Bug? when trying to delete a range from decisions

1

Hi :slight_smile:
Have a look :

root@myserver-008:/var/log/nginx# cscli decisions list -l0|grep 163.116.163
| 6312485 | crowdsec | Ip:163.116.163.113 | crowdsecurity/http-bad-user-agent         | ban    | FR      |                             0  |      2 | 55m42.078921s      |   168982 |
| 6312484 | crowdsec | Ip:163.116.163.141 | crowdsecurity/http-bad-user-agent         | ban    | FR      |                             0  |      2 | 55m41.478303875s   |   168981 |
| 6312483 | crowdsec | Ip:163.116.163.121 | crowdsecurity/http-bad-user-agent         | ban    | FR      |                             0  |      2 | 55m36.395457105s   |   168980 |
| 6312479 | crowdsec | Ip:163.116.163.120 | crowdsecurity/http-bad-user-agent         | ban    | FR      |                             0  |      2 | 55m28.486711655s   |   168976 |
| 6312478 | crowdsec | Ip:163.116.163.123 | crowdsecurity/http-bad-user-agent         | ban    | FR      |                             0  |      2 | 55m27.748867461s   |   168975 |
| 6312477 | crowdsec | Ip:163.116.163.117 | crowdsecurity/http-bad-user-agent         | ban    | FR      |                             0  |      2 | 55m27.165810604s   |   168974 |
| 6312476 | crowdsec | Ip:163.116.163.115 | crowdsecurity/http-bad-user-agent         | ban    | FR      |                             0  |      2 | 55m26.955817421s   |   168973 |
| 6312475 | crowdsec | Ip:163.116.163.118 | crowdsecurity/http-bad-user-agent         | ban    | FR      |                             0  |      2 | 55m26.812355654s   |   168972 |
| 6312473 | crowdsec | Ip:163.116.163.140 | crowdsecurity/http-bad-user-agent         | ban    | FR      |                             0  |      2 | 55m25.509125098s   |   168970 |
| 6312472 | crowdsec | Ip:163.116.163.116 | crowdsecurity/http-bad-user-agent         | ban    | FR      |                             0  |      2 | 55m24.806342948s   |   168969 |
| 6312471 | crowdsec | Ip:163.116.163.139 | crowdsecurity/http-bad-user-agent         | ban    | FR      |                             0  |      2 | 55m24.184873843s   |   168968 |
| 6312470 | crowdsec | Ip:163.116.163.142 | crowdsecurity/http-bad-user-agent         | ban    | FR      |                             0  |      2 | 55m24.155431617s   |   168967 |
| 6312469 | crowdsec | Ip:163.116.163.124 | crowdsecurity/http-bad-user-agent         | ban    | FR      |                             0  |      2 | 55m21.939050027s   |   168966 |
| 6312468 | crowdsec | Ip:163.116.163.122 | crowdsecurity/http-bad-user-agent         | ban    | FR      |                             0  |      2 | 55m20.305851825s   |   168965 |
| 6312467 | crowdsec | Ip:163.116.163.114 | crowdsecurity/http-bad-user-agent         | ban    | FR      |                             0  |      2 | 55m18.993079451s   |   168964 |
root@myserver-008:/var/log/nginx# cscli decisions delete -r 163.116.163.0/24
INFO[12-04-2022 11:41:33 AM] 0 decision(s) deleted                        
root@myserver-008:/var/log/nginx#

Seems clearly a bug. If I try to delete the Ip one by one, it works

root@myserver-008:/var/log/nginx# cscli decisions delete -i 163.116.163.114
INFO[12-04-2022 11:44:15 AM] 1 decision(s) deleted                        
root@myserver-008:/var/log/nginx#

Crowdsec 1.3.0 on Ubuntu

Thanks

2

Hello,

To delete decisions from range, you must use the --contained flag.
For your case, cscli decisions delete -r 163.116.163.0/24 --contained should works.

3

Hi !
Yes it should work, but I don’t understand the --contained flag.

As a “simple user”, I just would like to delete the decisions on a range, why should I have to specify this ?

4

Hello,

Indeed, this is not very user friendly. We are going to invert this behavior in the next release.