From 61ef64fa13458730651e753be843f71367fbf415 Mon Sep 17 00:00:00 2001
From: BPplays <58504799+BPplays@users.noreply.github.com>
Date: Mon, 21 Jul 2025 14:49:20 -0700
Subject: [PATCH] security/crowdsec(fix): IPv6 validation for LAPI listen
 address broken (#4822)

---
 .../opnsense/mvc/app/models/OPNsense/CrowdSec/General.xml    | 4 ++--
 .../src/opnsense/scripts/OPNsense/CrowdSec/reconfigure.py    | 5 +++++
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/security/crowdsec/src/opnsense/mvc/app/models/OPNsense/CrowdSec/General.xml b/security/crowdsec/src/opnsense/mvc/app/models/OPNsense/CrowdSec/General.xml
index 7a85d8bbc..63cf526f1 100644
--- a/security/crowdsec/src/opnsense/mvc/app/models/OPNsense/CrowdSec/General.xml
+++ b/security/crowdsec/src/opnsense/mvc/app/models/OPNsense/CrowdSec/General.xml
@@ -24,10 +24,10 @@
       <Required>Y</Required>
     </lapi_manual_configuration>
 
-    <lapi_listen_address type="TextField">
+    <lapi_listen_address type="NetworkField">
       <Default>127.0.0.1</Default>
       <Required>Y</Required>
-      <Mask>((^\s*((([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))\s*$)|(^\s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))(%.+)?\s*$))</Mask>
+      <NetMaskAllowed>N</NetMaskAllowed>
     </lapi_listen_address>
 
     <lapi_listen_port type="PortField">
diff --git a/security/crowdsec/src/opnsense/scripts/OPNsense/CrowdSec/reconfigure.py b/security/crowdsec/src/opnsense/scripts/OPNsense/CrowdSec/reconfigure.py
index 04d61a028..fa0670092 100755
--- a/security/crowdsec/src/opnsense/scripts/OPNsense/CrowdSec/reconfigure.py
+++ b/security/crowdsec/src/opnsense/scripts/OPNsense/CrowdSec/reconfigure.py
@@ -10,6 +10,9 @@ import yaml
 logging.basicConfig(level=logging.INFO)
 
 
+def is_ipv6(ip: str) -> bool:
+    return ":" in ip
+
 def load_config(filename: str) -> dict[str, Any]:
     with open(filename) as fin:
         return yaml.safe_load(fin)
@@ -27,6 +30,8 @@ def get_netloc(settings: dict[str, str]):
     # defaults if config has not been saved yet
     listen_address = settings.get('lapi_listen_address', '127.0.0.1')
     listen_port = settings.get('lapi_listen_port', '8080')
+    if is_ipv6(listen_address):
+        listen_address = '[{}]'.format(listen_address)
     return '{}:{}'.format(listen_address, listen_port)