Ruakij/Ansible-roles
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

crowdsec_range_bouncer: skip range decisions wider than /8 (IPv4) or /16 (IPv6) and log each skip

Browse Source
This commit is contained in:
Ruakij
2026-10-26 19:52:14 +00:00
parent 78a370dbd1
commit 7a260afe39
1 changed files with 12 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crowdsec_range_bouncer/templates/crowdsec-range-bouncer.py.j2
+12 -5
View File
@@ -20,6 +20,8 @@ STATE_DIR = os.environ.get("STATE_DIRECTORY", "/var/lib/crowdsec-range-bouncer")
HASH_FILE = os.path.join(STATE_DIR, "last.sha256") HASH_FILE = os.path.join(STATE_DIR, "last.sha256")
NFT = "/usr/sbin/nft" NFT = "/usr/sbin/nft"
TABLE = "crowdsec_ranges" TABLE = "crowdsec_ranges"
# A prefix this wide is a poisoned decision, not a bad network.
MIN_DECISION_PREFIXLEN = {4: 8, 6: 16}
def fetch_ranges(lapi_url, api_key): def fetch_ranges(lapi_url, api_key):
@@ -35,11 +37,16 @@ def fetch_ranges(lapi_url, api_key):
return [] return []
if not isinstance(decisions, list): if not isinstance(decisions, list):
raise ValueError("unexpected LAPI answer: %s" % type(decisions).__name__) raise ValueError("unexpected LAPI answer: %s" % type(decisions).__name__)
return [ networks = []
ipaddress.ip_network(d["value"], strict=False) for d in decisions:
for d in decisions if d["type"] != "ban" or d["scope"].lower() != "range":
if d["type"] == "ban" and d["scope"].lower() == "range" continue
] network = ipaddress.ip_network(d["value"], strict=False)
if network.prefixlen < MIN_DECISION_PREFIXLEN[network.version]:
print("skipping suspiciously wide range decision %s" % network)
continue
networks.append(network)
return networks
def collapse(networks, version): def collapse(networks, version):