967ddf48fa
## Problem
Contributing a ban to CrowdSec failed against a real LAPI — `POST /v1/alerts` answered **500**, and depending on the shard's locale, auth answered **401**. Three independent defects, each sufficient on its own.
## Fixes
**`scenario_hash` / `scenario_version` were never serialized.** LAPI dereferences both unconditionally when persisting an alert, so omitting them is a nil deref and a 500 rather than a validation error. Both are now emitted with the values a watcher without a hub scenario is expected to send (`""` and `"1.0"`).
**`start_at`/`stop_at` were formatted without an `IFormatProvider`.** `:` is the time separator *specifier* in a custom .NET format string, not a literal — a shard running under a culture like `fi-FI` emitted `T15.04.05.123Z`, which Go's `time.RFC3339` rejects, producing another 500. Non-Gregorian cultures (`th-TH`, `ar-SA`) would also shift the year. Formatting is now pinned to `InvariantCulture` in `FormatTimestamp`, which additionally converts non-UTC input — the trailing `Z` is a literal and was previously an unchecked claim.
**The `User-Agent` was a plain product string.** LAPI's default watcher profile matches the `crowdsec/` prefix and answers 401 without it, so the header is a protocol constraint, not cosmetic. It is now an `internal const` carrying that reason.
Also fixed, same root cause as the timestamp bug: the login-expiry parse used a bare `DateTime.TryParse` on LAPI's RFC3339 `expire`. Under a mismatched culture that silently fails and falls back to a fabricated `UtcNow + 1h`, pushing re-auth past the real expiry and costing a 401-relogin round trip on every send.
`capacity` now defaults to `1` instead of `0`, matching the one-decision-per-alert shape actually being sent.
## Note on scope
The two 500 causes are independent. On an `en-US` shard only the missing scenario fields were biting; the date bug was latent and would have surfaced as an unexplained regression the first time someone ran a shard under a European locale.
## Verification
The emitted payload is field-for-field identical to a hand-verified request that a live LAPI accepts:
```json
[
{
"scenario": "modernuo/rate-limit",
"scenario_hash": "",
"scenario_version": "1.0",
"message": "ModernUO rate-limit ban for 192.0.2.123",
"events_count": 1,
"start_at": "2026-07-27T15:04:05.123Z",
"stop_at": "2026-07-27T15:04:05.123Z",
"capacity": 1,
"leakspeed": "0s",
"simulated": false,
"events": [],
"remediation": true,
"source": { "scope": "Ip", "value": "192.0.2.123" },
"decisions": [
{
"origin": "modernuo",
"type": "ban",
"scope": "Ip",
"value": "192.0.2.123",
"duration": "300s",
"scenario": "modernuo/rate-limit"
}
]
}
]
```
Regression tests assert the required scenario fields on the **serialized JSON** rather than the DTO — the DTO is not what goes on the wire — and cover the timestamp as a `[Theory]` across `fi-FI`/`th-TH`/`ar-SA`.
`dotnet test --filter "FullyQualifiedName~CrowdSec"` → **21/21 passed**, build clean with 0 warnings.
78 lines
4 KiB
C#
78 lines
4 KiB
C#
/*************************************************************************
|
|
* ModernUO *
|
|
* Copyright 2019-2026 - ModernUO Development Team *
|
|
* Email: hi@modernuo.com *
|
|
* File: CrowdSecAlert.cs *
|
|
* *
|
|
* This program is free software: you can redistribute it and/or modify *
|
|
* it under the terms of the GNU General Public License as published by *
|
|
* the Free Software Foundation, either version 3 of the License, or *
|
|
* (at your option) any later version. *
|
|
* *
|
|
* You should have received a copy of the GNU General Public License *
|
|
* along with this program. If not, see <http://www.gnu.org/licenses/>. *
|
|
*************************************************************************/
|
|
|
|
using System.Text.Json.Serialization;
|
|
|
|
namespace Server.Network.Bans.CrowdSec;
|
|
|
|
/// <summary>One CrowdSec alert (<c>POST /v1/alerts</c> takes an array of these).</summary>
|
|
public sealed class CrowdSecAlert
|
|
{
|
|
[JsonPropertyName("scenario")] public string Scenario { get; set; }
|
|
|
|
/// <summary>
|
|
/// Required by LAPI. It dereferences the field unconditionally when persisting the alert, so
|
|
/// omitting it answers 500 rather than a validation error. Empty is the accepted value for a
|
|
/// watcher that isn't shipping a hub scenario.
|
|
/// </summary>
|
|
[JsonPropertyName("scenario_hash")] public string ScenarioHash { get; set; } = "";
|
|
|
|
/// <summary>Required alongside <see cref="ScenarioHash"/>; same 500-on-missing behavior.</summary>
|
|
[JsonPropertyName("scenario_version")] public string ScenarioVersion { get; set; } = "1.0";
|
|
|
|
[JsonPropertyName("message")] public string Message { get; set; }
|
|
[JsonPropertyName("events_count")] public int EventsCount { get; set; } = 1;
|
|
[JsonPropertyName("start_at")] public string StartAt { get; set; }
|
|
[JsonPropertyName("stop_at")] public string StopAt { get; set; }
|
|
|
|
/// <summary>Bucket capacity. One decision per alert, so 1 — a leaky-bucket capacity of 0 is nonsense.</summary>
|
|
[JsonPropertyName("capacity")] public int Capacity { get; set; } = 1;
|
|
[JsonPropertyName("leakspeed")] public string LeakSpeed { get; set; } = "0s";
|
|
[JsonPropertyName("simulated")] public bool Simulated { get; set; }
|
|
[JsonPropertyName("events")] public object[] Events { get; set; } = [];
|
|
[JsonPropertyName("remediation")] public bool Remediation { get; set; } = true;
|
|
[JsonPropertyName("source")] public CrowdSecSource Source { get; set; }
|
|
[JsonPropertyName("decisions")] public CrowdSecDecisionDto[] Decisions { get; set; }
|
|
}
|
|
|
|
public sealed class CrowdSecSource
|
|
{
|
|
[JsonPropertyName("scope")] public string Scope { get; set; } = "Ip";
|
|
[JsonPropertyName("value")] public string Value { get; set; }
|
|
}
|
|
|
|
public sealed class CrowdSecDecisionDto
|
|
{
|
|
[JsonPropertyName("origin")] public string Origin { get; set; }
|
|
[JsonPropertyName("type")] public string Type { get; set; } = "ban";
|
|
[JsonPropertyName("scope")] public string Scope { get; set; } = "Ip";
|
|
[JsonPropertyName("value")] public string Value { get; set; }
|
|
[JsonPropertyName("duration")] public string Duration { get; set; }
|
|
[JsonPropertyName("scenario")] public string Scenario { get; set; }
|
|
}
|
|
|
|
/// <summary>Watcher login request/response for <c>POST /v1/watchers/login</c>.</summary>
|
|
public sealed class CrowdSecLoginRequest
|
|
{
|
|
[JsonPropertyName("machine_id")] public string MachineId { get; set; }
|
|
[JsonPropertyName("password")] public string Password { get; set; }
|
|
}
|
|
|
|
public sealed class CrowdSecLoginResponse
|
|
{
|
|
[JsonPropertyName("code")] public int Code { get; set; }
|
|
[JsonPropertyName("token")] public string Token { get; set; }
|
|
[JsonPropertyName("expire")] public string Expire { get; set; }
|
|
}
|