Initial versionHEADmaster

This was taken from nixturris.

15 files changed, 415 insertions, 0 deletions

diff --git a/pkgs/build-support/bootstrap.sh b/pkgs/build-support/bootstrap.sh
new file mode 100644
index 0000000..a1202cb
--- /dev/null
+++ b/pkgs/build-support/bootstrap.sh
@@ -0,0 +1,5 @@
+preConfigurePhases="${preConfigurePhases:-} bootstrapPhase"
+
+bootstrapPhase() {
+	./bootstrap
+}
diff --git a/pkgs/default.nix b/pkgs/default.nix
new file mode 100644
index 0000000..81360e6
--- /dev/null
+++ b/pkgs/default.nix
@@ -0,0 +1,45 @@
+{ nixpkgs ? <nixpkgs>, nixlib ? nixpkgs.lib }:
+
+let
+  pkgs = nixpkgs // sentinelPkgs;
+  callPackage = nixlib.callPackageWith pkgs;
+
+  sentinelPkgs = with pkgs; {
+
+    bootstrapHook = callPackage (
+      { makeSetupHook, autoconf, autoconf-archive, automake, gettext, libtool }:
+      makeSetupHook
+        { deps = [ autoconf autoconf-archive automake gettext libtool ]; }
+        ./build-support/bootstrap.sh
+    ) { };
+
+    ## Libraries ##
+    logc = callPackage ./libraries/logc { };
+    logc-0_1 = logc.overrideAttrs (oldAttrs: rec {
+      version = "0.1.0";
+      src = fetchgit {
+        url = "https://gitlab.nic.cz/turris/logc.git";
+        rev = "v" + version;
+        sha256 = "1swjzs2249wvnqx2zvxwd7d1z22kd3512xxfvq002cvgbq78ka9a";
+      };
+      patches = [];
+    });
+    logc-libs = callPackage ./libraries/logc-libs { };
+    base64c = callPackage ./libraries/base64c { };
+    paho-mqtt-c = callPackage ./libraries/paho-mqtt-c { };
+
+    ## Sentinel applications ##
+    sentinel-certgen = python3Packages.callPackage ./sentinel/certgen { };
+    #sentinel-dynfw-client = python3Packages.callPackage ./sentinel/dynfw-client { };
+    sentinel-proxy = callPackage ./sentinel/proxy { };
+    sentinel-minipot = callPackage ./sentinel/minipot { };
+    sentinel-fwlogs = callPackage ./sentinel/fwlogs { };
+    sentinel-faillogs = callPackage ./sentinel/faillogs { };
+    turris-crypto-wrapper = callPackage ./turris/crypto-wrapper { };
+
+    ## Turris routers specific tools ##
+    libatsha204 = callPackage ./turris/libatsha204 { };
+
+  };
+
+in sentinelPkgs
diff --git a/pkgs/libraries/base64c/default.nix b/pkgs/libraries/base64c/default.nix
new file mode 100644
index 0000000..9cb6def
--- /dev/null
+++ b/pkgs/libraries/base64c/default.nix
@@ -0,0 +1,27 @@
+{ stdenv, lib, fetchgit
+, bootstrapHook, pkg-config
+, check
+}:
+
+stdenv.mkDerivation rec {
+  pname = "base64c";
+  version = "0.2.1";
+  meta = with lib; {
+    homepage = "https://gitlab.nic.cz/turris/base64c";
+    description = "Base64 encoding/decoding library for C";
+    license = licenses.mit;
+  };
+
+  src = fetchgit {
+    url = "https://gitlab.nic.cz/turris/base64c.git";
+    rev = "v" + version;
+    sha256 = "09qgx2qcni6cmk9mwiis843wgp3f85mh2c3sm0w37ib0bcxdvq7x";
+  };
+
+  nativeBuildInputs = [bootstrapHook pkg-config];
+  depsBuildBuild = [check];
+
+  doCheck = true;
+  doInstallCheck = true;
+  configureFlags = lib.optional (stdenv.hostPlatform == stdenv.buildPlatform) "--enable-tests";
+}
diff --git a/pkgs/libraries/logc-libs/0001-tests-cmzq-try-to-fix-test-failure.patch b/pkgs/libraries/logc-libs/0001-tests-cmzq-try-to-fix-test-failure.patch
new file mode 100644
index 0000000..349bf91
--- /dev/null
+++ b/pkgs/libraries/logc-libs/0001-tests-cmzq-try-to-fix-test-failure.patch
@@ -0,0 +1,31 @@
+From ecd66fc7d0079093fc56c16233c1fb2e88879df3 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Karel=20Ko=C4=8D=C3=AD?= <karel.koci@nic.cz>
+Date: Thu, 24 Feb 2022 17:52:59 +0100
+Subject: [PATCH] tests/cmzq: try to fix test failure
+
+The errno seems to be possibly set by logc_czmq_init and thus we have to
+reset errno after that.
+---
+ tests/czmq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tests/czmq.c b/tests/czmq.c
+index b6244d1..f25ab07 100644
+--- a/tests/czmq.c
++++ b/tests/czmq.c
+@@ -10,11 +10,11 @@ char *stderr_data;
+ size_t stderr_len;
+ 
+ void f_setup() {
+-	errno = 0;
+ 	orig_stderr = stderr;
+ 	stderr = open_memstream(&stderr_data, &stderr_len);
+ 	logc_czmq_init();
+ 	log_set_level(log_czmq, LL_DEBUG);
++	errno = 0;
+ }
+ void f_teardown() {
+ 	ck_assert_int_eq(errno, 0);
+-- 
+2.35.1
+
diff --git a/pkgs/libraries/logc-libs/default.nix b/pkgs/libraries/logc-libs/default.nix
new file mode 100644
index 0000000..f8e4a57
--- /dev/null
+++ b/pkgs/libraries/logc-libs/default.nix
@@ -0,0 +1,29 @@
+{ stdenv, lib, fetchgit
+, bootstrapHook, pkg-config
+, logc, czmq, libevent
+, check
+}:
+
+stdenv.mkDerivation rec {
+  pname = "logc-libs";
+  version = "0.1.0";
+  meta = with lib; {
+    homepage = "https://gitlab.nic.cz/turris/logc-libs";
+    description = "Logging for C";
+    license = licenses.mit;
+  };
+
+  src = fetchgit {
+    url = "https://gitlab.nic.cz/turris/logc-libs.git";
+    rev = "v" + version;
+    sha256 = "11b89742k81wbb0mc4r13l2sviz720qgl06v4wnjwlmi9x4pzy1a";
+  };
+
+  buildInputs = [logc czmq libevent];
+  nativeBuildInputs = [bootstrapHook pkg-config];
+  depsBuildBuild = [check];
+
+  doCheck = false; #  TODO the test fails due to errno being set by czmq for some reason
+  doInstallCheck = false;
+  configureFlags = lib.optional (stdenv.hostPlatform == stdenv.buildPlatform) "--enable-tests";
+}
diff --git a/pkgs/libraries/logc/0001-configure.ac-fix-cross-compilation.patch b/pkgs/libraries/logc/0001-configure.ac-fix-cross-compilation.patch
new file mode 100644
index 0000000..3c0fafe
--- /dev/null
+++ b/pkgs/libraries/logc/0001-configure.ac-fix-cross-compilation.patch
@@ -0,0 +1,28 @@
+From 7105fb9859f4d3264dbaaee5dc7596c561dc3e1a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Karel=20Ko=C4=8D=C3=AD?= <karel.koci@nic.cz>
+Date: Tue, 4 Jan 2022 18:38:38 +0100
+Subject: [PATCH] configure.ac: fix cross compilation
+
+The AC_CHECK_FILE is not supported when cross compiling. We can just use
+plain AS_IF with test for the same effect.
+---
+ CHANGELOG.md | 1 +
+ configure.ac | 2 +-
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/configure.ac b/configure.ac
+index 5946a53..b6d42ea 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -18,7 +18,7 @@ PKG_INSTALLDIR
+ AX_CHECK_COMPILE_FLAG([-std=c11], , AC_MSG_ERROR([Compiler with C11 standard support is required]))
+ AX_APPEND_FLAG([-std=c11])
+ 
+-AC_CHECK_FILE([${0%/*}/bootstrap],[
++AS_IF([test -x "${0%/*}/bootstrap" ],[
+   AC_PATH_PROG([GPERF], [gperf])
+   AS_IF([test -z "$GPERF"], [AC_MSG_ERROR([Missing gperf generator])])
+ ])
+-- 
+2.35.1
+
diff --git a/pkgs/libraries/logc/default.nix b/pkgs/libraries/logc/default.nix
new file mode 100644
index 0000000..6ffd8f4
--- /dev/null
+++ b/pkgs/libraries/logc/default.nix
@@ -0,0 +1,32 @@
+{ stdenv, lib, fetchgit
+, bootstrapHook, pkg-config, gperf
+, libconfig
+, check
+}:
+
+stdenv.mkDerivation rec {
+  pname = "logc";
+  version = "0.4.0";
+  meta = with lib; {
+    homepage = "https://gitlab.nic.cz/turris/logc";
+    description = "Logging for C";
+    license = licenses.mit;
+  };
+
+  src = fetchgit {
+    url = "https://gitlab.nic.cz/turris/logc.git";
+    rev = "v" + version;
+    sha256 = "15nplgjgg6dxryy4yzbj4524y77ci0syi970rmbr955m9vxvhrib";
+  };
+  patches = [
+    ./0001-configure.ac-fix-cross-compilation.patch
+  ];
+
+  buildInputs = [libconfig];
+  nativeBuildInputs = [bootstrapHook pkg-config gperf];
+  depsBuildBuild = [check];
+
+  doCheck = true;
+  doInstallCheck = true;
+  configureFlags = lib.optional (stdenv.hostPlatform == stdenv.buildPlatform) "--enable-tests";
+}
diff --git a/pkgs/libraries/paho-mqtt-c/default.nix b/pkgs/libraries/paho-mqtt-c/default.nix
new file mode 100644
index 0000000..545af96
--- /dev/null
+++ b/pkgs/libraries/paho-mqtt-c/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, lib, fetchurl
+, cmake
+, openssl
+}:
+
+stdenv.mkDerivation rec {
+  pname = "paho-mqtt-c";
+  version = "1.3.9";
+  meta = with lib; {
+    homepage = "https://eclipse.org/paho";
+    description = "An Eclipse Paho C client library for MQTT";
+    license = licenses.epl20;
+  };
+
+  src = fetchurl {
+    url = "https://github.com/eclipse/paho.mqtt.c/archive/refs/tags/v" + version + ".tar.gz";
+    sha256 = "1v9m4mx47bhahzda5sf5zp80shbaizymfbdidm8hsvfgl5grnv1q";
+  };
+
+  buildInputs = [openssl];
+  nativeBuildInputs = [cmake];
+
+  cmakeFlags = ["-DPAHO_WITH_SSL=TRUE" "-DPAHO_HIGH_PERFORMANCE=TRUE"];
+}
diff --git a/pkgs/sentinel/certgen/default.nix b/pkgs/sentinel/certgen/default.nix
new file mode 100644
index 0000000..3818b9b
--- /dev/null
+++ b/pkgs/sentinel/certgen/default.nix
@@ -0,0 +1,25 @@
+{ buildPythonApplication, lib, fetchgit
+, python3
+, crypto-wrapper
+}:
+
+buildPythonApplication rec {
+  pname = "sentinel-certgen";
+  version = "6.2";
+  meta = with lib; {
+    homepage = "https://gitlab.nic.cz/turris/sentinel/certgen";
+    description = "Sentinel automated passwords and certificates retrieval";
+    license = licenses.gpl3;
+  };
+
+  src = fetchgit {
+    url = "https://gitlab.nic.cz/turris/sentinel/certgen.git";
+    rev = "v" + version;
+    sha256 = "10ii3j3wqdib7m2fc0w599981mv9q3ahj96q4kyrn5sh18v2c7nb";
+  };
+
+  propagatedBuildInputs = with python3.pkgs; [
+    crypto-wrapper
+    six requests cryptography
+  ];
+}
diff --git a/pkgs/sentinel/dynfw-client/default.nix b/pkgs/sentinel/dynfw-client/default.nix
new file mode 100644
index 0000000..b059b6d
--- /dev/null
+++ b/pkgs/sentinel/dynfw-client/default.nix
@@ -0,0 +1,26 @@
+{ buildPythonApplication, lib, fetchgit
+, ipset
+}:
+
+buildPythonApplication rec {
+  pname = "sentinel-dynfw-client";
+  version = "1.4.0";
+  meta = with lib; {
+    homepage = "https://gitlab.nic.cz/turris/sentinel/dynfw-client";
+    description = "Dynamic firewall client";
+    platforms = platforms.linux;
+    license = licenses.gpl3;
+  };
+
+  src = fetchgit {
+    url = "https://gitlab.nic.cz/turris/sentinel/dynfw-client.git";
+    rev = "v" + version;
+    sha256 = "1g0wbhsjzifvdfvig6922cl3yfj1f96yvg11s4vgiaxca9yspcmp";
+  };
+
+  buildInputs = [ipset];
+  preConfigure = ''
+    ls
+    find -type f | xargs sed -i 's#/usr/sbin/ipset#${ipset}#g' 
+    '';
+}
diff --git a/pkgs/sentinel/faillogs/default.nix b/pkgs/sentinel/faillogs/default.nix
new file mode 100644
index 0000000..4b3a2d3
--- /dev/null
+++ b/pkgs/sentinel/faillogs/default.nix
@@ -0,0 +1,29 @@
+{ stdenv, lib, fetchgit
+, bootstrapHook, pkg-config, gperf
+, logc, logc-libs, libevent, czmq, msgpack, libconfig
+, check
+}:
+
+stdenv.mkDerivation rec {
+  pname = "sentinel-faillogs";
+  version = "0.1.0";
+  meta = with lib; {
+    homepage = "https://gitlab.nic.cz/turris/sentinel/faillogs";
+    description = "Failed login attempt logs collector";
+    license = licenses.gpl3;
+  };
+
+  src = fetchgit {
+    url = "https://gitlab.nic.cz/turris/sentinel/faillogs.git";
+    rev = "99ec41baed19cc1ca70490b2b8cd81784e7748d2";
+    sha256 = "1pp93z78qwg7arca5z70gdp5ja2jldk1rzig8r29a2fhjakd0hb2";
+  };
+
+  buildInputs = [logc logc-libs libevent czmq msgpack libconfig];
+  nativeBuildInputs = [bootstrapHook pkg-config gperf];
+  depsBuildBuild = [check];
+
+  doCheck = true;
+  doInstallCheck = true;
+  configureFlags = lib.optional (stdenv.hostPlatform == stdenv.buildPlatform) "--enable-tests";
+}
diff --git a/pkgs/sentinel/fwlogs/default.nix b/pkgs/sentinel/fwlogs/default.nix
new file mode 100644
index 0000000..6c9d529
--- /dev/null
+++ b/pkgs/sentinel/fwlogs/default.nix
@@ -0,0 +1,30 @@
+{ stdenv, lib, fetchgit
+, bootstrapHook, pkg-config
+, czmq, msgpack, logc-0_1, logc-libs, libconfig, libnetfilter_log
+, check
+}:
+
+stdenv.mkDerivation rec {
+  pname = "sentinel-proxy";
+  version = "0.2.0";
+  meta = with lib; {
+    homepage = "https://gitlab.nic.cz/turris/sentinel/fwlogs";
+    description = "Firewall logs collector";
+    platforms = platforms.linux;
+    license = licenses.gpl3;
+  };
+
+  src = fetchgit {
+    url = "https://gitlab.nic.cz/turris/sentinel/fwlogs.git";
+    rev = "v" + version;
+    sha256 = "04rlm3mlri2wz33z6jh2yh0p81lnrfpfmmfjrn4sfjwh1g21ins7";
+  };
+
+  buildInputs = [czmq msgpack logc-0_1 logc-libs libconfig libnetfilter_log];
+  nativeBuildInputs = [bootstrapHook pkg-config];
+  depsBuildBuild = [check];
+
+  doCheck = true;
+  doInstallCheck = true;
+  configureFlags = lib.optional (stdenv.hostPlatform == stdenv.buildPlatform) "--enable-tests";
+}
diff --git a/pkgs/sentinel/minipot/default.nix b/pkgs/sentinel/minipot/default.nix
new file mode 100644
index 0000000..1f26074
--- /dev/null
+++ b/pkgs/sentinel/minipot/default.nix
@@ -0,0 +1,29 @@
+{ stdenv, lib, fetchgit
+, bootstrapHook, pkg-config, gperf
+, czmq, msgpack, libevent, base64c, logc-0_1, logc-libs
+, check
+}:
+
+stdenv.mkDerivation rec {
+  pname = "sentinel-minipot";
+  version = "2.2";
+  meta = with lib; {
+    homepage = "https://gitlab.nic.cz/turris/sentinel/minipot";
+    description = "Firewall logs collector";
+    license = licenses.gpl3;
+  };
+
+  src = fetchgit {
+    url = "https://gitlab.nic.cz/turris/sentinel/minipot.git";
+    rev = "v" + version;
+    sha256 = "05p2q9mj8bhjapfphlrs45l691dmkpiia6ir1nnpa1pa5jy045p9";
+  };
+
+  buildInputs = [czmq msgpack libevent base64c logc-0_1 logc-libs];
+  nativeBuildInputs = [bootstrapHook pkg-config gperf];
+  depsBuildBuild = [check];
+
+  doCheck = true;
+  doInstallCheck = true;
+  configureFlags = lib.optional (stdenv.hostPlatform == stdenv.buildPlatform) "--enable-tests";
+}
diff --git a/pkgs/sentinel/proxy/default.nix b/pkgs/sentinel/proxy/default.nix
new file mode 100644
index 0000000..a3b6bf2
--- /dev/null
+++ b/pkgs/sentinel/proxy/default.nix
@@ -0,0 +1,31 @@
+{ stdenv, lib, fetchgit
+, bootstrapHook, pkg-config, gperf
+, openssl, zlib, czmq, libconfig, msgpack, paho-mqtt-c
+, check
+}:
+
+stdenv.mkDerivation rec {
+  pname = "sentinel-proxy";
+  version = "1.4";
+  meta = with lib; {
+    homepage = "https://gitlab.nic.cz/turris/sentinel/proxy";
+    description = "Main MQTT Sentinel client. Proxy that lives on the router and relays messages received from ZMQ to uplink server over MQTT channel.";
+    license = licenses.gpl3;
+  };
+
+  src = fetchgit {
+    url = "https://gitlab.nic.cz/turris/sentinel/proxy.git";
+    rev = "v" + version;
+    sha256 = "11s538yf4ydlzlx1vs9fc6hh9igf40s3v853mlcki8a28bni6xwb";
+  };
+
+  buildInputs = [openssl zlib czmq libconfig msgpack paho-mqtt-c];
+  nativeBuildInputs = [bootstrapHook pkg-config gperf];
+  depsBuildBuild = [check];
+
+  preConfigure = "./bootstrap";
+
+  doCheck = true;
+  doInstallCheck = true;
+  configureFlags = lib.optional (stdenv.hostPlatform == stdenv.buildPlatform) "--enable-tests";
+}
diff --git a/pkgs/turris/crypto-wrapper/default.nix b/pkgs/turris/crypto-wrapper/default.nix
new file mode 100644
index 0000000..aa65b17
--- /dev/null
+++ b/pkgs/turris/crypto-wrapper/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, lib, fetchgit
+}:
+
+stdenv.mkDerivation rec {
+  pname = "turris-crypto-wrapper";
+  version = "0.4";
+  meta = with lib; {
+    homepage = "https://gitlab.nic.cz/turris/crypto-wrapper";
+    description = "";
+    license = licenses.gpl3;
+  };
+
+  src = fetchgit {
+    url = "https://gitlab.nic.cz/turris/crypto-wrapper.git";
+    rev = "v" + version;
+    sha256 = "1ly37cajkmgqmlj230h5az9m2m1rgvf4r0bf94yipp80wl0z215s";
+  };
+
+  buildInputs = [czmq msgpack libevent base64c logc-0_1 logc-libs];
+  nativeBuildInputs = [bootstrapHook pkg-config gperf];
+  depsBuildBuild = [check];
+
+  configureFlags = lib.optional (stdenv.hostPlatform == stdenv.buildPlatform) "--enable-tests";
+}