bd44ef4026
Contributing a ban to CrowdSec failed against a real LAPI. Three independent
defects, each sufficient on its own:
scenario_hash / scenario_version were never serialized. LAPI dereferences both
unconditionally when persisting an alert, so omitting them is a nil deref and a
500 rather than a validation error. Both are now emitted with the values a
watcher without a hub scenario is expected to send ("" and "1.0").
start_at/stop_at were formatted without an IFormatProvider. ':' is the time
separator *specifier* in a custom .NET format string, not a literal, so a shard
running under a culture like fi-FI emitted "T15.04.05.123Z" -- which Go's
time.RFC3339 rejects, producing another 500. Non-Gregorian cultures (th-TH,
ar-SA) would also shift the year. Formatting is now pinned to InvariantCulture
in FormatTimestamp, which additionally converts non-UTC input, since the
trailing 'Z' is a literal and was previously an unchecked claim.
The User-Agent was a plain product string. LAPI's default watcher profile
matches the "crowdsec/" prefix and answers 401 without it, so the header is a
protocol constraint; it is now an internal const carrying that reason.
Also fixes the same culture bug in the login-expiry parse: a bare
DateTime.TryParse on LAPI's RFC3339 expire silently fails under a mismatched
culture and falls back to a fabricated UtcNow+1h, pushing re-auth past the real
expiry and costing a 401-relogin round trip on every send.
capacity now defaults to 1 instead of 0, matching the one-decision-per-alert
shape actually being sent.
The resulting payload is field-for-field identical to a hand-verified request
that LAPI accepts. Regression tests assert the required scenario fields on the
serialized JSON rather than the DTO, since the DTO is not what goes on the
wire, and cover the timestamp across fi-FI/th-TH/ar-SA.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
78 lines
4 KiB
C#
78 lines
4 KiB
C#
/*************************************************************************
|
|
* ModernUO *
|
|
* Copyright 2019-2026 - ModernUO Development Team *
|
|
* Email: hi@modernuo.com *
|
|
* File: CrowdSecAlert.cs *
|
|
* *
|
|
* This program is free software: you can redistribute it and/or modify *
|
|
* it under the terms of the GNU General Public License as published by *
|
|
* the Free Software Foundation, either version 3 of the License, or *
|
|
* (at your option) any later version. *
|
|
* *
|
|
* You should have received a copy of the GNU General Public License *
|
|
* along with this program. If not, see <http://www.gnu.org/licenses/>. *
|
|
*************************************************************************/
|
|
|
|
using System.Text.Json.Serialization;
|
|
|
|
namespace Server.Network.Bans.CrowdSec;
|
|
|
|
/// <summary>One CrowdSec alert (<c>POST /v1/alerts</c> takes an array of these).</summary>
|
|
public sealed class CrowdSecAlert
|
|
{
|
|
[JsonPropertyName("scenario")] public string Scenario { get; set; }
|
|
|
|
/// <summary>
|
|
/// Required by LAPI. It dereferences the field unconditionally when persisting the alert, so
|
|
/// omitting it answers 500 rather than a validation error. Empty is the accepted value for a
|
|
/// watcher that isn't shipping a hub scenario.
|
|
/// </summary>
|
|
[JsonPropertyName("scenario_hash")] public string ScenarioHash { get; set; } = "";
|
|
|
|
/// <summary>Required alongside <see cref="ScenarioHash"/>; same 500-on-missing behavior.</summary>
|
|
[JsonPropertyName("scenario_version")] public string ScenarioVersion { get; set; } = "1.0";
|
|
|
|
[JsonPropertyName("message")] public string Message { get; set; }
|
|
[JsonPropertyName("events_count")] public int EventsCount { get; set; } = 1;
|
|
[JsonPropertyName("start_at")] public string StartAt { get; set; }
|
|
[JsonPropertyName("stop_at")] public string StopAt { get; set; }
|
|
|
|
/// <summary>Bucket capacity. One decision per alert, so 1 — a leaky-bucket capacity of 0 is nonsense.</summary>
|
|
[JsonPropertyName("capacity")] public int Capacity { get; set; } = 1;
|
|
[JsonPropertyName("leakspeed")] public string LeakSpeed { get; set; } = "0s";
|
|
[JsonPropertyName("simulated")] public bool Simulated { get; set; }
|
|
[JsonPropertyName("events")] public object[] Events { get; set; } = [];
|
|
[JsonPropertyName("remediation")] public bool Remediation { get; set; } = true;
|
|
[JsonPropertyName("source")] public CrowdSecSource Source { get; set; }
|
|
[JsonPropertyName("decisions")] public CrowdSecDecisionDto[] Decisions { get; set; }
|
|
}
|
|
|
|
public sealed class CrowdSecSource
|
|
{
|
|
[JsonPropertyName("scope")] public string Scope { get; set; } = "Ip";
|
|
[JsonPropertyName("value")] public string Value { get; set; }
|
|
}
|
|
|
|
public sealed class CrowdSecDecisionDto
|
|
{
|
|
[JsonPropertyName("origin")] public string Origin { get; set; }
|
|
[JsonPropertyName("type")] public string Type { get; set; } = "ban";
|
|
[JsonPropertyName("scope")] public string Scope { get; set; } = "Ip";
|
|
[JsonPropertyName("value")] public string Value { get; set; }
|
|
[JsonPropertyName("duration")] public string Duration { get; set; }
|
|
[JsonPropertyName("scenario")] public string Scenario { get; set; }
|
|
}
|
|
|
|
/// <summary>Watcher login request/response for <c>POST /v1/watchers/login</c>.</summary>
|
|
public sealed class CrowdSecLoginRequest
|
|
{
|
|
[JsonPropertyName("machine_id")] public string MachineId { get; set; }
|
|
[JsonPropertyName("password")] public string Password { get; set; }
|
|
}
|
|
|
|
public sealed class CrowdSecLoginResponse
|
|
{
|
|
[JsonPropertyName("code")] public int Code { get; set; }
|
|
[JsonPropertyName("token")] public string Token { get; set; }
|
|
[JsonPropertyName("expire")] public string Expire { get; set; }
|
|
}
|