crowdsec: initial package v1.2.0
/net/crowdsec/
Crowdsec - An open-source, lightweight agent to detect
and respond to bad behaviours.
It also automatically benefits from a global community-wide
IP reputation database.
Signed-off-by: Kerma Gérald <gandalf@gk2.net>
(cherry picked from commit 8903d1b7ca)
This commit is contained in:
Kerma Gérald
Rosen Penev
parent
b92db741e5
commit
738fda6b64
6 changed files with 276 additions and 0 deletions
153
net/crowdsec/Makefile
Normal file
153
net/crowdsec/Makefile
Normal file
|
|
@ -0,0 +1,153 @@
|
|||
# SPDX-License-Identifier: MIT
|
||||
#
|
||||
# Copyright (C) 2021 Gerald Kerma
|
||||
#
|
||||
|
||||
include $(TOPDIR)/rules.mk
|
||||
|
||||
PKG_NAME:=crowdsec
|
||||
PKG_VERSION:=1.2.0
|
||||
PKG_RELEASE:=$(AUTORELEASE)
|
||||
|
||||
PKG_SOURCE_PROTO:=git
|
||||
PKG_SOURCE_URL:=https://github.com/crowdsecurity/crowdsec
|
||||
PKG_SOURCE_VERSION:=v$(PKG_VERSION)
|
||||
PKG_SOURCE_DATE:=20210914
|
||||
PKG_MIRROR_HASH:=911af2c49c28596256c31ebb26b48c5ba9e6a0abdd46830e75e2cf4c0eff4256
|
||||
|
||||
PKG_LICENSE:=MIT
|
||||
PKG_LICENSE_FILES:=LICENSE
|
||||
PKG_MAINTAINER:=Gerald Kerma <gandalf@gk2.net>
|
||||
|
||||
PKG_BUILD_DEPENDS:=golang/host
|
||||
PKG_BUILD_PARALLEL:=1
|
||||
PKG_USE_MIPS16:=0
|
||||
|
||||
CWD_SYSTEM:=openwrt
|
||||
CWD_BUILD_VERSION?=$(PKG_SOURCE_VERSION)
|
||||
CWD_BUILD_GOVERSION:=$(shell go version | cut -d " " -f3 | sed -E 's/[go]+//g')
|
||||
CWD_BUILD_CODENAME:=alphaga
|
||||
CWD_BUILD_TIMESTAMP:=$(SOURCE_DATE_EPOCH)
|
||||
CWD_BUILD_TAG:=openwrt
|
||||
|
||||
CWD_VERSION_PKG:=github.com/crowdsecurity/crowdsec/pkg/cwversion
|
||||
|
||||
GO_PKG:=github.com/crowdsecurity/crowdsec
|
||||
|
||||
GO_PKG_LDFLAGS_X:=$(CWD_VERSION_PKG).Version=$(CWD_BUILD_VERSION) \
|
||||
$(CWD_VERSION_PKG).System=$(CWD_SYSTEM) \
|
||||
$(CWD_VERSION_PKG).BuildDate=$(CWD_BUILD_TIMESTAMP) \
|
||||
$(CWD_VERSION_PKG).Codename=$(CWD_BUILD_CODENAME) \
|
||||
$(CWD_VERSION_PKG).Tag=$(CWD_BUILD_TAG) \
|
||||
$(CWD_VERSION_PKG).GoVersion=$(CWD_BUILD_GOVERSION)
|
||||
|
||||
GO_PKG_INSTALL_ALL:=1
|
||||
|
||||
include $(INCLUDE_DIR)/package.mk
|
||||
include ../../lang/golang/golang-package.mk
|
||||
|
||||
define Package/crowdsec/Default
|
||||
SECTION:=net
|
||||
CATEGORY:=Network
|
||||
TITLE:=Crowdsec detection engine
|
||||
URL:=https://crowdsec.net/
|
||||
endef
|
||||
|
||||
define Package/crowdsec
|
||||
$(call Package/crowdsec/Default)
|
||||
DEPENDS:=$(GO_ARCH_DEPENDS)
|
||||
endef
|
||||
|
||||
define Package/golang-crowdsec-dev
|
||||
$(call Package/crowdsec/Default)
|
||||
$(call GoPackage/GoSubMenu)
|
||||
TITLE+= (source files)
|
||||
DEPENDS:=$(GO_ARCH_DEPENDS)
|
||||
PKGARCH:=all
|
||||
endef
|
||||
|
||||
define Package/crowdsec/Default/description
|
||||
Crowdsec - An open-source, lightweight agent to detect
|
||||
and respond to bad behaviours.
|
||||
It also automatically benefits from a global
|
||||
community-wide IP reputation database.
|
||||
endef
|
||||
|
||||
define Package/crowdsec/description
|
||||
$(call Package/crowdsec/Default/description)
|
||||
|
||||
This package contains the main program.
|
||||
endef
|
||||
|
||||
define Package/golang-crowdsec-dev/description
|
||||
$(call Package/crowdsec/Default/description)
|
||||
|
||||
This package provides the source files for the program.
|
||||
endef
|
||||
|
||||
define Package/crowdsec/install
|
||||
$(call GoPackage/Package/Install/Bin,$(1))
|
||||
|
||||
$(INSTALL_DIR) $(1)/etc/crowdsec
|
||||
$(INSTALL_DIR) $(1)/etc/crowdsec/scenarios
|
||||
$(INSTALL_DIR) $(1)/etc/crowdsec/postoverflows
|
||||
$(INSTALL_DIR) $(1)/etc/crowdsec/collections
|
||||
$(INSTALL_DIR) $(1)/etc/crowdsec/patterns
|
||||
$(INSTALL_DIR) $(1)/etc/crowdsec/hub
|
||||
|
||||
$(INSTALL_DATA) \
|
||||
$(GO_PKG_BUILD_DIR)/src/$(GO_PKG)/config/config.yaml \
|
||||
$(1)/etc/crowdsec
|
||||
$(INSTALL_DATA) \
|
||||
$(GO_PKG_BUILD_DIR)/src/$(GO_PKG)/config/dev.yaml \
|
||||
$(1)/etc/crowdsec
|
||||
$(INSTALL_DATA) \
|
||||
$(GO_PKG_BUILD_DIR)/src/$(GO_PKG)/config/user.yaml \
|
||||
$(1)/etc/crowdsec
|
||||
$(INSTALL_DATA) \
|
||||
$(GO_PKG_BUILD_DIR)/src/$(GO_PKG)/config/acquis.yaml \
|
||||
$(1)/etc/crowdsec
|
||||
$(INSTALL_DATA) \
|
||||
$(GO_PKG_BUILD_DIR)/src/$(GO_PKG)/config/profiles.yaml \
|
||||
$(1)/etc/crowdsec
|
||||
$(INSTALL_DATA) \
|
||||
$(GO_PKG_BUILD_DIR)/src/$(GO_PKG)/config/simulation.yaml \
|
||||
$(1)/etc/crowdsec
|
||||
$(INSTALL_DATA) \
|
||||
$(GO_PKG_BUILD_DIR)/src/$(GO_PKG)/config/local_api_credentials.yaml \
|
||||
$(1)/etc/crowdsec
|
||||
$(INSTALL_DATA) \
|
||||
$(GO_PKG_BUILD_DIR)/src/$(GO_PKG)/config/online_api_credentials.yaml \
|
||||
$(1)/etc/crowdsec
|
||||
|
||||
$(CP) \
|
||||
$(GO_PKG_BUILD_DIR)/src/$(GO_PKG)/config/patterns/* \
|
||||
$(1)/etc/crowdsec/patterns
|
||||
|
||||
$(INSTALL_DIR) $(1)/srv/crowdsec/data/
|
||||
|
||||
$(INSTALL_DIR) $(1)/etc/init.d
|
||||
$(INSTALL_BIN) \
|
||||
./files/crowdsec.initd \
|
||||
$(1)/etc/init.d/crowdsec
|
||||
|
||||
$(INSTALL_DIR) $(1)/etc/config
|
||||
$(INSTALL_CONF) \
|
||||
./files/crowdsec.config \
|
||||
$(1)/etc/config/crowdsec
|
||||
|
||||
$(LN) /usr/bin/crowdsec-cli $(1)/usr/bin/cscli
|
||||
|
||||
$(INSTALL_DIR) $(1)/etc/uci-defaults
|
||||
$(INSTALL_BIN) \
|
||||
./files/crowdsec.defaults \
|
||||
$(1)/etc/uci-defaults/99_crowdsec
|
||||
endef
|
||||
|
||||
define Package/crowdsec/conffiles
|
||||
/etc/crowdsec/
|
||||
/etc/config/crowdsec
|
||||
endef
|
||||
|
||||
$(eval $(call GoBinPackage,crowdsec))
|
||||
$(eval $(call BuildPackage,crowdsec))
|
||||
4
net/crowdsec/files/crowdsec.config
Normal file
4
net/crowdsec/files/crowdsec.config
Normal file
|
|
@ -0,0 +1,4 @@
|
|||
config crowdsec 'crowdsec'
|
||||
option data_dir '/srv/crowdsec/data'
|
||||
option db_path '/srv/crowdsec/data/crowdsec.db'
|
||||
|
||||
26
net/crowdsec/files/crowdsec.defaults
Normal file
26
net/crowdsec/files/crowdsec.defaults
Normal file
|
|
@ -0,0 +1,26 @@
|
|||
#!/bin/sh
|
||||
|
||||
CONFIG=/etc/crowdsec/config.yaml
|
||||
data_dir=`uci get "crowdsec.crowdsec.data_dir"`
|
||||
sed -i "s,^\(\s*data_dir\s*:\s*\).*\$,\1$data_dir," $CONFIG
|
||||
db_path=`uci get "crowdsec.crowdsec.db_path"`
|
||||
sed -i "s,^\(\s*db_path\s*:\s*\).*\$,\1$db_path," $CONFIG
|
||||
|
||||
# Create data dir & permissions if needed
|
||||
if [ ! -d "${data_dir}" ]; then
|
||||
mkdir -m 0755 -p "${data_dir}"
|
||||
fi;
|
||||
|
||||
if grep -q "login:" /etc/crowdsec/local_api_credentials.yaml; then
|
||||
echo local API already registered...
|
||||
else
|
||||
cscli -c /etc/crowdsec/config.yaml machines add -a -f /etc/crowdsec/local_api_credentials.yaml
|
||||
fi
|
||||
if [ -s /etc/crowdsec/online_api_credentials.yaml ]; then
|
||||
echo online API already registered...
|
||||
else
|
||||
cscli -c /etc/crowdsec/config.yaml capi register -f /etc/crowdsec/online_api_credentials.yaml
|
||||
fi
|
||||
cscli hub update && cscli collections install crowdsecurity/linux && cscli parsers install crowdsecurity/whitelists && cscli hub upgrade
|
||||
|
||||
exit 0
|
||||
44
net/crowdsec/files/crowdsec.initd
Executable file
44
net/crowdsec/files/crowdsec.initd
Executable file
|
|
@ -0,0 +1,44 @@
|
|||
#!/bin/sh /etc/rc.common
|
||||
# (C) 2021 Gerald Kerma
|
||||
|
||||
START=99
|
||||
USE_PROCD=1
|
||||
NAME=crowdsec
|
||||
PROG=/usr/bin/crowdsec
|
||||
CONFIG=/etc/crowdsec/config.yaml
|
||||
RUNCONFDIR=/srv/crowdsec/data
|
||||
VARCONFIGDIR=/var/etc/crowdsec
|
||||
VARCONFIG=/var/etc/crowdsec/config.yaml
|
||||
|
||||
service_triggers() {
|
||||
procd_add_reload_trigger crowdsec
|
||||
}
|
||||
|
||||
init_config() {
|
||||
config_load crowdsec
|
||||
config_get data_dir crowdsec data_dir "${RUNCONFDIR}"
|
||||
config_get db_path crowdsec db_path "${RUNCONFDIR}/crowdsec.db"
|
||||
|
||||
# Create tmp dir & permissions if needed
|
||||
if [ ! -d "${VARCONFIGDIR}" ]; then
|
||||
mkdir -m 0755 -p "${VARCONFIGDIR}"
|
||||
fi;
|
||||
|
||||
cp $CONFIG $VARCONFIG
|
||||
|
||||
sed -i "s,^\(\s*data_dir\s*:\s*\).*\$,\1$data_dir," $VARCONFIG
|
||||
sed -i "s,^\(\s*db_path\s*:\s*\).*\$,\1$db_path," $VARCONFIG
|
||||
|
||||
# Create data dir & permissions if needed
|
||||
if [ ! -d "${RUNCONFDIR}" ]; then
|
||||
mkdir -m 0755 -p "${RUNCONFDIR}"
|
||||
fi;
|
||||
}
|
||||
|
||||
start_service() {
|
||||
init_config
|
||||
|
||||
procd_open_instance
|
||||
procd_set_param command "$PROG" -c "$VARCONFIG"
|
||||
procd_close_instance
|
||||
}
|
||||
20
net/crowdsec/patches/001-fix_config_data_dir.patch
Normal file
20
net/crowdsec/patches/001-fix_config_data_dir.patch
Normal file
|
|
@ -0,0 +1,20 @@
|
|||
--- a/config/config.yaml
|
||||
+++ b/config/config.yaml
|
||||
@@ -7,7 +7,7 @@ common:
|
||||
working_dir: .
|
||||
config_paths:
|
||||
config_dir: /etc/crowdsec/
|
||||
- data_dir: /var/lib/crowdsec/data/
|
||||
+ data_dir: /srv/crowdsec/data/
|
||||
simulation_path: /etc/crowdsec/simulation.yaml
|
||||
hub_dir: /etc/crowdsec/hub/
|
||||
index_path: /etc/crowdsec/hub/.index.json
|
||||
@@ -21,7 +21,7 @@ cscli:
|
||||
db_config:
|
||||
log_level: info
|
||||
type: sqlite
|
||||
- db_path: /var/lib/crowdsec/data/crowdsec.db
|
||||
+ db_path: /srv/crowdsec/data/crowdsec.db
|
||||
#user:
|
||||
#password:
|
||||
#db_name:
|
||||
29
net/crowdsec/patches/010-fix-32bits-compile.patch
Normal file
29
net/crowdsec/patches/010-fix-32bits-compile.patch
Normal file
|
|
@ -0,0 +1,29 @@
|
|||
Author: Kerma Gérald <gandalf@gk2.net>
|
||||
Date: Mon Sep 20 10:34:20 2021 +0200
|
||||
|
||||
Use math.MaxInt32 instead of math.MaxUint32
|
||||
|
||||
To fix 32 bits compilation in v1.2.0
|
||||
https://github.com/crowdsecurity/crowdsec/issues/979
|
||||
|
||||
Signed-off-by: Kerma Gérald <gandalf@gk2.net>
|
||||
|
||||
--- a/pkg/csplugin/broker.go
|
||||
+++ b/pkg/csplugin/broker.go
|
||||
@@ -400,14 +400,14 @@ func getProccessAtr(username string, gro
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
- if uid < 0 && uid > math.MaxUint32 {
|
||||
+ if uid < 0 && uid > math.MaxInt32 {
|
||||
return nil, fmt.Errorf("out of bound uid")
|
||||
}
|
||||
gid, err := strconv.Atoi(g.Gid)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
- if gid < 0 && gid > math.MaxUint32 {
|
||||
+ if gid < 0 && gid > math.MaxInt32 {
|
||||
return nil, fmt.Errorf("out of bound gid")
|
||||
}
|
||||
return &syscall.SysProcAttr{
|
||||
Loading…
Reference in a new issue