Crowdsec - Variable "mode" not replaced during installation

[Scorpoon]

Important notices
Before you add a new report, we ask you kindly to acknowledge the following:

• I have read the contributing guide lines at https://github.com/opnsense/plugins/blob/master/CONTRIBUTING.md
• I have searched the existing issues, open and closed, and I'm convinced that mine is new.
• The title contains the plugin to which this issue belongs

Describe the bug
During the installation of os-crowdsec (v1.0.7) the variable ${BACKEND} for mode should be replaced in "/usr/loca/etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml" but it isn't.
The bouncer fails to start because of fatal error "firewall '${BACKEND}' is not supported" and another warning "unexpected ${BACKEND} mode".
My OpnSense instance is pretty fresh so i can't revert to check if it worked earlier.

To Reproduce
Steps to reproduce the behavior:

1. Install the crowdsec plugin
2. Check if variable was replaced

Expected behavior
The variable should be replaced with "pf".
I guess, i'm relative new to Linux :D

Relevant log files
level=warning msg="unexpected ${BACKEND} mode"
time="13-10-2023 16:07:13" level=info msg="Starting crowdsec-firewall-bouncer v0.0.28-freebsd-af6e7e2"
time="13-10-2023 16:07:13" level=info msg="backend type : ${BACKEND}"
time="13-10-2023 16:07:13" level=fatal msg="firewall '${BACKEND}' is not supported"

After changing mode to pf:
level=info msg="Starting crowdsec-firewall-bouncer v0.0.28-freebsd-af6e7e2"
time="13-10-2023 16:23:41" level=info msg="backend type : pf"
time="13-10-2023 16:23:41" level=info msg="pf table clean-up: /sbin/pfctl -t crowdsec_blacklists -T flush"
time="13-10-2023 16:23:41" level=info msg="Checking pf table: crowdsec_blacklists"
time="13-10-2023 16:23:41" level=info msg="pf initiated for ipv4"
time="13-10-2023 16:23:41" level=info msg="pf table clean-up: /sbin/pfctl -t crowdsec6_blacklists -T flush"
time="13-10-2023 16:23:41" level=info msg="Checking pf table: crowdsec6_blacklists"
time="13-10-2023 16:23:41" level=info msg="pf initiated for ipv6"

Environment

OPNsense 23.7.6-amd64
FreeBSD 13.2-RELEASE-p3
OpenSSL 1.1.1w 11 Sep 23
os-crowdsec 1.0.7

Installed by plugin:
crowdsec 1.5.4
crowdsec-firewall-bouncer 0.0.28

[rmaffeo]

This also appears to affect ${API_KEY}.

[LaurenceJJones]

@mmetc

[eeeeb]

I can confirm, having the same issue on a fresh install of OPNSense 23.7.6

/var/log/crowdsec/crowdsec-firewall-bouncer.log:
time="16-10-2023 16:22:11" level=warning msg="unexpected ${BACKEND} mode"
time="16-10-2023 16:22:11" level=info msg="Starting crowdsec-firewall-bouncer v0.0.28-freebsd-af6e7e2"
time="16-10-2023 16:22:11" level=info msg="backend type : ${BACKEND}"
time="16-10-2023 16:22:11" level=fatal msg="firewall '${BACKEND}' is not supported"
time="16-10-2023 16:24:43" level=warning msg="unexpected ${BACKEND} mode"
time="16-10-2023 16:24:43" level=info msg="Starting crowdsec-firewall-bouncer v0.0.28-freebsd-af6e7e2"
time="16-10-2023 16:24:43" level=info msg="backend type : ${BACKEND}"
time="16-10-2023 16:24:43" level=fatal msg="firewall '${BACKEND}' is not supported"

[nzkiwi68]

Same issued here - fresh install on 23.7.6

/var/log/crowdsec/crowdsec-firewall-bouncer.log:

time="17-10-2023 16:07:54" level=warning msg="unexpected ${BACKEND} mode"
time="17-10-2023 16:07:54" level=info msg="Starting crowdsec-firewall-bouncer v0.0.28-freebsd-af6e7e2"

[LaurenceJJones]

Hey 👋🏻

We have found the issue, the PR was missing a patch file.

To simply fix it you can edit the bouncer configuration and change the ${BACKEND} to pf

Normally you find this file under /usr/local/etc/crowdsec/bouncers/

[mmetc]

Hi, I am the package maintainer.

The fix is correct:

• replace "${BACKEND}" with "pf"
• run "service crowdsec_firewall start"

A patch file was missing from the packaging, a new version has been submitted to freebsd. Existing installations are not concerned.
Again, sorry for the mistake.

[fichtner]

@mmetc can you point me to the upstream patch, perhaps I can hotfix ours tomorrow to avoid 1-2 weeks roundtrip time

[mmetc]

Here it is, thanks!

https://bz-attachments.freebsd.org/attachment.cgi?id=245691

[fichtner]

opnsense/ports@2718996e5d

thanks, I will try to hotfix it tomorrow