crowdsec: 1.0.10 (#4706)

* Update crowdsec rule reference ($ -> <>); bump release

* php cleanup

* javascript: reformat

* backport js changes from pfsense: var -> const, let, function order

* backport name change

* backport changes: const -> var; id =

* prettier

* tabs

* backport callback style

* cron: avoid spamming stdout when the hub index is updated

* icon

* add outgoing rules

* blacklists -> blocklists

* some python typing

* enroll to console from the settings

* v1.0.10 with option to disable rule generation

security/crowdsec/+POST_DEINSTALL.post

@@ -41,8 +41,8 @@ function removeAlias($name)
     }
 }
 
-removeAlias('crowdsec_blacklists');
-removeAlias('crowdsec6_blacklists');
+removeAlias('crowdsec_blocklists');
+removeAlias('crowdsec6_blocklists');
 EOT
 
 

security/crowdsec/Makefile

@@ -1,5 +1,5 @@
 PLUGIN_NAME=		crowdsec
-PLUGIN_VERSION=		1.0.9
+PLUGIN_VERSION=		1.0.10
 PLUGIN_DEPENDS=		crowdsec
 PLUGIN_COMMENT=		Lightweight and collaborative security engine
 PLUGIN_MAINTAINER=	marco@crowdsec.net

security/crowdsec/pkg-descr

@@ -8,6 +8,13 @@ WWW: https://crowdsec.net/
 Plugin Changelog
 ================
 
+1.0.10
+ * changed alias names crowdsec*blacklists -> crowdsec*blocklists
+ * added rules for outgoing connections too
+ * added enroll_key to settings for automatic enrollment
+ * option to disable rule generation (bring your own rules!)
+ * code cleanup, reformat, typing
+
 1.0.9
 
  * Update rule reference ($ -> <>) for opnsense 25.1

security/crowdsec/src/etc/inc/plugins.inc.d/crowdsec.inc

@@ -43,39 +43,69 @@ function crowdsec_firewall(Plugin $fw)
         $rules_tag = $general['rules_tag'];
     }
 
-    add_alias_if_not_exist('crowdsec_blacklists', 'CrowdSec (IPv4)', 'IPv4');
+    add_alias_if_not_exist('crowdsec_blocklists', 'CrowdSec (IPv4)', 'IPv4');
+    add_alias_if_not_exist('crowdsec6_blocklists', 'CrowdSec (IPv6)', 'IPv6');
 
     // https://github.com/opnsense/core/blob/master/src/opnsense/mvc/app/library/OPNsense/Firewall/FilterRule.php
 
-    $fw->registerFilterRule(
-        1, /* priority */
-        array(
-            'ipprotocol' => 'inet',
-            'descr'      => 'CrowdSec (IPv4)',
-            'from'       => '<crowdsec_blacklists>',
-            'direction'  => 'in',
-            'type'       => 'block',
-            'log'        => $rules_log_enabled,
-            'tag'        => $rules_tag,
-            'quick'      => true
-        )
-    );
+    // if missing, default to true
+    if (!isset($general['rules_enabled']) || $general['rules_enabled'] != 0) {
+        $fw->registerFilterRule(
+            1, /* priority */
+            array(
+                'ipprotocol' => 'inet',
+                'descr'      => 'CrowdSec (IPv4) in',
+                'from'       => '<crowdsec_blocklists>',
+                'direction'  => 'in',
+                'type'       => 'block',
+                'log'        => $rules_log_enabled,
+                'tag'        => $rules_tag,
+                'quick'      => true
+            )
+        );
 
-    add_alias_if_not_exist('crowdsec6_blacklists', 'CrowdSec (IPv6)', 'IPv6');
+        $fw->registerFilterRule(
+            1, /* priority */
+            array(
+                'ipprotocol' => 'inet',
+                'descr'      => 'CrowdSec (IPv4) out',
+                'to'         => '<crowdsec_blocklists>',
+                'direction'  => 'out',
+                'type'       => 'block',
+                'log'        => $rules_log_enabled,
+                'tag'        => $rules_tag,
+                'quick'      => true
+            )
+        );
 
-    $fw->registerFilterRule(
-        1, /* priority */
-        array(
-            'ipprotocol' => 'inet6',
-            'descr'      => 'CrowdSec (IPv6)',
-            'from'       => '<crowdsec6_blacklists>',
-            'direction'  => 'in',
-            'type'       => 'block',
-            'log'        => $rules_log_enabled,
-            'tag'        => $rules_tag,
-            'quick'      => true
-        )
-    );
+        $fw->registerFilterRule(
+            1, /* priority */
+            array(
+                'ipprotocol' => 'inet6',
+                'descr'      => 'CrowdSec (IPv6) in',
+                'from'       => '<crowdsec6_blocklists>',
+                'direction'  => 'in',
+                'type'       => 'block',
+                'log'        => $rules_log_enabled,
+                'tag'        => $rules_tag,
+                'quick'      => true
+            )
+        );
+
+        $fw->registerFilterRule(
+            1, /* priority */
+            array(
+                'ipprotocol' => 'inet6',
+                'descr'      => 'CrowdSec (IPv6) out',
+                'to'         => '<crowdsec6_blocklists>',
+                'direction'  => 'out',
+                'type'       => 'block',
+                'log'        => $rules_log_enabled,
+                'tag'        => $rules_tag,
+                'quick'      => true
+            )
+        );
+    }
 }
 
 function crowdsec_services()

security/crowdsec/src/opnsense/mvc/app/controllers/OPNsense/CrowdSec/Api/AlertsController.php

@@ -15,19 +15,19 @@ use OPNsense\Core\Backend;
 class AlertsController extends ApiControllerBase
 {
     /**
-     * retrieve list of alerts
+     * Retrieve list of alerts
+     *
      * @return array of alerts
      * @throws \OPNsense\Base\ModelException
      * @throws \ReflectionException
      */
     public function getAction()
     {
-        $backend = new Backend();
-        $bckresult = json_decode(trim($backend->configdRun("crowdsec alerts-list")), true);
-        if ($bckresult !== null) {
+        $result = json_decode(trim((new Backend())->configdRun("crowdsec alerts-list")), true);
+        if ($result !== null) {
             // only return valid json type responses
-            return $bckresult;
+            return $result;
         }
-        return array("message" => "unable to list alerts");
+        return ["message" => "unable to list alerts"];
     }
 }

security/crowdsec/src/opnsense/mvc/app/controllers/OPNsense/CrowdSec/Api/BouncersController.php

@@ -15,19 +15,19 @@ use OPNsense\Core\Backend;
 class BouncersController extends ApiControllerBase
 {
     /**
-     * retrieve list of bouncers
+     * Retrieve list of bouncers
+     *
      * @return array of bouncers
      * @throws \OPNsense\Base\ModelException
      * @throws \ReflectionException
      */
     public function getAction()
     {
-        $backend = new Backend();
-        $bckresult = json_decode(trim($backend->configdRun("crowdsec bouncers-list")), true);
-        if ($bckresult !== null) {
+        $result = json_decode(trim((new Backend())->configdRun("crowdsec bouncers-list")), true);
+        if ($result !== null) {
             // only return valid json type responses
-            return $bckresult;
+            return $result;
         }
-        return array("message" => "unable to list bouncers");
+        return ["message" => "unable to list bouncers"];
     }
 }

security/crowdsec/src/opnsense/mvc/app/controllers/OPNsense/CrowdSec/Api/DecisionsController.php

@@ -15,36 +15,35 @@ use OPNsense\Core\Backend;
 class DecisionsController extends ApiControllerBase
 {
     /**
-     * retrieve list of decisions
+     * Retrieve list of decisions
+     *
      * @return array of decisions
      * @throws \OPNsense\Base\ModelException
      * @throws \ReflectionException
      */
     public function getAction()
     {
-        $backend = new Backend();
-        $bckresult = json_decode(trim($backend->configdRun("crowdsec decisions-list")), true);
-        if ($bckresult !== null) {
+        $result = json_decode(trim((new Backend())->configdRun("crowdsec decisions-list")), true);
+        if ($result !== null) {
             // only return valid json type responses
-            return $bckresult;
+            return $result;
         }
-        return array("message" => "unable to list decisions");
+        return ["message" => "unable to list decisions"];
     }
 
     public function deleteAction($decision_id)
     {
         if ($this->request->isDelete()) {
-            $backend = new Backend();
-            $bckresult = $backend->configdRun("crowdsec decisions-delete ${decision_id}");
-            if ($bckresult !== null) {
+            $result = (new Backend())->configdRun("crowdsec decisions-delete ${decision_id}");
+            if ($result !== null) {
                 // why does the action return \n\n for empty output?
-                if (trim($bckresult) === '') {
-                    return array("message" => "OK");
+                if (trim($result) === '') {
+                    return ["message" => "OK"];
                 }
                 // TODO handle error
-                return array("message" => $bckresult);
+                return ["message" => result];
             }
-            return array("message" => "OK");
+            return ["message" => "OK"];
         } else {
             $this->response->setStatusCode(405, "Method Not Allowed");
             $this->response->setHeader("Allow", "DELETE");

security/crowdsec/src/opnsense/mvc/app/controllers/OPNsense/CrowdSec/Api/HubController.php

@@ -15,19 +15,19 @@ use OPNsense\Core\Backend;
 class HubController extends ApiControllerBase
 {
     /**
-     * retrieve the registered hub items
+     * Retrieve the registered hub items
+     *
      * @return dictionary of items, by type
      * @throws \OPNsense\Base\ModelException
      * @throws \ReflectionException
      */
     public function getAction()
     {
-        $backend = new Backend();
-        $bckresult = json_decode(trim($backend->configdRun("crowdsec hub-items")), true);
-        if ($bckresult !== null) {
+        $result = json_decode(trim((new Backend())->configdRun("crowdsec hub-items")), true);
+        if ($result !== null) {
             // only return valid json type responses
-            return $bckresult;
+            return $result;
         }
-        return array("message" => "unable to list hub items");
+        return ["message" => "unable to list hub items"];
     }
 }

security/crowdsec/src/opnsense/mvc/app/controllers/OPNsense/CrowdSec/Api/MachinesController.php

@@ -15,19 +15,19 @@ use OPNsense\Core\Backend;
 class MachinesController extends ApiControllerBase
 {
     /**
-     * retrieve list of registered machines
+     * Retrieve list of registered machines
+     *
      * @return array of machines
      * @throws \OPNsense\Base\ModelException
      * @throws \ReflectionException
      */
     public function getAction()
     {
-        $backend = new Backend();
-        $bckresult = json_decode(trim($backend->configdRun("crowdsec machines-list")), true);
-        if ($bckresult !== null) {
+        $result = json_decode(trim((new Backend())->configdRun("crowdsec machines-list")), true);
+        if ($result !== null) {
             // only return valid json type responses
-            return $bckresult;
+            return $result;
         }
-        return array("message" => "unable to list machines");
+        return ["message" => "unable to list machines"];
     }
 }

security/crowdsec/src/opnsense/mvc/app/controllers/OPNsense/CrowdSec/Api/ServiceController.php

@@ -30,11 +30,12 @@ class ServiceController extends ApiControllerBase
                 }
             }
         }
-        return array("status" => $status);
+        return ["status" => $status];
     }
 
     /**
-     * retrieve status of crowdsec
+     * Retrieve status of crowdsec
+     *
      * @return array
      * @throws \Exception
      */
@@ -59,20 +60,9 @@ class ServiceController extends ApiControllerBase
             $firewall_status = "running";
         }
 
-        return array(
+        return [
             "crowdsec-status" => $status,
             "crowdsec-firewall-status" => $firewall_status,
-        );
-    }
-
-    /**
-     * return debug information
-     * @return array
-     */
-    public function debugAction()
-    {
-        $backend = new Backend();
-        $response = $backend->configdRun("crowdsec debug");
-        return array("message" => $response);
+        ];
     }
 }

security/crowdsec/src/opnsense/mvc/app/controllers/OPNsense/CrowdSec/Api/VersionController.php

@@ -15,14 +15,14 @@ use OPNsense\Core\Backend;
 class VersionController extends ApiControllerBase
 {
     /**
-     * retrieve version description
+     * Retrieve version description
+     *
      * @return version description
      * @throws \OPNsense\Base\ModelException
      * @throws \ReflectionException
      */
     public function getAction()
     {
-        $backend = new Backend();
-        return $backend->configdRun("crowdsec version");
+        return (new Backend())->configdRun("crowdsec version");
     }
 }

security/crowdsec/src/opnsense/mvc/app/controllers/OPNsense/CrowdSec/forms/general.xml

@@ -27,6 +27,14 @@
       packets from the attacking IP addresses.</help>
   </field>
 
+  <!-- enroll_key  -->
+  <field>
+    <id>general.enroll_key</id>
+    <label>Enrollment key from https://app.crowdsec.net</label>
+    <type>text</type>
+    <help>Click "Enroll command" on the the website and copy the key here.</help>
+  </field>
+
   <!-- lapi_manual_configuration -->
   <field>
     <id>general.lapi_manual_configuration</id>
@@ -66,6 +74,16 @@
       services.</help>
   </field>
 
+  <!-- rules_enabled -->
+  <field>
+    <id>general.rules_enabled</id>
+    <label>Create blocklist rules</label>
+    <type>checkbox</type>
+    <help>Generate block rules from the Crowdsec blocklists.
+    They are applied t all interfaces, ipv4/v6, ingress and egress.
+    If you disable this, you'll have to write your own rules to block anything.</help>
+  </field>
+
   <!-- rules_log -->
   <field>
     <id>general.rules_log</id>

security/crowdsec/src/opnsense/mvc/app/models/OPNsense/CrowdSec/General.xml

@@ -1,7 +1,7 @@
 <model>
   <mount>//OPNsense/crowdsec/general</mount>
   <description>CrowdSec general configuration</description>
-  <version>1.0.9</version>
+  <version>1.0.10</version>
   <items>
 
     <agent_enabled type="BooleanField">
@@ -37,6 +37,11 @@
       <EnableRanges>N</EnableRanges>
     </lapi_listen_port>
 
+    <rules_enabled type="BooleanField">
+      <default>1</default>
+      <Required>Y</Required>
+    </rules_enabled>
+
     <rules_log type="BooleanField">
       <default>0</default>
       <Required>Y</Required>
@@ -47,6 +52,11 @@
       <ValidationMessage>A tag must only contain numbers and letters and must be between 1 and 63 characters.</ValidationMessage>
     </rules_tag>
 
+    <enroll_key type="TextField">
+      <Mask>/^([0-9a-zA-Z]{1,63})$/u</Mask>
+      <ValidationMessage>The enrollment key can only contain numbers and letters and must be between 1 and 63 characters. Did you take it from app.crowdsec.net?</ValidationMessage>
+    </enroll_key>
+
     <crowdsec_firewall_verbose type="BooleanField">
       <default>0</default>
       <Required>Y</Required>

security/crowdsec/src/opnsense/mvc/app/views/OPNsense/CrowdSec/general.volt

@@ -3,7 +3,7 @@
 
 <script>
     $( document ).ready(function() {
-        var data_get_map = {'frm_GeneralSettings':"/api/crowdsec/general/get"};
+        const data_get_map = {'frm_GeneralSettings':"/api/crowdsec/general/get"};
         mapDataToFormUI(data_get_map).done(function(data){
             // place actions to run after load, for example update form styles.
         });
@@ -64,8 +64,8 @@
         <a href="https://doc.crowdsec.net/docs/next/user_guides/multiserver_setup">any other agent</a>
         connected to the same LAPI node. Other types of remediation are possible (ex. captcha test for scraping attempts).</p>
 
-	We recommend you to <a href="https://app.crowdsec.net/">register to the Console</a>. This helps you manage your instances,
-	and us to have better overall metrics.
+        We recommend you to <a href="https://app.crowdsec.net/">register to the Console</a>. This helps you manage your instances,
+        and us to have better overall metrics.
 
         <p>Please refer to the <a href="https://crowdsec.net/blog/category/tutorial/">tutorials</a> to explore
         the possibilities.</p>
@@ -148,16 +148,16 @@
         <p>
             It might be a good idea to have a secondary IP from which you can
             connect, should anything go wrong.
-	</p>
+        </p>
 
-	<pre><code>[root@OPNsense ~]# cscli decisions add -t ban -d 2m -i &lt;your_ip_address&gt;</code></pre>
+        <pre><code>[root@OPNsense ~]# cscli decisions add -t ban -d 2m -i &lt;your_ip_address&gt;</code></pre>
 
-	<p>
-	    This is a more secure way to test than attempting to brute-force
-	    yourself: the default ban period is 4 hours, and Crowdsec reads the
-	    logs from the beginning, so it could ban you even if you failed ssh
-	    login 10 times in 30 seconds two hours before installing it.
-	</p>
+        <p>
+            This is a more secure way to test than attempting to brute-force
+            yourself: the default ban period is 4 hours, and Crowdsec reads the
+            logs from the beginning, so it could ban you even if you failed ssh
+            login 10 times in 30 seconds two hours before installing it.
+        </p>
 
         <div>
             <a class="btn btn-default btn-info" href="https://github.com/crowdsecurity/crowdsec">

security/crowdsec/src/opnsense/mvc/app/views/OPNsense/CrowdSec/overview.volt

@@ -45,7 +45,6 @@ ul.nav>li>a {
     <li><a data-toggle="tab" id="postoverflows_tab" href="#postoverflows">Postoverflows</a></li>
     <li class="spaced"><a data-toggle="tab" id="alerts_tab" href="#alerts">Alerts</a></li>
     <li><a data-toggle="tab" id="decisions_tab" href="#decisions">Decisions</a></li>
-    <li class="pull-right"><a data-toggle="tab" id="debug_tab" href="#debug" style="display:none">Debug</a></li>
 </ul>
 
 <div class="tab-content content-box">
@@ -223,13 +222,8 @@ ul.nav>li>a {
         </table>
     </div>
 
-    <div id="debug" class="tab-pane fade in">
-        <pre>
-        </pre>
-    </div>
-
     <!-- Modal popup to confirm decision deletion -->
-    <div class="modal fade" id="delete-decision-modal" tabindex="-1" role="dialog" aria-labelledby="modalLabel" aria-hidden="true">
+    <div class="modal fade" id="remove-decision-modal" tabindex="-1" role="dialog" aria-labelledby="modalLabel" aria-hidden="true">
         <div class="modal-dialog" role="document">
             <div class="modal-content">
                 <div class="modal-header">
@@ -243,7 +237,7 @@ ul.nav>li>a {
                 </div>
                 <div class="modal-footer">
                     <button type="button" class="btn btn-secondary" data-dismiss="modal">No, cancel</button>
-                    <button type="button" class="btn btn-danger" data-dismiss="modal" id="delete-decision-confirm">Yes, delete</button>
+                    <button type="button" class="btn btn-danger" data-dismiss="modal" id="remove-decision-confirm">Yes, delete</button>
                 </div>
             </div>
         </div>

security/crowdsec/src/opnsense/scripts/OPNsense/CrowdSec/hub-upgrade.sh

@@ -2,9 +2,9 @@
 
 test -x /usr/local/bin/cscli || exit 0
 
-/usr/local/bin/cscli --error hub update
+/usr/local/bin/cscli --error -o human hub update >/dev/null
 
-upgraded=$(/usr/local/bin/cscli --error hub upgrade)
+upgraded=$(/usr/local/bin/cscli --error -o human hub upgrade)
 
 if [ ! -e "/usr/local/etc/crowdsec/collections/opnsense.yaml" ]; then
     /usr/local/bin/cscli --error collections install crowdsecurity/opnsense

security/crowdsec/src/opnsense/scripts/OPNsense/CrowdSec/reconfigure.py

@@ -2,33 +2,35 @@
 
 import logging
 import json
+import subprocess
 import urllib.parse
+from typing import cast, Any
 import yaml
 
 logging.basicConfig(level=logging.INFO)
 
 
-def load_config(filename):
+def load_config(filename: str) -> dict[str, Any]:
     with open(filename) as fin:
         return yaml.safe_load(fin)
 
 
 # only save if some value has changed
-def save_config(filename, new_config):
+def save_config(filename: str, new_config: dict[str, Any]):
     old_config = load_config(filename)
     if old_config != new_config:
         with open(filename, 'w') as fout:
             yaml.dump(new_config, fout)
 
 
-def get_netloc(settings):
+def get_netloc(settings: dict[str, str]):
     # defaults if config has not been saved yet
     listen_address = settings.get('lapi_listen_address', '127.0.0.1')
     listen_port = settings.get('lapi_listen_port', '8080')
     return '{}:{}'.format(listen_address, listen_port)
 
 
-def get_new_url(old_url, settings):
+def get_new_url(old_url: str, settings: dict[str, str]):
     old_tuple = urllib.parse.urlsplit(old_url)
     new_tuple = old_tuple._replace(netloc=get_netloc(settings))
     new_url = urllib.parse.urlunsplit(new_tuple)
@@ -39,7 +41,7 @@ def get_new_url(old_url, settings):
     return new_url
 
 
-def configure_agent(settings):
+def configure_agent(settings: dict[str, str]):
     config_path = '/usr/local/etc/crowdsec/config.yaml'
     config = load_config(config_path)
 
@@ -53,7 +55,7 @@ def configure_agent(settings):
     save_config(config_path, config)
 
 
-def configure_lapi(settings):
+def configure_lapi(settings: dict[str, str]):
     config_path = '/usr/local/etc/crowdsec/config.yaml'
     config = load_config(config_path)
 
@@ -63,7 +65,7 @@ def configure_lapi(settings):
     save_config(config_path, config)
 
 
-def configure_lapi_credentials(settings):
+def configure_lapi_credentials(settings: dict[str, str]):
     config_path = '/usr/local/etc/crowdsec/local_api_credentials.yaml'
     config = load_config(config_path)
 
@@ -73,13 +75,13 @@ def configure_lapi_credentials(settings):
     save_config(config_path, config)
 
 
-def configure_bouncer(settings):
+def configure_bouncer(settings: dict[str, str]):
     config_path = '/usr/local/etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml'
     config = load_config(config_path)
 
     config['log_dir'] = '/var/log/crowdsec'
-    config['blacklists_ipv4'] = 'crowdsec_blacklists'
-    config['blacklists_ipv6'] = 'crowdsec6_blacklists'
+    config['blacklists_ipv4'] = 'crowdsec_blocklists'
+    config['blacklists_ipv6'] = 'crowdsec6_blocklists'
     config['retry_initial_connect'] = True
     config['pf'] = {'anchor_name': ''}
 
@@ -89,10 +91,35 @@ def configure_bouncer(settings):
     save_config(config_path, config)
 
 
+def enroll(settings: dict[str, str]):
+    enroll_key = settings.get('enroll_key')
+    if enroll_key:
+        try:
+            p = subprocess.run(['cscli', 'capi', 'status'], check=True, text=True, stdout=subprocess.PIPE)
+            if "instance is enrolled" in p.stdout:
+                logging.info("crowdsec instance is already enrolled")
+                return
+        except subprocess.CalledProcessError:
+            return
+        except Exception as e:
+            logging.error("could not run command 'cscli' to perform enrollment: %s", e)
+
+        try:
+            logging.info("enrolling crowdsec instance, please accept the enrollment on https://app.crowdsec.net")
+            _ = subprocess.run(
+                    ['cscli', 'console', 'enroll', '-e', 'context', enroll_key],
+                    check=True, text=True)
+        except subprocess.CalledProcessError as e:
+            logging.error("enrollment failed: %s", e)
+            return
+        except Exception as e:
+            logging.error("could not run command 'cscli' to perform enrollment: %s", e)
+
+
 def main():
     try:
         with open('/usr/local/etc/crowdsec/opnsense/settings.json') as f:
-            settings = json.load(f)
+            settings = cast(dict[str, str], json.load(f))
     except FileNotFoundError:
         logging.info("settings.json not found, won't change crowdsec config")
         return
@@ -100,6 +127,7 @@ def main():
     configure_agent(settings)
     configure_lapi(settings)
     configure_lapi_credentials(settings)
+    enroll(settings)
     configure_bouncer(settings)