Review Code, add comments

bouncer.go

@@ -17,8 +17,6 @@ import (
 )
 
 const (
-	realIpHeader                = "X-Real-Ip"
-	forwardHeader               = "X-Forwarded-For"
 	crowdsecAuthHeader  = "X-Api-Key"
 	crowdsecRoute       = "v1/decisions"
 	crowdsecStreamRoute = "v1/decisions/stream"
@@ -66,7 +64,7 @@ type Bouncer struct {
 	client                 *http.Client
 }
 
-// New created a new Demo plugin.
+// New creates the crowdsec bouncer plugin.
 func New(ctx context.Context, next http.Handler, config *Config, name string) (http.Handler, error) {
 	requiredStrings := map[string]string{
 		"CrowdsecLapiScheme": config.CrowdsecLapiScheme,
@@ -88,6 +86,16 @@ func New(ctx context.Context, next http.Handler, config *Config, name string) (h
 			return nil, fmt.Errorf("%v cannot be less than 1", key)
 		}
 	}
+	// none -> If the client IP is on ban list, it will get a http code 403 response.
+	//         Otherwise, request will continue as usual. All request call the Crowdsec LAPI
+	// live ->  If the client IP is on ban list, it will get a http code 403 response.
+	//          Otherwise, request will continue as usual.
+	//          The bouncer can leverage use of a local cache in order to reduce the number
+	//          of requests made to the Crowdsec LAPI. It will keep in cache the status for
+	//          each IP that makes queries.
+	// stream -> Stream Streaming mode allows you to keep in the local cache only the Banned IPs,
+	// 			every requests that does not hit the cache is authorized.
+	// 			Every minute, the cache is updated with news from the Crowdsec LAPI.
 	if !contains([]string{"none", "live", "stream"}, config.CrowdsecMode) {
 		return nil, fmt.Errorf("CrowdsecMode must be one of: none, live or stream")
 	}
@@ -125,18 +133,21 @@ func New(ctx context.Context, next http.Handler, config *Config, name string) (h
 			Timeout: 5 * time.Second,
 		},
 	}
-	go handleStreamCache(bouncer, "true")
+	// if we are on a stream mode, we fetch in a go routine every minute the new decisions
+	if config.CrowdsecMode == "stream" {
+		go handleStreamCache(bouncer, true)
+	}
 	return bouncer, nil
 }
 
 func (a *Bouncer) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
-	log.Printf("not enabled, %v", a.enabled )
 	if !a.enabled {
-		log.Printf("not enabled")
+		log.Printf("Crowdsec Bouncer not enabled")
 		a.next.ServeHTTP(rw, req)
 		return
 	}
 
+	// TODO Make sur remote address does not include the port
 	remoteHost, _, err := net.SplitHostPort(req.RemoteAddr)
 	if err != nil {
 		log.Printf("failed to extract ip from remote address: %v", err)
@@ -156,6 +167,7 @@ func (a *Bouncer) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
 		}
 	}
 
+	// Right here if we cannot join the stream we forbid the request to go on
 	if a.crowdsecMode == "stream" {
 		if a.crowdsecStreamHealthy {
 			a.next.ServeHTTP(rw, req)
@@ -165,7 +177,7 @@ func (a *Bouncer) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
 		return
 	}
 
-	if a.crowdsecMode == "none" || a.crowdsecMode == "live" {
+	// We are now in none or live mode
 	noneUrl := url.URL{
 		Scheme:   a.crowdsecScheme,
 		Host:     a.crowdsecHost,
@@ -221,14 +233,10 @@ func (a *Bouncer) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
 		setDecision(remoteHost, false, a.defaultDecisionTimeout)
 	}
 	a.next.ServeHTTP(rw, req)
-		return
-	}
-
-	a.next.ServeHTTP(rw, req)
 }
 
 // CUSTOM CODE
-
+// TODO place in another file
 type Decision struct {
 	Id        int    `json:"id"`
 	Origin    string `json:"origin"`
@@ -254,6 +262,8 @@ func contains(source []string, target string) bool {
 	return false
 }
 
+// Get Decision check in the cache if the IP has the banned / not banned value
+// Otherwise return with an error to add the IP in cache if we are on
 func getDecision(clientIP string) (bool, error) {
 	isBanned, ok := cache.Get(clientIP)
 	if ok && len(isBanned.(string)) > 0 {
@@ -274,15 +284,16 @@ func setDecision(clientIP string, isBanned bool, duration int64) {
 	}
 }
 
-func handleStreamCache(a *Bouncer, initialized string) {
+func handleStreamCache(a *Bouncer, initialized bool) {
-	time.AfterFunc(time.Duration(a.updateInterval) * time.Second, func () {
+	// TODO clean properly on exit
-		handleStreamCache(a, "false")
+	time.AfterFunc(time.Duration(a.updateInterval)*time.Second, func() {
+		handleStreamCache(a, false)
 	})
 	streamUrl := url.URL{
 		Scheme:   a.crowdsecScheme,
 		Host:     a.crowdsecHost,
 		Path:     crowdsecStreamRoute,
-		RawQuery: fmt.Sprintf("startup=%s", initialized),
+		RawQuery: fmt.Sprintf("startup=%t", initialized),
 	}
 	req, _ := http.NewRequest(http.MethodGet, streamUrl.String(), nil)
 	req.Header.Add(crowdsecAuthHeader, a.crowdsecKey)