Add support for centralized allowlists #3355
Conversation
|
@blotus: There are no 'kind' label on this PR. You need a 'kind' label to generate the release automatically.
DetailsI am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the BirthdayResearch/oss-governance-bot repository. |
|
@blotus: There are no area labels on this PR. You can add as many areas as you see fit.
DetailsI am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the BirthdayResearch/oss-governance-bot repository. |
|
/kind feature |
github-actions
bot
added
kind/feature
area/local-api
and removed
needs/kind
needs/area
labels
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #3355 +/- ##
==========================================
- Coverage 59.35% 55.24% -4.12%
==========================================
Files 362 387 +25
Lines 38979 43196 +4217
==========================================
+ Hits 23137 23863 +726
- Misses 13916 17305 +3389
- Partials 1926 2028 +102
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
blotus
force-pushed
the
centralized-allowlists
branch
from
3a34d3a to
8385b05
Compare
blotus
force-pushed
the
centralized-allowlists
branch
from
8385b05 to
dbb9adc
Compare
| @@ -166,6 +168,8 @@ func (cli *cliRoot) initialize() error { | |||
| } | |||
| } | |||
|
|
|||
| csConfig.DbConfig.LogLevel = ptr.Of(cli.wantedLogLevel()) | |||
| @@ -31,6 +32,8 @@ const ( | |||
| ) | |||
|
|
|||
| var DefaultAuthCacheDuration = (1 * time.Minute) | |||
| var negativeAllowlistCacheDuration = (5 * time.Minute) | |||
| var positiveAllowlistCacheDuration = (5 * time.Minute) | |||
There was a problem hiding this comment.
looks like a lot to me, but it depends if SE gets a force_pull via PAPI when the allowlist is updated ?
| @@ -186,10 +186,6 @@ func (t *JWTTransport) RoundTrip(req *http.Request) (*http.Response, error) { | |||
| } | |||
|
|
|||
| resp, err = t.transport().RoundTrip(clonedReq) | |||
| if log.GetLevel() >= log.TraceLevel { | |||
| @@ -205,6 +205,7 @@ func (lc *LokiClient) getURLFor(endpoint string, params map[string]string) strin | |||
| func (lc *LokiClient) Ready(ctx context.Context) error { | |||
| tick := time.NewTicker(500 * time.Millisecond) | |||
| url := lc.getURLFor("ready", nil) | |||
| lc.Logger.Debugf("Using url: %s for ready check", url) | |||
| @@ -154,6 +175,11 @@ func (c *Controller) CreateAlert(gctx *gin.Context) { | |||
| } | |||
| } | |||
|
|
|||
| if allowlisted, reason := c.isAllowListed(ctx, alert); allowlisted { | |||
| log.Infof("alert source %s is allowlisted by %s, skipping", *alert.Source.Value, reason) | |||
There was a problem hiding this comment.
Let's add scenario, and if we can the allowlist name
|
Todo:
|
This PR adds a new type of allowlist that is managed by LAPI and applies to alerts, blocklists content and appsec (but not to manual decisions with
cscli):Compared to existing types of allowlists in crowdsec (in parsers, postoverflows, custom profiles or appsec hooks), they only support IPs and ranges (ie, no arbitrary expression), but they can have an optional expiration.
An alert is considered allowlisted in the following situations:
1.2.3.4is allowlisted, and an alert on1.2.3.0/24is generated): while this seems counter-intuitive, range alerts are rare and it would be add a lot of complexity to carve out the specific IPs that are allowlisted from the alert source (and generate multiple sub-alerts).They can be managed with:
csclicsclito avoid conflict), in which case they are pulled from CAPI or PAPI.If a local allowlist is created, and another one with the same name is created in the console, the one from the console will replace the local one.