crowdsec icon indicating copy to clipboard operation
crowdsec copied to clipboard

Bug/cscli: issue with decisions management

Open he2ss opened this issue 4 years ago • 1 comments

Describe the bug When deleting an IP from decisions, it delete also the ranges that contains this IP in the active decisions.

To Reproduce Steps to reproduce the behavior:

  1. cscli decisions add --range 172.17.0.0/16
  2. cscli decisions add --ip 172.17.0.1
  3. cscli decisions delete --ip 172.17.0.1
  4. cscli decisions list

Expected behavior When deleting an IP, only decision about the IP should be removed, not the range.

Screenshots

hess $ sudo cscli decisions list
+------+--------+---------------------+--------------------------+--------+---------+----+--------+--------------------+----------+
|  ID  | SOURCE |     SCOPE:VALUE     |          REASON          | ACTION | COUNTRY | AS | EVENTS |     EXPIRATION     | ALERT ID |
+------+--------+---------------------+--------------------------+--------+---------+----+--------+--------------------+----------+
| 1378 | cscli  | Ip:172.17.0.1       | manual 'ban' from 'toto' | ban    |         |    |      1 | 3h34m34.71588989s  |     1376 |
| 1377 | cscli  | Range:172.17.0.0/16 | manual 'ban' from 'toto' | ban    |         |    |      1 | 3h27m57.715887846s |     1375 |
+------+--------+---------------------+--------------------------+--------+---------+----+--------+--------------------+----------+
hess $ sudo cscli decisions delete --ip 172.17.0.1
INFO[11-01-2022 05:51:33 PM] 2 decision(s) deleted                        
hess $ sudo cscli decisions list
No active decisions

he2ss avatar Jan 11 '22 17:01 he2ss

Somehow it's not really a bug but we should be more verbose explicit about it (if you want to unban 1.2.3.4 and there is a ban on 1.2.3.0/24, you need to remove the ban on the range ... or do something smart like split it etc.)

buixor avatar Jun 24 '22 14:06 buixor