Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add LookupHost expr lib func #1775

Merged
merged 2 commits into from
Oct 26, 2022

Conversation

ThinkChaos
Copy link
Contributor

Makes it possible to allow-list a domain whose IPs are not known in advance.
A practical is example is whitelisting a home IP with a dynamic DNS setup without having to resort to allowing the whole country or ISP.

Example:

name: me/my_cool_whitelist
description: lets whitelist our own IP
whitelist:
  reason: dont ban my IP
  expression:
    - evt.Overflow.Alert.Source.IP in LookupHost('my-home-domain.invalid')

This is my solution to #1315 and crowdsecurity/hub#405. I'll let you decide if it fixes those requests, but my use case is the exact same so I think it should suffice.
I didn't implement it via a enrichment because it's easier this way: for this use case the param to the function is constant, so it doesn't need to be via enrich. Also enrich functions can only return a string (and no error).

Makes it possible to allow-list a domain who's IPs are not known in
advance.
A practical is example is whitelisting a home IP with a dynamic DNS
setup without having to resort to allowing the whole country or ISP.
@codecov-commenter
Copy link

codecov-commenter commented Sep 30, 2022

Codecov Report

Merging #1775 (edc03a1) into master (6798dd7) will increase coverage by 6.60%.
The diff coverage is 100.00%.

@@            Coverage Diff             @@
##           master    #1775      +/-   ##
==========================================
+ Coverage   42.30%   48.90%   +6.60%     
==========================================
  Files          33      118      +85     
  Lines        6839    17737   +10898     
==========================================
+ Hits         2893     8674    +5781     
- Misses       3556     8044    +4488     
- Partials      390     1019     +629     
Flag Coverage Δ
func-crowdsec 45.84% <ø> (ø)
func-cscli 41.68% <ø> (ø)
unit-windows 53.04% <100.00%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files Coverage Δ
pkg/exprhelpers/exprlib.go 71.90% <100.00%> (ø)
pkg/acquisition/modules/kinesis/kinesis.go 0.00% <0.00%> (ø)
pkg/csconfig/profiles.go 73.07% <0.00%> (ø)
pkg/parser/enrich_geoip.go 43.00% <0.00%> (ø)
pkg/leakybucket/overflow_filter.go 75.75% <0.00%> (ø)
pkg/apiserver/utils.go 0.00% <0.00%> (ø)
...on/modules/syslog/internal/parser/rfc5424/parse.go 69.53% <0.00%> (ø)
pkg/parser/node.go 70.87% <0.00%> (ø)
pkg/cwhub/download.go 52.17% <0.00%> (ø)
pkg/apiclient/decisions_service.go 42.50% <0.00%> (ø)
... and 76 more

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

@buixor
Copy link
Contributor

buixor commented Oct 4, 2022

Hello,

I like it, I'll keep you posted soon.

@LaurenceJJones LaurenceJJones self-assigned this Oct 21, 2022
Copy link
Contributor

@LaurenceJJones LaurenceJJones left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Will add some documentation to docs.crowdsec.net to advise this should only be used in postoverflows as its very slow.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants