ripe-atlas: add new package

Replace atlas-probe and atlas-sw-probe with ripe-atlas, built from the
upstream ripe-atlas-software-probe release tarball (tag 5110) so future
bumps only touch PKG_VERSION and PKG_HASH. Provide atlas-probe and
atlas-sw-probe so existing installs and sysupgrade keep resolving across
the rename.

Run the probe as the ripe-atlas user instead of root, with ujail granting
the measurement applets CAP_NET_RAW from capabilities.json. Drop the unused
e2fsprogs dependency; keep OPENSSL_WITH_DEPRECATED, which upstream tcputil.c
still needs.

Signed-off-by: Tiago Gaspar <redacted>

diff --git a/net/ripe-atlas/Makefile b/net/ripe-atlas/Makefile
new file mode 100644 (file)
index 0000000..d426169
--- /dev/null
+++ b/net/ripe-atlas/Makefile
@@ -0,0 +1,209 @@
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=ripe-atlas
+PKG_VERSION:=5110
+PKG_RELEASE:=1
+
+PKG_SOURCE:=ripe-atlas-software-probe-$(PKG_VERSION).tar.gz
+PKG_SOURCE_URL:=https://codeload.github.com/RIPE-NCC/ripe-atlas-software-probe/tar.gz/refs/tags/$(PKG_VERSION)?
+PKG_HASH:=9ff4931056b7da67e13478c29dfaea0f647ee4cb725f864ba5fa28a33a8ec5c7
+PKG_BUILD_DIR:=$(BUILD_DIR)/ripe-atlas-software-probe-$(PKG_VERSION)
+
+PKG_MAINTAINER:=Tiago Gaspar <tiagogaspar8@gmail.com>, Michel Stam <mstam@ripe.net>
+PKG_LICENSE:=GPL-3.0-only
+PKG_LICENSE_FILES:=LICENSE
+
+PKG_FIXUP:=autoreconf
+PKG_INSTALL:=1
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/ripe-atlas/Default
+  SECTION:=net
+  CATEGORY:=Network
+  TITLE:=RIPE Atlas
+  URL:=https://atlas.ripe.net/
+endef
+
+define Package/ripe-atlas/Default/description
+  RIPE Atlas is the RIPE NCC's main Internet data
+  collection system. It is a global network of
+  devices, called probes and anchors, that
+  actively measure Internet connectivity. Anyone
+  can access this data via Internet traffic maps,
+  streaming data visualisations, and an API.
+  RIPE Atlas users can also perform customised
+  measurements to gain valuable data about their
+  own networks.
+endef
+
+# The measurement applets need raw sockets; ujail hands them CAP_NET_RAW from
+# capabilities.json, so the probe does not have to run as root.
+CONFIGURE_ARGS+= \
+       --with-probe-type=generic \
+       --with-user=ripe-atlas \
+       --with-group=ripe-atlas \
+       --with-measurement-user=ripe-atlas \
+       --disable-systemd \
+       --disable-setcap-install \
+       --disable-chown
+
+define Package/ripe-atlas-common
+  $(call Package/ripe-atlas/Default)
+  TITLE+=(common files)
+  USERID:=ripe-atlas=445:ripe-atlas=445
+  PROVIDES:=atlas-probe
+  DEPENDS:= \
+       +jsonfilter \
+       +openssh-client \
+       +openssh-keygen \
+       +libopenssl \
+       +@OPENSSL_WITH_DEPRECATED \
+       +@BUSYBOX_CONFIG_KILL \
+       +@BUSYBOX_CONFIG_KILLALL \
+       +@BUSYBOX_CONFIG_PS \
+       +@BUSYBOX_CONFIG_SED \
+       +@BUSYBOX_CONFIG_TAR \
+       +@BUSYBOX_CONFIG_NTPD \
+       +@BUSYBOX_CONFIG_BUNZIP2
+endef
+
+define Package/ripe-atlas-common/conffiles
+/etc/ripe-atlas/mode
+/etc/ripe-atlas/probe_key
+/etc/ripe-atlas/probe_key.pub
+/etc/config/ripe-atlas
+endef
+
+define Package/ripe-atlas-common/description
+  RIPE Atlas (common files)
+
+  $(call Package/ripe-atlas/Default/description)
+endef
+
+define LinkApplet
+       $(LN) busybox $(1)/usr/lib/ripe-atlas/measurement/$(2)
+endef
+
+define Package/ripe-atlas-common/install
+       $(INSTALL_DIR) $(1)/etc/init.d
+       $(INSTALL_BIN) ./files/ripe-atlas.init $(1)/etc/init.d/ripe-atlas
+
+       $(INSTALL_DIR) $(1)/etc/config
+       $(INSTALL_CONF) ./files/ripe-atlas.conf $(1)/etc/config/ripe-atlas
+
+       $(INSTALL_DIR) $(1)/etc/ripe-atlas
+
+       $(INSTALL_DIR) $(1)/usr/lib/ripe-atlas/measurement
+       $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/lib/ripe-atlas/measurement/busybox \
+                      $(1)/usr/lib/ripe-atlas/measurement/busybox
+       $(call LinkApplet,$(1),atlasinit)
+       $(call LinkApplet,$(1),buddyinfo)
+       $(call LinkApplet,$(1),condmv)
+       $(call LinkApplet,$(1),date)
+       $(call LinkApplet,$(1),dfrm)
+       $(call LinkApplet,$(1),eooqd)
+       $(call LinkApplet,$(1),eperd)
+       $(call LinkApplet,$(1),evhttpget)
+       $(call LinkApplet,$(1),evntp)
+       $(call LinkApplet,$(1),evping)
+       $(call LinkApplet,$(1),evsslgetcert)
+       $(call LinkApplet,$(1),evtdig)
+       $(call LinkApplet,$(1),evtraceroute)
+       $(call LinkApplet,$(1),httppost)
+       $(call LinkApplet,$(1),onlyuptime)
+       $(call LinkApplet,$(1),perd)
+       $(call LinkApplet,$(1),rchoose)
+       $(call LinkApplet,$(1),rptaddrs)
+       $(call LinkApplet,$(1),rptra6)
+       $(call LinkApplet,$(1),rptuptime)
+       $(call LinkApplet,$(1),rxtxrpt)
+       $(call LinkApplet,$(1),telnetd)
+
+       $(INSTALL_DIR) $(1)/usr/lib/ripe-atlas/scripts
+       $(INSTALL_BIN) -t $(1)/usr/lib/ripe-atlas/scripts \
+               $(PKG_INSTALL_DIR)/usr/lib/ripe-atlas/scripts/array.lib.sh \
+               $(PKG_INSTALL_DIR)/usr/lib/ripe-atlas/scripts/atlas_log.lib.sh \
+               $(PKG_INSTALL_DIR)/usr/lib/ripe-atlas/scripts/class.lib.sh \
+               $(PKG_INSTALL_DIR)/usr/lib/ripe-atlas/scripts/common-pre.sh \
+               $(PKG_INSTALL_DIR)/usr/lib/ripe-atlas/scripts/common.sh \
+               $(PKG_INSTALL_DIR)/usr/lib/ripe-atlas/scripts/config.sh \
+               $(PKG_INSTALL_DIR)/usr/lib/ripe-atlas/scripts/generic-ATLAS.sh \
+               $(PKG_INSTALL_DIR)/usr/lib/ripe-atlas/scripts/generic-common.sh \
+               $(PKG_INSTALL_DIR)/usr/lib/ripe-atlas/scripts/generic-reginit.sh \
+               $(PKG_INSTALL_DIR)/usr/lib/ripe-atlas/scripts/json.lib.sh \
+               $(PKG_INSTALL_DIR)/usr/lib/ripe-atlas/scripts/linux-functions.sh \
+               $(PKG_INSTALL_DIR)/usr/lib/ripe-atlas/scripts/paths.lib.sh \
+               $(PKG_INSTALL_DIR)/usr/lib/ripe-atlas/scripts/reg_servers.sh.dev \
+               $(PKG_INSTALL_DIR)/usr/lib/ripe-atlas/scripts/reg_servers.sh.test \
+               $(PKG_INSTALL_DIR)/usr/lib/ripe-atlas/scripts/reginit.sh \
+               $(PKG_INSTALL_DIR)/usr/lib/ripe-atlas/scripts/resolvconf \
+               $(PKG_INSTALL_DIR)/usr/lib/ripe-atlas/scripts/support.lib.sh
+
+       $(INSTALL_DIR) $(1)/usr/share/ripe-atlas
+       $(INSTALL_DATA) ./files/capabilities.json $(1)/usr/share/ripe-atlas/capabilities.json
+       $(INSTALL_DATA) -t $(1)/usr/share/ripe-atlas \
+               $(PKG_INSTALL_DIR)/usr/share/ripe-atlas/FIRMWARE_APPS_VERSION
+       $(INSTALL_CONF) -t $(1)/usr/share/ripe-atlas \
+               $(PKG_INSTALL_DIR)/usr/share/ripe-atlas/measurement.conf
+
+       $(INSTALL_DIR) $(1)/usr/sbin
+       $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/ripe-atlas $(1)/usr/sbin/ripe-atlas
+endef
+
+define Package/ripe-atlas-probe
+  $(call Package/ripe-atlas/Default)
+  TITLE+=(Software Probe)
+  DEPENDS+=+ripe-atlas-common
+  PROVIDES:=atlas-sw-probe
+  VARIANT:=probe
+  CONFLICTS+=ripe-atlas-anchor
+endef
+
+define Package/ripe-atlas-probe/description
+  RIPE Atlas (Software Probe)
+
+  $(call Package/ripe-atlas/Default/description)
+endef
+
+define Package/ripe-atlas-probe/install
+       $(INSTALL_DIR) $(1)/usr/lib/ripe-atlas/scripts
+       $(INSTALL_BIN) $(PKG_BUILD_DIR)/config/probe/reg_servers.sh.prod \
+               $(1)/usr/lib/ripe-atlas/scripts
+
+       $(INSTALL_DIR) $(1)/usr/share/ripe-atlas
+       $(INSTALL_DATA) $(PKG_BUILD_DIR)/config/probe/known_hosts.reg \
+               $(1)/usr/share/ripe-atlas
+endef
+
+define Package/ripe-atlas-anchor
+  $(call Package/ripe-atlas/Default)
+  TITLE+=(Anchor)
+  DEPENDS+=+ripe-atlas-common
+  VARIANT:=anchor
+endef
+
+define Package/ripe-atlas-anchor/description
+  RIPE Atlas (Anchor)
+
+  $(call Package/ripe-atlas/Default/description)
+endef
+
+define Package/ripe-atlas-anchor/install
+       $(INSTALL_DIR) $(1)/usr/lib/ripe-atlas/scripts
+       $(INSTALL_BIN) $(PKG_BUILD_DIR)/config/anchor/reg_servers.sh.prod \
+               $(1)/usr/lib/ripe-atlas/scripts
+
+       $(INSTALL_DIR) $(1)/usr/share/ripe-atlas
+       $(INSTALL_DATA) $(PKG_BUILD_DIR)/config/anchor/known_hosts.reg \
+               $(1)/usr/share/ripe-atlas
+endef
+
+$(eval $(call BuildPackage,ripe-atlas-common))
+$(eval $(call BuildPackage,ripe-atlas-anchor))
+$(eval $(call BuildPackage,ripe-atlas-probe))

diff --git a/net/ripe-atlas/files/capabilities.json b/net/ripe-atlas/files/capabilities.json
new file mode 100644 (file)
index 0000000..ab56e43
--- /dev/null
+++ b/net/ripe-atlas/files/capabilities.json
@@ -0,0 +1,17 @@
+{
+       "bounding": [
+               "CAP_NET_RAW", "CAP_SETUID"
+       ],
+       "effective": [
+               "CAP_NET_RAW", "CAP_SETUID"
+       ],
+       "ambient": [
+               "CAP_NET_RAW", "CAP_SETUID"
+       ],
+       "permitted": [
+               "CAP_NET_RAW", "CAP_SETUID"
+       ],
+       "inheritable": [
+               "CAP_NET_RAW", "CAP_SETUID"
+       ]
+}

diff --git a/net/ripe-atlas/files/ripe-atlas.conf b/net/ripe-atlas/files/ripe-atlas.conf
new file mode 100644 (file)
index 0000000..021705c
--- /dev/null
+++ b/net/ripe-atlas/files/ripe-atlas.conf
@@ -0,0 +1,6 @@
+config ripe-atlas
+       option enabled '1'
+       option mode 'prod'
+       option log_stdout '0'
+       option log_stderr '0'
+       option rxtx_report '0'

diff --git a/net/ripe-atlas/files/ripe-atlas.init b/net/ripe-atlas/files/ripe-atlas.init
new file mode 100644 (file)
index 0000000..25512fa
--- /dev/null
+++ b/net/ripe-atlas/files/ripe-atlas.init
@@ -0,0 +1,148 @@
+#!/bin/sh /etc/rc.common
+START=60
+STOP=01
+USE_PROCD=1
+MAINU=ripe-atlas
+MEASU=ripe-atlas
+GROUP=ripe-atlas
+
+validate_config()
+{
+       uci_load_validate 'ripe-atlas' 'ripe-atlas' "${1}" "${2}" \
+               'enabled:uinteger:1' \
+               'log_stderr:uinteger:0' \
+               'log_stdout:uinteger:0' \
+               'mode:string:prod' \
+               'rxtx_report:uinteger:0'
+}
+
+create_dir()
+{
+       local user
+       local group
+       local mode
+       local dir
+
+       user="${1}"
+       shift
+       group="${1}"
+       shift
+       mode="${1}"
+       shift
+
+       while [ -n "${1}" ]; do
+               dir="${1}"
+               mkdir -p "${dir}"
+               chown ${user}:${group} "${dir}"
+               chmod ${mode} "${dir}"
+               shift
+       done
+}
+
+setup_environment()
+{
+       create_dir ${MEASU} ${GROUP} 0775 \
+               /var/run/ripe-atlas/pids \
+               /var/run/ripe-atlas/status
+       create_dir ${MEASU} ${GROUP} 2775 \
+               /var/spool/ripe-atlas/crons \
+               /var/spool/ripe-atlas/crons/main \
+               /var/spool/ripe-atlas/crons/2 \
+               /var/spool/ripe-atlas/crons/3 \
+               /var/spool/ripe-atlas/crons/4 \
+               /var/spool/ripe-atlas/crons/5 \
+               /var/spool/ripe-atlas/crons/6 \
+               /var/spool/ripe-atlas/crons/7 \
+               /var/spool/ripe-atlas/crons/8 \
+               /var/spool/ripe-atlas/crons/9 \
+               /var/spool/ripe-atlas/crons/10 \
+               /var/spool/ripe-atlas/crons/11 \
+               /var/spool/ripe-atlas/crons/12 \
+               /var/spool/ripe-atlas/crons/13 \
+               /var/spool/ripe-atlas/crons/14 \
+               /var/spool/ripe-atlas/crons/15 \
+               /var/spool/ripe-atlas/crons/16 \
+               /var/spool/ripe-atlas/crons/17 \
+               /var/spool/ripe-atlas/crons/18 \
+               /var/spool/ripe-atlas/crons/19 \
+               /var/spool/ripe-atlas/crons/20 \
+               /var/spool/ripe-atlas/data \
+               /var/spool/ripe-atlas/data/new \
+               /var/spool/ripe-atlas/data/oneoff \
+               /var/spool/ripe-atlas/data/out \
+               /var/spool/ripe-atlas/data/out/ooq \
+               /var/spool/ripe-atlas/data/out/ooq10
+}
+
+start_instance()
+{
+       local cfg=/etc/ripe-atlas/config.txt
+       local mod=/etc/ripe-atlas/mode
+
+       if [ ${2} -ne 0 ]; then
+               echo 'validation failed'
+               return 1
+       fi
+
+       if [ ${enabled} -eq 0 ]; then
+               return 1
+       fi
+
+       rm -f /etc/ripe-atlas/reg_servers.sh
+       case "${mode}" in
+               test|dev|prod)
+                       ;;
+               *)
+                       return 1
+                       ;;
+       esac
+
+       echo 'Starting RIPE Atlas'
+       setup_environment
+       : > "${cfg}"
+
+       if [ ${rxtx_report} -ne 0 ]; then
+               echo 'RXTXRPT=yes' >> "${cfg}"
+       fi
+       echo "${mode}" > "${mod}"
+
+       procd_open_instance
+       procd_set_param command /usr/sbin/ripe-atlas
+       procd_set_param user ${MAINU}
+       procd_set_param group ${GROUP}
+       procd_set_param stdout ${log_stdout}
+       procd_set_param stderr ${log_stderr}
+       procd_set_param respawn
+       if [ -x /sbin/ujail ]; then
+               procd_add_jail ripe-atlas
+               procd_append_param capabilities /usr/share/ripe-atlas/capabilities.json
+       fi
+       procd_close_instance
+
+       return 0
+}
+
+start_service()
+{
+       config_load 'ripe-atlas'
+       config_foreach validate_config 'ripe-atlas' start_instance
+}
+
+stop_service()
+{
+       local pids
+       local pid
+
+       for pid in $(find /proc -type d -maxdepth 1 -group ${GROUP} -print); do
+               pids="${pid##*/} ${pids}"
+       done
+
+       if [ -n "${pids}" ]; then
+               kill ${pids} 1>/dev/null 2>&1
+       fi
+}
+
+service_triggers()
+{
+       procd_add_validation validate_config
+}

diff --git a/net/ripe-atlas/patches/001-uname.patch b/net/ripe-atlas/patches/001-uname.patch
new file mode 100644 (file)
index 0000000..ca1d9eb
--- /dev/null
+++ b/net/ripe-atlas/patches/001-uname.patch
@@ -0,0 +1,30 @@
+From 64a088ae6c2752888966167508e1318bed047f03 Mon Sep 17 00:00:00 2001
+From: ttaiclet <ttaiclet@ripe.net>
+Date: Wed, 16 Apr 2025 18:09:56 +0200
+Subject: [PATCH] changed: uname instead of hostname for generic ssh-key
+ creation
+
+hostname is a call to uname() in most implementations, but requires
+an additional binary to be shipped. By using uname directly, no
+additional binary has to be shipped.
+
+See 'uname' in the following links:
+- https://linux.die.net/man/2/gethostname
+- https://pubs.opengroup.org/onlinepubs/7908799/xsh/sysutsname.h.html
+
+Reviewed-by: Marios Mavropoulos <mmavropoulos@ripe.net>
+---
+ bin/arch/generic/generic-ATLAS.sh.in | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/bin/arch/generic/generic-ATLAS.sh.in
++++ b/bin/arch/generic/generic-ATLAS.sh.in
+@@ -49,7 +49,7 @@ get_ether_addr
+ 
+ # Create ssh keys if they are not there yet.
+ if [ ! -f $ATLAS_SYSCONFDIR/probe_key ]; then
+-    name=$(hostname -s)
++    name=$(uname -n)
+     ssh-keygen -t rsa -P '' -C $name -f $ATLAS_SYSCONFDIR/probe_key
+     chown -R @ripe_atlas_user@:@ripe_atlas_group@ $ATLAS_SYSCONFDIR
+ fi