Summary: Web-based network traffic monitoring
Name: ntopng
Version: @NTOPNG_VERSION@
Release: @REVISION@
License: GPL
URL: http://www.ntop.org/
Group: Networking/Utilities
Source: ntopng-%{version}.tgz
Packager: Luca Deri <deri@ntop.org>
# Temporary location where the RPM will be built
BuildRoot:  %{_tmppath}/%{name}-%{version}-root
%if 0%{?centos_ver} <= 8
Requires: pfring = @PFRING_VERSION@, redis >= 2.4.0, rrdtool >= 1.3.8, numactl, libcurl, ntopng-data, logrotate, zeromq >= 4.0.0, openldap, radcli, openssl, hiredis, mysql-libs, ethtool, redhat-lsb-core, libcap, json-c, expat, libzstd, net-snmp-libs, newt, libatomic, libmaxminddb, tcp_wrappers-libs, librdkafka, nmap, cronie, libsodium, @LICENSE_DEP@
%else
Requires: pfring = @PFRING_VERSION@, redis >= 2.4.0, rrdtool >= 1.3.8, numactl, libcurl, ntopng-data, logrotate, zeromq >= 4.0.0, openldap, radcli, openssl, hiredis, mysql-libs, ethtool, libcap, json-c, expat, libzstd, net-snmp-libs, newt, libatomic, libmaxminddb, tcp_wrappers-libs, librdkafka, cronie, libsodium, @LICENSE_DEP@
%endif
# Disable shared libs dependency check (needed by FPGA libs)
AutoReqProv: no
# Make sure .build-id is not part of the package
%define _build_id_links none

%description
ntopng high-speed web-based traffic monitoring and analysis tool (libpcap)
Web-based traffic monitoring

%setup -q

# https://imvoid.wordpress.com/2013/06/05/stripping-and-stopping-stripping-of-binaries-in-rpm-build/
# Disable stripping
# %global _enable_debug_package 0
# %global debug_package %{nil}
# %global __os_install_post /usr/lib/rpm/brp-compress %{nil}

%build
if ! test -f "$HOME/ntopng/pro/utils/snzip"; then echo "snzip missing"; exit; fi
#

# Installation may be a matter of running an install make target or you
# may need to manually install files with the install command.
%install
PATH=/usr/bin:/bin:/usr/sbin:/sbin
if [ -d $RPM_BUILD_ROOT ]; then
	\rm -rf $RPM_BUILD_ROOT
fi

mkdir -p $RPM_BUILD_ROOT/usr/bin $RPM_BUILD_ROOT/usr/share/ntopng $RPM_BUILD_ROOT/usr/share/man/man8 
mkdir -p $RPM_BUILD_ROOT/var/lib/ntopng
mkdir -p $RPM_BUILD_ROOT/etc/logrotate.d
mkdir -p $RPM_BUILD_ROOT/etc/sudoers.d/
mkdir -p $RPM_BUILD_ROOT/etc/rsyslog.d/
mkdir -p $RPM_BUILD_ROOT/etc/cron.d/
cp $HOME/ntopng/ntopng $RPM_BUILD_ROOT/usr/bin
strip $RPM_BUILD_ROOT/usr/bin/ntopng
cp $HOME/ntopng/ntopng.8 $RPM_BUILD_ROOT/usr/share/man/man8/ 
cp -Lr $HOME/ntopng/httpdocs $HOME/ntopng/scripts $RPM_BUILD_ROOT/usr/share/ntopng  # L to dereference symlinks
cp $HOME/ntopng/packages/wizard/ntopng-config $RPM_BUILD_ROOT/usr/bin
mv $RPM_BUILD_ROOT/usr/share/ntopng/httpdocs/misc/ntopng-utils-manage-config $RPM_BUILD_ROOT/usr/bin
mv $RPM_BUILD_ROOT/usr/share/ntopng/httpdocs/misc/ntopng-utils-manage-updates $RPM_BUILD_ROOT/usr/bin
cp $HOME/ntopng/packages/usr/bin/ntopctl $RPM_BUILD_ROOT/usr/bin/

# nmap vulnerability scan - https://github.com/scipag/vulscan
\mkdir -p $RPM_BUILD_ROOT/usr/share/nmap/scripts/vulscan
wget -O $RPM_BUILD_ROOT/usr/share/nmap/scripts/vulscan/vulscan.nse https://raw.githubusercontent.com/scipag/vulscan/master/vulscan.nse
wget -O $RPM_BUILD_ROOT/usr/share/nmap/scripts/vulscan/cve.csv 	https://raw.githubusercontent.com/scipag/vulscan/master/cve.csv
#wget -O $RPM_BUILD_ROOT/usr/share/nmap/scripts/vulscan/openvas.csv 	https://www.computec.ch/projekte/vulscan/download/openvas.csv

# Make sure .mmdb files are not packaged by ntopng as they belong to ntopng-data
rm -f $RPM_BUILD_ROOT/usr/share/ntopng/httpdocs/geoip/*.mmdb
mv $RPM_BUILD_ROOT/usr/share/ntopng/httpdocs/ssl/ntopng-cert.pem.dummy $RPM_BUILD_ROOT/usr/share/ntopng/httpdocs/ssl/ntopng-cert.pem
if test -d "$HOME/ntopng/pro"; then
   cd $HOME/ntopng/pro; make; cd -
   mkdir $RPM_BUILD_ROOT/usr/share/ntopng/pro
   cp -r $HOME/ntopng/pro/httpdocs $RPM_BUILD_ROOT/usr/share/ntopng/pro
   cp -r $HOME/ntopng/pro/scripts $RPM_BUILD_ROOT/usr/share/ntopng/pro
   rm -rf $RPM_BUILD_ROOT/usr/share/ntopng/pro/scripts/lua/nedge
   cd $RPM_BUILD_ROOT/usr/share/ntopng/scripts/lua; ln -s ../../pro/scripts/lua pro
   find $RPM_BUILD_ROOT/usr/share/ntopng/pro -name "*.lua" -type f -exec $HOME/ntopng/pro/utils/snzip -c -i {} -o {}r \;
   find $RPM_BUILD_ROOT/usr/share/ntopng/pro -name "*.lua" -type f -exec /bin/rm  {} ';'
   find $RPM_BUILD_ROOT/usr/share/ntopng/pro -name "*.luar" | xargs rename .luar .lua
fi

# For some reason the command below makes the packaging fail on RH8
%if 0%{?centos_ver} > 8
#find $RPM_BUILD_ROOT/usr/share/ntopng/scripts/lua -name "*.lua" -type f -exec $HOME/ntopng/tools/luac.sh {} ';'
%endif
 
if hash systemctl 2>/dev/null; then
   mkdir -p $RPM_BUILD_ROOT/usr/lib/systemd/system/
   cp $HOME/ntopng/packages/etc/systemd/system/ntopng*.service $RPM_BUILD_ROOT/usr/lib/systemd/system/
else
   cp $HOME/ntopng/packages/etc/init.d/ntopng    $RPM_BUILD_ROOT/etc/init.d
fi
cp $HOME/ntopng/packages/etc/sudoers.d/ntopng      $RPM_BUILD_ROOT/etc/sudoers.d/
cp $HOME/ntopng/packages/etc/rsyslog.d/20-ntopng.conf $RPM_BUILD_ROOT/etc/rsyslog.d/
cp $HOME/ntopng/packages/etc/logrotate.d/ntopng    $RPM_BUILD_ROOT/etc/logrotate.d/
cp $HOME/ntopng/packages/etc/cron.d/ntopng         $RPM_BUILD_ROOT/etc/cron.d/

mkdir $RPM_BUILD_ROOT/etc/ntopng $RPM_BUILD_ROOT/etc/ntopng.conf.d
cp $HOME/ntopng/packages/etc/ntopng/ntopng.conf               $RPM_BUILD_ROOT/etc/ntopng
cp $HOME/ntopng/packages/etc/ntopng/ntopng.conf.nprobe.sample $RPM_BUILD_ROOT/etc/ntopng

find $RPM_BUILD_ROOT -name ".git" | xargs /bin/rm -rf
find $RPM_BUILD_ROOT -name ".svn" | xargs /bin/rm -rf
find $RPM_BUILD_ROOT -name "*~"   | xargs /bin/rm -f
#
DST=$RPM_BUILD_ROOT/usr/ntopng
SRC=$RPM_BUILD_DIR/%{name}-%{version}
#mkdir -p $DST/conf
# Clean out our build directory
%clean
rm -fr $RPM_BUILD_ROOT

%files
/usr/bin/ntopng
/usr/bin/ntopctl
/usr/bin/ntopng-config
/usr/bin/ntopng-utils-manage-config
/usr/bin/ntopng-utils-manage-updates
/usr/share/man/man8/ntopng.8.gz
%config(noreplace) /etc/ntopng/ntopng.conf
/etc/ntopng/ntopng.conf.nprobe.sample
/usr/lib/systemd/system/ntopng.service
/usr/lib/systemd/system/ntopng@.service
/etc/logrotate.d/ntopng
/etc/sudoers.d/ntopng
/etc/rsyslog.d/20-ntopng.conf
/etc/cron.d/ntopng
/usr/share/ntopng
# Don't overwrite ntopng-cert.pem is the file is already present
%config(noreplace) /usr/share/ntopng/httpdocs/ssl/ntopng-cert.pem
#/etc/ntopng/ntopng.conf.sample
#/etc/ntopng/ntopng.start
/usr/share/nmap/scripts/vulscan/vulscan.nse
/usr/share/nmap/scripts/vulscan/cve.csv

%dir %attr(700, ntopng, ntopng) /var/lib/ntopng

# Set the default attributes of all of the files specified to have an
# owner and group of root and to inherit the permissions of the file
# itself.
%defattr(-, root, root)

%changelog
* Sun Jun 30 2013 Luca Deri <deri@ntop.org> 1.0
- Current package version

# Execution order:
# install:    pre -> (copy) -> post
# upgrade:    pre -> (copy) -> post -> preun (old) -> (delete old) -> postun (old)
# un-install:                          preun       -> (delete)     -> postun

%pre

if ! grep -q 'ntop:' /etc/group; then
    echo 'Creating ntop group'
    /usr/sbin/groupadd -r ntop
fi
if ! /usr/bin/id -u ntopng > /dev/null 2>&1; then 
    echo "Creating ntopng user..."
    /usr/sbin/useradd -M -N -g ntop -r -s /bin/false ntopng
fi
/usr/sbin/usermod -g ntop ntopng

if [ $(getent group n2disk) ] && [ $(getent passwd ntopng) ]; then
    # this is necessary to allow ntopng to extract pcaps
    # recorded with n2disk
    if ! id -nG ntopng | grep -qw "n2disk"; then
	echo "Adding user ntopng to group n2disk..."
	/usr/sbin/usermod -a -G n2disk ntopng
    fi
fi

if [ $(getent group systemd-journal) ] && [ $(getent passwd ntopng) ]; then
    # this is necessary to allow ntopng to read journalctl logs
    if ! id -nG ntopng | grep -qw "systemd-journal"; then
       echo "Adding user ntopng to group systemd-journal..."
       /usr/sbin/usermod -a -G systemd-journal ntopng
    fi
fi

%post

/bin/chown ntopng:ntopng /usr/bin/ntopng-config
/bin/chmod gou+s /usr/bin/ntopng-config
/bin/chown -R ntopng:ntopng /etc/ntopng

CMDLINE=$(tr -d '\0' < /proc/1/cmdline) 
if [ -z "${CMDLINE##*system*}" ] || [ -z "${CMDLINE##*init*}" ]; then # init/systemd (not a container)
/bin/systemctl daemon-reload
%systemd_post ntopng.service
fi

TLS_DIR="/usr/share/ntopng/httpdocs/ssl"
TLS_CERT_PATH="$TLS_DIR/ntopng-cert.pem"
if [ ! -f "$TLS_CERT_PATH" ]; then
    openssl req -new -x509 -sha1 -extensions v3_ca -nodes -days 365 -out $TLS_DIR/cert.pem -subj "/CN=ntopng.local"
    mv privkey.pem $TLS_CERT_PATH
    cat $TLS_DIR/cert.pem >> $TLS_CERT_PATH
    rm $TLS_DIR/cert.pem
fi

case "$1" in
  1)
    # install
    echo ''
    echo 'NOTE'
    echo ''
    echo 'ntopng Community does not require a license.'
    echo 'ntopng Pro/Enterprise licenses are perpetual and include 1 year maintenance/updates:'
    echo 'you can use the software even after maintenance is expired, however updating it after'
    echo '1 year would prevent ntopng from running. If you have automatic updates enabled, and'
    echo 'maintenance is expired, it is recommended to put the package updates on hold by adding'
    echo 'the "exclude=ntopng*" directive in /etc/yum.conf. Alternatively it is possible to install'
    echo 'the versionlock plugin with "yum install yum-plugin-versionlock" and lock the ntopng'
    echo 'version with "yum versionlock ntopng" (it can be unlocked with "yum versionlock clear")'
    echo ''
  ;;
esac

%preun

CMDLINE=$(tr -d '\0' < /proc/1/cmdline) 
if [ -z "${CMDLINE##*system*}" ] || [ -z "${CMDLINE##*init*}" ]; then # init/systemd (not a container)
  %systemd_preun ntopng.service
fi

%postun
CMDLINE=$(tr -d '\0' < /proc/1/cmdline) 
if [ -z "${CMDLINE##*system*}" ] || [ -z "${CMDLINE##*init*}" ]; then # init/systemd (not a container)
  %systemd_postun_with_restart ntopng.service
fi
