for $i failed."
+	done
+	eend
+
+	AT_M4DIR=m4 eautoreconf
+}
+
+src_configure() {
+
+	econf \
+		$(use_enable !static shared) \
+		$(use_enable static) \
+		$(use_enable static so-with-static-lib) \
+		$(use_enable gre) \
+		$(use_enable mpls) \
+		$(use_enable targetbased) \
+		$(use_enable control-socket) \
+		$(use_enable file-inspect) \
+		$(use_enable high-availability ha) \
+		$(use_enable non-ether-decoders) \
+		$(use_enable shared-rep) \
+		$(use_enable side-channel) \
+		$(use_enable sourcefire) \
+		$(use_enable ppm) \
+		$(use_enable perfprofiling) \
+		$(use_enable linux-smp-stats) \
+		$(use_enable inline-init-failopen) \
+		$(use_enable threads pthread) \
+		$(use_enable debug) \
+		$(use_enable debug debug-msgs) \
+		$(use_enable debug corefiles) \
+		$(use_enable !debug dlclose) \
+		$(use_enable active-response) \
+		$(use_enable normalizer) \
+		$(use_enable reload-error-restart) \
+		$(use_enable react) \
+		$(use_enable flexresp3) \
+		$(use_enable large-pcap-64bit large-pcap) \
+		--enable-reload \
+		--disable-build-dynamic-examples \
+		--disable-profile \
+		--disable-ppm-test \
+		--disable-intel-soft-cpm \
+		--disable-static-daq
+}
+
+src_install() {
+
+	emake DESTDIR="${D}" install
+
+	dodir /var/log/snort \
+		/var/run/snort \
+		/etc/snort/rules \
+		/etc/snort/so_rules \
+		/usr/$(get_libdir)/snort_dynamicrules
+
+	# config.log and build.log are needed by Sourcefire
+	# to trouble shoot build problems and bug reports so we are
+	# perserving them incase the user needs upstream support.
+	dodoc RELEASE.NOTES ChangeLog \
+		doc/* \
+		tools/u2boat/README.u2boat
+
+	insinto /etc/snort
+	doins etc/attribute_table.dtd \
+		etc/classification.config \
+		etc/gen-msg.map \
+		etc/reference.config \
+		etc/threshold.conf \
+		etc/unicode.map
+
+	# We use snort.conf.distrib because the config file is complicated
+	# and the one shipped with snort can change drastically between versions.
+	# Users should migrate setting by hand and not with etc-update.
+	newins etc/snort.conf snort.conf.distrib
+
+	# config.log and build.log are needed by Sourcefire
+	# to troubleshoot build problems and bug reports so we are
+	# preserving them incase the user needs upstream support.
+	if [ -f "${WORKDIR}/${PF}/config.log" ]; then
+		dodoc "${WORKDIR}/${PF}/config.log"
+	fi
+	if [ -f "${T}/build.log" ]; then
+		dodoc "${T}/build.log"
+	fi
+
+	insinto /etc/snort/preproc_rules
+	doins preproc_rules/decoder.rules \
+		preproc_rules/preprocessor.rules \
+		preproc_rules/sensitive-data.rules
+
+	fowners -R snort:snort \
+		/var/log/snort \
+		/var/run/snort \
+		/etc/snort
+
+	newinitd "${FILESDIR}/snort.rc12" snort
+	newconfd "${FILESDIR}/snort.confd.2" snort
+
+	# Sourcefire uses Makefiles to install docs causing Bug #297190.
+	# This removes the unwanted doc directory and rogue Makefiles.
+	rm -rf "${D}"usr/share/doc/snort || die "Failed to remove SF doc directories"
+	rm "${D}"usr/share/doc/"${PF}"/Makefile* || die "Failed to remove doc make files"
+
+	# Remove unneeded .la files (Bug #382863)
+	rm "${D}"usr/$(get_libdir)/snort_dynamicengine/libsf_engine.la || die
+	rm "${D}"usr/$(get_libdir)/snort_dynamicpreprocessor/libsf_*_preproc.la || die "Failed to remove libsf_?_preproc.la"
+
+	# Set the correct lib path for dynamicengine, dynamicpreprocessor, and dynamicdetection
+	sed -i -e 's|/usr/local/lib|/usr/'$(get_libdir)'|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the correct rule location in the config
+	sed -i -e 's|RULE_PATH ../rules|RULE_PATH /etc/snort/rules|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the correct preprocessor/decoder rule location in the config
+	sed -i -e 's|PREPROC_RULE_PATH ../preproc_rules|PREPROC_RULE_PATH /etc/snort/preproc_rules|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Enable the preprocessor/decoder rules
+	sed -i -e 's|^# include $PREPROC_RULE_PATH|include $PREPROC_RULE_PATH|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	sed -i -e 's|^# dynamicdetection directory|dynamicdetection directory|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Just some clean up of trailing /'s in the config
+	sed -i -e 's|snort_dynamicpreprocessor/$|snort_dynamicpreprocessor|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Make it clear in the config where these are...
+	sed -i -e 's|^include classification.config|include /etc/snort/classification.config|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	sed -i -e 's|^include reference.config|include /etc/snort/reference.config|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Disable all rule files by default.
+	sed -i -e 's|^include $RULE_PATH|# include $RULE_PATH|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Disable normalizer preprocessor config if normalizer USE flag not set.
+	if ! use normalizer; then
+		sed -i -e 's|^preprocessor normalize|#preprocessor normalize|g' \
+			"${D}etc/snort/snort.conf.distrib" || die
+	fi
+
+	# Set the configured DAQ to afpacket
+	sed -i -e 's|^# config daq: <type>|config daq: afpacket|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the location of the DAQ modules
+	sed -i -e 's|^# config daq_dir: <dir>|config daq_dir: /usr/'$(get_libdir)'/daq|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the DAQ mode to passive
+	sed -i -e 's|^# config daq_mode: <mode>|config daq_mode: passive|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set snort to run as snort:snort
+	sed -i -e 's|^# config set_gid:|config set_gid: snort|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+	sed -i -e 's|^# config set_uid:|config set_uid: snort|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the default log dir
+	sed -i -e 's|^# config logdir:|config logdir: /var/log/snort/|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the correct so_rule location in the config
+	 sed -i -e 's|SO_RULE_PATH ../so_rules|SO_RULE_PATH /etc/snort/so_rules|g' \
+		 "${D}etc/snort/snort.conf.distrib" || die
+}
+
+pkg_postinst() {
+
+	einfo "There have been a number of improvements and new features"
+	einfo "added to ${P}. Please review the RELEASE.NOTES and"
+	einfo "ChangLog located in /usr/share/doc/${PF}."
+	einfo
+	elog "The Sourcefire Vulnerability Research Team (VRT) recommends that"
+	elog "users migrate their snort.conf customizations to the latest config"
+	elog "file released by the VRT. You can find the latest version of the"
+	elog "Snort config file in /etc/snort/snort.conf.distrib."
+	elog
+	elog "!! It is important that you migrate to this new snort.conf file !!"
+	elog
+	elog "This version of the ebuild includes an updated init.d file and"
+	elog "conf.d file that rely on options found in the latest Snort"
+	elog "config file provided by the VRT."
+
+	if use debug; then
+		elog "You have the 'debug' USE flag enabled. If this has been done to"
+		elog "troubleshoot an issue by producing a core dump or a back trace,"
+		elog "then you need to also ensure the FEATURES variable in make.conf"
+		elog "contains the 'nostrip' option."
+	fi
+}
diff --git a/net-analyzer/snort/snort-2.9.7.3.ebuild b/net-analyzer/snort/snort-2.9.7.3.ebuild
new file mode 100644
index 000000000000..dcc015235dbf
--- /dev/null
+++ b/net-analyzer/snort/snort-2.9.7.3.ebuild
@@ -0,0 +1,250 @@
+# Copyright 1999-2015 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Id$
+
+EAPI="5"
+inherit autotools multilib user
+
+DESCRIPTION="The de facto standard for intrusion detection/prevention"
+HOMEPAGE="http://www.snort.org/"
+SRC_URI="https://www.snort.org/downloads/${PN}/${P}.tar.gz"
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~mips ~ppc ~ppc64 ~sparc ~x86"
+IUSE="static +gre +mpls +targetbased +ppm +perfprofiling
++non-ether-decoders control-socket file-inspect high-availability
+shared-rep side-channel sourcefire linux-smp-stats inline-init-failopen
++threads debug +active-response +normalizer reload-error-restart
++react +flexresp3 large-pcap-64bit selinux"
+
+DEPEND=">=net-libs/libpcap-1.3.0
+	>=net-libs/daq-2.0.2
+	>=dev-libs/libpcre-8.33
+	dev-libs/libdnet
+	sys-libs/zlib"
+
+RDEPEND="${DEPEND}
+	selinux? ( sec-policy/selinux-snort )"
+
+REQUIRED_USE="!kernel_linux? ( !shared-rep )"
+
+pkg_setup() {
+
+	# pre_inst() is a better place to put this
+	# but we need it here for the 'fowners' statements in src_install()
+	enewgroup snort
+	enewuser snort -1 -1 /dev/null snort
+
+}
+
+src_prepare() {
+
+	# Multilib fix for the sf_engine
+	ebegin "Applying multilib fix"
+	sed -i -e 's|${exec_prefix}/lib|${exec_prefix}/'$(get_libdir)'|g' \
+		"${WORKDIR}/${P}/src/dynamic-plugins/sf_engine/Makefile.am" \
+		|| die "sed for sf_engine failed"
+
+	# Multilib fix for the curent set of dynamic-preprocessors
+	for i in file ftptelnet smtp ssh dns ssl dcerpc2 sdf imap pop sip reputation gtp modbus dnp3; do
+		sed -i -e 's|${exec_prefix}/lib|${exec_prefix}/'$(get_libdir)'|g' \
+			"${WORKDIR}/${P}/src/dynamic-preprocessors/$i/Makefile.am" \
+			|| die "sed for $i failed."
+	done
+	eend
+
+	AT_M4DIR=m4 eautoreconf
+}
+
+src_configure() {
+
+	econf \
+		$(use_enable !static shared) \
+		$(use_enable static) \
+		$(use_enable static so-with-static-lib) \
+		$(use_enable gre) \
+		$(use_enable mpls) \
+		$(use_enable targetbased) \
+		$(use_enable control-socket) \
+		$(use_enable file-inspect) \
+		$(use_enable high-availability ha) \
+		$(use_enable non-ether-decoders) \
+		$(use_enable shared-rep) \
+		$(use_enable side-channel) \
+		$(use_enable sourcefire) \
+		$(use_enable ppm) \
+		$(use_enable perfprofiling) \
+		$(use_enable linux-smp-stats) \
+		$(use_enable inline-init-failopen) \
+		$(use_enable threads pthread) \
+		$(use_enable debug) \
+		$(use_enable debug debug-msgs) \
+		$(use_enable debug corefiles) \
+		$(use_enable !debug dlclose) \
+		$(use_enable active-response) \
+		$(use_enable normalizer) \
+		$(use_enable reload-error-restart) \
+		$(use_enable react) \
+		$(use_enable flexresp3) \
+		$(use_enable large-pcap-64bit large-pcap) \
+		--enable-reload \
+		--disable-build-dynamic-examples \
+		--disable-profile \
+		--disable-ppm-test \
+		--disable-intel-soft-cpm \
+		--disable-static-daq
+}
+
+src_install() {
+
+	emake DESTDIR="${D}" install
+
+	dodir /var/log/snort \
+		/var/run/snort \
+		/etc/snort/rules \
+		/etc/snort/so_rules \
+		/usr/$(get_libdir)/snort_dynamicrules
+
+	# config.log and build.log are needed by Sourcefire
+	# to trouble shoot build problems and bug reports so we are
+	# perserving them incase the user needs upstream support.
+	dodoc RELEASE.NOTES ChangeLog \
+		doc/* \
+		tools/u2boat/README.u2boat
+
+	insinto /etc/snort
+	doins etc/attribute_table.dtd \
+		etc/classification.config \
+		etc/gen-msg.map \
+		etc/reference.config \
+		etc/threshold.conf \
+		etc/unicode.map
+
+	# We use snort.conf.distrib because the config file is complicated
+	# and the one shipped with snort can change drastically between versions.
+	# Users should migrate setting by hand and not with etc-update.
+	newins etc/snort.conf snort.conf.distrib
+
+	# config.log and build.log are needed by Sourcefire
+	# to troubleshoot build problems and bug reports so we are
+	# preserving them incase the user needs upstream support.
+	if [ -f "${WORKDIR}/${PF}/config.log" ]; then
+		dodoc "${WORKDIR}/${PF}/config.log"
+	fi
+	if [ -f "${T}/build.log" ]; then
+		dodoc "${T}/build.log"
+	fi
+
+	insinto /etc/snort/preproc_rules
+	doins preproc_rules/decoder.rules \
+		preproc_rules/preprocessor.rules \
+		preproc_rules/sensitive-data.rules
+
+	fowners -R snort:snort \
+		/var/log/snort \
+		/var/run/snort \
+		/etc/snort
+
+	newinitd "${FILESDIR}/snort.rc12" snort
+	newconfd "${FILESDIR}/snort.confd.2" snort
+
+	# Sourcefire uses Makefiles to install docs causing Bug #297190.
+	# This removes the unwanted doc directory and rogue Makefiles.
+	rm -rf "${D}"usr/share/doc/snort || die "Failed to remove SF doc directories"
+	rm "${D}"usr/share/doc/"${PF}"/Makefile* || die "Failed to remove doc make files"
+
+	# Remove unneeded .la files (Bug #382863)
+	rm "${D}"usr/$(get_libdir)/snort_dynamicengine/libsf_engine.la || die
+	rm "${D}"usr/$(get_libdir)/snort_dynamicpreprocessor/libsf_*_preproc.la || die "Failed to remove libsf_?_preproc.la"
+
+	# Set the correct lib path for dynamicengine, dynamicpreprocessor, and dynamicdetection
+	sed -i -e 's|/usr/local/lib|/usr/'$(get_libdir)'|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the correct rule location in the config
+	sed -i -e 's|RULE_PATH ../rules|RULE_PATH /etc/snort/rules|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the correct preprocessor/decoder rule location in the config
+	sed -i -e 's|PREPROC_RULE_PATH ../preproc_rules|PREPROC_RULE_PATH /etc/snort/preproc_rules|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Enable the preprocessor/decoder rules
+	sed -i -e 's|^# include $PREPROC_RULE_PATH|include $PREPROC_RULE_PATH|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	sed -i -e 's|^# dynamicdetection directory|dynamicdetection directory|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Just some clean up of trailing /'s in the config
+	sed -i -e 's|snort_dynamicpreprocessor/$|snort_dynamicpreprocessor|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Make it clear in the config where these are...
+	sed -i -e 's|^include classification.config|include /etc/snort/classification.config|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	sed -i -e 's|^include reference.config|include /etc/snort/reference.config|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Disable all rule files by default.
+	sed -i -e 's|^include $RULE_PATH|# include $RULE_PATH|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Disable normalizer preprocessor config if normalizer USE flag not set.
+	if ! use normalizer; then
+		sed -i -e 's|^preprocessor normalize|#preprocessor normalize|g' \
+			"${D}etc/snort/snort.conf.distrib" || die
+	fi
+
+	# Set the configured DAQ to afpacket
+	sed -i -e 's|^# config daq: <type>|config daq: afpacket|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the location of the DAQ modules
+	sed -i -e 's|^# config daq_dir: <dir>|config daq_dir: /usr/'$(get_libdir)'/daq|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the DAQ mode to passive
+	sed -i -e 's|^# config daq_mode: <mode>|config daq_mode: passive|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set snort to run as snort:snort
+	sed -i -e 's|^# config set_gid:|config set_gid: snort|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+	sed -i -e 's|^# config set_uid:|config set_uid: snort|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the default log dir
+	sed -i -e 's|^# config logdir:|config logdir: /var/log/snort/|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the correct so_rule location in the config
+	 sed -i -e 's|SO_RULE_PATH ../so_rules|SO_RULE_PATH /etc/snort/so_rules|g' \
+		 "${D}etc/snort/snort.conf.distrib" || die
+}
+
+pkg_postinst() {
+
+	einfo "There have been a number of improvements and new features"
+	einfo "added to ${P}. Please review the RELEASE.NOTES and"
+	einfo "ChangLog located in /usr/share/doc/${PF}."
+	einfo
+	elog "The Sourcefire Vulnerability Research Team (VRT) recommends that"
+	elog "users migrate their snort.conf customizations to the latest config"
+	elog "file released by the VRT. You can find the latest version of the"
+	elog "Snort config file in /etc/snort/snort.conf.distrib."
+	elog
+	elog "!! It is important that you migrate to this new snort.conf file !!"
+	elog
+	elog "This version of the ebuild includes an updated init.d file and"
+	elog "conf.d file that rely on options found in the latest Snort"
+	elog "config file provided by the VRT."
+
+	if use debug; then
+		elog "You have the 'debug' USE flag enabled. If this has been done to"
+		elog "troubleshoot an issue by producing a core dump or a back trace,"
+		elog "then you need to also ensure the FEATURES variable in make.conf"
+		elog "contains the 'nostrip' option."
+	fi
+}
diff --git a/net-analyzer/snort/snort-2.9.7.5.ebuild b/net-analyzer/snort/snort-2.9.7.5.ebuild
new file mode 100644
index 000000000000..dcc015235dbf
--- /dev/null
+++ b/net-analyzer/snort/snort-2.9.7.5.ebuild
@@ -0,0 +1,250 @@
+# Copyright 1999-2015 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Id$
+
+EAPI="5"
+inherit autotools multilib user
+
+DESCRIPTION="The de facto standard for intrusion detection/prevention"
+HOMEPAGE="http://www.snort.org/"
+SRC_URI="https://www.snort.org/downloads/${PN}/${P}.tar.gz"
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~mips ~ppc ~ppc64 ~sparc ~x86"
+IUSE="static +gre +mpls +targetbased +ppm +perfprofiling
++non-ether-decoders control-socket file-inspect high-availability
+shared-rep side-channel sourcefire linux-smp-stats inline-init-failopen
++threads debug +active-response +normalizer reload-error-restart
++react +flexresp3 large-pcap-64bit selinux"
+
+DEPEND=">=net-libs/libpcap-1.3.0
+	>=net-libs/daq-2.0.2
+	>=dev-libs/libpcre-8.33
+	dev-libs/libdnet
+	sys-libs/zlib"
+
+RDEPEND="${DEPEND}
+	selinux? ( sec-policy/selinux-snort )"
+
+REQUIRED_USE="!kernel_linux? ( !shared-rep )"
+
+pkg_setup() {
+
+	# pre_inst() is a better place to put this
+	# but we need it here for the 'fowners' statements in src_install()
+	enewgroup snort
+	enewuser snort -1 -1 /dev/null snort
+
+}
+
+src_prepare() {
+
+	# Multilib fix for the sf_engine
+	ebegin "Applying multilib fix"
+	sed -i -e 's|${exec_prefix}/lib|${exec_prefix}/'$(get_libdir)'|g' \
+		"${WORKDIR}/${P}/src/dynamic-plugins/sf_engine/Makefile.am" \
+		|| die "sed for sf_engine failed"
+
+	# Multilib fix for the curent set of dynamic-preprocessors
+	for i in file ftptelnet smtp ssh dns ssl dcerpc2 sdf imap pop sip reputation gtp modbus dnp3; do
+		sed -i -e 's|${exec_prefix}/lib|${exec_prefix}/'$(get_libdir)'|g' \
+			"${WORKDIR}/${P}/src/dynamic-preprocessors/$i/Makefile.am" \
+			|| die "sed for $i failed."
+	done
+	eend
+
+	AT_M4DIR=m4 eautoreconf
+}
+
+src_configure() {
+
+	econf \
+		$(use_enable !static shared) \
+		$(use_enable static) \
+		$(use_enable static so-with-static-lib) \
+		$(use_enable gre) \
+		$(use_enable mpls) \
+		$(use_enable targetbased) \
+		$(use_enable control-socket) \
+		$(use_enable file-inspect) \
+		$(use_enable high-availability ha) \
+		$(use_enable non-ether-decoders) \
+		$(use_enable shared-rep) \
+		$(use_enable side-channel) \
+		$(use_enable sourcefire) \
+		$(use_enable ppm) \
+		$(use_enable perfprofiling) \
+		$(use_enable linux-smp-stats) \
+		$(use_enable inline-init-failopen) \
+		$(use_enable threads pthread) \
+		$(use_enable debug) \
+		$(use_enable debug debug-msgs) \
+		$(use_enable debug corefiles) \
+		$(use_enable !debug dlclose) \
+		$(use_enable active-response) \
+		$(use_enable normalizer) \
+		$(use_enable reload-error-restart) \
+		$(use_enable react) \
+		$(use_enable flexresp3) \
+		$(use_enable large-pcap-64bit large-pcap) \
+		--enable-reload \
+		--disable-build-dynamic-examples \
+		--disable-profile \
+		--disable-ppm-test \
+		--disable-intel-soft-cpm \
+		--disable-static-daq
+}
+
+src_install() {
+
+	emake DESTDIR="${D}" install
+
+	dodir /var/log/snort \
+		/var/run/snort \
+		/etc/snort/rules \
+		/etc/snort/so_rules \
+		/usr/$(get_libdir)/snort_dynamicrules
+
+	# config.log and build.log are needed by Sourcefire
+	# to trouble shoot build problems and bug reports so we are
+	# perserving them incase the user needs upstream support.
+	dodoc RELEASE.NOTES ChangeLog \
+		doc/* \
+		tools/u2boat/README.u2boat
+
+	insinto /etc/snort
+	doins etc/attribute_table.dtd \
+		etc/classification.config \
+		etc/gen-msg.map \
+		etc/reference.config \
+		etc/threshold.conf \
+		etc/unicode.map
+
+	# We use snort.conf.distrib because the config file is complicated
+	# and the one shipped with snort can change drastically between versions.
+	# Users should migrate setting by hand and not with etc-update.
+	newins etc/snort.conf snort.conf.distrib
+
+	# config.log and build.log are needed by Sourcefire
+	# to troubleshoot build problems and bug reports so we are
+	# preserving them incase the user needs upstream support.
+	if [ -f "${WORKDIR}/${PF}/config.log" ]; then
+		dodoc "${WORKDIR}/${PF}/config.log"
+	fi
+	if [ -f "${T}/build.log" ]; then
+		dodoc "${T}/build.log"
+	fi
+
+	insinto /etc/snort/preproc_rules
+	doins preproc_rules/decoder.rules \
+		preproc_rules/preprocessor.rules \
+		preproc_rules/sensitive-data.rules
+
+	fowners -R snort:snort \
+		/var/log/snort \
+		/var/run/snort \
+		/etc/snort
+
+	newinitd "${FILESDIR}/snort.rc12" snort
+	newconfd "${FILESDIR}/snort.confd.2" snort
+
+	# Sourcefire uses Makefiles to install docs causing Bug #297190.
+	# This removes the unwanted doc directory and rogue Makefiles.
+	rm -rf "${D}"usr/share/doc/snort || die "Failed to remove SF doc directories"
+	rm "${D}"usr/share/doc/"${PF}"/Makefile* || die "Failed to remove doc make files"
+
+	# Remove unneeded .la files (Bug #382863)
+	rm "${D}"usr/$(get_libdir)/snort_dynamicengine/libsf_engine.la || die
+	rm "${D}"usr/$(get_libdir)/snort_dynamicpreprocessor/libsf_*_preproc.la || die "Failed to remove libsf_?_preproc.la"
+
+	# Set the correct lib path for dynamicengine, dynamicpreprocessor, and dynamicdetection
+	sed -i -e 's|/usr/local/lib|/usr/'$(get_libdir)'|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the correct rule location in the config
+	sed -i -e 's|RULE_PATH ../rules|RULE_PATH /etc/snort/rules|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the correct preprocessor/decoder rule location in the config
+	sed -i -e 's|PREPROC_RULE_PATH ../preproc_rules|PREPROC_RULE_PATH /etc/snort/preproc_rules|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Enable the preprocessor/decoder rules
+	sed -i -e 's|^# include $PREPROC_RULE_PATH|include $PREPROC_RULE_PATH|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	sed -i -e 's|^# dynamicdetection directory|dynamicdetection directory|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Just some clean up of trailing /'s in the config
+	sed -i -e 's|snort_dynamicpreprocessor/$|snort_dynamicpreprocessor|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Make it clear in the config where these are...
+	sed -i -e 's|^include classification.config|include /etc/snort/classification.config|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	sed -i -e 's|^include reference.config|include /etc/snort/reference.config|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Disable all rule files by default.
+	sed -i -e 's|^include $RULE_PATH|# include $RULE_PATH|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Disable normalizer preprocessor config if normalizer USE flag not set.
+	if ! use normalizer; then
+		sed -i -e 's|^preprocessor normalize|#preprocessor normalize|g' \
+			"${D}etc/snort/snort.conf.distrib" || die
+	fi
+
+	# Set the configured DAQ to afpacket
+	sed -i -e 's|^# config daq: <type>|config daq: afpacket|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the location of the DAQ modules
+	sed -i -e 's|^# config daq_dir: <dir>|config daq_dir: /usr/'$(get_libdir)'/daq|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the DAQ mode to passive
+	sed -i -e 's|^# config daq_mode: <mode>|config daq_mode: passive|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set snort to run as snort:snort
+	sed -i -e 's|^# config set_gid:|config set_gid: snort|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+	sed -i -e 's|^# config set_uid:|config set_uid: snort|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the default log dir
+	sed -i -e 's|^# config logdir:|config logdir: /var/log/snort/|g' \
+		"${D}etc/snort/snort.conf.distrib" || die
+
+	# Set the correct so_rule location in the config
+	 sed -i -e 's|SO_RULE_PATH ../so_rules|SO_RULE_PATH /etc/snort/so_rules|g' \
+		 "${D}etc/snort/snort.conf.distrib" || die
+}
+
+pkg_postinst() {
+
+	einfo "There have been a number of improvements and new features"
+	einfo "added to ${P}. Please review the RELEASE.NOTES and"
+	einfo "ChangLog located in /usr/share/doc/${PF}."
+	einfo
+	elog "The Sourcefire Vulnerability Research Team (VRT) recommends that"
+	elog "users migrate their snort.conf customizations to the latest config"
+	elog "file released by the VRT. You can find the latest version of the"
+	elog "Snort config file in /etc/snort/snort.conf.distrib."
+	elog
+	elog "!! It is important that you migrate to this new snort.conf file !!"
+	elog
+	elog "This version of the ebuild includes an updated init.d file and"
+	elog "conf.d file that rely on options found in the latest Snort"
+	elog "config file provided by the VRT."
+
+	if use debug; then
+		elog "You have the 'debug' USE flag enabled. If this has been done to"
+		elog "troubleshoot an issue by producing a core dump or a back trace,"
+		elog "then you need to also ensure the FEATURES variable in make.conf"
+		elog "contains the 'nostrip' option."
+	fi
+}