commit: abb0829a6cca560c1686ee864b9735a60c2c4b98 Author: Michael Orlitzky <mjo <AT> gentoo <DOT> org> AuthorDate: Tue Jan 4 15:18:46 2022 +0000 Commit: Michael Orlitzky <mjo <AT> gentoo <DOT> org> CommitDate: Tue Jan 4 16:08:31 2022 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=abb0829a
net-analyzer/fail2ban: new revision with improved openrc support. This -r3 adds a patch corresponding to, https://github.com/fail2ban/fail2ban/pull/2182 that (a) upstreams the OpenRC script and (b) adds some nice improvements to it. Done with sam's permission. Package-Manager: Portage-3.0.28, Repoman-3.0.3 Signed-off-by: Michael Orlitzky <mjo <AT> gentoo.org> net-analyzer/fail2ban/fail2ban-0.11.2-r3.ebuild | 134 +++++++++++ .../files/fail2ban-0.11.2-upstream-openrc.patch | 247 +++++++++++++++++++++ 2 files changed, 381 insertions(+) diff --git a/net-analyzer/fail2ban/fail2ban-0.11.2-r3.ebuild b/net-analyzer/fail2ban/fail2ban-0.11.2-r3.ebuild new file mode 100644 index 000000000000..1390bc1bdc39 --- /dev/null +++ b/net-analyzer/fail2ban/fail2ban-0.11.2-r3.ebuild @@ -0,0 +1,134 @@ +# Copyright 1999-2022 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=7 + +PYTHON_COMPAT=( python3_{8..10} ) +DISTUTILS_SINGLE_IMPL=1 + +inherit bash-completion-r1 distutils-r1 systemd tmpfiles + +DESCRIPTION="Scans log files and bans IPs that show malicious signs" +HOMEPAGE="https://www.fail2ban.org/"; +if [[ ${PV} == *9999 ]] ; then + EGIT_REPO_URI="https://github.com/${PN}/${PN}"; + inherit git-r3 +else + SRC_URI="https://github.com/${PN}/${PN}/archive/${PV}.tar.gz -> ${P}.tar.gz" + KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ppc ~ppc64 ~sparc ~x86" +fi + +LICENSE="GPL-2" +SLOT="0" +IUSE="selinux systemd" + +RDEPEND=" + virtual/logger + virtual/mta + selinux? ( sec-policy/selinux-fail2ban ) + systemd? ( + $(python_gen_cond_dep ' + || ( + dev-python/python-systemd[${PYTHON_USEDEP}] + sys-apps/systemd[python(-),${PYTHON_USEDEP}] + )' 'python*' ) + ) +" + +DOCS=( ChangeLog DEVELOP README.md THANKS TODO doc/run-rootless.txt ) + +PATCHES=( + "${FILESDIR}"/${P}-fix-tests-for-2021.patch + "${FILESDIR}"/${PN}-0.11.2-adjust-apache-logs-paths.patch + "${FILESDIR}"/${P}-fix-2to3-usage.patch + "${FILESDIR}"/${P}-fix-systemd-test.patch + "${FILESDIR}"/${P}-fix-py3.10-collections.patch + "${FILESDIR}"/${P}-upstream-openrc.patch +) + +python_prepare_all() { + distutils-r1_python_prepare_all + + # Replace /var/run with /run, but not in the top source directory + find . -mindepth 2 -type f -exec \ + sed -i -e 's|/var\(/run/fail2ban\)|\1|g' {} + || die +} + +python_compile() { + ./fail2ban-2to3 || die + distutils-r1_python_compile +} + +python_test() { + bin/fail2ban-testcases \ + --no-network \ + --no-gamin \ + --verbosity=4 || die "Tests failed with ${EPYTHON}" +} + +python_install_all() { + distutils-r1_python_install_all + + rm -rf "${ED}"/usr/share/doc/${PN} "${ED}"/run || die + + newconfd files/fail2ban-openrc.conf ${PN} + + # These two are placed in the ${BUILD_DIR} after being "built" + # in install_scripts(). + newinitd "${BUILD_DIR}/fail2ban-openrc.init" "${PN}" + systemd_dounit "${BUILD_DIR}/${PN}.service" + + dotmpfiles files/${PN}-tmpfiles.conf + + doman man/*.{1,5} + + # Use INSTALL_MASK if you do not want to touch /etc/logrotate.d. + # See http://thread.gmane.org/gmane.linux.gentoo.devel/35675 + insinto /etc/logrotate.d + newins files/${PN}-logrotate ${PN} + + keepdir /var/lib/${PN} + + newbashcomp files/bash-completion ${PN}-client + bashcomp_alias ${PN}-client ${PN}-server ${PN}-regex +} + +pkg_preinst() { + has_version "<${CATEGORY}/${PN}-0.7" + previous_less_than_0_7=$? +} + +pkg_postinst() { + tmpfiles_process ${PN}-tmpfiles.conf + + if [[ ${previous_less_than_0_7} = 0 ]] ; then + elog + elog "Configuration files are now in /etc/fail2ban/" + elog "You probably have to manually update your configuration" + elog "files before restarting Fail2Ban!" + elog + elog "Fail2Ban is not installed under /usr/lib anymore. The" + elog "new location is under /usr/share." + elog + elog "You are upgrading from version 0.6.x, please see:" + elog "http://www.fail2ban.org/wiki/index.php/HOWTO_Upgrade_from_0.6_to_0.8"; + fi + + if ! has_version dev-python/pyinotify && ! has_version app-admin/gamin ; then + elog "For most jail.conf configurations, it is recommended you install either" + elog "dev-python/pyinotify or app-admin/gamin (in order of preference)" + elog "to control how log file modifications are detected" + fi + + if ! has_version dev-lang/python[sqlite] ; then + elog "If you want to use ${PN}'s persistent database, then reinstall" + elog "dev-lang/python with USE=sqlite. If you do not use the" + elog "persistent database feature, then you should set" + elog "dbfile = :memory: in fail2ban.conf accordingly." + fi + + if has_version sys-apps/systemd[-python] ; then + elog "If you want to track logins through sys-apps/systemd's" + elog "journal backend, then reinstall sys-apps/systemd with USE=python" + fi +} diff --git a/net-analyzer/fail2ban/files/fail2ban-0.11.2-upstream-openrc.patch b/net-analyzer/fail2ban/files/fail2ban-0.11.2-upstream-openrc.patch new file mode 100644 index 000000000000..7483c5685156 --- /dev/null +++ b/net-analyzer/fail2ban/files/fail2ban-0.11.2-upstream-openrc.patch @@ -0,0 +1,247 @@ +https://github.com/fail2ban/fail2ban/pull/2182 + +diff --git a/MANIFEST b/MANIFEST +index 48c751a0..c2df1e51 100644 +--- a/MANIFEST ++++ b/MANIFEST +@@ -393,8 +393,8 @@ files/fail2ban.service.in + files/fail2ban-tmpfiles.conf + files/fail2ban.upstart + files/gen_badbots +-files/gentoo-confd +-files/gentoo-initd ++files/fail2ban-openrc.conf ++files/fail2ban-openrc.init.in + files/ipmasq-ZZZzzz_fail2ban.rul + files/logwatch/fail2ban + files/logwatch/fail2ban-0.8.log +diff --git a/files/fail2ban-openrc.conf b/files/fail2ban-openrc.conf +new file mode 100644 +index 00000000..9454ef68 +--- /dev/null ++++ b/files/fail2ban-openrc.conf +@@ -0,0 +1,2 @@ ++# For available options, plase run "fail2ban-server --help". ++#FAIL2BAN_OPTIONS="-x" +diff --git a/files/fail2ban-openrc.init.in b/files/fail2ban-openrc.init.in +new file mode 100755 +index 00000000..2c56ee3a +--- /dev/null ++++ b/files/fail2ban-openrc.init.in +@@ -0,0 +1,86 @@ ++#!/sbin/openrc-run ++# This file is part of Fail2Ban. ++# ++# Fail2Ban is free software; you can redistribute it and/or modify ++# it under the terms of the GNU General Public License as published by ++# the Free Software Foundation; either version 2 of the License, or ++# (at your option) any later version. ++# ++# Fail2Ban is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with Fail2Ban; if not, write to the Free Software ++# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. ++# ++# Author: Sireyessire, Cyril Jaquier ++# ++ ++description="Ban hosts that cause multiple authentication errors" ++description_reload="reload configuration without dropping bans" ++extra_started_commands="reload" ++ ++# Can't (and shouldn't) be changed by the end-user. ++# ++# Note that @BINDIR@ is already supplied by the build system. Some ++# day, it might be nice to have @RUNDIR@ supplied by the build system ++# as well, so that we don't have to hard-code /run here. ++FAIL2BAN_RUNDIR="/run/${RC_SVCNAME}" ++FAIL2BAN_SOCKET="${FAIL2BAN_RUNDIR}/${RC_SVCNAME}.sock" ++ ++# The fail2ban-client program is also capable of starting and stopping ++# the server, but things are simpler if we let start-stop-daemon do it. ++command="@BINDIR@/fail2ban-server" ++pidfile="${FAIL2BAN_RUNDIR}/${RC_SVCNAME}.pid" ++ ++# We force the pidfile/socket location in this service script because ++# we're taking responsibility for ensuring that their parent directory ++# exists and has the correct permissions (which we can't do if the ++# user is allowed to change them). ++command_args="${FAIL2BAN_OPTIONS} -p ${pidfile} -s ${FAIL2BAN_SOCKET}" ++retry="30" ++ ++depend() { ++ use logger ++ after iptables ++} ++ ++checkconfig() { ++ "${command}" ${command_args} --test ++} ++ ++start_pre() { ++ # If this isn't a restart, make sure that the user's config isn't ++ # busted before we try to start the daemon (this will produce ++ # better error messages than if we just try to start it blindly). ++ # ++ # If, on the other hand, this *is* a restart, then the stop_pre ++ # action will have ensured that the config is usable and we don't ++ # need to do that again. ++ if [ "${RC_CMD}" != "restart" ] ; then ++ checkconfig || return $? ++ fi ++ checkpath -d "${FAIL2BAN_RUNDIR}" ++} ++ ++stop_pre() { ++ # If this is a restart, check to make sure the user's config ++ # isn't busted before we stop the running daemon. ++ if [ "${RC_CMD}" = "restart" ] ; then ++ checkconfig || return $? ++ fi ++} ++ ++reload() { ++ # The fail2ban-client uses an undocumented protocol to tell ++ # the server to reload(), so we have to use it here rather ++ # than e.g. sending a signal to the server daemon. Note that ++ # the reload will fail (on the server side) if the new config ++ # is invalid; we therefore don't need to test it ourselves ++ # with checkconfig() before initiating the reload. ++ ebegin "Reloading ${RC_SVCNAME}" ++ "@BINDIR@/fail2ban-client" ${command_args} reload ++ eend $? "Failed to reload ${RC_SVCNAME}" ++} +diff --git a/files/gentoo-confd b/files/gentoo-confd +deleted file mode 100644 +index 00d19f8b..00000000 +--- a/files/gentoo-confd ++++ /dev/null +@@ -1,8 +0,0 @@ +-# Config file for /etc/init.d/fail2ban +-# +-# For information on options, see "/usr/bin/fail2ban-client -h". +- +-FAIL2BAN_OPTIONS="" +- +-# Force execution of the server even if the socket already exists: +-#FAIL2BAN_OPTIONS="-x" +diff --git a/files/gentoo-initd b/files/gentoo-initd +deleted file mode 100755 +index 0fb157cd..00000000 +--- a/files/gentoo-initd ++++ /dev/null +@@ -1,60 +0,0 @@ +-#!/sbin/openrc-run +-# This file is part of Fail2Ban. +-# +-# Fail2Ban is free software; you can redistribute it and/or modify +-# it under the terms of the GNU General Public License as published by +-# the Free Software Foundation; either version 2 of the License, or +-# (at your option) any later version. +-# +-# Fail2Ban is distributed in the hope that it will be useful, +-# but WITHOUT ANY WARRANTY; without even the implied warranty of +-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +-# GNU General Public License for more details. +-# +-# You should have received a copy of the GNU General Public License +-# along with Fail2Ban; if not, write to the Free Software +-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +-# +-# Author: Sireyessire, Cyril Jaquier +-# +- +-description="Daemon to ban hosts that cause multiple authentication errors" +-description_reload="reload configuration" +-description_showlog="show fail2ban logs" +-extra_started_commands="reload showlog" +- +-FAIL2BAN="/usr/bin/fail2ban-client ${FAIL2BAN_OPTIONS}" +- +-depend() { +- need net +- need logger +- after iptables +-} +- +-start() { +- ebegin "Starting fail2ban" +- mkdir -p /var/run/fail2ban || return 1 +- # remove stalled sock file after system crash +- # bug 347477 +- rm -f /var/run/fail2ban/fail2ban.sock || return 1 +- start-stop-daemon --start --pidfile /var/run/fail2ban/fail2ban.pid \ +- -- ${FAIL2BAN} start +- eend $? "Failed to start fail2ban" +-} +- +-stop() { +- ebegin "Stopping fail2ban" +- start-stop-daemon --stop --pidfile /var/run/fail2ban/fail2ban.pid --retry 30 \ +- -- ${FAIL2BAN} stop +- eend $? "Failed to stop fail2ban" +-} +- +-reload() { +- ebegin "Reloading fail2ban" +- ${FAIL2BAN} reload +- eend $? "Failed to reload fail2ban" +-} +- +-showlog(){ +- less /var/log/fail2ban.log +-} +diff --git a/setup.py b/setup.py +index 98413273..91f71cf2 100755 +--- a/setup.py ++++ b/setup.py +@@ -89,24 +89,27 @@ class install_scripts_f2b(install_scripts): + if install_dir.startswith(root): + install_dir = install_dir[len(root):] + except: # pragma: no cover +- print('WARNING: Cannot find root-base option, check the bin-path to fail2ban-scripts in "fail2ban.service".') +- print('Creating %s/fail2ban.service (from fail2ban.service.in): @BINDIR@ -> %s' % (buildroot, install_dir)) +- with open(os.path.join(source_dir, 'files/fail2ban.service.in'), 'r') as fn: +- lines = fn.readlines() +- fn = None +- if not dry_run: +- fn = open(os.path.join(buildroot, 'fail2ban.service'), 'w') +- try: +- for ln in lines: +- ln = re.sub(r'@BINDIR@', lambda v: install_dir, ln) +- if dry_run: +- sys.stdout.write(' | ' + ln) +- continue +- fn.write(ln) +- finally: +- if fn: fn.close() +- if dry_run: +- print(' `') ++ print('WARNING: Cannot find root-base option, check the bin-path to fail2ban-scripts in "fail2ban.service" and "fail2ban-openrc.init".') ++ ++ scripts = ['fail2ban.service', 'fail2ban-openrc.init'] ++ for script in scripts: ++ print('Creating %s/%s (from %s.in): @BINDIR@ -> %s' % (buildroot, script, script, install_dir)) ++ with open(os.path.join(source_dir, 'files/%s.in' % script), 'r') as fn: ++ lines = fn.readlines() ++ fn = None ++ if not dry_run: ++ fn = open(os.path.join(buildroot, script), 'w') ++ try: ++ for ln in lines: ++ ln = re.sub(r'@BINDIR@', lambda v: install_dir, ln) ++ if dry_run: ++ sys.stdout.write(' | ' + ln) ++ continue ++ fn.write(ln) ++ finally: ++ if fn: fn.close() ++ if dry_run: ++ print(' `') + + + # Wrapper to specify fail2ban own options:
