crowdsecurity/crowdsec · error

rule has no zones, 'and', or 'or' children

Error message

rule has no zones, 'and', or 'or' children

What it means

flattenToDNF collects the DNF parts from a rule's zones and its and/or children; if the resulting parts list is empty, the rule contained nothing matchable at all (no zones and no children producing groups). Compiling such a rule would produce an empty or invalid modsecurity rule, so the build is aborted with this error.

Source

Thrown at pkg/appsec/appsec_rule/modsecurity.go:182

	// All Or children's DNFs are concatenated into one, then treated as a single AND term
	if len(rule.Or) > 0 {
		var orDNF [][]*CustomRule

		for i := range rule.Or {
			childDNF, err := flattenToDNF(&rule.Or[i])
			if err != nil {
				return nil, err
			}

			orDNF = append(orDNF, childDNF...)
		}

		parts = append(parts, orDNF)
	}

	if len(parts) == 0 {
		return nil, errors.New("rule has no zones, 'and', or 'or' children")
	}

	if len(parts) == 1 {
		return parts[0], nil
	}

	// Multiple parts: cross-product them all
	result := parts[0]

	for i := 1; i < len(parts); i++ {
		var err error

		result, err = crossProduct(result, parts[i])
		if err != nil {
			return nil, err
		}
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Give the rule real content: zones plus a match, or non-empty and/or children
2. Remove empty `and: []` / `or: []` scaffolding that has no children
3. Validate rules before compiling: each leaf must have zones, each group must have at least one child

Example fix

// before
rule := &CustomRule{And: []*CustomRule{}}

// after
rule := &CustomRule{And: []*CustomRule{{Zones: []string{"URI"}, Match: Match{Type: "contains", Value: "x"}}}}

if len(rule.Zones) == 0 && len(rule.And) == 0 && len(rule.Or) == 0 {
    return fmt.Errorf("rule is empty: no zones, and, or children")
}

When it happens

Trigger: Calling Build/flattenToDNF with a CustomRule whose zones is empty/non-nil in a way that yields no leaf groups, or whose and/or children all expand to empty groups (e.g. `and: []` or `or: []` with no zones).

Common situations: A rule with only `and: []` or `or: []` keys and no zones; a programmatically built rule with zero-length child slices; a generator emitting empty group containers.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• no zones defined
• no match type defined
• no match value defined
• leaf rule must have zones
• invalid schema name

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/c4c3b8ffab94950d. Report an issue: GitHub.