Appsec rule deduplication breaks multilines seclang rules

[blotus]

When deduplication is performed on the loaded appsec rules, we do not handle properly multilines seclang rules, for example (from the CRS):

SecAction \
    "id:901200,\
    phase:1,\
    pass,\
    t:none,\
    nolog,\
...

The parser will consider SecAction \ to be its own rule and will remove all duplicated instances, which breaks CRS support.

[github-actions]

@blotus: Thanks for opening an issue, it is currently awaiting triage.

In the meantime, you can:

1. Check Crowdsec Documentation to see if your issue can be self resolved.
2. You can also join our Discord.
3. Check Releases to make sure your agent is on the latest version.

Details

I am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the BirthdayResearch/oss-governance-bot repository.

[github-actions]

@blotus: There are no 'kind' label on this issue. You need a 'kind' label to start the triage process.

• /kind feature
• /kind enhancement
• /kind refactoring
• /kind bug
• /kind packaging

Details

I am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the BirthdayResearch/oss-governance-bot repository.

[victoredvardsson]

Hello, will this be patched in 1.6.4 asap or will it be fixed in a future version?

Currently a blocker for us to upgrade.

[blotus]

Hello,

This will be fixed in a future update.

In the meantime, you can transform your rules into "single line" rules, and crowdsec will be able to load them (if you encounter an error with the secaction directive, make sure you have only a single space after it in your rules).