From: Tiago Gaspar Date: Mon, 16 Jun 2025 16:02:14 +0000 (+0100) Subject: ripe-atlas: add new package X-Git-Url: http://git.99rst.org/?a=commitdiff_plain;h=b77264c9226cd8fbe8a5b2ef512283484ce97087;p=openwrt-packages.git ripe-atlas: add new package Replace atlas-probe and atlas-sw-probe with ripe-atlas, built from the upstream ripe-atlas-software-probe release tarball (tag 5110) so future bumps only touch PKG_VERSION and PKG_HASH. Provide atlas-probe and atlas-sw-probe so existing installs and sysupgrade keep resolving across the rename. Run the probe as the ripe-atlas user instead of root, with ujail granting the measurement applets CAP_NET_RAW from capabilities.json. Drop the unused e2fsprogs dependency; keep OPENSSL_WITH_DEPRECATED, which upstream tcputil.c still needs. Signed-off-by: Tiago Gaspar --- diff --git a/net/ripe-atlas/Makefile b/net/ripe-atlas/Makefile new file mode 100644 index 000000000..d42616986 --- /dev/null +++ b/net/ripe-atlas/Makefile @@ -0,0 +1,209 @@ +# +# This is free software, licensed under the GNU General Public License v2. +# See /LICENSE for more information. +# + +include $(TOPDIR)/rules.mk + +PKG_NAME:=ripe-atlas +PKG_VERSION:=5110 +PKG_RELEASE:=1 + +PKG_SOURCE:=ripe-atlas-software-probe-$(PKG_VERSION).tar.gz +PKG_SOURCE_URL:=https://codeload.github.com/RIPE-NCC/ripe-atlas-software-probe/tar.gz/refs/tags/$(PKG_VERSION)? +PKG_HASH:=9ff4931056b7da67e13478c29dfaea0f647ee4cb725f864ba5fa28a33a8ec5c7 +PKG_BUILD_DIR:=$(BUILD_DIR)/ripe-atlas-software-probe-$(PKG_VERSION) + +PKG_MAINTAINER:=Tiago Gaspar , Michel Stam +PKG_LICENSE:=GPL-3.0-only +PKG_LICENSE_FILES:=LICENSE + +PKG_FIXUP:=autoreconf +PKG_INSTALL:=1 + +include $(INCLUDE_DIR)/package.mk + +define Package/ripe-atlas/Default + SECTION:=net + CATEGORY:=Network + TITLE:=RIPE Atlas + URL:=https://atlas.ripe.net/ +endef + +define Package/ripe-atlas/Default/description + RIPE Atlas is the RIPE NCC's main Internet data + collection system. It is a global network of + devices, called probes and anchors, that + actively measure Internet connectivity. Anyone + can access this data via Internet traffic maps, + streaming data visualisations, and an API. + RIPE Atlas users can also perform customised + measurements to gain valuable data about their + own networks. +endef + +# The measurement applets need raw sockets; ujail hands them CAP_NET_RAW from +# capabilities.json, so the probe does not have to run as root. +CONFIGURE_ARGS+= \ + --with-probe-type=generic \ + --with-user=ripe-atlas \ + --with-group=ripe-atlas \ + --with-measurement-user=ripe-atlas \ + --disable-systemd \ + --disable-setcap-install \ + --disable-chown + +define Package/ripe-atlas-common + $(call Package/ripe-atlas/Default) + TITLE+=(common files) + USERID:=ripe-atlas=445:ripe-atlas=445 + PROVIDES:=atlas-probe + DEPENDS:= \ + +jsonfilter \ + +openssh-client \ + +openssh-keygen \ + +libopenssl \ + +@OPENSSL_WITH_DEPRECATED \ + +@BUSYBOX_CONFIG_KILL \ + +@BUSYBOX_CONFIG_KILLALL \ + +@BUSYBOX_CONFIG_PS \ + +@BUSYBOX_CONFIG_SED \ + +@BUSYBOX_CONFIG_TAR \ + +@BUSYBOX_CONFIG_NTPD \ + +@BUSYBOX_CONFIG_BUNZIP2 +endef + +define Package/ripe-atlas-common/conffiles +/etc/ripe-atlas/mode +/etc/ripe-atlas/probe_key +/etc/ripe-atlas/probe_key.pub +/etc/config/ripe-atlas +endef + +define Package/ripe-atlas-common/description + RIPE Atlas (common files) + + $(call Package/ripe-atlas/Default/description) +endef + +define LinkApplet + $(LN) busybox $(1)/usr/lib/ripe-atlas/measurement/$(2) +endef + +define Package/ripe-atlas-common/install + $(INSTALL_DIR) $(1)/etc/init.d + $(INSTALL_BIN) ./files/ripe-atlas.init $(1)/etc/init.d/ripe-atlas + + $(INSTALL_DIR) $(1)/etc/config + $(INSTALL_CONF) ./files/ripe-atlas.conf $(1)/etc/config/ripe-atlas + + $(INSTALL_DIR) $(1)/etc/ripe-atlas + + $(INSTALL_DIR) $(1)/usr/lib/ripe-atlas/measurement + $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/lib/ripe-atlas/measurement/busybox \ + $(1)/usr/lib/ripe-atlas/measurement/busybox + $(call LinkApplet,$(1),atlasinit) + $(call LinkApplet,$(1),buddyinfo) + $(call LinkApplet,$(1),condmv) + $(call LinkApplet,$(1),date) + $(call LinkApplet,$(1),dfrm) + $(call LinkApplet,$(1),eooqd) + $(call LinkApplet,$(1),eperd) + $(call LinkApplet,$(1),evhttpget) + $(call LinkApplet,$(1),evntp) + $(call LinkApplet,$(1),evping) + $(call LinkApplet,$(1),evsslgetcert) + $(call LinkApplet,$(1),evtdig) + $(call LinkApplet,$(1),evtraceroute) + $(call LinkApplet,$(1),httppost) + $(call LinkApplet,$(1),onlyuptime) + $(call LinkApplet,$(1),perd) + $(call LinkApplet,$(1),rchoose) + $(call LinkApplet,$(1),rptaddrs) + $(call LinkApplet,$(1),rptra6) + $(call LinkApplet,$(1),rptuptime) + $(call LinkApplet,$(1),rxtxrpt) + $(call LinkApplet,$(1),telnetd) + + $(INSTALL_DIR) $(1)/usr/lib/ripe-atlas/scripts + $(INSTALL_BIN) -t $(1)/usr/lib/ripe-atlas/scripts \ + $(PKG_INSTALL_DIR)/usr/lib/ripe-atlas/scripts/array.lib.sh \ + $(PKG_INSTALL_DIR)/usr/lib/ripe-atlas/scripts/atlas_log.lib.sh \ + $(PKG_INSTALL_DIR)/usr/lib/ripe-atlas/scripts/class.lib.sh \ + $(PKG_INSTALL_DIR)/usr/lib/ripe-atlas/scripts/common-pre.sh \ + $(PKG_INSTALL_DIR)/usr/lib/ripe-atlas/scripts/common.sh \ + $(PKG_INSTALL_DIR)/usr/lib/ripe-atlas/scripts/config.sh \ + $(PKG_INSTALL_DIR)/usr/lib/ripe-atlas/scripts/generic-ATLAS.sh \ + $(PKG_INSTALL_DIR)/usr/lib/ripe-atlas/scripts/generic-common.sh \ + $(PKG_INSTALL_DIR)/usr/lib/ripe-atlas/scripts/generic-reginit.sh \ + $(PKG_INSTALL_DIR)/usr/lib/ripe-atlas/scripts/json.lib.sh \ + $(PKG_INSTALL_DIR)/usr/lib/ripe-atlas/scripts/linux-functions.sh \ + $(PKG_INSTALL_DIR)/usr/lib/ripe-atlas/scripts/paths.lib.sh \ + $(PKG_INSTALL_DIR)/usr/lib/ripe-atlas/scripts/reg_servers.sh.dev \ + $(PKG_INSTALL_DIR)/usr/lib/ripe-atlas/scripts/reg_servers.sh.test \ + $(PKG_INSTALL_DIR)/usr/lib/ripe-atlas/scripts/reginit.sh \ + $(PKG_INSTALL_DIR)/usr/lib/ripe-atlas/scripts/resolvconf \ + $(PKG_INSTALL_DIR)/usr/lib/ripe-atlas/scripts/support.lib.sh + + $(INSTALL_DIR) $(1)/usr/share/ripe-atlas + $(INSTALL_DATA) ./files/capabilities.json $(1)/usr/share/ripe-atlas/capabilities.json + $(INSTALL_DATA) -t $(1)/usr/share/ripe-atlas \ + $(PKG_INSTALL_DIR)/usr/share/ripe-atlas/FIRMWARE_APPS_VERSION + $(INSTALL_CONF) -t $(1)/usr/share/ripe-atlas \ + $(PKG_INSTALL_DIR)/usr/share/ripe-atlas/measurement.conf + + $(INSTALL_DIR) $(1)/usr/sbin + $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/ripe-atlas $(1)/usr/sbin/ripe-atlas +endef + +define Package/ripe-atlas-probe + $(call Package/ripe-atlas/Default) + TITLE+=(Software Probe) + DEPENDS+=+ripe-atlas-common + PROVIDES:=atlas-sw-probe + VARIANT:=probe + CONFLICTS+=ripe-atlas-anchor +endef + +define Package/ripe-atlas-probe/description + RIPE Atlas (Software Probe) + + $(call Package/ripe-atlas/Default/description) +endef + +define Package/ripe-atlas-probe/install + $(INSTALL_DIR) $(1)/usr/lib/ripe-atlas/scripts + $(INSTALL_BIN) $(PKG_BUILD_DIR)/config/probe/reg_servers.sh.prod \ + $(1)/usr/lib/ripe-atlas/scripts + + $(INSTALL_DIR) $(1)/usr/share/ripe-atlas + $(INSTALL_DATA) $(PKG_BUILD_DIR)/config/probe/known_hosts.reg \ + $(1)/usr/share/ripe-atlas +endef + +define Package/ripe-atlas-anchor + $(call Package/ripe-atlas/Default) + TITLE+=(Anchor) + DEPENDS+=+ripe-atlas-common + VARIANT:=anchor +endef + +define Package/ripe-atlas-anchor/description + RIPE Atlas (Anchor) + + $(call Package/ripe-atlas/Default/description) +endef + +define Package/ripe-atlas-anchor/install + $(INSTALL_DIR) $(1)/usr/lib/ripe-atlas/scripts + $(INSTALL_BIN) $(PKG_BUILD_DIR)/config/anchor/reg_servers.sh.prod \ + $(1)/usr/lib/ripe-atlas/scripts + + $(INSTALL_DIR) $(1)/usr/share/ripe-atlas + $(INSTALL_DATA) $(PKG_BUILD_DIR)/config/anchor/known_hosts.reg \ + $(1)/usr/share/ripe-atlas +endef + +$(eval $(call BuildPackage,ripe-atlas-common)) +$(eval $(call BuildPackage,ripe-atlas-anchor)) +$(eval $(call BuildPackage,ripe-atlas-probe)) diff --git a/net/ripe-atlas/files/capabilities.json b/net/ripe-atlas/files/capabilities.json new file mode 100644 index 000000000..ab56e4329 --- /dev/null +++ b/net/ripe-atlas/files/capabilities.json @@ -0,0 +1,17 @@ +{ + "bounding": [ + "CAP_NET_RAW", "CAP_SETUID" + ], + "effective": [ + "CAP_NET_RAW", "CAP_SETUID" + ], + "ambient": [ + "CAP_NET_RAW", "CAP_SETUID" + ], + "permitted": [ + "CAP_NET_RAW", "CAP_SETUID" + ], + "inheritable": [ + "CAP_NET_RAW", "CAP_SETUID" + ] +} diff --git a/net/ripe-atlas/files/ripe-atlas.conf b/net/ripe-atlas/files/ripe-atlas.conf new file mode 100644 index 000000000..021705c39 --- /dev/null +++ b/net/ripe-atlas/files/ripe-atlas.conf @@ -0,0 +1,6 @@ +config ripe-atlas + option enabled '1' + option mode 'prod' + option log_stdout '0' + option log_stderr '0' + option rxtx_report '0' diff --git a/net/ripe-atlas/files/ripe-atlas.init b/net/ripe-atlas/files/ripe-atlas.init new file mode 100644 index 000000000..25512fa72 --- /dev/null +++ b/net/ripe-atlas/files/ripe-atlas.init @@ -0,0 +1,148 @@ +#!/bin/sh /etc/rc.common +START=60 +STOP=01 +USE_PROCD=1 +MAINU=ripe-atlas +MEASU=ripe-atlas +GROUP=ripe-atlas + +validate_config() +{ + uci_load_validate 'ripe-atlas' 'ripe-atlas' "${1}" "${2}" \ + 'enabled:uinteger:1' \ + 'log_stderr:uinteger:0' \ + 'log_stdout:uinteger:0' \ + 'mode:string:prod' \ + 'rxtx_report:uinteger:0' +} + +create_dir() +{ + local user + local group + local mode + local dir + + user="${1}" + shift + group="${1}" + shift + mode="${1}" + shift + + while [ -n "${1}" ]; do + dir="${1}" + mkdir -p "${dir}" + chown ${user}:${group} "${dir}" + chmod ${mode} "${dir}" + shift + done +} + +setup_environment() +{ + create_dir ${MEASU} ${GROUP} 0775 \ + /var/run/ripe-atlas/pids \ + /var/run/ripe-atlas/status + create_dir ${MEASU} ${GROUP} 2775 \ + /var/spool/ripe-atlas/crons \ + /var/spool/ripe-atlas/crons/main \ + /var/spool/ripe-atlas/crons/2 \ + /var/spool/ripe-atlas/crons/3 \ + /var/spool/ripe-atlas/crons/4 \ + /var/spool/ripe-atlas/crons/5 \ + /var/spool/ripe-atlas/crons/6 \ + /var/spool/ripe-atlas/crons/7 \ + /var/spool/ripe-atlas/crons/8 \ + /var/spool/ripe-atlas/crons/9 \ + /var/spool/ripe-atlas/crons/10 \ + /var/spool/ripe-atlas/crons/11 \ + /var/spool/ripe-atlas/crons/12 \ + /var/spool/ripe-atlas/crons/13 \ + /var/spool/ripe-atlas/crons/14 \ + /var/spool/ripe-atlas/crons/15 \ + /var/spool/ripe-atlas/crons/16 \ + /var/spool/ripe-atlas/crons/17 \ + /var/spool/ripe-atlas/crons/18 \ + /var/spool/ripe-atlas/crons/19 \ + /var/spool/ripe-atlas/crons/20 \ + /var/spool/ripe-atlas/data \ + /var/spool/ripe-atlas/data/new \ + /var/spool/ripe-atlas/data/oneoff \ + /var/spool/ripe-atlas/data/out \ + /var/spool/ripe-atlas/data/out/ooq \ + /var/spool/ripe-atlas/data/out/ooq10 +} + +start_instance() +{ + local cfg=/etc/ripe-atlas/config.txt + local mod=/etc/ripe-atlas/mode + + if [ ${2} -ne 0 ]; then + echo 'validation failed' + return 1 + fi + + if [ ${enabled} -eq 0 ]; then + return 1 + fi + + rm -f /etc/ripe-atlas/reg_servers.sh + case "${mode}" in + test|dev|prod) + ;; + *) + return 1 + ;; + esac + + echo 'Starting RIPE Atlas' + setup_environment + : > "${cfg}" + + if [ ${rxtx_report} -ne 0 ]; then + echo 'RXTXRPT=yes' >> "${cfg}" + fi + echo "${mode}" > "${mod}" + + procd_open_instance + procd_set_param command /usr/sbin/ripe-atlas + procd_set_param user ${MAINU} + procd_set_param group ${GROUP} + procd_set_param stdout ${log_stdout} + procd_set_param stderr ${log_stderr} + procd_set_param respawn + if [ -x /sbin/ujail ]; then + procd_add_jail ripe-atlas + procd_append_param capabilities /usr/share/ripe-atlas/capabilities.json + fi + procd_close_instance + + return 0 +} + +start_service() +{ + config_load 'ripe-atlas' + config_foreach validate_config 'ripe-atlas' start_instance +} + +stop_service() +{ + local pids + local pid + + for pid in $(find /proc -type d -maxdepth 1 -group ${GROUP} -print); do + pids="${pid##*/} ${pids}" + done + + if [ -n "${pids}" ]; then + kill ${pids} 1>/dev/null 2>&1 + fi +} + +service_triggers() +{ + procd_add_validation validate_config +} diff --git a/net/ripe-atlas/patches/001-uname.patch b/net/ripe-atlas/patches/001-uname.patch new file mode 100644 index 000000000..ca1d9ebd0 --- /dev/null +++ b/net/ripe-atlas/patches/001-uname.patch @@ -0,0 +1,30 @@ +From 64a088ae6c2752888966167508e1318bed047f03 Mon Sep 17 00:00:00 2001 +From: ttaiclet +Date: Wed, 16 Apr 2025 18:09:56 +0200 +Subject: [PATCH] changed: uname instead of hostname for generic ssh-key + creation + +hostname is a call to uname() in most implementations, but requires +an additional binary to be shipped. By using uname directly, no +additional binary has to be shipped. + +See 'uname' in the following links: +- https://linux.die.net/man/2/gethostname +- https://pubs.opengroup.org/onlinepubs/7908799/xsh/sysutsname.h.html + +Reviewed-by: Marios Mavropoulos +--- + bin/arch/generic/generic-ATLAS.sh.in | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/bin/arch/generic/generic-ATLAS.sh.in ++++ b/bin/arch/generic/generic-ATLAS.sh.in +@@ -49,7 +49,7 @@ get_ether_addr + + # Create ssh keys if they are not there yet. + if [ ! -f $ATLAS_SYSCONFDIR/probe_key ]; then +- name=$(hostname -s) ++ name=$(uname -n) + ssh-keygen -t rsa -P '' -C $name -f $ATLAS_SYSCONFDIR/probe_key + chown -R @ripe_atlas_user@:@ripe_atlas_group@ $ATLAS_SYSCONFDIR + fi