warrentyexpired/ModernUO
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(crowdsec): send a payload LAPI accepts (500 on alerts, 401 on auth)

Browse source 
Contributing a ban to CrowdSec failed against a real LAPI. Three independent
defects, each sufficient on its own:

scenario_hash / scenario_version were never serialized. LAPI dereferences both
unconditionally when persisting an alert, so omitting them is a nil deref and a
500 rather than a validation error. Both are now emitted with the values a
watcher without a hub scenario is expected to send ("" and "1.0").

start_at/stop_at were formatted without an IFormatProvider. ':' is the time
separator *specifier* in a custom .NET format string, not a literal, so a shard
running under a culture like fi-FI emitted "T15.04.05.123Z" -- which Go's
time.RFC3339 rejects, producing another 500. Non-Gregorian cultures (th-TH,
ar-SA) would also shift the year. Formatting is now pinned to InvariantCulture
in FormatTimestamp, which additionally converts non-UTC input, since the
trailing 'Z' is a literal and was previously an unchecked claim.

The User-Agent was a plain product string. LAPI's default watcher profile
matches the "crowdsec/" prefix and answers 401 without it, so the header is a
protocol constraint; it is now an internal const carrying that reason.

Also fixes the same culture bug in the login-expiry parse: a bare
DateTime.TryParse on LAPI's RFC3339 expire silently fails under a mismatched
culture and falls back to a fabricated UtcNow+1h, pushing re-auth past the real
expiry and costing a 401-relogin round trip on every send.

capacity now defaults to 1 instead of 0, matching the one-decision-per-alert
shape actually being sent.

The resulting payload is field-for-field identical to a hand-verified request
that LAPI accepts. Regression tests assert the required scenario fields on the
serialized JSON rather than the DTO, since the DTO is not what goes on the
wire, and cover the timestamp across fi-FI/th-TH/ar-SA.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Kamron Batman 2026-07-27 23:30:32 -07:00
parent 294dcd94a0
commit bd44ef4026
No known key found for this signature in database
GPG key ID: 7D81DF26D9A5D94A
5 changed files with 111 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

19
Projects/UOContent/Misc/CrowdSec/CrowdSecAlertClient.cs
View file

@ -15,6 +15,7 @@
using System;
using System.Collections.Generic;
using System.Globalization;
using System.Net;
using System.Net.Http;
using System.Net.Http.Headers;
@ -40,6 +41,12 @@ public sealed class CrowdSecAlertClient : ICrowdSecAlertClient
{
private static readonly JsonSerializerOptions _jsonOptions = new() { PropertyNameCaseInsensitive = true };
/// <summary>
/// The <c>crowdsec/</c> prefix is load-bearing: LAPI's default watcher profile matches on it and
/// answers 401 for anything else, so this cannot be a plain product string.
/// </summary>
internal const string UserAgent = "crowdsec/ModernUO-watcher-1.0";
private readonly HttpClient _http;
private readonly string _machineId;
private readonly string _password;
@ -51,7 +58,7 @@ public sealed class CrowdSecAlertClient : ICrowdSecAlertClient
{
var baseUri = new Uri(settings.LapiUrl, UriKind.Absolute); // fails loud on malformed url
_http = new HttpClient { BaseAddress = baseUri, Timeout = TimeSpan.FromSeconds(30) };
_http.DefaultRequestHeaders.Add("User-Agent", "ModernUO-watcher/1.0");
_http.DefaultRequestHeaders.Add("User-Agent", UserAgent);
_machineId = settings.MachineId;
_password = settings.Password;
}
@ -71,7 +78,15 @@ public sealed class CrowdSecAlertClient : ICrowdSecAlertClient
var login = await response.Content.ReadFromJsonAsync<CrowdSecLoginResponse>(_jsonOptions, token)
.ConfigureAwait(false);
_token = login?.Token ?? throw new InvalidOperationException("CrowdSec login returned no token.");
_tokenExpiresUtc = DateTime.TryParse(login.Expire, out var exp) ? exp.ToUniversalTime() : DateTime.UtcNow.AddHours(1);
// LAPI returns an RFC3339 expiry. Parse it invariantly for the same reason we format invariantly:
// the current culture must not decide whether a machine-readable timestamp is understood.
_tokenExpiresUtc = DateTime.TryParse(
login.Expire,
CultureInfo.InvariantCulture,
DateTimeStyles.AdjustToUniversal,
out var exp
) ? exp : DateTime.UtcNow.AddHours(1);
}
private void Authorize(HttpRequestMessage message) =>