sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-05-04 08:06:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix CrowdSec review findings: observe metadata, idempotent Start, HasRestrictions, proto map alias

Browse Source
This commit is contained in:
Viktor Liu
2026-03-29 08:50:34 +02:00
parent ae84272a30
commit 6411136fec
6 changed files with 25 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
proxy/internal/restrict/restrict.go
View File

@@ -174,7 +174,12 @@ func (v Verdict) String() string {
// IsCrowdSec returns true when the verdict originates from a CrowdSec check.
func (v Verdict) IsCrowdSec() bool {
return v >= DenyCrowdSecBan && v <= DenyCrowdSecUnavailable
switch v {
case DenyCrowdSecBan, DenyCrowdSecCaptcha, DenyCrowdSecThrottle, DenyCrowdSecUnavailable:
return true
default:
return false
}
}
// IsObserveOnly returns true when v is a CrowdSec verdict and the filter is in
@@ -306,5 +311,5 @@ func (f *Filter) HasRestrictions() bool {
}
return len(f.AllowedCIDRs) > 0 || len(f.BlockedCIDRs) > 0 ||
len(f.AllowedCountries) > 0 || len(f.BlockedCountries) > 0 ||
(f.CrowdSec != nil && f.CrowdSecMode != CrowdSecOff)
f.CrowdSecMode == CrowdSecEnforce || f.CrowdSecMode == CrowdSecObserve
}

5
proxy/internal/restrict/restrict_test.go
View File

@@ -403,4 +403,9 @@ func TestFilter_HasRestrictions_CrowdSec(t *testing.T) {
cs := &mockCrowdSec{ready: true}
f := ParseFilter(FilterConfig{CrowdSec: cs, CrowdSecMode: CrowdSecEnforce})
assert.True(t, f.HasRestrictions())
// Enforce mode without checker (LAPI not configured): still has restrictions
// because Check() will fail-closed with DenyCrowdSecUnavailable.
f2 := ParseFilter(FilterConfig{CrowdSec: nil, CrowdSecMode: CrowdSecEnforce})
assert.True(t, f2.HasRestrictions())
}