From da53031f7fe8f4fe26511164780819d9d0b52d69 Mon Sep 17 00:00:00 2001 From: mmetc <92726601+mmetc@users.noreply.github.com> Date: Fri, 3 May 2024 10:20:28 +0200 Subject: [PATCH] security/crowdsec 1.0.8 (#3959) --- security/crowdsec/Makefile | 2 +- security/crowdsec/pkg-descr | 8 +++++ .../crowdsec/src/etc/cron.d/oscrowdsec.cron | 2 +- .../CrowdSec/Api/CollectionsController.php | 33 ----------------- ...arsersController.php => HubController.php} | 10 +++--- .../CrowdSec/Api/PostoverflowsController.php | 33 ----------------- .../CrowdSec/Api/ScenariosController.php | 33 ----------------- .../OPNsense/CrowdSec/forms/general.xml | 6 ++-- .../app/models/OPNsense/CrowdSec/General.xml | 6 ++-- .../app/views/OPNsense/CrowdSec/general.volt | 6 ++-- .../app/views/OPNsense/CrowdSec/overview.volt | 35 ++++++++++--------- .../scripts/OPNsense/CrowdSec/hub-upgrade.sh | 10 +++--- .../scripts/OPNsense/CrowdSec/reconfigure.py | 1 + .../scripts/OPNsense/CrowdSec/reconfigure.sh | 1 - .../conf/actions.d/actions_crowdsec.conf | 35 ++++++------------- .../src/opnsense/www/js/CrowdSec/crowdsec.js | 24 +++++++------ 16 files changed, 73 insertions(+), 172 deletions(-) delete mode 100644 security/crowdsec/src/opnsense/mvc/app/controllers/OPNsense/CrowdSec/Api/CollectionsController.php rename security/crowdsec/src/opnsense/mvc/app/controllers/OPNsense/CrowdSec/Api/{ParsersController.php => HubController.php} (74%) delete mode 100644 security/crowdsec/src/opnsense/mvc/app/controllers/OPNsense/CrowdSec/Api/PostoverflowsController.php delete mode 100644 security/crowdsec/src/opnsense/mvc/app/controllers/OPNsense/CrowdSec/Api/ScenariosController.php diff --git a/security/crowdsec/Makefile b/security/crowdsec/Makefile index 621a91909..ebf2924bb 100644 --- a/security/crowdsec/Makefile +++ b/security/crowdsec/Makefile @@ -1,5 +1,5 @@ PLUGIN_NAME= crowdsec -PLUGIN_VERSION= 1.0.7 +PLUGIN_VERSION= 1.0.8 PLUGIN_DEPENDS= crowdsec PLUGIN_COMMENT= Lightweight and collaborative security engine PLUGIN_MAINTAINER= marco@crowdsec.net diff --git a/security/crowdsec/pkg-descr b/security/crowdsec/pkg-descr index 456dce455..ef22794a4 100644 --- a/security/crowdsec/pkg-descr +++ b/security/crowdsec/pkg-descr @@ -8,6 +8,14 @@ WWW: https://crowdsec.net/ Plugin Changelog ================ +1.0.8 + +* Enable use_wal, remove warning +* Randomize cron execution over 5 minutes +* Refactor javascript +* Fix initial service start with no pending hub updates (1.6.1) +* Add input validation for `rules_tag` to prevent invalid `pf` syntax. + 1.0.7 * Add option `retry_initial_connect` to bouncer configuration for more robust startup. The option was introduced in Crowdsec 1.5.4. diff --git a/security/crowdsec/src/etc/cron.d/oscrowdsec.cron b/security/crowdsec/src/etc/cron.d/oscrowdsec.cron index 635b78577..bff08edd3 100644 --- a/security/crowdsec/src/etc/cron.d/oscrowdsec.cron +++ b/security/crowdsec/src/etc/cron.d/oscrowdsec.cron @@ -6,4 +6,4 @@ SHELL=/bin/sh PATH=/etc:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin #minute hour mday month wday who command -0 1 * * * root (sleep $(jot -r 1 1 60); /usr/local/opnsense/scripts/OPNsense/CrowdSec/hub-upgrade.sh) +0 1 * * * root (sleep $(jot -r 1 1 300); /usr/local/opnsense/scripts/OPNsense/CrowdSec/hub-upgrade.sh) diff --git a/security/crowdsec/src/opnsense/mvc/app/controllers/OPNsense/CrowdSec/Api/CollectionsController.php b/security/crowdsec/src/opnsense/mvc/app/controllers/OPNsense/CrowdSec/Api/CollectionsController.php deleted file mode 100644 index 62c63afa6..000000000 --- a/security/crowdsec/src/opnsense/mvc/app/controllers/OPNsense/CrowdSec/Api/CollectionsController.php +++ /dev/null @@ -1,33 +0,0 @@ - - -namespace OPNsense\CrowdSec\Api; - -use OPNsense\Base\ApiControllerBase; -use OPNsense\CrowdSec\CrowdSec; -use OPNsense\Core\Backend; - -/** - * @package OPNsense\CrowdSec - */ -class CollectionsController extends ApiControllerBase -{ - /** - * retrieve list of collections - * @return array of collections - * @throws \OPNsense\Base\ModelException - * @throws \ReflectionException - */ - public function getAction() - { - $backend = new Backend(); - $bckresult = json_decode(trim($backend->configdRun("crowdsec collections-list")), true); - if ($bckresult !== null) { - // only return valid json type responses - return $bckresult; - } - return array("message" => "unable to list collections"); - } -} diff --git a/security/crowdsec/src/opnsense/mvc/app/controllers/OPNsense/CrowdSec/Api/ParsersController.php b/security/crowdsec/src/opnsense/mvc/app/controllers/OPNsense/CrowdSec/Api/HubController.php similarity index 74% rename from security/crowdsec/src/opnsense/mvc/app/controllers/OPNsense/CrowdSec/Api/ParsersController.php rename to security/crowdsec/src/opnsense/mvc/app/controllers/OPNsense/CrowdSec/Api/HubController.php index 6dfcfcdb8..a8114ff2c 100644 --- a/security/crowdsec/src/opnsense/mvc/app/controllers/OPNsense/CrowdSec/Api/ParsersController.php +++ b/security/crowdsec/src/opnsense/mvc/app/controllers/OPNsense/CrowdSec/Api/HubController.php @@ -12,22 +12,22 @@ use OPNsense\Core\Backend; /** * @package OPNsense\CrowdSec */ -class ParsersController extends ApiControllerBase +class HubController extends ApiControllerBase { /** - * retrieve list of registered parsers - * @return array of parsers + * retrieve the registered hub items + * @return dictionary of items, by type * @throws \OPNsense\Base\ModelException * @throws \ReflectionException */ public function getAction() { $backend = new Backend(); - $bckresult = json_decode(trim($backend->configdRun("crowdsec parsers-list")), true); + $bckresult = json_decode(trim($backend->configdRun("crowdsec hub-items")), true); if ($bckresult !== null) { // only return valid json type responses return $bckresult; } - return array("message" => "unable to list parsers"); + return array("message" => "unable to list hub items"); } } diff --git a/security/crowdsec/src/opnsense/mvc/app/controllers/OPNsense/CrowdSec/Api/PostoverflowsController.php b/security/crowdsec/src/opnsense/mvc/app/controllers/OPNsense/CrowdSec/Api/PostoverflowsController.php deleted file mode 100644 index a52fc928c..000000000 --- a/security/crowdsec/src/opnsense/mvc/app/controllers/OPNsense/CrowdSec/Api/PostoverflowsController.php +++ /dev/null @@ -1,33 +0,0 @@ - - -namespace OPNsense\CrowdSec\Api; - -use OPNsense\Base\ApiControllerBase; -use OPNsense\CrowdSec\CrowdSec; -use OPNsense\Core\Backend; - -/** - * @package OPNsense\CrowdSec - */ -class PostoverflowsController extends ApiControllerBase -{ - /** - * retrieve list of registered postoverflows - * @return array of postoverflows - * @throws \OPNsense\Base\ModelException - * @throws \ReflectionException - */ - public function getAction() - { - $backend = new Backend(); - $bckresult = json_decode(trim($backend->configdRun("crowdsec postoverflows-list")), true); - if ($bckresult !== null) { - // only return valid json type responses - return $bckresult; - } - return array("message" => "unable to list postoverflows"); - } -} diff --git a/security/crowdsec/src/opnsense/mvc/app/controllers/OPNsense/CrowdSec/Api/ScenariosController.php b/security/crowdsec/src/opnsense/mvc/app/controllers/OPNsense/CrowdSec/Api/ScenariosController.php deleted file mode 100644 index 5daa6b82b..000000000 --- a/security/crowdsec/src/opnsense/mvc/app/controllers/OPNsense/CrowdSec/Api/ScenariosController.php +++ /dev/null @@ -1,33 +0,0 @@ - - -namespace OPNsense\CrowdSec\Api; - -use OPNsense\Base\ApiControllerBase; -use OPNsense\CrowdSec\CrowdSec; -use OPNsense\Core\Backend; - -/** - * @package OPNsense\CrowdSec - */ -class ScenariosController extends ApiControllerBase -{ - /** - * retrieve list of registered scenarios - * @return array of scenarios - * @throws \OPNsense\Base\ModelException - * @throws \ReflectionException - */ - public function getAction() - { - $backend = new Backend(); - $bckresult = json_decode(trim($backend->configdRun("crowdsec scenarios-list")), true); - if ($bckresult !== null) { - // only return valid json type responses - return $bckresult; - } - return array("message" => "unable to list scenarios"); - } -} diff --git a/security/crowdsec/src/opnsense/mvc/app/controllers/OPNsense/CrowdSec/forms/general.xml b/security/crowdsec/src/opnsense/mvc/app/controllers/OPNsense/CrowdSec/forms/general.xml index f154c544a..45d9d3f24 100644 --- a/security/crowdsec/src/opnsense/mvc/app/controllers/OPNsense/CrowdSec/forms/general.xml +++ b/security/crowdsec/src/opnsense/mvc/app/controllers/OPNsense/CrowdSec/forms/general.xml @@ -3,7 +3,7 @@ general.agent_enabled - + checkbox Enable/disable the CrowdSec agent. Keep this enabled to detect attacks and receive alerts from the CrowSec central service. @@ -21,9 +21,9 @@ general.firewall_bouncer_enabled - + checkbox - Enable/disable the firewall bouncer. Keep this enabled to block + Enable/disable the remediation component. Keep this enabled to block packets from the attacking IP addresses. diff --git a/security/crowdsec/src/opnsense/mvc/app/models/OPNsense/CrowdSec/General.xml b/security/crowdsec/src/opnsense/mvc/app/models/OPNsense/CrowdSec/General.xml index 4349222b6..f332b3b64 100644 --- a/security/crowdsec/src/opnsense/mvc/app/models/OPNsense/CrowdSec/General.xml +++ b/security/crowdsec/src/opnsense/mvc/app/models/OPNsense/CrowdSec/General.xml @@ -1,7 +1,7 @@ //OPNsense/crowdsec/general CrowdSec general configuration - 1.0.6 + 1.0.8 @@ -43,8 +43,8 @@ - - N + /^([0-9a-zA-Z]{1,63})$/u + A tag must only contain numbers and letters and must be between 1 and 63 characters. diff --git a/security/crowdsec/src/opnsense/mvc/app/views/OPNsense/CrowdSec/general.volt b/security/crowdsec/src/opnsense/mvc/app/views/OPNsense/CrowdSec/general.volt index ed1b89b7d..c7ae96adf 100644 --- a/security/crowdsec/src/opnsense/mvc/app/views/OPNsense/CrowdSec/general.volt +++ b/security/crowdsec/src/opnsense/mvc/app/views/OPNsense/CrowdSec/general.volt @@ -71,7 +71,7 @@ the possibilities.

For the latest plugin documentation, including how to use it with an external LAPI, see Install + href="https://docs.crowdsec.net/u/getting_started/installation/opnsense">Install CrowdSec (OPNsense)

A few remarks:

@@ -79,7 +79,7 @@
  • New acquisition files go under /usr/local/etc/crowdsec/acquis.d. See opnsense.yaml for details. - The option poll_without_inotify: true is required if the acquitision targets are symlinks (which + The option poll_without_inotify: true is required if the log sources are symlinks (which is the case for most opnsense logs).
  • @@ -91,7 +91,7 @@ At the moment, the CrowdSec package for OPNsense is fully functional on the command line but its web interface is limited; you can only list the installed objects and revoke decisions. For anything else - you need the shell. + you need the shell or the CrowdSec Console.
  • Do not enable/start the agent and bouncer services with sysrc or /etc/rc.conf diff --git a/security/crowdsec/src/opnsense/mvc/app/views/OPNsense/CrowdSec/overview.volt b/security/crowdsec/src/opnsense/mvc/app/views/OPNsense/CrowdSec/overview.volt index 87987c30a..a51cbb5bf 100644 --- a/security/crowdsec/src/opnsense/mvc/app/views/OPNsense/CrowdSec/overview.volt +++ b/security/crowdsec/src/opnsense/mvc/app/views/OPNsense/CrowdSec/overview.volt @@ -54,7 +54,7 @@ ul.nav>li>a { - + @@ -74,7 +74,7 @@ ul.nav>li>a {
    NameName IP Address Last Update Validated?
    - + @@ -95,10 +95,11 @@ ul.nav>li>a {
    NameName IP Address Valid Last API Pull
    - + - + + @@ -114,10 +115,10 @@ ul.nav>li>a {
    NameCollection Status VersionLocal PathPathDescription
    - + - + @@ -134,10 +135,10 @@ ul.nav>li>a {
    NameScenario Status VersionPathPath Description
    - + - + @@ -154,10 +155,10 @@ ul.nav>li>a {
    NameParser Status VersionLocal PathPath Description
    - + - + @@ -174,7 +175,7 @@ ul.nav>li>a {
    NamePostoverflow Status VersionLocal PathPath Description
    - + @@ -198,17 +199,19 @@ ul.nav>li>a {
    IDID Value Reason Country
    - - - + + + - + - + diff --git a/security/crowdsec/src/opnsense/scripts/OPNsense/CrowdSec/hub-upgrade.sh b/security/crowdsec/src/opnsense/scripts/OPNsense/CrowdSec/hub-upgrade.sh index 4d2a56808..50b81c744 100755 --- a/security/crowdsec/src/opnsense/scripts/OPNsense/CrowdSec/hub-upgrade.sh +++ b/security/crowdsec/src/opnsense/scripts/OPNsense/CrowdSec/hub-upgrade.sh @@ -10,11 +10,11 @@ if [ ! -e "/usr/local/etc/crowdsec/collections/opnsense.yaml" ]; then /usr/local/bin/cscli --error collections install crowdsecurity/opnsense fi -if [ -n "$upgraded" ]; then - if service crowdsec enabled; then - if ! service crowdsec status >/dev/null 2>&1; then - service crowdsec start >/dev/null 2>&1 || : - else +if service crowdsec enabled; then + if ! service crowdsec status >/dev/null 2>&1; then + service crowdsec start >/dev/null 2>&1 || : + else + if [ -n "$upgraded" ]; then service crowdsec reload >/dev/null 2>&1 || : fi fi diff --git a/security/crowdsec/src/opnsense/scripts/OPNsense/CrowdSec/reconfigure.py b/security/crowdsec/src/opnsense/scripts/OPNsense/CrowdSec/reconfigure.py index 20c572439..84008d625 100755 --- a/security/crowdsec/src/opnsense/scripts/OPNsense/CrowdSec/reconfigure.py +++ b/security/crowdsec/src/opnsense/scripts/OPNsense/CrowdSec/reconfigure.py @@ -45,6 +45,7 @@ def configure_agent(settings): config['common']['log_dir'] = '/var/log/crowdsec' config['crowdsec_service']['acquisition_dir'] = '/usr/local/etc/crowdsec/acquis.d/' + config['db_config']['use_wal'] = True if not int(settings.get('lapi_manual_configuration', '0')): config['api']['server']['listen_uri'] = get_netloc(settings) diff --git a/security/crowdsec/src/opnsense/scripts/OPNsense/CrowdSec/reconfigure.sh b/security/crowdsec/src/opnsense/scripts/OPNsense/CrowdSec/reconfigure.sh index 1c339cc01..ce4660c50 100755 --- a/security/crowdsec/src/opnsense/scripts/OPNsense/CrowdSec/reconfigure.sh +++ b/security/crowdsec/src/opnsense/scripts/OPNsense/CrowdSec/reconfigure.sh @@ -10,7 +10,6 @@ set -e # apply configuration options specific to opnsense /usr/local/opnsense/scripts/OPNsense/CrowdSec/reconfigure.py -# enable pf anchor here - the tables and rules will be created by the bouncer /usr/local/sbin/configctl filter reload >/dev/null # the hub is upgraded by cron too diff --git a/security/crowdsec/src/opnsense/service/conf/actions.d/actions_crowdsec.conf b/security/crowdsec/src/opnsense/service/conf/actions.d/actions_crowdsec.conf index de9c3f6fd..371cf485d 100644 --- a/security/crowdsec/src/opnsense/service/conf/actions.d/actions_crowdsec.conf +++ b/security/crowdsec/src/opnsense/service/conf/actions.d/actions_crowdsec.conf @@ -19,7 +19,7 @@ message: oscrowdsec status [restart] command:/usr/local/etc/rc.d/oscrowdsec restart type: script -message: stopping crowdsec services +message: restarting crowdsec services [reload] command:/usr/local/etc/rc.d/oscrowdsec reload @@ -37,22 +37,17 @@ type:script_output message: request crowdsec_firewall status [alerts-list] -command:/usr/local/bin/cscli alerts list -l 0 -o json | sed 's/^null$/\[\]/' +command:/usr/local/bin/cscli alerts list -l 0 -o json type:script_output message:crowdsec alerts list [bouncers-list] -command:/usr/local/bin/cscli bouncers list -o json | sed 's/^null$/\[\]/' +command:/usr/local/bin/cscli bouncers list -o json type:script_output message:crowdsec bouncers list -[collections-list] -command:/usr/local/bin/cscli collections list -o json -type:script_output -message:crowdsec collections list - [decisions-list] -command:/usr/local/bin/cscli decisions list -l 0 -o json | sed 's/^null$/\[\]/' +command:/usr/local/bin/cscli decisions list -l 0 -o json type:script_output message:crowdsec decisions list @@ -62,26 +57,16 @@ parameters:--id %s type:script_output message:crowdsec decisions delete +[hub-items] +command:/usr/local/bin/cscli hub list -o json +type:script_output +message:crowdsec hub list + [machines-list] -command:/usr/local/bin/cscli machines list -o json | sed 's/^null$/\[\]/' +command:/usr/local/bin/cscli machines list -o json type:script_output message:crowdsec machines list -[parsers-list] -command:/usr/local/bin/cscli parsers list -o json -type:script_output -message:crowdsec parsers list - -[postoverflows-list] -command:/usr/local/bin/cscli postoverflows list -o json -type:script_output -message:crowdsec postoverflows list - -[scenarios-list] -command:/usr/local/bin/cscli scenarios list -o json -type:script_output -message:crowdsec scenarios list - [version] command:/usr/local/bin/cscli version 2>&1 type:script_output diff --git a/security/crowdsec/src/opnsense/www/js/CrowdSec/crowdsec.js b/security/crowdsec/src/opnsense/www/js/CrowdSec/crowdsec.js index 93b9ec767..09f16c12e 100644 --- a/security/crowdsec/src/opnsense/www/js/CrowdSec/crowdsec.js +++ b/security/crowdsec/src/opnsense/www/js/CrowdSec/crowdsec.js @@ -6,6 +6,7 @@ var CrowdSec = (function () { 'use strict'; + var crowdsec_path = '/usr/local/etc/crowdsec/'; var _refreshTemplate = ''; var _dataFormatters = { @@ -87,8 +88,9 @@ var CrowdSec = (function () { timestamp = $freshness.data('refresh_timestamp'); } var howlongHuman = '???'; + var howlongms; if (timestamp) { - var howlongms = moment() - moment(timestamp); + howlongms = moment() - moment(timestamp); howlongHuman = moment.duration(howlongms).humanize(); } $freshness.text(howlongHuman + ' ago'); @@ -129,7 +131,8 @@ var CrowdSec = (function () { dectypes[decision.type] = dectypes[decision.type] ? (dectypes[decision.type] + 1) : 1; }); var ret = ''; - for (var type in dectypes) { + var type; + for (type in dectypes) { if (ret !== '') { ret += ' '; } @@ -217,7 +220,7 @@ var CrowdSec = (function () { } function _initCollections () { - var url = '/api/crowdsec/collections/get'; + var url = '/api/crowdsec/hub/get'; var dataCallback = function (data) { var rows = []; data.collections.map(function (row) { @@ -225,7 +228,8 @@ var CrowdSec = (function () { name: row.name, status: row.status, local_version: row.local_version || ' ', - local_path: row.local_path || ' ' + local_path: row.local_path ? row.local_path.replace(crowdsec_path, '') : ' ', + description: row.description || ' ' }); }); $('#collections table').bootgrid('clear').bootgrid('append', rows); @@ -234,7 +238,7 @@ var CrowdSec = (function () { } function _initScenarios () { - var url = '/api/crowdsec/scenarios/get'; + var url = '/api/crowdsec/hub/get'; var dataCallback = function (data) { var rows = []; data.scenarios.map(function (row) { @@ -242,7 +246,7 @@ var CrowdSec = (function () { name: row.name, status: row.status, local_version: row.local_version || ' ', - local_path: row.local_path || ' ', + local_path: row.local_path ? row.local_path.replace(crowdsec_path, '') : ' ', description: row.description || ' ' }); }); @@ -252,7 +256,7 @@ var CrowdSec = (function () { } function _initParsers () { - var url = '/api/crowdsec/parsers/get'; + var url = '/api/crowdsec/hub/get'; var dataCallback = function (data) { var rows = []; data.parsers.map(function (row) { @@ -260,7 +264,7 @@ var CrowdSec = (function () { name: row.name, status: row.status, local_version: row.local_version || ' ', - local_path: row.local_path || ' ', + local_path: row.local_path ? row.local_path.replace(crowdsec_path, '') : ' ', description: row.description || ' ' }); }); @@ -270,7 +274,7 @@ var CrowdSec = (function () { } function _initPostoverflows () { - var url = '/api/crowdsec/postoverflows/get'; + var url = '/api/crowdsec/hub/get'; var dataCallback = function (data) { var rows = []; data.postoverflows.map(function (row) { @@ -278,7 +282,7 @@ var CrowdSec = (function () { name: row.name, status: row.status, local_version: row.local_version || ' ', - local_path: row.local_path || ' ', + local_path: row.local_path ? row.local_path.replace(crowdsec_path, '') : ' ', description: row.description || ' ' }); });
    IDSourceIDSource Scope:Value ReasonActionAction Country AS Events ExpirationAlert IDAlert ID