search

crowdsecurity / crowdsec

CrowdSec - the open-source and participative security solution offering crowdsourced protection against malicious IPs and access to the most advanced real-world CTI.
https://crowdsec.net
MIT License
9.01k stars 467 forks source link

Bug/cscli: issue with decisions management #1156

Open he2ss opened 2 years ago

he2ss commented 2 years ago

Describe the bug When deleting an IP from decisions, it delete also the ranges that contains this IP in the active decisions.

To Reproduce Steps to reproduce the behavior:

  1. cscli decisions add --range 172.17.0.0/16
  2. cscli decisions add --ip 172.17.0.1
  3. cscli decisions delete --ip 172.17.0.1
  4. cscli decisions list

Expected behavior When deleting an IP, only decision about the IP should be removed, not the range.

Screenshots

hess $ sudo cscli decisions list
+------+--------+---------------------+--------------------------+--------+---------+----+--------+--------------------+----------+
|  ID  | SOURCE |     SCOPE:VALUE     |          REASON          | ACTION | COUNTRY | AS | EVENTS |     EXPIRATION     | ALERT ID |
+------+--------+---------------------+--------------------------+--------+---------+----+--------+--------------------+----------+
| 1378 | cscli  | Ip:172.17.0.1       | manual 'ban' from 'toto' | ban    |         |    |      1 | 3h34m34.71588989s  |     1376 |
| 1377 | cscli  | Range:172.17.0.0/16 | manual 'ban' from 'toto' | ban    |         |    |      1 | 3h27m57.715887846s |     1375 |
+------+--------+---------------------+--------------------------+--------+---------+----+--------+--------------------+----------+
hess $ sudo cscli decisions delete --ip 172.17.0.1
INFO[11-01-2022 05:51:33 PM] 2 decision(s) deleted                        
hess $ sudo cscli decisions list
No active decisions
buixor commented 2 years ago

Somehow it's not really a bug but we should be more verbose explicit about it (if you want to unban 1.2.3.4 and there is a ban on 1.2.3.0/24, you need to remove the ban on the range ... or do something smart like split it etc.)