Package: crowdsec
Version: 1.4.2-1
Severity: important
Forwarded: https://github.com/crowdsecurity/crowdsec/issues/2128

Hi,

The upstream bug report has all the details, but let's sum them up for
the Debian BTS, adding some context about Debian 11 and Debian 12
specifically: an existing 1.0.9 crowdsec would usually get decisions
from the Central API (CAPI), listing things to block based on the
enabled collections (they are all enabled with the default install).

While there are no bouncers to be found in Debian 11, upgrading crowdsec
from Debian 11 to Debian 12, and installing the firewall bouncer right
away seems like a reasonable use case. Unfortunately, that would lead
to absolutely no protection for a while:
 - crowdsec believes it has contacted the CAPI recently enough (which is
   true), so wouldn't refresh its decisions immediately;
 - bouncers contact crowdsec via the Local API (LAPI), and get no
   decisions (at least from CAPI; manually-added decisions might still
   be returned);
 - several hours pass;
 - crowdsec contacts the CAPI and fetches decisions (in passing, that
   might be around 15k instead of a mere 500 initially, since the
   crowdsec version is an important factor regarding what is returned
   by the CAPI);
 - bouncers would finally get those decisions via the LAPI.

Various approaches have been proposed during the joint debugging session
with upstream:
 - Do nothing, it's going to fix itself eventually.
    → Not something that seems suitable.
 - Delete all decisions, restart the daemon.
    → Heavy hammer, losing any manually-added decisions. Was mainly to
      confirm what was happening.
 - Fixing the case in the database when upgrading.
    → Unfortunately, since crowdsec supports several backends, that
      would mean having to write dedicated code just for that, reading
      at least the db_config part of the main config file, etc. If that
      was only about SQLite, we could add sqlite3 to Depends and run a
      “migration” script, but MariaDB and PostgreSQL support wouldn't
      be that easy.

Therefore, I'm considering doing the following, when an upgrade from
pre-1.4.x versions is spotted:
 - list all alerts;
 - spot the “Community blocklist” one(s);
 - use `cscli alerts delete --id` on it(them);
 - restart `crowdsec.service` if there was such an alert.

Of course, it would be even better to do that in advance, to avoid the
restart. Unfortunately, crowdsec 1.0.9 doesn't seem to feature anything
that would let us delete the “Community blocklist” one: trying to build
a filter for it didn't, and deletion via --id didn't exist in that
version.

Also, since cscli is merely a wrapper that builds requests for the API,
cscli 1.4.x does support `cscli alerts delete --id`, but would get an
error from the endpoint published by crowdsec 1.0.9, which doesn't
support this kind of deletion.

That's why the above steps are to be performed after restarting into the
1.4.x version.


Cheers,

Hello,

Bug #1033138 in crowdsec reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/go-team/packages/crowdsec/-/commit/718dc10ebd252f05502967c634a7b86baf0ca21e
When performing an upgrade from pre-1.4.x versions, apply a workaround
to avoid losing CAPI decisions for several hours: delete alert(s)
matching “Community blocklist”, and if at least one deletion occurred,
restart the daemon to force an immediate pull.
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1033138

We believe that the bug you reported is fixed in the latest version of
crowdsec, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1033138@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Cyril Brulebois <cyril@debamax.com> (supplier of updated crowdsec package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 19 Mar 2023 00:25:07 +0100
Source: crowdsec
Architecture: source
Version: 1.4.6-3
Distribution: unstable
Urgency: medium
Maintainer: Cyril Brulebois <cyril@debamax.com>
Changed-By: Cyril Brulebois <cyril@debamax.com>
Closes: 1033132 1033138
Changes:
 crowdsec (1.4.6-3) unstable; urgency=medium
 .
   * When performing an upgrade from pre-1.4.x versions, apply a workaround
     to avoid losing CAPI decisions for several hours (Closes: #1033138):
     delete alert(s) matching “Community blocklist”, and if at least one
     deletion occurred, restart the daemon to force an immediate pull.
   * Hardcode libsqlite3-0 (>= 3.35.0) in Depends to ensure Ent-generated
     SQLite queries are understood (Closes: #1033132): otherwise, we would
     get a dependency on libsqlite3-0 (>= 3.12.0) via shlibs, which is
     clearly not enough.
   * Backport upstream patch to fix building in the past/in the future (as
     seen with reproducible builds), no longer hardcoding the expected year
     for yearless timestamps:
      - 0016-try-to-make-reproducible-build-work-2119.patch
Checksums-Sha1:
 8087a76c9d90ef1f2cf7a770f881dc0aec01572f 4936 crowdsec_1.4.6-3.dsc
 19481cf28b5fcd5c8edf0838ed947ca439c3f6a9 27520 crowdsec_1.4.6-3.debian.tar.xz
 fe406b2a8de1f2bde4e2073db859b22dec5c244f 7644 crowdsec_1.4.6-3_source.buildinfo
Checksums-Sha256:
 5b3b628bc710fb3d66108df8bb355a1faf763888614c913c2df509c9151a2fa8 4936 crowdsec_1.4.6-3.dsc
 d843030fbeb60f311fb4f0e38973744a0206ad02a3357cff3e3e610daf2ead90 27520 crowdsec_1.4.6-3.debian.tar.xz
 cf925ad3c16c14c59d1a4f8c67e173c02f46d6675e24c88a3e26b68d8222d477 7644 crowdsec_1.4.6-3_source.buildinfo
Files:
 81e78f7238677b178054d89692bcd98b 4936 golang optional crowdsec_1.4.6-3.dsc
 5d55f1e7e9786eef4245f6dc3f79ddd1 27520 golang optional crowdsec_1.4.6-3.debian.tar.xz
 e1793305012eef8e3c70ae68b61766e8 7644 golang optional crowdsec_1.4.6-3_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJEBAEBCgAuFiEEtg6/KYRFPHDXTPR4/5FK8MKzVSAFAmQWTkUQHGtpYmlAZGVi
aWFuLm9yZwAKCRD/kUrwwrNVIAn6D/9D40z28v4sm/iIA9TNgRkqi/r0IsXXuxrr
O34jj6QC2GfN99TC1LYOswVF4vp8myTl1CLB5Y80wHlXe5q60Czxc1lWnpzmT42l
1lG12LfC50aa+jSUVDD3l1r0VtCDmN48u4+B62IXgiz9l3z6W8Eoe7EMKO/Vr3sP
xhiNyNRfmP8pBg9iLsoTGPOpmN0pcykSVwuX9EDtUqUeWzcYGvm7Wd7FZpq3ux6G
8q69xX5a1EsMd2MgVK71O7C7CreYFplK/oFvWoFlrANyzeSOU2nPwOGowvt2o3Kq
PYmLYX5sI3GyWHPU0qIODt3xMC0lNPCQvVP/XIAg0W6DSP0elGL0LhwaUS+0wAB5
WAsdHetB9cRwhPLEHaLAQqizLsn8phNrGf5FwHZGZy0Awkd+uLT/4mCSeSViEDMx
IOhEgm/ytTfDgrETh04jesq8L4b09WSqRS14YP6atqhShhuVZy7kdwoungQEHhi0
eI0Ctu/321h7hYLMBHniwrQ0O/hMsCv9vxbxMPLr8zTv+6lUViQu3BVn1udSIZIW
hli8r49bwj/Cjt09XrKTB0MDPWz64JmaOgbJ2s5NM+a5Gl65KZmMfr+lAAMEmRXh
Qfg5x4VoK21S4FIywR5XXvuC5bZC9jzdbLON8oqvWv0z4O4fPHniqA1xh/HV04cQ
8QFD6Y7Xgw==
=fAb6
-----END PGP SIGNATURE-----