27 files changed, 856 insertions, 251 deletions

diff --git a/security/bro/Makefile b/security/bro/Makefile
index 8afe6eaeadd2..b29426909c19 100644
--- a/security/bro/Makefile
+++ b/security/bro/Makefile
@@ -1,62 +1,106 @@
-# ex:ts=8
 # Ports collection makefile for:  bro
-# Date created:			  Sat Feb 28, 1998
-# Whom:				  David O'Brien (obrien@FreeBSD.org)
+# Date created:			  Mon Jul 16, 2007
+# Whom:				  Paul Schmehl (pauls@utdallas.edu)
 #
 # $FreeBSD$
 #
 
 PORTNAME=	bro
-PORTVERSION=	0.8
-PORTREVISION=	1
+PORTVERSION=	1.2
 CATEGORIES=	security
-MASTER_SITES=	ftp://ftp.ee.lbl.gov/
-DISTNAME=	${PORTNAME}-pub-${PORTVERSION}a37
+MASTER_SITES=	ftp://bro-ids.org/
+DISTNAME=	${PORTNAME}-${PORTVERSION}-stable
 
-MAINTAINER=	ports@FreeBSD.org
+MAINTAINER=	pauls@utdallas.edu
 COMMENT=	System for detecting Network Intruders in real-time
 
 BUILD_DEPENDS=	bison:${PORTSDIR}/devel/bison
 
-WRKSRC=		${WRKDIR}/${PORTNAME}-pub-${PORTVERSION}a37
+OPTIONS=	GPG "Support encrypted email" Off \
+		DOCS "Install documentation (not recommended)" Off
 
+WRKSRC=		${WRKDIR}/bro-${PORTVERSION}.1
+
+USE_LDCONFIG=	${PREFIX}/share
 GNU_CONFIGURE=	yes
 MAKE_ENV+=	CC="${CC}"
 CONFIGURE_TARGET=	--build=${MACHINE_ARCH}-portbld-freebsd${OSREL}
 CONFIGURE_ARGS=	--libdir=${PREFIX}/share
 USE_PERL5=	yes
 
+IS_INTERACTIVE=	yes	# during the install phase
+
+SUB_FILES=	pkg-deinstall pkg-install pkg-message
+SUB_LIST=	BROHOME=${BROHOME} BROSITEDIR=${BROSITEDIR} SITE_PERL=${SITE_PERL} WRKSRC=${WRKSRC}
+BROHOME=	${PREFIX}/bro
+BROSITEDIR=	${BROHOME}/site
+
+.include <bsd.port.pre.mk>
+
+.if defined(WITH_GPG)
+BUILD_DEPENDS+=	gpg:${PORTSDIR}/security/gnupg
+.endif
+.if !defined(WITH_DOCS)
+NOPORTDOCS=	Yes
+.endif
+
 post-extract:
-	@cd ${WRKSRC} && ${TAR} xfz libedit.src.tar.gz
+	@cd ${WRKSRC}/src && ${TAR} xfz libedit.src.tar.gz
 
 post-patch:
 	@${REINPLACE_CMD} -e 's|CFLAGS+=-g -O0||g; \
 		s|CC=gcc||' \
-		${WRKSRC}/libedit/Makefile.in \
-		${WRKSRC}/libedit/Makefile
+		${WRKSRC}/src/libedit/Makefile.in \
+		${WRKSRC}/src/libedit/Makefile
 	@${REINPLACE_CMD} -e "s,tr '\[a-z\]' '\[A-Z\]',tr 'a-z' 'A-Z',g" \
-		${WRKSRC}/libedit/makelist
+		${WRKSRC}/src/libedit/makelist
 	@${REINPLACE_CMD} -E -e 's,(const char\*) const (helpstring),\1 \2,g' \
-		${WRKSRC}/DebugCmds.h
+		${WRKSRC}/src/DebugCmds.h
 
 pre-configure:
 	@${ECHO_CMD} "Configure libedit..."
-	@(cd ${WRKSRC}/libedit && ${MAKE_ENV} ./configure)
+	@(cd ${WRKSRC}/src/libedit && ${MAKE_ENV} ./configure)
 
 pre-build:
 	@${ECHO_CMD} "Building libedit..."
-	@(cd ${WRKSRC}/libedit && ${MAKE})
-
-pre-install:
-	@${MKDIR} ${DATADIR}
+	@(cd ${WRKSRC}/src/libedit && ${MAKE})
 
 post-install:
-	@${STRIP_CMD} ${PREFIX}/sbin/bro
-	@${INSTALL_DATA} ${WRKSRC}/policy/*.* ${DATADIR}
+	@${STRIP_CMD} ${PREFIX}/bin/bro
+	@${MKDIR} ${PREFIX}/bro/etc
+	@${MKDIR} ${SITE_PERL}/mach/Bro
+	@${MKDIR} ${SITE_PERL}/mach/Bro/Log
+	@${MKDIR} ${SITE_PERL}/mach/Bro/Report
+	${INSTALL_DATA} ${WRKSRC}/scripts/bro.cfg.example ${PREFIX}/etc
+	${INSTALL_DATA} ${WRKSRC}/scripts/local.site.bro.default ${BROSITEDIR}
+	${INSTALL_DATA} ${WRKSRC}/scripts/IP4.pm ${SITE_PERL}/mach
+	${INSTALL_DATA} ${WRKSRC}/scripts/perl/lib/Bro/Config.pm ${SITE_PERL}/mach/Bro
+	${INSTALL_DATA} ${WRKSRC}/scripts/perl/lib/Bro/Log.pm ${SITE_PERL}/mach/Bro
+	${INSTALL_DATA} ${WRKSRC}/scripts/perl/lib/Bro/Report.pm ${SITE_PERL}/mach/Bro
+	${INSTALL_DATA} ${WRKSRC}/scripts/perl/lib/Bro/Signature.pm ${SITE_PERL}/mach/Bro
+	${INSTALL_DATA} ${WRKSRC}/scripts/perl/lib/Bro/Log/Alarm.pm ${SITE_PERL}/mach/Bro/Log
+	${INSTALL_DATA} ${WRKSRC}/scripts/perl/lib/Bro/Log/Conn.pm ${SITE_PERL}/mach/Bro/Log
+	${INSTALL_DATA} ${WRKSRC}/scripts/perl/lib/Bro/Report/Alarm.pm ${SITE_PERL}/mach/Bro/Report
+	${INSTALL_DATA} ${WRKSRC}/scripts/perl/lib/Bro/Report/Conn.pm ${SITE_PERL}/mach/Bro/Report
+	${INSTALL_SCRIPT} ${WRKSRC}/scripts/bro.rc ${BROHOME}/scripts
+	${INSTALL_SCRIPT} ${WRKSRC}/scripts/bro.rc-hooks.sh ${BROHOME}/scripts
+	${INSTALL_SCRIPT} ${WRKSRC}/scripts/bro_config ${BROHOME}/scripts
+	${INSTALL_SCRIPT} ${WRKSRC}/scripts/localnetMAC.pl ${BROHOME}/scripts
+	${INSTALL_SCRIPT} ${WRKSRC}/scripts/perl/script/edit-brorule.pl ${BROHOME}/scripts
+	${INSTALL_SCRIPT} ${WRKSRC}/scripts/perl/script/site-report.pl ${BROHOME}/scripts
+	${INSTALL_PROGRAM} ${WRKSRC}/aux/adtrace/adtrace ${PREFIX}/bin
+	${SH} ${PKGINSTALL}
+
 .if !defined(NOPORTDOCS)
+	@${ECHO_MSG} "You have chosen to install documentation"
+	@${ECHO_MSG} "but the online documentation will be much"
+	@${ECHO_MSG} "more up to date."
 	@${MKDIR} ${DOCSDIR}
-	${INSTALL_MAN} ${WRKSRC}/doc/bro-CN99.ps ${DOCSDIR}
-	@${GZIP_CMD} ${DOCSDIR}/bro-CN99.ps
+	${INSTALL_DATA} ${WRKSRC}/doc/quick-start/Bro-quick-start.pdf ${DOCSDIR}
+	${INSTALL_DATA} ${WRKSRC}/doc/quick-start/bro-deployment.pdf ${DOCSDIR}
+	${INSTALL_DATA} ${WRKSRC}/doc/user-manual/Bro-user-manual.pdf ${DOCSDIR}
 .endif
 
-.include <bsd.port.mk>
+	@${CAT} ${PKGMESSAGE}
+
+.include <bsd.port.post.mk>
diff --git a/security/bro/distinfo b/security/bro/distinfo
index 2fe3ea524f3e..dde086d459e8 100644
--- a/security/bro/distinfo
+++ b/security/bro/distinfo
@@ -1,3 +1,3 @@
-MD5 (bro-pub-0.8a37.tar.gz) = abf9ddc6e7086639130f2e792eca4ab3
-SHA256 (bro-pub-0.8a37.tar.gz) = 3bdf9c18ccb12181e8383c9d5969fd1b86d7d601a98fdf6655467c64167fb5bc
-SIZE (bro-pub-0.8a37.tar.gz) = 1696069
+MD5 (bro-1.2-stable.tar.gz) = ca4c0435da066d901c63f182faa7f540
+SHA256 (bro-1.2-stable.tar.gz) = 276da336a210d5664b483bc44fe29e3e670a02cd5b2932890050a11954afe17f
+SIZE (bro-1.2-stable.tar.gz) = 3986890
diff --git a/security/bro/files/patch-Conn.h b/security/bro/files/patch-Conn.h
deleted file mode 100644
index 6d126fb09e23..000000000000
--- a/security/bro/files/patch-Conn.h
+++ /dev/null
@@ -1,29 +0,0 @@
---- Conn.h.orig	Sun Aug 31 02:39:01 2003
-+++ Conn.h	Thu Dec 21 13:27:24 2006
-@@ -59,7 +59,7 @@
- 	// dst_port just have to reflect the two different sides of the
- 	// connection, neither has to be the particular source/destination
- 	// or originator/responder.
--	HashKey* ConnID::BuildConnKey() const;
-+	HashKey* BuildConnKey() const;
- };
- 
- static inline int addr_port_canon_lt(const uint32* a1, uint32 p1,
-@@ -223,6 +223,8 @@
- 		return 1;
- 		}
- 
-+	void DeleteTimer(double t);
-+
- protected:
- 	virtual void UpdateEndpointVal(RecordVal* endp, int is_orig) = 0;
- 
-@@ -235,8 +237,6 @@
- 
- 	friend class ConnectionTimer;
- 	void RemoveTimer(Timer* t);
--
--	void DeleteTimer(double t);
- 
- 	void InactivityTimer(double t);
- 
diff --git a/security/bro/files/patch-Makefile.in b/security/bro/files/patch-Makefile.in
index ed829223ea40..b038cede4703 100644
--- a/security/bro/files/patch-Makefile.in
+++ b/security/bro/files/patch-Makefile.in
@@ -1,27 +1,36 @@
---- Makefile.in.orig	Sun Aug 31 04:39:14 2003
-+++ Makefile.in	Tue Oct 14 12:08:51 2003
-@@ -52,13 +52,13 @@
- LIBS = $(LIBEDIT_LIBS) @LIBS@ -lm
+--- Makefile.in.orig	Thu Dec 14 11:59:51 2006
++++ Makefile.in	Wed Jul 18 23:57:10 2007
+@@ -206,7 +206,7 @@
+ # noticed.
+ #
+ DISTCHECK_CONFIGURE_FLAGS = --disable-gtk-doc
+-versiondir = $(prefix)/etc
++versiondir = $(prefix)/bro/etc
+ dist_version_DATA = VERSION
+ chown = @CHOWN@
  
- # Purify barfs when c++ is used for $(CPLUS).
--PURIFY_CPLUS = g++
-+PURIFY_CPLUS = @CC@
- PURE_FLAGS = -chain-length=20
+@@ -658,9 +658,9 @@
+ install-brolite:
+ 	$(MAKE) install
+ 	( cd scripts && $(MAKE) install-brolite )
+-	- @CHOWN@ -R `cat scripts/bro_user_id` ${prefix}/
++	- @CHOWN@ -R `cat scripts/bro_user_id` ${prefix}/bro
+ 	@echo "*********************************************************"
+-	@echo "Please run \"${prefix}/etc/bro.rc --start\" to start bro"
++	@echo "Please run \"${prefix}/bro/scripts/bro.rc --start\" to start bro"
+ 	@echo "*********************************************************"
  
- YACC = @YACC@
- YFLAGS = -d -t -v
- LEX = @LEX@
--INSTALL = @INSTALL@ -d
-+INSTALL = @INSTALL_PROGRAM@
- INSTALL_DATA = @INSTALL_DATA@
- @SET_MAKE@
- COMPRESS = @COMPRESS@
-@@ -121,7 +121,7 @@
+ docs:
+@@ -687,9 +687,9 @@
  
- all: $(PKG)
+ # make sure all the dirs are correctly created and owned 
+ install-data-local:
+-	$(INSTALL) -d $(prefix)/logs
+-	$(INSTALL) -d $(prefix)/archive
+-	$(INSTALL) -d $(prefix)/var
++	$(INSTALL) -d $(prefix)/bro/logs
++	$(INSTALL) -d $(prefix)/bro/archive
++	$(INSTALL) -d $(prefix)/bro/var
  
--$(PKG): $(LIBEDIT_LIB) $(OBJ)
-+$(PKG): $(OBJ)
- 	$(CPLUS) -o $(EXEC) $(OBJ) $(LDFLAGS) $(LIBS)
- opt:
- 	@$(MAKE) $(MFLAGS) CCOPT="`echo $(CCOPT) | sed -e 's/-O2//;s/$$/ -O3/'`"
+ release:
+ 	./autogen.sh
diff --git a/security/bro/files/patch-Obj.cc b/security/bro/files/patch-Obj.cc
deleted file mode 100644
index 295affb0d446..000000000000
--- a/security/bro/files/patch-Obj.cc
+++ /dev/null
@@ -1,11 +0,0 @@
---- Obj.cc.orig	Sun Oct  5 18:27:31 2003
-+++ Obj.cc	Sun Oct  5 18:27:44 2003
-@@ -47,7 +47,7 @@
- 	delete_data = true;
- 
- 	int tmp;
--	return s->Read(&(char*) filename, &tmp) &&
-+	return s->Read((char**) &filename, &tmp) &&
- 		s->Read(&first_line) && s->Read(&last_line) &&
- 		s->Read(&first_column) && s->Read(&last_column);
- 	}
diff --git a/security/bro/files/patch-Serializer.h b/security/bro/files/patch-Serializer.h
deleted file mode 100644
index 3113bddd8ef9..000000000000
--- a/security/bro/files/patch-Serializer.h
+++ /dev/null
@@ -1,13 +0,0 @@
---- Serializer.h.orig	Thu Dec 21 13:24:28 2006
-+++ Serializer.h	Thu Dec 21 13:24:45 2006
-@@ -82,8 +82,8 @@
- 	void StartSerialization();
- 	bool EndSerialization();
- 
--	bool Serializer::UnserializeID();
--	bool Serializer::UnserializeEvent();
-+	bool UnserializeID();
-+	bool UnserializeEvent();
- 
- 	SerializationFormat* format;
- 
diff --git a/security/bro/files/patch-aux-scripts-Makefile.in b/security/bro/files/patch-aux-scripts-Makefile.in
new file mode 100644
index 000000000000..cbd3f2b43819
--- /dev/null
+++ b/security/bro/files/patch-aux-scripts-Makefile.in
@@ -0,0 +1,11 @@
+--- aux/scripts/Makefile.in.orig	Wed Jul 18 16:27:01 2007
++++ aux/scripts/Makefile.in	Wed Jul 18 16:27:41 2007
+@@ -173,7 +173,7 @@
+ target_vendor = @target_vendor@
+ 
+ # override where to stick the scripts
+-scriptdir = ${prefix}/scripts
++scriptdir = ${prefix}/bro/scripts
+ dist_script_SCRIPTS = bro-logchk.pl host-to-addrs mvlog host-grep 
+ EXTRA_DIST = hot-report mon-report ip-grep ca-create ca-issue
+ all: all-am
diff --git a/security/bro/files/patch-libedit::configure b/security/bro/files/patch-libedit::configure
deleted file mode 100644
index fe37b4aeec1c..000000000000
--- a/security/bro/files/patch-libedit::configure
+++ /dev/null
@@ -1,19 +0,0 @@
---- libedit/configure.orig	Tue Oct 14 12:30:58 2003
-+++ libedit/configure	Tue Oct 14 12:31:54 2003
-@@ -733,13 +733,13 @@
-   CFLAGS="$ac_save_CFLAGS"
- elif test $ac_cv_prog_cc_g = yes; then
-   if test "$GCC" = yes; then
--    CFLAGS="-g -O2"
-+    CFLAGS=""
-   else
--    CFLAGS="-g"
-+    CFLAGS=""
-   fi
- else
-   if test "$GCC" = yes; then
--    CFLAGS="-O2"
-+    CFLAGS=""
-   else
-     CFLAGS=
-   fi
diff --git a/security/bro/files/patch-patricia.c b/security/bro/files/patch-patricia.c
deleted file mode 100644
index b3db5ede01f0..000000000000
--- a/security/bro/files/patch-patricia.c
+++ /dev/null
@@ -1,22 +0,0 @@
---- patricia.c.orig	Tue Oct  7 15:06:56 2003
-+++ patricia.c	Tue Oct  7 15:07:19 2003
-@@ -52,6 +52,11 @@
- "This product includes software developed by the University of Michigan, Merit"
- "Network, Inc., and their contributors.";
- 
-+#include <sys/types.h>
-+#include <sys/socket.h>
-+#include <netinet/in.h>
-+#include <arpa/inet.h>
-+
- #include <assert.h> /* assert */
- #include <ctype.h> /* isdigit */
- #include <errno.h> /* errno */
-@@ -60,7 +65,6 @@
- #include <stdio.h> /* sprintf, fprintf, stderr */
- #include <stdlib.h> /* free, atol, calloc */
- #include <string.h> /* memcpy, strchr, strlen */
--#include <arpa/inet.h> /* for inet_addr */
- 
- #include "patricia.h"
- 
diff --git a/security/bro/files/patch-patricia.h b/security/bro/files/patch-patricia.h
deleted file mode 100644
index 10979f72537e..000000000000
--- a/security/bro/files/patch-patricia.h
+++ /dev/null
@@ -1,11 +0,0 @@
---- patricia.h.orig	Sun Oct  5 18:29:52 2003
-+++ patricia.h	Sun Oct  5 18:30:05 2003
-@@ -51,6 +51,8 @@
- #ifndef _PATRICIA_H
- #define _PATRICIA_H
- 
-+#include <sys/types.h>
-+
- /* typedef unsigned int u_int; */
- typedef void (*void_fn_t)();
- /* { from defs.h */
diff --git a/security/bro/files/patch-policy-Makefile.in b/security/bro/files/patch-policy-Makefile.in
new file mode 100644
index 000000000000..32cfa1c0f4b7
--- /dev/null
+++ b/security/bro/files/patch-policy-Makefile.in
@@ -0,0 +1,64 @@
+--- policy/Makefile.in.orig	Wed Jul 18 16:30:32 2007
++++ policy/Makefile.in	Wed Jul 18 16:31:47 2007
+@@ -190,7 +190,7 @@
+ 
+ 
+ # doesn't end in a sig
+-bropolicydir = ${prefix}/policy
++bropolicydir = ${prefix}/bro/policy
+ dist_bropolicy_DATA = bro.init adu.bro alarm.bro analy.bro \
+ 	anon.bro arp.bro backdoor.bro blaster.bro brolite.bro \
+ 	brolite-backdoor.bro brolite-sigs.bro capture-events.bro \
+@@ -542,30 +542,30 @@
+ 
+ 
+ install-data-hook:
+-	$(INSTALL_DATA) bro.bif.bro $(DESTDIR)${prefix}/policy/
+-	$(INSTALL_DATA) common-rw.bif.bro $(DESTDIR)${prefix}/policy/
+-	$(INSTALL_DATA) const.bif.bro $(DESTDIR)${prefix}/policy/
+-	$(INSTALL_DATA) dns-rw.bif.bro $(DESTDIR)${prefix}/policy/
+-	$(INSTALL_DATA) event.bif.bro $(DESTDIR)${prefix}/policy/
+-	$(INSTALL_DATA) finger-rw.bif.bro $(DESTDIR)${prefix}/policy/
+-	$(INSTALL_DATA) ftp-rw.bif.bro $(DESTDIR)${prefix}/policy/
+-	$(INSTALL_DATA) http-rw.bif.bro $(DESTDIR)${prefix}/policy/
+-	$(INSTALL_DATA) ident-rw.bif.bro $(DESTDIR)${prefix}/policy/
+-	$(INSTALL_DATA) smtp-rw.bif.bro $(DESTDIR)${prefix}/policy/
+-	$(INSTALL_DATA) strings.bif.bro $(DESTDIR)${prefix}/policy/
++	$(INSTALL_DATA) bro.bif.bro $(DESTDIR)${prefix}/bro/policy/
++	$(INSTALL_DATA) common-rw.bif.bro $(DESTDIR)${prefix}/bro/policy/
++	$(INSTALL_DATA) const.bif.bro $(DESTDIR)${prefix}/bro/policy/
++	$(INSTALL_DATA) dns-rw.bif.bro $(DESTDIR)${prefix}/bro/policy/
++	$(INSTALL_DATA) event.bif.bro $(DESTDIR)${prefix}/bro/policy/
++	$(INSTALL_DATA) finger-rw.bif.bro $(DESTDIR)${prefix}/bro/policy/
++	$(INSTALL_DATA) ftp-rw.bif.bro $(DESTDIR)${prefix}/bro/policy/
++	$(INSTALL_DATA) http-rw.bif.bro $(DESTDIR)${prefix}/bro/policy/
++	$(INSTALL_DATA) ident-rw.bif.bro $(DESTDIR)${prefix}/bro/policy/
++	$(INSTALL_DATA) smtp-rw.bif.bro $(DESTDIR)${prefix}/bro/policy/
++	$(INSTALL_DATA) strings.bif.bro $(DESTDIR)${prefix}/bro/policy/
+ 
+ uninstall-local:
+-	rm -f $(DESTDIR)${prefix}/policy/bro.bif.bro
+-	rm -f $(DESTDIR)${prefix}/policy/common-rw.bif.bro
+-	rm -f $(DESTDIR)${prefix}/policy/const.bif.bro
+-	rm -f $(DESTDIR)${prefix}/policy/dns-rw.bif.bro
+-	rm -f $(DESTDIR)${prefix}/policy/event.bif.bro
+-	rm -f $(DESTDIR)${prefix}/policy/finger-rw.bif.bro
+-	rm -f $(DESTDIR)${prefix}/policy/ftp-rw.bif.bro
+-	rm -f $(DESTDIR)${prefix}/policy/http-rw.bif.bro
+-	rm -f $(DESTDIR)${prefix}/policy/ident-rw.bif.bro
+-	rm -f $(DESTDIR)${prefix}/policy/smtp-rw.bif.bro
+-	rm -f $(DESTDIR)${prefix}/policy/strings.bif.bro
++	rm -f $(DESTDIR)${prefix}/bro/policy/bro.bif.bro
++	rm -f $(DESTDIR)${prefix}/bro/policy/common-rw.bif.bro
++	rm -f $(DESTDIR)${prefix}/bro/policy/const.bif.bro
++	rm -f $(DESTDIR)${prefix}/bro/policy/dns-rw.bif.bro
++	rm -f $(DESTDIR)${prefix}/bro/policy/event.bif.bro
++	rm -f $(DESTDIR)${prefix}/bro/policy/finger-rw.bif.bro
++	rm -f $(DESTDIR)${prefix}/bro/policy/ftp-rw.bif.bro
++	rm -f $(DESTDIR)${prefix}/bro/policy/http-rw.bif.bro
++	rm -f $(DESTDIR)${prefix}/bro/policy/ident-rw.bif.bro
++	rm -f $(DESTDIR)${prefix}/bro/policy/smtp-rw.bif.bro
++	rm -f $(DESTDIR)${prefix}/bro/policy/strings.bif.bro
+ # Tell versions [3.59,3.63) of GNU make to not export all variables.
+ # Otherwise a system limit (for SysV at least) may be exceeded.
+ .NOEXPORT:
diff --git a/security/bro/files/patch-policy-sigs-Makefile.in b/security/bro/files/patch-policy-sigs-Makefile.in
new file mode 100644
index 000000000000..be598acfd6a0
--- /dev/null
+++ b/security/bro/files/patch-policy-sigs-Makefile.in
@@ -0,0 +1,11 @@
+--- policy/sigs/Makefile.in.orig	Wed Jul 18 16:32:45 2007
++++ policy/sigs/Makefile.in	Wed Jul 18 16:33:13 2007
+@@ -171,7 +171,7 @@
+ target_cpu = @target_cpu@
+ target_os = @target_os@
+ target_vendor = @target_vendor@
+-sigsdir = ${prefix}/policy/sigs
++sigsdir = ${prefix}/bro/policy/sigs
+ dist_sigs_DATA = dpd.sig ex.web-rules.sig p0fsyn.osf \
+ 	snort-default.sig ssl-worm.sig worm.sig 
+ 
diff --git a/security/bro/files/patch-script-s2b-example-bro_files-Makefile.in b/security/bro/files/patch-script-s2b-example-bro_files-Makefile.in
new file mode 100644
index 000000000000..deb7f329fe49
--- /dev/null
+++ b/security/bro/files/patch-script-s2b-example-bro_files-Makefile.in
@@ -0,0 +1,14 @@
+--- scripts/s2b/example_bro_files/Makefile.in.orig	Wed Jul 18 17:39:54 2007
++++ scripts/s2b/example_bro_files/Makefile.in	Wed Jul 18 17:40:29 2007
+@@ -172,9 +172,9 @@
+ target_cpu = @target_cpu@
+ target_os = @target_os@
+ target_vendor = @target_vendor@
+-actiondir = ${prefix}/policy
++actiondir = ${prefix}/bro/policy
+ dist_action_DATA = sig-action.bro
+-sigsdir = ${prefix}/site
++sigsdir = ${prefix}/bro/site
+ dist_sigs_DATA = signatures.sig
+ all: all-am
+ 
diff --git a/security/bro/files/patch-scripts-Makefile.in b/security/bro/files/patch-scripts-Makefile.in
new file mode 100644
index 000000000000..25bcff64dd7d
--- /dev/null
+++ b/security/bro/files/patch-scripts-Makefile.in
@@ -0,0 +1,92 @@
+--- scripts/Makefile.in.orig	Thu Dec 14 11:59:53 2006
++++ scripts/Makefile.in	Wed Jul 18 22:30:43 2007
+@@ -186,12 +186,12 @@
+ target_os = @target_os@
+ target_vendor = @target_vendor@
+ bro_bin = ${prefix}/bin
+-bro_logs = ${prefix}/logs
++bro_logs = ${prefix}/bro/logs
+ bro_etc = ${prefix}/etc
+-bro_site = ${prefix}/site
+-bro_scripts = ${prefix}/scripts
+-bro_reports = ${prefix}/reports
+-bro_perlmods = ${prefix}/perl
++bro_site = ${prefix}/bro/site
++bro_scripts = ${prefix}/bro/scripts
++bro_reports = ${prefix}/bro/reports
++bro_perlmods = ${prefix}/bro/perl
+ 
+ # where to download signatures from.
+ SIGHOST = www.bro-ids.org
+@@ -222,9 +222,9 @@
+ bin_SCRIPT = bro.rc 
+ 
+ # more files! Ugggg, will the pain ever stop?
+-scoredir = $(prefix)/etc
++scoredir = $(prefix)/bro/etc
+ dist_score_DATA = alert_scores signature_scores
+-scriptsdir = $(prefix)/scripts
++scriptsdir = $(prefix)/bro/scripts
+ dist_scripts_SCRIPTS = bro_log_compress.sh \
+    frontend-mail-reports.sh frontend-site-report.sh push_logs.sh mail_notice.sh
+ 
+@@ -596,11 +596,11 @@
+ 	rm -f $(bro_etc)/bro.rc
+ 	rm -f $(bro_etc)/bro.cfg
+ 	rm -f $(bro_etc)/bro.cfg.example
+-	rm -f $(prefix)/etc/bro.rc-hooks.sh
++	rm -f $(prefix)/bro/scripts/bro.rc-hooks.sh
+ 	rm -f  $(prefix)/site/local.site.bro
+ 	rm -f  $(prefix)/site/${brohost}.bro
+ 	$(srcdir)/install_cron.sh uninstall
+-	-rm -f $(prefix)/etc/bro.rc-hooks.sh.new 
++	-rm -f $(prefix)/bro/scripts/bro.rc-hooks.sh.new 
+ 	-rm -f /usr/local/etc/rc.d/bro.sh
+ 
+ # install the stuff to do reports
+@@ -625,14 +625,14 @@
+ 	@if [ ! -s signatures.sig.new ] ; then \
+ 		echo "Error in download. Try again later." ; \
+ 	else \
+-		if [ ! -f $(prefix)/site/signatures.sig ] ; then  \
++		if [ ! -f $(prefix)/bro/site/signatures.sig ] ; then  \
+ 			echo "No previous version, installing new version." ; \
+-			cp signatures.sig.new $(prefix)/site/signatures.sig ; \
++			cp signatures.sig.new $(prefix)/bro/site/signatures.sig ; \
+ 		else \
+-			cp signatures.sig.new $(prefix)/site/signatures.sig.new ; \
++			cp signatures.sig.new $(prefix)/bro/site/signatures.sig.new ; \
+ 			echo "***********************************************************" ; \
+ 			echo "A new signature file (signatures.sig.new) has been placed in" ; \
+-			echo "$(prefix)/site. Please compare it to your current signatures.sig " ; \
++			echo "$(prefix)/bro/site. Please compare it to your current signatures.sig " ; \
+ 			echo "and copy it over if there are no significant differences." ; \
+ 			echo "***********************************************************" ; \
+ 		fi \
+@@ -669,20 +669,20 @@
+ 	else \
+ 		$(INSTALL_DATA) $(srcdir)/local.lite.bro $(bro_site)/${brohost}.bro.new ;   \
+ 	fi
+-	@if [ ! -f $(prefix)/etc/bro.rc-hooks.sh ] ; then              \
+-		$(INSTALL_DATA) $(srcdir)/bro.rc-hooks.sh $(prefix)/etc/bro.rc-hooks.sh ;   \
++	@if [ ! -f $(prefix)/bro/scripts/bro.rc-hooks.sh ] ; then              \
++		$(INSTALL_DATA) $(srcdir)/bro.rc-hooks.sh $(prefix)/bro/scripts/bro.rc-hooks.sh ;   \
+ 	else \
+-		$(INSTALL_DATA) $(srcdir)/bro.rc-hooks.sh $(prefix)/etc/bro.rc-hooks.sh.new ; \
++		$(INSTALL_DATA) $(srcdir)/bro.rc-hooks.sh $(prefix)/bro/scripts/bro.rc-hooks.sh.new ; \
+ 	fi
+ 
+ # Default files that can be installed/reinstalled, not site specific
+ install_default_files:
+ 	$(INSTALL) $(srcdir)/mail_reports.sh $(bro_scripts)/mail_reports.sh
+-	$(INSTALL) bro.rc $(prefix)/etc/bro.rc
+-	$(INSTALL) bro_config  $(prefix)/scripts/bro_config
++	$(INSTALL) bro.rc $(prefix)/bro/scripts/bro.rc
++	$(INSTALL) bro_config  $(prefix)/bro/scripts/bro_config
+ 	-$(INSTALL_DATA) bro.cfg  $(bro_etc)/bro.cfg
+ 	$(INSTALL_DATA) $(srcdir)/bro.cfg.example $(bro_etc)/bro.cfg.example
+-	- $(INSTALL) bro.rc /usr/local/etc/rc.d/bro.sh
++	- $(INSTALL) bro.rc @prefix@/bro/scripts/bro.sh
+ 	(cd s2b ; $(MAKE) install)
+ 
+ # install cron file
diff --git a/security/bro/files/patch-scripts-bro-config.in b/security/bro/files/patch-scripts-bro-config.in
new file mode 100644
index 000000000000..64fecf79a024
--- /dev/null
+++ b/security/bro/files/patch-scripts-bro-config.in
@@ -0,0 +1,115 @@
+--- scripts/bro_config.in.orig	Tue Dec  5 15:58:52 2006
++++ scripts/bro_config.in	Sat Jul 14 14:38:48 2007
+@@ -6,7 +6,7 @@
+ # on the "configure" command line
+ # some machines (i.e. OSX) don't put sbin in the path by default
+ PATH=$PATH:/usr/sbin:/sbin
+-BROHOME=@prefix@
++BROHOME=@prefix@/bro
+ # Usage
+ Usage="bro_config: [-p prefix] [-d]"
+ # Debug mode? 
+@@ -39,9 +39,9 @@
+ bro_config_got_root()
+ { 
+     # make a backup of local.site.bro if it exists
+-    if [ -f local.site.bro ]; then 
++    if [ -f ${BROHOME}/site/local.site.bro ]; then 
+         echo "Detected an old local.site.bro, saving it to local.site.bro.save"
+-        cp local.site.bro local.site.bro.save
++        cp ${BROHOME}/site/local.site.bro ${BROHOME}/site/local.site.bro.save
+     fi
+ 
+     if [ `id -ur` -ne 0 ]; then 
+@@ -62,7 +62,7 @@
+ ######################################################################
+ bro_config_create_local_site_bro()
+ {
+-cat - > local.site.bro << _EOF
++cat - > ${BROHOME}/sitelocal.site.bro.default << _EOF
+ # This file should describe your network configuration.
+ # If your local network is a class C, and its network
+ # address was 192.168.1.0 and a class B network 
+@@ -263,7 +263,7 @@
+ # BRO_HOSTNAME=`hostname`
+ 
+ # Directory containing Bro binaries
+-BRO_BIN_DIR="${BRO_BIN_DIR:-${BROHOME}/bin}"
++BRO_BIN_DIR="${BRO_BIN_DIR:-@prefix@/bin}"
+ 
+ # Directory containing Bro logs
+ BROLOGS="${BROLOGS:-${BROHOME}/logs}"
+@@ -287,7 +287,7 @@
+ # BRO_PREFIX="local"
+ 
+ # Location of the Bro executable
+-BRO="${BRO:-$BRO_BIN_DIR/bro}"
++BRO="${BRO_BIN_DIR}/bro"
+ 
+ # Base command line options.
+ BRO_ADD_OPTS=" -W"
+@@ -352,7 +352,7 @@
+ BRO_EMAIL_REMOTE="${BRO_EMAIL_REMOTE}"
+ 
+ # User id to install and run Bro under
+-BRO_USER_ID="${BRO_USER_ID:-brother}"
++BRO_USER_ID="${BRO_USER_ID:-root}"
+ 
+ # Site name for reports (i.e. LBNL, FOO.COM, BAZ.ORG)
+ BRO_SITE_NAME="${BRO_SITE_NAME}"
+@@ -454,29 +454,29 @@
+         echo " done."
+         kill -INT $pid 2>&1 > /dev/null
+         echo -n "Analyzing dump file....."
+-        ./localnetMAC.pl -a 16 -r /tmp/bro_config.tcpdump.file.$$  -b local.site.bro 2>&1 > /dev/null
++        ${BROHOME}/scripts/localnetMAC.pl -a 16 -r /tmp/bro_config.tcpdump.file.$$  -b ${BROHOME}/site/local.site.bro 2>&1 > /dev/null
+         rm /tmp/bro_config.tcpdump.file.$$
+         #Yes there is a spelling error in the output
+         echo " done."
+-        num=`grep "MAC adresses" local.site.bro | awk '{print $3}'`
++        num=`grep "MAC adresses" ${BROHOME}/site/local.site.bro | awk '{print $3}'`
+         if [ "$num" -gt 2 ] ; then 
+             echo "You don't appear to be running on a DMZ (found more then two (2) hardware "
+-            echo "address. Please edit local.site.bro to reflect your correct network parameters"
+-            cp local.site.bro.default local.site.bro
++            echo "address. Please edit ${BROHOME}/site/local.site.bro to reflect your correct network parameters"
++            cp ${BROHOME}/site/local.site.bro.default ${BROHOME}/site/local.site.bro
+         else
+             echo "Your network appears to contain the following networks:"
+-            for net in ` grep ",$" local.site.bro|sed 's/,//g'`; 
++            for net in ` grep ",$" ${BROHOME}/site/local.site.bro|sed 's/,//g'`; 
+             do 
+                echo $net; 
+             done
+-            echo "Edit local.site.bro by hand if this is not correct" 
++            echo "Edit ${BROHOME}/site/local.site.bro by hand if this is not correct" 
+         fi
+     else
+-        if [ -f local.site.bro ]; then
++        if [ -f ${BROHOME}/site/local.site.bro ]; then
+             echo "No previous local.site.bro found. Creating default"
+             bro_config_create_local_site_bro
+             #cp local.site.bro.default local.site.bro
+-            echo "Please edit local.site.bro so that it describes your network configuration"
++            echo "Please edit ${BROHOME}/site/local.site.bro so that it describes your network configuration"
+         fi
+     fi
+ }
+@@ -617,7 +617,7 @@
+     #  source a bro.cfg if it exists, so we know the past default values from the
+     #  last run
+ 
+-    dirs="$BROHOME/etc/bro.cfg $BROHOME/etc/bro.cfg.example `pwd`/bro.cfg"
++    dirs="@prefix@/etc/bro.cfg @prefix@/etc/bro.cfg.example `pwd`/bro.cfg"
+     cfgused=
+ 
+     for cfgfile in $dirs ; do 
+@@ -783,7 +783,7 @@
+ bro_config_site_name()
+ {
+     if [ -z $BRO_SITE_NAME ]; then
+-        BRO_SITE_NAME=`hostname|awk -F. '{print $2 $3}'`
++        BRO_SITE_NAME=`hostname|awk -F. '{print $2"."$3}'`
+         if [ -z $BRO_SITE_NAME ] ; then 
+             BRO_SITE_NAME="SOMESITE"
+         fi
diff --git a/security/bro/files/patch-scripts-bro.rc.in b/security/bro/files/patch-scripts-bro.rc.in
new file mode 100644
index 000000000000..21a4561599d4
--- /dev/null
+++ b/security/bro/files/patch-scripts-bro.rc.in
@@ -0,0 +1,47 @@
+--- scripts/bro.rc.in.orig	Fri Jul 13 15:53:29 2007
++++ scripts/bro.rc.in	Fri Jul 13 15:59:26 2007
+@@ -25,7 +25,7 @@
+ # For tasks to complete before and after Bro starts please edit the following
+ # scripts to suit your needs.  For those of you familiar with dhclient this
+ # uses the same idea.
+-#  Before Bro starts $BROHOME/etc/bro.rc-hooks.sh
++#  Before Bro starts @prefix@/bin/bro.rc-hooks.sh
+ 
+ # See the bottom of this script for an explanation of how this all works.
+ # I'll try my best to be clear....
+@@ -35,14 +35,14 @@
+ RETVAL=0
+ 
+ # picked up from configure at install time
+-BROHOME="@prefix@"
++BROHOME="@prefix@/bro"
+ export BROHOME
+ 
+ # Set the environment.
+-source_config="${BROHOME}/etc/bro.cfg"
++source_config="@prefix@/etc/bro.cfg"
+ 
+ # Location of bro-hooks.sh script
+-bro_hooks="${BROHOME}/etc/bro.rc-hooks.sh"
++bro_hooks="@prefix@/bro/scripts/bro.rc-hooks.sh"
+ 
+ # Set the full path to this script as called
+ if [ `echo ${0} | grep -E "^/"` ]; then
+@@ -88,7 +88,7 @@
+ export BROLOGS
+ export BROPATH
+ export BROHOME
+-export PATH="${BROHOME}/bro/bin:${BROHOME}/bro/scripts:/usr/local/bin:/usr/local/sbin:${PATH}" 
++export PATH="@prefix@/bin:${BROHOME}/scripts:/usr/local/bin:/usr/local/sbin:${PATH}" 
+ 
+ # Make sure that the $BRO_RUNTIME_DIR exists and is writtable
+ if [ ! -d "${BRO_RUNTIME_DIR}" ]; then
+@@ -1033,7 +1033,7 @@
+ # running instance of Bro.
+ # bro.rc logs it's actions to syslog via the logger command.
+ # bro.rc offers users an interface into the starting and stopping of a Bro
+-# process via the file $BROHOME/etc/bro.rc-hooks.rc.  This allows for
++# process via the file @prefix@/bro/scripts/bro.rc-hooks.rc.  This allows for
+ # actions to be sent to any custom monitoring or alerting programs the
+ # user may wish to use.
+ 
diff --git a/security/bro/files/patch-scripts-localnetMAC.pl b/security/bro/files/patch-scripts-localnetMAC.pl
new file mode 100644
index 000000000000..b3232189886f
--- /dev/null
+++ b/security/bro/files/patch-scripts-localnetMAC.pl
@@ -0,0 +1,15 @@
+--- scripts/localnetMAC.pl.in.orig	Sat Jul 14 00:01:55 2007
++++ scripts/localnetMAC.pl.in	Sat Jul 14 00:03:48 2007
+@@ -50,10 +50,10 @@
+ 
+ my $fh;
+ if ($args{r} and $args{r}=~/gz$/){
+-    open (IN, "$decomp $args{r} |../aux/adtrace/adtrace -|") or die "cannot execute $decomp $args{r} |../aux/adtrace/adtrace - : $!\n";
++    open (IN, "$decomp $args{r} |@prefix@/bin/adtrace -|") or die "cannot execute $decomp $args{r} |@prefix@/bin/adtrace - : $!\n";
+     $fh = *IN;
+ }elsif($args{r}){
+-    open (IN, "../aux/adtrace/adtrace $args{r}|") or die "cannot execute ./adtrace/adtrace $args{r}: $!\n";
++    open (IN, "@prefix@/bin/adtrace $args{r}|") or die "cannot execute @prefix@/bin/adtrace $args{r}: $!\n";
+     $fh = *IN;
+ }elsif($args{t} and $args{t}=~/gz$/){
+     open (IN, "$decomp $args{t} |") or die "cannot execute $decomp $args{t} | : $!\n";
diff --git a/security/bro/files/patch-scripts-perl-Makefile.PL b/security/bro/files/patch-scripts-perl-Makefile.PL
new file mode 100644
index 000000000000..b28d02dc311a
--- /dev/null
+++ b/security/bro/files/patch-scripts-perl-Makefile.PL
@@ -0,0 +1,18 @@
+--- scripts/perl/Makefile.PL.orig	Wed Jul 18 16:40:51 2007
++++ scripts/perl/Makefile.PL	Wed Jul 18 16:47:11 2007
+@@ -43,13 +43,13 @@
+ 	}
+ 	else
+ 	{
+-		$brohome = '/usr/local/bro';
++		$brohome = $ENV{PREFIX}/bro';
+ 	}
+ }
+ 
+ if( ! $broconfig )
+ {
+-	$broconfig = "$brohome/etc/bro.cfg";
++	$broconfig = "$ENV{PREFIX}/etc/bro.cfg";
+ }
+ 
+ 
diff --git a/security/bro/files/patch-scripts-s2b-bin-Makefile.in b/security/bro/files/patch-scripts-s2b-bin-Makefile.in
new file mode 100644
index 000000000000..30649ae3bdfb
--- /dev/null
+++ b/security/bro/files/patch-scripts-s2b-bin-Makefile.in
@@ -0,0 +1,11 @@
+--- scripts/s2b/bin/Makefile.in.orig	Wed Jul 18 17:33:29 2007
++++ scripts/s2b/bin/Makefile.in	Wed Jul 18 17:34:02 2007
+@@ -321,7 +321,7 @@
+ 
+ 
+ # OR we can install them on a make install 
+-#scriptsdir=$(prefix)/etc
++#scriptsdir=$(prefix)/bro/scripts
+ #dist_scripts_SCRIPTS = s2b.pl snort2bro
+ # Tell versions [3.59,3.63) of GNU make to not export all variables.
+ # Otherwise a system limit (for SysV at least) may be exceeded.
diff --git a/security/bro/files/patch-scripts-s2b-bro-include-Makefile.in b/security/bro/files/patch-scripts-s2b-bro-include-Makefile.in
new file mode 100644
index 000000000000..1539a3b047c1
--- /dev/null
+++ b/security/bro/files/patch-scripts-s2b-bro-include-Makefile.in
@@ -0,0 +1,11 @@
+--- scripts/s2b/bro-include/Makefile.in.orig	Wed Jul 18 17:35:02 2007
++++ scripts/s2b/bro-include/Makefile.in	Wed Jul 18 17:35:25 2007
+@@ -171,7 +171,7 @@
+ target_cpu = @target_cpu@
+ target_os = @target_os@
+ target_vendor = @target_vendor@
+-includesigsdir = ${prefix}/policy
++includesigsdir = ${prefix}/bro/policy
+ dist_includesigs_DATA = sig-addendum.sig sig-functions.bro
+ all: all-am
+ 
diff --git a/security/bro/files/patch-scripts-s2b-etc-Makefile.in b/security/bro/files/patch-scripts-s2b-etc-Makefile.in
new file mode 100644
index 000000000000..de449617299d
--- /dev/null
+++ b/security/bro/files/patch-scripts-s2b-etc-Makefile.in
@@ -0,0 +1,11 @@
+--- scripts/s2b/etc/Makefile.in.orig	Wed Jul 18 17:37:19 2007
++++ scripts/s2b/etc/Makefile.in	Wed Jul 18 17:37:45 2007
+@@ -321,7 +321,7 @@
+ 
+ 
+ # OR we can install them on a make install 
+-#scriptsdir=$(prefix)/etc
++#scriptsdir=$(prefix)/bro/scripts
+ #dist_scripts_SCRIPTS = s2b-augment.cfg s2b-ruleset-augment.cfg s2b-sigmap.cfg s2b.cfg
+ # Tell versions [3.59,3.63) of GNU make to not export all variables.
+ # Otherwise a system limit (for SysV at least) may be exceeded.
diff --git a/security/bro/files/patch-src-Makefile.in b/security/bro/files/patch-src-Makefile.in
new file mode 100644
index 000000000000..e351acf5d880
--- /dev/null
+++ b/security/bro/files/patch-src-Makefile.in
@@ -0,0 +1,11 @@
+--- src/Makefile.in.orig	Wed Jul 18 16:48:03 2007
++++ src/Makefile.in	Wed Jul 18 16:48:34 2007
+@@ -550,7 +550,7 @@
+ 		   $(DISTCLEANFILES)
+ 
+ 
+-#bropolicydir=${prefix}/policy
++#bropolicydir=${prefix}/bro/policy
+ #dist_bropolicy_DATA = $(BIF_BRO)
+ CCOPT = @V_CCOPT@ -W -Wall -Wno-unused
+ INCLS = @V_INCLS@
diff --git a/security/bro/files/pkg-deinstall.in b/security/bro/files/pkg-deinstall.in
new file mode 100644
index 000000000000..f36772a02b0e
--- /dev/null
+++ b/security/bro/files/pkg-deinstall.in
@@ -0,0 +1,21 @@
+#!/bin/sh
+
+# Since pkg-plist prepends PREFIX to SITE_PERL,
+# we can't remove these files in the normal way
+
+if [ "$2" != "POST-DEINSTALL" ]; then
+        exit 0
+fi
+
+/bin/rm %%SITE_PERL%%/mach/IP4.pm
+/bin/rm %%SITE_PERL%%/mach/Bro/Config.pm
+/bin/rm %%SITE_PERL%%/mach/Bro/Log.pm
+/bin/rm %%SITE_PERL%%/mach/Bro/Report.pm
+/bin/rm %%SITE_PERL%%/mach/Bro/Signature.pm
+/bin/rm %%SITE_PERL%%/mach/Bro/Log/Alarm.pm
+/bin/rm %%SITE_PERL%%/mach/Bro/Log/Conn.pm
+/bin/rm %%SITE_PERL%%/mach/Bro/Report/Alarm.pm
+/bin/rm %%SITE_PERL%%/mach/Bro/Report/Conn.pm
+/bin/rmdir %%SITE_PERL%%/mach/Bro/Report
+/bin/rmdir %%SITE_PERL%%/mach/Bro/Log
+/bin/rmdir %%SITE_PERL%%/mach/Bro
diff --git a/security/bro/files/pkg-install.in b/security/bro/files/pkg-install.in
new file mode 100644
index 000000000000..c10f1d2392cf
--- /dev/null
+++ b/security/bro/files/pkg-install.in
@@ -0,0 +1,25 @@
+#!/bin/sh
+
+# Call the bro_config script to configure bro and, when complete,
+# copy the newly created cfg file to %%PREFIX%%/etc.
+
+echo "****************************************"
+echo "* RUNNING THE BRO CONFIGURATION SCRIPT *"
+echo "****************************************"
+echo
+
+if [ -f %%BROHOME%%/scripts/bro_config ]; then
+	/bin/sh %%BROHOME%%/scripts/bro_config
+fi
+
+if [ -f %%WRKSRC%%/../../bro.cfg ]; then
+	cp bro.cfg %%PREFIX%%/etc/bro.cfg
+fi
+
+if [ -f %%WRKSRC%%/../../bro.cfg ]; then
+	rm %%WRKSRC%%/../../bro.cfg*
+fi
+
+if [ -f %%WRKSRC%%/../../bro_user_id ]; then
+	rm %%WRKSRC%%/../../bro_user*
+fi
diff --git a/security/bro/files/pkg-message.in b/security/bro/files/pkg-message.in
new file mode 100644
index 000000000000..c10f1d2392cf
--- /dev/null
+++ b/security/bro/files/pkg-message.in
@@ -0,0 +1,25 @@
+#!/bin/sh
+
+# Call the bro_config script to configure bro and, when complete,
+# copy the newly created cfg file to %%PREFIX%%/etc.
+
+echo "****************************************"
+echo "* RUNNING THE BRO CONFIGURATION SCRIPT *"
+echo "****************************************"
+echo
+
+if [ -f %%BROHOME%%/scripts/bro_config ]; then
+	/bin/sh %%BROHOME%%/scripts/bro_config
+fi
+
+if [ -f %%WRKSRC%%/../../bro.cfg ]; then
+	cp bro.cfg %%PREFIX%%/etc/bro.cfg
+fi
+
+if [ -f %%WRKSRC%%/../../bro.cfg ]; then
+	rm %%WRKSRC%%/../../bro.cfg*
+fi
+
+if [ -f %%WRKSRC%%/../../bro_user_id ]; then
+	rm %%WRKSRC%%/../../bro_user*
+fi
diff --git a/security/bro/pkg-descr b/security/bro/pkg-descr
index 9a2565b85c12..3620bfe9b871 100644
--- a/security/bro/pkg-descr
+++ b/security/bro/pkg-descr
@@ -1,16 +1,16 @@
-Bro is a system for detecting Network Intruders in real-time by the guys
-that brought you tcpdump, libpcap, and flex.
-
-Bro is a stand-alone system for detecting network intruders in real-time
-by passively monitoring a network link over which the intruder's traffic
-transits.  Bro is divided into an "event engine" that reduces a
-kernel-filtered network traffic stream into a series of higher-level
-events, and a "policy script interpreter" that interprets event handlers
-written in a specialized language used to express a site's security policy.
-Event handlers can update state information, synthesize new events, record
-information to disk, and generate real-time notifications via `syslog'.
+Bro is an open-source, Unix-based Network Intrusion Detection System (NIDS)
+that passively monitors network traffic and looks for suspicious activity.
+Bro detects intrusions by first parsing network traffic to extract is
+application-level semantics and then executing event-oriented analyzers that
+compare the activity with patterns deemed troublesome. Its analysis includes
+detection of specific attacks (including those defined by signatures, but
+also those defined in terms of events) and unusual activities (e.g., certain
+hosts connecting to certain services, or patterns of failed connection
+attempts).
 
 Bro is documented in the USENIX 1998 Security Conference proceedings.
 
--- David
-   obrien@cs.ucdavis.edu
+-- Paul
+   pauls@utdallas.edu
+
+WWW: http://bro-ids.org/
diff --git a/security/bro/pkg-plist b/security/bro/pkg-plist
index bf7fc1c0c929..ce78833bfa1c 100644
--- a/security/bro/pkg-plist
+++ b/security/bro/pkg-plist
@@ -1,83 +1,238 @@
-@comment $FreeBSD$
-sbin/bro
-%%DATADIR%%/active.bro
-%%DATADIR%%/alert.bro
-%%DATADIR%%/analy.bro
-%%DATADIR%%/anon.bro
-%%DATADIR%%/backdoor.bro
-%%DATADIR%%/bro.bif.bro
-%%DATADIR%%/bro.init
-%%DATADIR%%/capture-events.bro
-%%DATADIR%%/checkpoint.bro
-%%DATADIR%%/common-rw.bif.bro
-%%DATADIR%%/conn.bro
-%%DATADIR%%/const.bif.bro
-%%DATADIR%%/contents.bro
-%%DATADIR%%/demux.bro
-%%DATADIR%%/dns.bro
-%%DATADIR%%/dns-lookup.bro
-%%DATADIR%%/drop-adapt.bro
-%%DATADIR%%/event.bif.bro
-%%DATADIR%%/finger.bro
-%%DATADIR%%/finger-rw.bif.bro
-%%DATADIR%%/flag-irc.bro
-%%DATADIR%%/flag-warez.bro
-%%DATADIR%%/frag.bro
-%%DATADIR%%/ftp.bro
-%%DATADIR%%/ftp-anonymizer.bro
-%%DATADIR%%/ftp-cmd-arg.bro
-%%DATADIR%%/ftp-rw.bif.bro
-%%DATADIR%%/ftp-safe-words.bro
-%%DATADIR%%/hot.bro
-%%DATADIR%%/hot-ids.bro
-%%DATADIR%%/http.bro
-%%DATADIR%%/http-abstract.bro
-%%DATADIR%%/http-body.bro
-%%DATADIR%%/http-entity.bro
-%%DATADIR%%/http-event.bro
-%%DATADIR%%/http-header.bro
-%%DATADIR%%/http-reply.bro
-%%DATADIR%%/http-request.bro
-%%DATADIR%%/http-rewriter.bro
-%%DATADIR%%/http-rw.bif.bro
-%%DATADIR%%/icmp.bro
-%%DATADIR%%/ident-rewriter.bro
-%%DATADIR%%/ident.bro
-%%DATADIR%%/ident-rw.bif.bro
-%%DATADIR%%/inactivity.bro
-%%DATADIR%%/interconn.bro
-%%DATADIR%%/load-level.bro
-%%DATADIR%%/log.bro
-%%DATADIR%%/login.bro
-%%DATADIR%%/mime.bro
-%%DATADIR%%/mt.bro
-%%DATADIR%%/netstats.bro
-%%DATADIR%%/ntp.bro
-%%DATADIR%%/pcap.bro
-%%DATADIR%%/port-name.bro
-%%DATADIR%%/portmapper.bro
-%%DATADIR%%/print-filter.bro
-%%DATADIR%%/print-globals.bro
-%%DATADIR%%/print-resources.bro
-%%DATADIR%%/reduce-memory.bro
-%%DATADIR%%/scan.bro
-%%DATADIR%%/signatures.bro
-%%DATADIR%%/site.bro
-%%DATADIR%%/smtp-relay.bro
-%%DATADIR%%/smtp-rewriter.bro
-%%DATADIR%%/smtp.bro
-%%DATADIR%%/smtp-rw.bif.bro
-%%DATADIR%%/software.bro
-%%DATADIR%%/ssh-stepping.bro
-%%DATADIR%%/ssh.bro
-%%DATADIR%%/ssl-worm.bro
-%%DATADIR%%/stepping.bro
-%%DATADIR%%/synflood.bro
-%%DATADIR%%/tcp.bro
-%%DATADIR%%/tftp.bro
-%%DATADIR%%/udp.bro
-%%DATADIR%%/weird.bro
-%%DATADIR%%/worm.bro
-%%PORTDOCS%%%%DOCSDIR%%/bro-CN99.ps.gz
-%%PORTDOCS%%@dirrm %%DATADIR%%
-%%PORTDOCS%%@dirrm %%DOCSDIR%%
+bin/adtrace
+bin/bdcat
+bin/binpac
+bin/bro
+bin/broccoli-config
+bin/broconftest
+bin/broconn
+bin/broenum
+bin/brohose
+bin/broping
+bin/cf
+bin/hf
+bin/nf
+bin/pf
+bin/rst
+bro/etc/alert_scores
+bro/etc/signature_scores
+bro/etc/VERSION
+bro/policy/OS-fingerprint.bro
+bro/policy/adu.bro
+bro/policy/alarm.bro
+bro/policy/analy.bro
+bro/policy/anon.bro
+bro/policy/arp.bro
+bro/policy/backdoor.bro
+bro/policy/blaster.bro
+bro/policy/bro.bif.bro
+bro/policy/bro.init
+bro/policy/brolite-backdoor.bro
+bro/policy/brolite-sigs.bro
+bro/policy/brolite.bro
+bro/policy/capture-events.bro
+bro/policy/checkpoint.bro
+bro/policy/clear-passwords.bro
+bro/policy/common-rw.bif.bro
+bro/policy/conn-id.bro
+bro/policy/conn.bro
+bro/policy/const.bif.bro
+bro/policy/contents.bro
+bro/policy/cpu-adapt.bro
+bro/policy/demux.bro
+bro/policy/detect-protocols-http.bro
+bro/policy/detect-protocols.bro
+bro/policy/dns-anonymizer.bro
+bro/policy/dns-info.bro
+bro/policy/dns-lookup.bro
+bro/policy/dns-rw.bif.bro
+bro/policy/dns.bro
+bro/policy/dpd.bro
+bro/policy/drop-adapt.bro
+bro/policy/dyn-disable.bro
+bro/policy/event.bif.bro
+bro/policy/file-flush.bro
+bro/policy/finger-rw.bif.bro
+bro/policy/finger.bro
+bro/policy/firewall.bro
+bro/policy/flag-irc.bro
+bro/policy/flag-warez.bro
+bro/policy/frag.bro
+bro/policy/ftp-anonymizer.bro
+bro/policy/ftp-cmd-arg.bro
+bro/policy/ftp-reply-pattern.bro
+bro/policy/ftp-rw.bif.bro
+bro/policy/ftp-safe-words.bro
+bro/policy/ftp.bro
+bro/policy/gnutella.bro
+bro/policy/hand-over.bro
+bro/policy/heavy-analysis.bro
+bro/policy/heavy.http.bro
+bro/policy/heavy.irc.bro
+bro/policy/heavy.scan.bro
+bro/policy/heavy.software.bro
+bro/policy/heavy.trw.bro
+bro/policy/hot-ids.bro
+bro/policy/hot.bro
+bro/policy/http-abstract.bro
+bro/policy/http-anon-server.bro
+bro/policy/http-anon-useragent.bro
+bro/policy/http-anon-utils.bro
+bro/policy/http-anonymizer.bro
+bro/policy/http-body.bro
+bro/policy/http-entity.bro
+bro/policy/http-event.bro
+bro/policy/http-header.bro
+bro/policy/http-reply.bro
+bro/policy/http-request.bro
+bro/policy/http-rewriter.bro
+bro/policy/http-rw.bif.bro
+bro/policy/http.bro
+bro/policy/icmp.bro
+bro/policy/ident-rewriter.bro
+bro/policy/ident-rw.bif.bro
+bro/policy/ident.bro
+bro/policy/inactivity.bro
+bro/policy/interconn.bro
+bro/policy/irc-bot.bro
+bro/policy/irc.bro
+bro/policy/large-conns.bro
+bro/policy/listen-clear.bro
+bro/policy/listen-ssl.bro
+bro/policy/load-level.bro
+bro/policy/load-sample.bro
+bro/policy/log-append.bro
+bro/policy/login.bro
+bro/policy/mime-pop.bro
+bro/policy/mime.bro
+bro/policy/mt.bro
+bro/policy/netstats.bro
+bro/policy/nfs.bro
+bro/policy/notice-action-filters.bro
+bro/policy/notice-policy.bro
+bro/policy/notice.bro
+bro/policy/ntp.bro
+bro/policy/passwords.bro
+bro/policy/pcap.bro
+bro/policy/peer-status.bro
+bro/policy/pkt-profile.bro
+bro/policy/pop3.bro
+bro/policy/port-name.bro
+bro/policy/portmapper.bro
+bro/policy/print-filter.bro
+bro/policy/print-globals.bro
+bro/policy/print-resources.bro
+bro/policy/print-sig-states.bro
+bro/policy/profiling.bro
+bro/policy/proxy.bro
+bro/policy/remote-pcap.bro
+bro/policy/remote-ping.bro
+bro/policy/remote-print.bro
+bro/policy/remote-report-notices.bro
+bro/policy/remote-send-id.bro
+bro/policy/remote.bro
+bro/policy/rotate-logs.bro
+bro/policy/rsh.bro
+bro/policy/scan.bro
+bro/policy/secondary-filter.bro
+bro/policy/sensor-sshd.bro
+bro/policy/server-ports.bro
+bro/policy/service-probe.bro
+bro/policy/sig-action.bro
+bro/policy/sig-addendum.sig
+bro/policy/sig-functions.bro
+bro/policy/signatures.bro
+bro/policy/sigs/dpd.sig
+bro/policy/sigs/ex.web-rules.sig
+bro/policy/sigs/p0fsyn.osf
+bro/policy/sigs/snort-default.sig
+bro/policy/sigs/ssl-worm.sig
+bro/policy/sigs/worm.sig
+bro/policy/site.bro
+bro/policy/smtp-relay.bro
+bro/policy/smtp-rewriter.bro
+bro/policy/smtp-rw.bif.bro
+bro/policy/smtp.bro
+bro/policy/snort.bro
+bro/policy/software.bro
+bro/policy/ssh-stepping.bro
+bro/policy/ssh.bro
+bro/policy/ssl-alerts.bro
+bro/policy/ssl-ciphers.bro
+bro/policy/ssl-errors.bro
+bro/policy/ssl-worm.bro
+bro/policy/ssl.bro
+bro/policy/stats.bro
+bro/policy/stepping.bro
+bro/policy/strings.bif.bro
+bro/policy/synflood.bro
+bro/policy/tcp.bro
+bro/policy/tftp.bro
+bro/policy/trw-impl.bro
+bro/policy/trw.bro
+bro/policy/udp-common.bro
+bro/policy/udp.bro
+bro/policy/vlan.bro
+bro/policy/weird.bro
+bro/policy/worm.bro
+bro/scripts/bro-logchk.pl
+bro/scripts/bro.rc
+bro/scripts/bro.rc-hooks.sh
+bro/scripts/bro_config
+bro/scripts/bro_log_compress.sh
+bro/scripts/edit-brorule.pl
+bro/scripts/frontend-mail-reports.sh
+bro/scripts/frontend-site-report.sh
+bro/scripts/host-grep
+bro/scripts/host-to-addrs
+bro/scripts/localnetMAC.pl
+bro/scripts/mail_notice.sh
+bro/scripts/mvlog
+bro/scripts/push_logs.sh
+bro/scripts/site-report.pl
+@unexec if cmp -s %D/bro/site/local.site.bro.default %D/bro/site/local.site.bro; then rm -f %D/bro/site/local.site.bro; fi
+bro/site/local.site.bro.default
+bro/site/signatures.sig
+@unexec if cmp -s %D/etc/bro.cfg.sample %D/etc/bro.cfg; then rm -f %D/etc/bro.cfg; fi
+etc/bro.cfg.example
+etc/broccoli.conf
+include/broccoli.h
+share/broccoli/broconn.bro
+share/broccoli/broenum.bro
+share/broccoli/brohose.bro
+share/broccoli/broping-record.bro
+share/broccoli/broping.bro
+share/gtk-doc/html/broccoli/a2850.html
+share/gtk-doc/html/broccoli/api.html
+share/gtk-doc/html/broccoli/broccoli-broccoli.html
+share/gtk-doc/html/broccoli/c21.html
+share/gtk-doc/html/broccoli/c55.html
+share/gtk-doc/html/broccoli/c85.html
+share/gtk-doc/html/broccoli/images/caution.gif
+share/gtk-doc/html/broccoli/images/logo.jpg
+share/gtk-doc/html/broccoli/images/note.gif
+share/gtk-doc/html/broccoli/images/warning.gif
+share/gtk-doc/html/broccoli/index.html
+share/gtk-doc/html/broccoli/stylesheet.css
+share/libbroccoli.a
+share/libbroccoli.la
+share/libbroccoli.so
+share/libbroccoli.so.0
+@unexec if [ -f %D/%%DOCSDIR%%/bro-deployment.pdf ]; then rm -f %D/%%DOCSDIR%%/bro-deployment.pdf; fi
+@unexec if [ -f %D/%%DOCSDIR%%/Bro-quick-start.pdf ]; then rm -f %D/%%DOCSDIR%%/Bro-quick-start.pdf; fi
+@unexec if [ -f %D/%%DOCSDIR%%/Bro-user-manual.pdf ]; then rm -f %D/%%DOCSDIR%%/Bro-user-manual.pdf; fi
+@dirrmtry %%DOCSDIR%%
+@dirrm share/gtk-doc/html/broccoli/images
+@dirrm share/gtk-doc/html/broccoli
+@dirrmtry share/gtk-doc/html
+@dirrmtry share/gtk-doc
+@dirrm share/broccoli
+@dirrmtry bro/var
+@dirrmtry bro/site
+@dirrmtry bro/scripts
+@dirrmtry bro/reports
+@dirrmtry bro/policy/sigs
+@dirrmtry bro/policy
+@dirrmtry bro/logs
+@dirrmtry bro/etc
+@dirrmtry bro/archive
+@dirrmtry bro