|
1 | 1 | package handlers |
2 | 2 |
|
3 | 3 | import ( |
| 4 | + "bufio" |
4 | 5 | "fmt" |
| 6 | + "io" |
| 7 | + "net" |
5 | 8 | "net/http" |
| 9 | + "strconv" |
| 10 | + "strings" |
6 | 11 | "time" |
7 | 12 |
|
8 | 13 | "crowdsec-manager/internal/config" |
@@ -343,3 +348,234 @@ func DeleteAllowlist(dockerClient *docker.Client, cfg *config.Config) gin.Handle |
343 | 348 | }) |
344 | 349 | } |
345 | 350 | } |
| 351 | + |
| 352 | +// ============================================================================= |
| 353 | +// ALLOWLIST IMPORT |
| 354 | +// ============================================================================= |
| 355 | + |
| 356 | +// privateIPRanges holds RFC 1918, loopback, and link-local ranges used by isPrivateIPAddr. |
| 357 | +var privateIPRanges = func() []*net.IPNet { |
| 358 | + cidrs := []string{ |
| 359 | + "10.0.0.0/8", |
| 360 | + "172.16.0.0/12", |
| 361 | + "192.168.0.0/16", |
| 362 | + "127.0.0.0/8", |
| 363 | + "::1/128", |
| 364 | + "fc00::/7", |
| 365 | + "fe80::/10", |
| 366 | + } |
| 367 | + ranges := make([]*net.IPNet, 0, len(cidrs)) |
| 368 | + for _, c := range cidrs { |
| 369 | + _, ipNet, err := net.ParseCIDR(c) |
| 370 | + if err == nil { |
| 371 | + ranges = append(ranges, ipNet) |
| 372 | + } |
| 373 | + } |
| 374 | + return ranges |
| 375 | +}() |
| 376 | + |
| 377 | +// isValidIPOrCIDR returns true if s is a valid IP address or CIDR notation. |
| 378 | +func isValidIPOrCIDR(s string) bool { |
| 379 | + if net.ParseIP(s) != nil { |
| 380 | + return true |
| 381 | + } |
| 382 | + _, _, err := net.ParseCIDR(s) |
| 383 | + return err == nil |
| 384 | +} |
| 385 | + |
| 386 | +// isPrivateIPAddr returns true if s falls within a private/loopback address range. |
| 387 | +func isPrivateIPAddr(s string) bool { |
| 388 | + ip := net.ParseIP(s) |
| 389 | + if ip == nil { |
| 390 | + // For CIDRs, check the network address |
| 391 | + ip, _, _ = net.ParseCIDR(s) |
| 392 | + } |
| 393 | + if ip == nil { |
| 394 | + return false |
| 395 | + } |
| 396 | + for _, r := range privateIPRanges { |
| 397 | + if r.Contains(ip) { |
| 398 | + return true |
| 399 | + } |
| 400 | + } |
| 401 | + return false |
| 402 | +} |
| 403 | + |
| 404 | +// parseAllowlistImportFile reads a reader and returns unique, non-empty candidate strings. |
| 405 | +// Entries can be separated by newlines or commas. |
| 406 | +func parseAllowlistImportFile(r io.Reader) []string { |
| 407 | + seen := make(map[string]struct{}) |
| 408 | + var out []string |
| 409 | + scanner := bufio.NewScanner(r) |
| 410 | + for scanner.Scan() { |
| 411 | + line := strings.TrimSpace(scanner.Text()) |
| 412 | + if line == "" || strings.HasPrefix(line, "#") { |
| 413 | + continue |
| 414 | + } |
| 415 | + for _, part := range strings.Split(line, ",") { |
| 416 | + entry := strings.TrimSpace(part) |
| 417 | + if entry == "" { |
| 418 | + continue |
| 419 | + } |
| 420 | + if _, exists := seen[entry]; !exists { |
| 421 | + seen[entry] = struct{}{} |
| 422 | + out = append(out, entry) |
| 423 | + } |
| 424 | + } |
| 425 | + } |
| 426 | + return out |
| 427 | +} |
| 428 | + |
| 429 | +// getExistingAllowlistValues fetches the current values in an allowlist for duplicate detection. |
| 430 | +func getExistingAllowlistValues(dockerClient *docker.Client, containerName, allowlistName string) map[string]struct{} { |
| 431 | + existing := make(map[string]struct{}) |
| 432 | + output, err := dockerClient.ExecCommand(containerName, []string{"cscli", "allowlists", "inspect", allowlistName, "-o", "json"}) |
| 433 | + if err != nil { |
| 434 | + return existing |
| 435 | + } |
| 436 | + dataBytes, err := parseCLIJSONToBytes(output) |
| 437 | + if err != nil { |
| 438 | + return existing |
| 439 | + } |
| 440 | + jsonparser.ArrayEach(dataBytes, func(itemValue []byte, _ jsonparser.ValueType, _ int, _ error) { |
| 441 | + if val, err := jsonparser.GetString(itemValue, "value"); err == nil { |
| 442 | + existing[val] = struct{}{} |
| 443 | + } |
| 444 | + }, "items") |
| 445 | + return existing |
| 446 | +} |
| 447 | + |
| 448 | +// ImportAllowlistEntries imports a plain-text list of IPs/CIDRs into an allowlist with optional filtering. |
| 449 | +// Accepts multipart/form-data with fields: |
| 450 | +// - file – text file, one IP/CIDR per line (or comma-separated) |
| 451 | +// - allowlist_name – target allowlist (required) |
| 452 | +// - expiration – optional, e.g. "7d", "30d" |
| 453 | +// - description – optional note added to entries |
| 454 | +// - skip_invalid – "true"/"false" (default true) – drop non-IP/CIDR tokens |
| 455 | +// - skip_private – "true"/"false" (default false) – drop RFC 1918 addresses |
| 456 | +// - skip_duplicates – "true"/"false" (default true) – drop entries already in allowlist |
| 457 | +func ImportAllowlistEntries(dockerClient *docker.Client, cfg *config.Config) gin.HandlerFunc { |
| 458 | + return func(c *gin.Context) { |
| 459 | + dockerClient = resolveDockerClient(c, dockerClient) |
| 460 | + |
| 461 | + allowlistName := strings.TrimSpace(c.PostForm("allowlist_name")) |
| 462 | + if allowlistName == "" { |
| 463 | + c.JSON(http.StatusBadRequest, models.Response{ |
| 464 | + Success: false, |
| 465 | + Error: "allowlist_name is required", |
| 466 | + }) |
| 467 | + return |
| 468 | + } |
| 469 | + |
| 470 | + expiration := strings.TrimSpace(c.PostForm("expiration")) |
| 471 | + description := strings.TrimSpace(c.PostForm("description")) |
| 472 | + |
| 473 | + parseBool := func(key string, defaultVal bool) bool { |
| 474 | + v := strings.TrimSpace(c.PostForm(key)) |
| 475 | + if v == "" { |
| 476 | + return defaultVal |
| 477 | + } |
| 478 | + b, err := strconv.ParseBool(v) |
| 479 | + if err != nil { |
| 480 | + return defaultVal |
| 481 | + } |
| 482 | + return b |
| 483 | + } |
| 484 | + skipInvalid := parseBool("skip_invalid", true) |
| 485 | + skipPrivate := parseBool("skip_private", false) |
| 486 | + skipDuplicates := parseBool("skip_duplicates", true) |
| 487 | + |
| 488 | + file, _, err := c.Request.FormFile("file") |
| 489 | + if err != nil { |
| 490 | + c.JSON(http.StatusBadRequest, models.Response{ |
| 491 | + Success: false, |
| 492 | + Error: "file upload required: " + err.Error(), |
| 493 | + }) |
| 494 | + return |
| 495 | + } |
| 496 | + defer file.Close() |
| 497 | + |
| 498 | + candidates := parseAllowlistImportFile(file) |
| 499 | + |
| 500 | + var ( |
| 501 | + skippedInvalid int |
| 502 | + skippedPrivate int |
| 503 | + skippedDuplicates int |
| 504 | + toAdd []string |
| 505 | + ) |
| 506 | + |
| 507 | + var existing map[string]struct{} |
| 508 | + if skipDuplicates { |
| 509 | + existing = getExistingAllowlistValues(dockerClient, cfg.CrowdsecContainerName, allowlistName) |
| 510 | + } |
| 511 | + |
| 512 | + for _, entry := range candidates { |
| 513 | + if skipInvalid && !isValidIPOrCIDR(entry) { |
| 514 | + skippedInvalid++ |
| 515 | + continue |
| 516 | + } |
| 517 | + if skipPrivate && isPrivateIPAddr(entry) { |
| 518 | + skippedPrivate++ |
| 519 | + continue |
| 520 | + } |
| 521 | + if skipDuplicates { |
| 522 | + if _, exists := existing[entry]; exists { |
| 523 | + skippedDuplicates++ |
| 524 | + continue |
| 525 | + } |
| 526 | + } |
| 527 | + toAdd = append(toAdd, entry) |
| 528 | + } |
| 529 | + |
| 530 | + imported := 0 |
| 531 | + const chunkSize = 50 |
| 532 | + for i := 0; i < len(toAdd); i += chunkSize { |
| 533 | + end := i + chunkSize |
| 534 | + if end > len(toAdd) { |
| 535 | + end = len(toAdd) |
| 536 | + } |
| 537 | + chunk := toAdd[i:end] |
| 538 | + |
| 539 | + cmd := []string{"cscli", "allowlists", "add", allowlistName} |
| 540 | + if expiration != "" { |
| 541 | + cmd = append(cmd, "--expiration", expiration) |
| 542 | + } |
| 543 | + if description != "" { |
| 544 | + cmd = append(cmd, "--description", description) |
| 545 | + } |
| 546 | + cmd = append(cmd, chunk...) |
| 547 | + |
| 548 | + output, execErr := dockerClient.ExecCommand(cfg.CrowdsecContainerName, cmd) |
| 549 | + if execErr != nil { |
| 550 | + logger.Error("Failed to add allowlist chunk", "name", allowlistName, "error", execErr, "output", output) |
| 551 | + c.JSON(http.StatusInternalServerError, models.Response{ |
| 552 | + Success: false, |
| 553 | + Error: fmt.Sprintf("Failed to add entries (imported %d so far): %v", imported, execErr), |
| 554 | + }) |
| 555 | + return |
| 556 | + } |
| 557 | + imported += len(chunk) |
| 558 | + } |
| 559 | + |
| 560 | + logger.Info("Allowlist import completed", |
| 561 | + "name", allowlistName, |
| 562 | + "total_input", len(candidates), |
| 563 | + "imported", imported, |
| 564 | + "skipped_invalid", skippedInvalid, |
| 565 | + "skipped_private", skippedPrivate, |
| 566 | + "skipped_duplicates", skippedDuplicates, |
| 567 | + ) |
| 568 | + |
| 569 | + c.JSON(http.StatusOK, models.Response{ |
| 570 | + Success: true, |
| 571 | + Message: fmt.Sprintf("Imported %d entries into '%s'", imported, allowlistName), |
| 572 | + Data: gin.H{ |
| 573 | + "total_input": len(candidates), |
| 574 | + "imported": imported, |
| 575 | + "skipped_invalid": skippedInvalid, |
| 576 | + "skipped_private": skippedPrivate, |
| 577 | + "skipped_duplicates": skippedDuplicates, |
| 578 | + }, |
| 579 | + }) |
| 580 | + } |
| 581 | +} |
0 commit comments