Add Matrix/Synapse parser whitelist and description#1726
Add Matrix/Synapse parser whitelist and description#1726pscriptos wants to merge 1 commit intocrowdsecurity:masterfrom
Conversation
|
Hello, Thanks for the PR. Unfortunately, I think using a parser whitelist for that is a bit too broad: you are effectively ignoring every request on anything that starts with those paths. A much better solution would be to use a postoverflow to only allow those paths for specific scenarios. |
|
Thank you very much for your feedback. |
|
Hi, I'm facing the same issue, then came here, I did follow the link about postoverflow, here is a file I'm now trying name: synapse-client-whitelists
description: Whitelist synapse client application for crawl non static
whitelist:
reason: synapse-client can trigger FP
expression:
- evt.Overflow.Alert.Scenario == "crowdsecurity/http-crawl-non_statics" and all(evt.Overflow.Alert.Events, {.GetMeta("http_path") startsWith "/_matrix/client/"})
- evt.Overflow.Alert.Scenario == "crowdsecurity/http-probing" and all(evt.Overflow.Alert.Events, {.GetMeta("http_path") startsWith "/_matrix/client/"})I did add the http-probing scenario because in some rooms there are a lot of 404 😕 that trigger the ban [edit] |
3 participants
Description
Add a parser whitelist for Matrix/Synapse traffic. This whitelist prevents legitimate Matrix federation, client-server API, Synapse admin/internal endpoints, and
.well-known/matrix/server discovery requests from being falsely flagged by CrowdSec scenarios such ashttp-probingorhttp-crawl-non_statics.Whitelisted paths:
/_matrix/— Federation and Client-Server API/_synapse/— Synapse Admin and internal endpoints/.well-known/matrix/— Matrix server discoveryChecklist