CrowdSec decision list fetched, kept, and its clients banned until the decision ends (closes #106)

SWWAF_CROWDSEC_LAPI_URL and SWWAF_CROWDSEC_LAPI_KEY name an engine whose
decision list, <url>/v1/decisions, is fetched every minute with the key in
X-Api-Key, following no redirect, and kept as a blocklist is: used while a
fetch fails, and across restarts through reputation.json. Ban decisions on an
Ip or a Range end at the fetch time plus their duration. A listed client's
request is refused and bans its netblock with the cause crowdsec until the
decision ends; bans.json, ban notes and metrics take the cause.

Judgement call: fetched every minute, not a setting.
Judgement call: a crowdsec ban never lengthens a limit ban.
Judgement call: a lifted crowdsec ban is remade while its decision lasts.

Model: opus-5-5

internal/state/state.go

@@ -60,7 +60,7 @@ var (
 	errVersion = errors.New("unknown version")
 	// errMissing is for an entry without a field it needs.
 	errMissing     = errors.New("has no")
-	errCause       = errors.New("is not limit, attack or admin")
+	errCause       = errors.New("is not limit, attack, admin or crowdsec")
 	errDestination = errors.New("is not webhook, slack or ntfy")
 	errScope       = errors.New("is not client, net, asn, total or watch")
 	errWaitingList = errors.New(`waiting is a list, but now lists the alerts by ` +
@@ -647,7 +647,7 @@ func (e BanEntry) ban() bans.Ban {
 // worked out, or an expires, which would make it permanent. A permanent
 // ban's expires is null, which Bans cannot tell from a missing one, so
 // each expires is read again as written. A cause other than limit,
-// attack or admin, most likely misspelt, is refused too.
+// attack, admin or crowdsec, most likely misspelt, is refused too.
 func (f *bansFile) check(data []byte) error {
 	var written struct {
 		Bans []struct {
@@ -669,7 +669,8 @@ func (f *bansFile) check(data []byte) error {
 		case written.Bans[i].Expires == nil:
 			return missing(i, "expires")
 		case entry.Cause != "" && entry.Cause != bans.CauseLimit &&
-			entry.Cause != bans.CauseAttack && entry.Cause != bans.CauseAdmin:
+			entry.Cause != bans.CauseAttack && entry.Cause != bans.CauseAdmin &&
+			entry.Cause != bans.CauseCrowdSec:
 			return fmt.Errorf("entry %d's cause %q %w", i+1, entry.Cause, errCause)
 		}
 	}

internal/state/state_test.go

@@ -97,7 +97,8 @@ const permanentBansJSON = `{
                 "earlier_bans": {
                     "limit": 3,
                     "attack": 1,
-                    "admin": 1
+                    "admin": 1,
+                    "crowdsec": 2
                 }
             }
         }
@@ -849,8 +850,10 @@ func TestBanWithAnotherCauseStopsTheStart(t *testing.T) {
 		`{"netblock": "203.0.113.10/32", "start": "2026-10-06T00:00:00Z", `+
 		`"expires": null, "cause": "admin"}, `+
 		`{"netblock": "203.0.113.11/32", "start": "2026-10-06T00:00:00Z", `+
+		`"expires": "2026-10-06T04:00:00Z", "cause": "crowdsec"}, `+
+		`{"netblock": "203.0.113.12/32", "start": "2026-10-06T00:00:00Z", `+
 		`"expires": null, "cause": "atack"}]}`,
-		`: entry 3's cause "atack" is not limit, attack or admin`)
+		`: entry 4's cause "atack" is not limit, attack, admin or crowdsec`)
 }
 
 func TestUnknownVersionStopsTheStart(t *testing.T) {
@@ -1726,8 +1729,9 @@ func office() netip.Prefix {
 	return netip.MustParsePrefix("203.0.113.0/24")
 }
 
-// fill puts a permanent ban an admin made, a ban for a broken limit and
-// one for a clear sign of attack, clients with counts and histories,
+// fill puts a permanent ban an admin made, a ban for a broken limit, one
+// for a clear sign of attack and one for CrowdSec's decision, clients
+// with counts and histories,
 // GeoJS answers, the blocklists' last tries and the copy of one, two
 // verdicts of a DNSBL zone, and the AbuseIPDB checks spent today with two
 // scores, as filledReputationJSON holds them, and alerts
@@ -1743,6 +1747,8 @@ func fill(params state.Params) {
 	})
 	params.Ledger.BanForAttack(netip.MustParsePrefix("192.0.2.1/32"), now,
 		bans.Notes{RuleID: "env-file", Target: "path"})
+	params.Ledger.BanForCrowdSec(netip.MustParsePrefix("198.51.100.9/32"), now,
+		now.Add(4*time.Hour), "crowdsecurity/ssh-bf", bans.Notes{})
 
 	for _, c := range []string{"2001:db8::/64", "203.0.113.9/32", "192.0.2.1/32"} {
 		params.Limiter.Count(netip.MustParsePrefix(c), now, whole)
@@ -1844,7 +1850,7 @@ func permanentBan() bans.Ban {
 			},
 			Requests:    1500,
 			Refused:     3,
-			EarlierBans: bans.EarlierBans{Limit: 3, Attack: 1, Admin: 1},
+			EarlierBans: bans.EarlierBans{Limit: 3, Attack: 1, Admin: 1, CrowdSec: 2},
 		},
 	}
 }