Bug/leakybucket: poor design causing excessive & unnecessary load, stuck sending event

[nameduser0]

Describe the bug
I was looking into an ssh attack and noticed many log lines like below in crowdsec. On looking at the code producing the log lines (for this blog post) it seems a poor design in PourItemToBucket.

There is a tight loop (no sleeps) that will repeat until an event is sent. This sometimes takes 300,000 attempts and more than a second.

It appears the intention was that the loop would block on a select call waiting for an event to happen. But this doesn't appear to be working. It seems there shouldn't be multiple select calls because you can wait on several events with a single select.

Either that or the loop needs a 100msec sleep to eliminate the unnecessary load.

time="03-05-2022 07:47:52" level=warning msg="stuck for 1.2835585s sending event to ff28ee5fb2ff72db65d783775f08425420084ca5 (sigclosed:0 keymiss:1 failed_sent:299998 attempts:300000)" cfg=crimson-paper file=/etc/crowdsec/scenarios/ssh-bf.yaml name=crowdsecurity/ssh-bf_user-enum

To Reproduce
Steps to reproduce the behavior:

1. Launch brute-force ssh attack on crowdsec on resource constrained server

Expected behavior
One or two failed loop attempts at most

Technical Information (please complete the following information):

• Debian 10
• v1.2.1

[AlteredCoder]

Hello, can you try to upgrade to the latest version and see if this behavior still happen ?

[nameduser0]

Makes no difference, the PourItemToBucket code hasn't changed

[buixor]

Hello,

While adding buffered channel or waiting on time might seem a good idea at first, it is going to have a lot of undesirable side effects.
Can you provide some context in the discourse post you made as well so we can try to reproduce ? This part might be optimized, but not in this way 🙂

[nameduser0]

What are the side effects and what context do you want?

[nameduser0]

I have posted the auth.log to the discourse post

[ryantig]

Was the cause of the problem identified? If not why was the issue closed?

[nameduser0]

Apparently making 300,000 attempts to do something simple is a non-issue according to @buixor 😱
Let's hope they've simulated it using my uploaded auth.log