Skip to content

enhance: Handle disabling ipv4 and ipv6 #85

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
LaurenceJJones wants to merge 5 commits into
base: main
Choose a base branch
from
Open

enhance: Handle disabling ipv4 and ipv6 #85

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
643a5ca
enhance: Handle disabling ipv4 and ipv6
LaurenceJJones Aug 13, 2025
81b4f40
enhance: Add CROWDSEC_BYPASS_DB_VOLUME_CHECK to tests
LaurenceJJones Aug 13, 2025
4162df4
enhance: Add CROWDSEC_BYPASS_DB_VOLUME_CHECK to tests
LaurenceJJones Aug 13, 2025
20db0cd
enhance: Remove CROWDSEC_BYPASS_DB_VOLUME_CHECK to tests
LaurenceJJones Aug 13, 2025
f92c75e
Merge branch 'main' into allow_disable
LaurenceJJones Aug 13, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,7 +74,7 @@ jobs:
# these need root
sudo -E $(which uv) run pytest ./tests/install/no_crowdsec
# these need a running crowdsec
docker run -d --name crowdsec -e CI_TESTING=true -e DISABLE_ONLINE_API=true -p 8080:8080 -ti crowdsecurity/crowdsec
docker run -d --name crowdsec -e CROWDSEC_BYPASS_DB_VOLUME_CHECK=true -e CI_TESTING=true -e DISABLE_ONLINE_API=true -p 8080:8080 -ti crowdsecurity/crowdsec
install -m 0755 /dev/stdin /usr/local/bin/cscli <<'EOT'
#!/bin/sh
docker exec crowdsec cscli "$@"
Expand Down
52 changes: 52 additions & 0 deletions pkg/cfg/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,8 @@
CertPath string `yaml:"cert_path"`
CAPath string `yaml:"ca_cert_path"`
SupportedActions []string `yaml:"supported_actions"`
DisableIPv4 *bool `yaml:"disable_ipv4"`
DisableIPv6 *bool `yaml:"disable_ipv6"`
}

type AclConfig struct {
Expand All @@ -44,13 +46,15 @@
CloudWatchEnabled bool `yaml:"cloudwatch_enabled"`
CloudWatchMetricName string `yaml:"cloudwatch_metric_name"`
SampleRequests bool `yaml:"sample_requests"`
DisableIPv4 *bool `yaml:"disable_ipv4"`
DisableIPv6 *bool `yaml:"disable_ipv6"`
}

var ValidActions = []string{"ban", "captcha", "count"}
var validScopes = []string{"REGIONAL", "CLOUDFRONT"}
var validIpHeaderPosition = []string{"FIRST", "LAST", "ANY"}

func getConfigFromEnv(config *bouncerConfig) {

Check failure on line 57 in pkg/cfg/config.go

View workflow job for this annotation

GitHub Actions / golangci-lint + codeql 

cognitive-complexity: function getConfigFromEnv has cognitive complexity 82 (> max enabled 62) (revive)
var (
key string
value string
Expand Down Expand Up @@ -124,6 +128,22 @@
log.Warnf("Invalid value for %s: %s, defaulting to false", key, value)
acl.SampleRequests = false
}
case "DISABLE_IPV4":
b, err := strconv.ParseBool(value)
if err != nil {
log.Warnf("Invalid value for %s: %s, defaulting to false", key, value)
acl.DisableIPv4 = aws.Bool(false)
} else {
acl.DisableIPv4 = aws.Bool(b)
}
case "DISABLE_IPV6":
b, err := strconv.ParseBool(value)
if err != nil {
log.Warnf("Invalid value for %s: %s, defaulting to false", key, value)
acl.DisableIPv6 = aws.Bool(false)
} else {
acl.DisableIPv6 = aws.Bool(b)
}
}
} else {
switch key {
Expand Down Expand Up @@ -178,6 +198,22 @@
config.CAPath = value
case "BOUNCER_SUPPORTED_ACTIONS":
config.SupportedActions = strings.Split(value, ",")
case "BOUNCER_DISABLE_IPV4":
b, err := strconv.ParseBool(value)
if err != nil {
log.Warnf("Invalid value for %s: %s, defaulting to false", key, value)
config.DisableIPv4 = aws.Bool(false)
} else {
config.DisableIPv4 = aws.Bool(b)
}
case "BOUNCER_DISABLE_IPV6":
b, err := strconv.ParseBool(value)
if err != nil {
log.Warnf("Invalid value for %s: %s, defaulting to false", key, value)
config.DisableIPv6 = aws.Bool(false)
} else {
config.DisableIPv6 = aws.Bool(b)
}
}
}
}
Expand Down Expand Up @@ -223,6 +259,14 @@
return fmt.Errorf("waf_config is required")
}

// Default root-level IPv4/IPv6 disable flags to false if not set
if c.DisableIPv4 == nil {
c.DisableIPv4 = aws.Bool(false)
}
if c.DisableIPv6 == nil {
c.DisableIPv6 = aws.Bool(false)
}

for i, aclConfig := range c.WebACLConfig {
if aclConfig.FallbackAction == "" {
return fmt.Errorf("fallback_action is required")
Expand Down Expand Up @@ -278,6 +322,14 @@
if aclConfig.Capacity == 0 {
c.WebACLConfig[i].Capacity = 300
}

// Inherit IPv4/IPv6 disable flags from root when not set on WAF config
if aclConfig.DisableIPv4 == nil {
c.WebACLConfig[i].DisableIPv4 = c.DisableIPv4
}
if aclConfig.DisableIPv6 == nil {
c.WebACLConfig[i].DisableIPv6 = c.DisableIPv6
}
}

return nil
Expand Down
56 changes: 30 additions & 26 deletions pkg/waf/waf.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -547,43 +547,47 @@ func (w *WAF) Init(ctx context.Context) error {
func (w *WAF) UpdateSetsContent(ctx context.Context, d Decisions) error {
var err error

for action, ips := range d.V4Add {
if action == "fallback" {
action = strings.ToLower(w.config.FallbackAction)
}
if w.config.DisableIPv4 == nil || !*w.config.DisableIPv4 {
for action, ips := range d.V4Add {
if action == "fallback" {
action = strings.ToLower(w.config.FallbackAction)
}

for _, ip := range ips {
w.ipsetManager.AddIp(*ip, action)
for _, ip := range ips {
w.ipsetManager.AddIp(*ip, action)
}
}
}

for action, ips := range d.V4Del {
if action == "fallback" {
action = strings.ToLower(w.config.FallbackAction)
}
for action, ips := range d.V4Del {
if action == "fallback" {
action = strings.ToLower(w.config.FallbackAction)
}

for _, ip := range ips {
w.ipsetManager.DeleteIp(*ip, action)
for _, ip := range ips {
w.ipsetManager.DeleteIp(*ip, action)
}
}
}

for action, ips := range d.V6Add {
if action == "fallback" {
action = strings.ToLower(w.config.FallbackAction)
}
if w.config.DisableIPv6 == nil || !*w.config.DisableIPv6 {
for action, ips := range d.V6Add {
if action == "fallback" {
action = strings.ToLower(w.config.FallbackAction)
}

for _, ip := range ips {
w.ipsetManager.AddIp(*ip, action)
for _, ip := range ips {
w.ipsetManager.AddIp(*ip, action)
}
}
}

for action, ips := range d.V6Del {
if action == "fallback" {
action = strings.ToLower(w.config.FallbackAction)
}
for action, ips := range d.V6Del {
if action == "fallback" {
action = strings.ToLower(w.config.FallbackAction)
}

for _, ip := range ips {
w.ipsetManager.DeleteIp(*ip, action)
for _, ip := range ips {
w.ipsetManager.DeleteIp(*ip, action)
}
}
}

Expand Down
Loading