Allowlist feature cannot withstand ddos load

Abierto
  • ¿Algo no está bien?
#4,115 8 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 2 días

Nadie ha tomado este issue todavía.

  • #4475 de @aa1ex — cerrado sin fusionar

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
25/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Estancado
Stack tecnológico
go
Área
backend-api-design, security

Línea de trabajo

Start by reviewing the allowlist-checking path and linked pull request #4475, then compare behavior from v1.6.6 onward with the reported v1.6.5 downgrade. The report says allowlists are unused but checks still reach the database during heavy traffic; done means unused allowlists are not checked and the API remains responsive under that load.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

kind/bug needs/triage
What happened?

I have one central API and hundreds of agents that are connected to one API.
The API is deployed on bare metal.

In v1.7.3, I noticed that the API stopped working when there was a huge wave of DDOS attacks.
On the API side, I saw in the log:

{"level":"error","msg":"error while checking allowlist: unable to check if value is allowlisted: context canceled","time":"2025-11-21T18:24:20+03:00"}
{"level":"error","msg":"error while checking allowlist: unable to check if value is allowlisted: context canceled","time":"2025-11-21T18:24:20+03:00"}

The API has stopped working.
I'm not using any allowlist functions, but crowdsec is still trying to connect to the database and request the allowlist.

After downgrading to version 1.6.5, everything is working and it keeps the load on

If you need any additional information, let me know.

Image Image Image
What did you expect to happen?

Allowlists should not be checked if they are not in use.

How can we reproduce it (as minimally and precisely as possible)?

You can reproduce it using >= 1.6.6

Anything else we need to know?

No response

Crowdsec version

problem starting from v1.6.6

OS version
# On Linux:
$ cat /etc/os-release
# paste output here
$ uname -a
# paste output here

# On Windows:
C:\> wmic os get Caption, Version, BuildNumber, OSArchitecture
# paste output here
Enabled collections and parsers
$ cscli hub list -o raw
# paste output here
Acquisition config
```console # On Linux: $ cat /etc/crowdsec/acquis.yaml /etc/crowdsec/acquis.d/* # paste output here

On Windows:

C:> Get-Content C:\ProgramData\CrowdSec\config\acquis.yaml

paste output here

Config show
$ cscli config show
# paste output here
Prometheus metrics
$ cscli metrics
# paste output here
Related custom configs versions (if applicable) : notification plugins, custom scenarios, parsers etc.
Lenguaje dominante
Go
Estrellas
15.1k
Forks
726
Merge medio
2 d 51 min
PR fusionados (30 d)
18

Preparar el entorno

Este proyecto no incluye contenedor de desarrollo, Dockerfile ni guía de contribución, así que la configuración corre por tu cuenta: empieza por su README y consulta nuestra guía para la primera contribución para los pasos generales.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de crowdsecurity/crowdsec

Todos los issues de crowdsecurity/crowdsec

Issues similares

Más issues de Go

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.