🐛 65 confused about configuring tls (#69)

* 🐛 Fix bug reading LAPIKEY, update exemples

* 🚨 Fix lint

bouncer.go

@@ -10,6 +10,7 @@ import (
 	"io"
 	"net/http"
 	"net/url"
+	"strings"
 	"text/template"
 	"time"
 
@@ -79,6 +80,7 @@ func New(ctx context.Context, next http.Handler, config *configuration.Config, n
 		logger.Error(fmt.Sprintf("New:crowdsecLapiKey fail to get CrowdsecLapiKey and no client certificate setup %s", err.Error()))
 		return nil, err
 	}
+	apiKey = strings.TrimSuffix(apiKey, "\n")
 
 	bouncer := &Bouncer{
 		next:     next,

exemples/binary-vm/Vagrantfile

@@ -67,6 +67,8 @@ Vagrant.configure("2") do |config|
   #   vb.memory = "2048"
   # end
   config.vm.provision "file", source: "./files", destination: "/home/vagrant/vagrant_data"
+  config.vm.provision "file", source: "./scripts", destination: "/home/vagrant/scripts"
+#  config.vm.provision "file", source: "../../", destination: "/home/vagrant/plugin"
 
   config.vm.provision "shell", path: "scripts/install_traefik.sh"
   config.vm.provision "shell", path: "scripts/configure_traefik.sh"

exemples/binary-vm/files/traefik/conf/whoami.yml

@@ -19,7 +19,7 @@ http:
       plugin:
         bouncer:
           enabled: true
-          crowdseclapikey: whoami-demo
+          crowdseclapikey: "whoami-demo"
           updateintervalseconds: 60
           crowdsecmode: live
           loglevel: "DEBUG"

exemples/binary-vm/files/traefik/traefik.yml

@@ -31,7 +31,7 @@ experimental:
   plugins:
     bouncer:
       moduleName: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
-      version: v1.1.5
+      version: v1.1.6
 
 ################################################################
 # Certificate Resolver

exemples/binary-vm/files/whoami.service

@@ -28,4 +28,4 @@ ProtectSystem=full
 NoNewPrivileges=true
 
 [Install]
-WantedBy=multi-user.
+WantedBy=multi-user.target

exemples/binary-vm/scripts/install_crowdsec.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
 
-curl -s https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.deb.sh | sudo bash
+DEBIAN_FRONTEND=noninteractive curl -s https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.deb.sh | sudo bash
-sudo apt install crowdsec -y
+DEBIAN_FRONTEND=noninteractive sudo apt install crowdsec -y
 sudo cp /home/vagrant/vagrant_data/crowdsec/acquis.yaml /etc/crowdsec/acquis.yaml

exemples/binary-vm/scripts/install_traefik.sh

@@ -1,6 +1,7 @@
 #!/bin/bash
 
-sudo apt-get update && apt-get install wget -y && apt-get upgrade -y
+DEBIAN_FRONTEND=noninteractive sudo apt-get update && sudo apt-get install wget -y
+# DEBIAN_FRONTEND=noninteractive sudo apt-get upgrade -y --assume-yes
 wget -O traefik.tar.gz "https://github.com/traefik/traefik/releases/download/v2.9.5/traefik_v2.9.5_linux_amd64.tar.gz"
 tar -zxvf traefik.tar.gz
 # inspired from https://gist.github.com/ubergesundheit/7c9d875befc2d7bfd0bf43d8b3862d85

exemples/binary-vm/scripts/install_whoami.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-sudo apt-get update && apt-get install wget -y
+DEBIAN_FRONTEND=noninteractive sudo apt-get update && apt-get install wget -y
 wget -O whoami.tar.gz "https://github.com/traefik/whoami/releases/download/v1.8.7/whoami_v1.8.7_linux_amd64.tar.gz"
 tar -zxvf whoami.tar.gz
 # inspired from https://gist.github.com/ubergesundheit/7c9d875befc2d7bfd0bf43d8b3862d85

exemples/tls-auth/docker-compose.tls-auth.yml

@@ -2,11 +2,11 @@ version: "3.8"
 
 services:
   traefik:
-    image: "traefik:v2.9.4"
+    image: "traefik:v2.9.6"
     container_name: "traefik"
     restart: unless-stopped
     command:
-      - "--log.level=DEBUG"
+      # - "--log.level=DEBUG"
       - "--accesslog"
       - "--accesslog.filepath=/var/log/traefik/access.log"
       - "--api.insecure=true"
@@ -14,11 +14,12 @@ services:
       - "--providers.docker.exposedbydefault=false"
       - "--entrypoints.web.address=:80"
 
-      # - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
+      - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
-      # - "--experimental.plugins.bouncer.version=v1.1.5"
+      - "--experimental.plugins.bouncer.version=v1.1.6"
-      - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
+      # - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
+      - ./LAPIKEY:/etc/traefik/LAPIKEY:ro
       - logs-tls-auth:/var/log/traefik
       - crowdsec-certs-tls-auth:/etc/traefik/crowdsec-certs
       - ./../../:/plugins-local/src/github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin

pkg/configuration/configuration.go

@@ -10,6 +10,7 @@ import (
 	"os"
 	"path/filepath"
 	"reflect"
+	"strings"
 
 	ip "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/pkg/ip"
 	logger "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/pkg/logger"
@@ -106,6 +107,8 @@ func GetVariable(config *Config, key string) (string, error) {
 }
 
 // ValidateParams validate all the param gave by user.
+//
+//nolint:gocyclo
 func ValidateParams(config *Config) error {
 	if err := validateParamsRequired(config); err != nil {
 		return err
@@ -142,6 +145,13 @@ func ValidateParams(config *Config) error {
 	// We need to either have crowdsecLapiKey defined or the BouncerCert and Bouncerkey
 	if lapiKey == "" && (certBouncer == "" || certBouncerKey == "") {
 		return fmt.Errorf("CrowdsecLapiKey || (CrowdsecLapiTLSCertificateBouncer && CrowdsecLapiTLSCertificateBouncerKey): cannot be both empty")
+	} else if lapiKey != "" && (certBouncer == "" || certBouncerKey == "") {
+		// check LAPIKey
+		lapiKey = strings.TrimSuffix(lapiKey, "\n")
+		err = validateParamsAPIKey(lapiKey)
+		if err != nil {
+			return err
+		}
 	}
 
 	// Case https to contact Crowdsec LAPI and certificate must be provided
@@ -155,6 +165,109 @@ func ValidateParams(config *Config) error {
 	return nil
 }
 
+func validateParamsAPIKey(lapiKey string) error {
+	for i := 0; i < len(lapiKey); i++ {
+		c := lapiKey[i]
+		if !validHeaderFieldByte(c) {
+			return fmt.Errorf("CrowdsecLapiKey contains the following forbidden caracter %q", c)
+		}
+	}
+	return nil
+}
+
+// validHeaderFieldByte reports whether b is a valid byte in a header
+// field name. RFC 7230 says:
+//
+//	header-field   = field-name ":" OWS field-value OWS
+//	field-name     = token
+//	tchar = "!" / "#" / "$" / "%" / "&" / "'" / "*" / "+" / "-" / "." /
+//	        "^" / "_" / "`" / "|" / "~" / DIGIT / ALPHA
+//	token = 1*tchar
+func validHeaderFieldByte(b byte) bool {
+	// isTokenTable is a copy of net/http/lex.go's isTokenTable.
+	// See https://httpwg.github.io/specs/rfc7230.html#rule.token.separators
+	var isTokenTable = [127]bool{
+		'!':  true,
+		'#':  true,
+		'$':  true,
+		'%':  true,
+		'&':  true,
+		'\'': true,
+		'*':  true,
+		'+':  true,
+		'-':  true,
+		'.':  true,
+		'0':  true,
+		'1':  true,
+		'2':  true,
+		'3':  true,
+		'4':  true,
+		'5':  true,
+		'6':  true,
+		'7':  true,
+		'8':  true,
+		'9':  true,
+		'A':  true,
+		'B':  true,
+		'C':  true,
+		'D':  true,
+		'E':  true,
+		'F':  true,
+		'G':  true,
+		'H':  true,
+		'I':  true,
+		'J':  true,
+		'K':  true,
+		'L':  true,
+		'M':  true,
+		'N':  true,
+		'O':  true,
+		'P':  true,
+		'Q':  true,
+		'R':  true,
+		'S':  true,
+		'T':  true,
+		'U':  true,
+		'W':  true,
+		'V':  true,
+		'X':  true,
+		'Y':  true,
+		'Z':  true,
+		'^':  true,
+		'_':  true,
+		'`':  true,
+		'a':  true,
+		'b':  true,
+		'c':  true,
+		'd':  true,
+		'e':  true,
+		'f':  true,
+		'g':  true,
+		'h':  true,
+		'i':  true,
+		'j':  true,
+		'k':  true,
+		'l':  true,
+		'm':  true,
+		'n':  true,
+		'o':  true,
+		'p':  true,
+		'q':  true,
+		'r':  true,
+		's':  true,
+		't':  true,
+		'u':  true,
+		'v':  true,
+		'w':  true,
+		'x':  true,
+		'y':  true,
+		'z':  true,
+		'|':  true,
+		'~':  true,
+	}
+	return int(b) < len(isTokenTable) && isTokenTable[b]
+}
+
 func validateParamsTLS(config *Config) error {
 	certAuth, err := GetVariable(config, "CrowdsecLapiTLSCertificateAuthority")
 	if err != nil {