From 9d7ae3fa0babe4ebf5c743f49744e83a2b3cecc2 Mon Sep 17 00:00:00 2001
From: Scott Ullrich <sullrich@pfsense.org>
Date: Fri, 6 Oct 2006 17:41:14 +0000
Subject: * Cleanup on deinstall * Increase net.bpf.bufsize to 20480

---
 packages/snort/snort.inc | 14 ++++++++++++++
 packages/snort/snort.xml |  7 +++++--
 2 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/packages/snort/snort.inc b/packages/snort/snort.inc
index 325ceab1..96a97d7b 100644
--- a/packages/snort/snort.inc
+++ b/packages/snort/snort.inc
@@ -112,6 +112,16 @@ function create_snort_conf() {
 	conf_mount_ro();
 }
 
+function snort_deinstall() {
+	$text_ww   = "*/60\t* \t 1\t *\t *\t root\t /usr/bin/nice -n20 /usr/local/pkg/snort_check_for_rule_updates.php";
+	$filenamea = "/etc/crontab";
+	remove_text_from_file($filenamea, $text_ww);
+	/* remove custom sysctl */
+	remove_text_from_file("/etc/sysctl.conf", "sysctl net.bpf.bufsize=20480");	
+	/* decrease bpf buffers back to 4096, from 20480 */
+	exec("/sbin/sysctl net.bpf.bufsize=4096");
+}
+
 function generate_snort_conf() {
 	global $config, $g;
 	conf_mount_rw();
@@ -125,6 +135,10 @@ function generate_snort_conf() {
 	add_text_to_file($filenamea, $text_ww);
 	exec("killall -HUP cron");
 
+	/* increase bpf buffers to 20480, 5 times the normal 4096 */
+	add_text_to_file("/etc/sysctl.conf", "net.bpf.bufsize=20480");
+	exec("/sbin/sysctl net.bpf.bufsize=20480");
+
 	/* should we install a automatic update crontab entry? */
 	$automaticrulesupdate = $config['installedpackages']['snort']['config'][0]['automaticrulesupdate'];
 
diff --git a/packages/snort/snort.xml b/packages/snort/snort.xml
index 8562e2fc..fe8bdbb7 100644
--- a/packages/snort/snort.xml
+++ b/packages/snort/snort.xml
@@ -160,9 +160,12 @@
 		sync_package_snort_reinstall();
     </custom_php_install_command>
 	<custom_add_php_command>
-		sync_package_snort();
+        sync_package_snort();
 	</custom_add_php_command>
 	<custom_php_resync_command>
 		sync_package_snort();
 	</custom_php_resync_command>
-</packagegui>
\ No newline at end of file
+	<custom_php_deinstall_command>
+		snort_deinstall();
+	</custom_php_deinstall_command>	
+</packagegui>
-- 
cgit v1.2.3