cscli allows decisions on CIDR ranges, but nftables sets do not have the `interval` flag
TLDR: nftables sets created/managed by cs-firewall-bouncer are missing the
interval
interval
flag, causing incorrect elements to be added for subnets.
Today I manually added a decision to ban an IPv6 subnet, which cscli reported as successful, but then I noticed that traffic from IPs in the subnet was still getting past the crowdsec6 table's chains. I dug deeper and realized that it's because the banned subnet wasn't added correctly to the
crowdsec6-blacklists-cscli
crowdsec6-blacklists-cscli
set; it appears to have been added as a single IP.
root@srv:~# cscli decisions add --range 2a06:4880::/32 --duration 90d --reason "[srv] manual ban"INFO Decision successfully added root@srv:~# nft list set ip6 crowdsec6 crowdsec6-blacklists-csclitable ip6 crowdsec6 { set crowdsec6-blacklists-cscli { type ipv6_addr flags timeout elements = { 2a06:4880:: timeout 29d23h35m21s expires 29d22h28m56s800ms } }}
root@srv:~# cscli decisions add --range 2a06:4880::/32 --duration 90d --reason "[srv] manual ban"INFO Decision successfully added root@srv:~# nft list set ip6 crowdsec6 crowdsec6-blacklists-csclitable ip6 crowdsec6 { set crowdsec6-blacklists-cscli { type ipv6_addr flags timeout elements = { 2a06:4880:: timeout 29d23h35m21s expires 29d22h28m56s800ms } }}