pretecno/crowdsec-bouncer-traefik-plugin
3
0
Fork 0
mirror of https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin.git synced 2026-07-21 11:38:59 +02:00
Code Issues Packages Releases Activity

16 read ip address from x forwarded for or x real ip instead of remoteaddr if it exists (#17)

Browse Source 
* Handle X forwarded for in the plugin

* Update docker-compose.cloudflare.yml

Change to version v1.0.9

* 🍱 fix + isolate cache

* 🍱 missing files

* 🍱 lint

Co-authored-by: MathieuHa <mathieu@hanotaux.fr>
Co-authored-by: Max Lerebourg <maxlerebourg@gmail.com>
This commit is contained in:
mathieuHa
2022-10-15 14:00:32 +02:00
committed by GitHub
co-authored by MathieuHa Max Lerebourg
parent 6dde683a0a
commit 552b30a9ef
10 changed files with 349 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bouncer.go
+70 -41
View File
@@ -16,6 +16,7 @@ import (
"time"
ttl_map "github.com/leprosus/golang-ttl-map"
ip "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/ip"
)
const (
@@ -23,7 +24,6 @@ const (
liveMode = "live"
noneMode = "none"
crowdsecLapiHeader = "X-Api-Key"
crowdsecCapiHeader = "Authorization"
crowdsecLapiRoute = "v1/decisions"
crowdsecLapiStreamRoute = "v1/decisions/stream"
cacheBannedValue = "t"
@@ -32,25 +32,27 @@ const (
// Config the plugin configuration.
type Config struct {
Enabled bool `json:"enabled,omitempty"`
CrowdsecMode string `json:"crowdsecMode,omitempty"`
CrowdsecLapiScheme string `json:"crowdsecLapiScheme,omitempty"`
CrowdsecLapiHost string `json:"crowdsecLapiHost,omitempty"`
CrowdsecLapiKey string `json:"crowdsecLapiKey,omitempty"`
UpdateIntervalSeconds int64 `json:"updateIntervalSeconds,omitempty"`
DefaultDecisionSeconds int64 `json:"defaultDecisionSeconds,omitempty"`
Enabled bool `json:"enabled,omitempty"`
CrowdsecMode string `json:"crowdsecMode,omitempty"`
CrowdsecLapiScheme string `json:"crowdsecLapiScheme,omitempty"`
CrowdsecLapiHost string `json:"crowdsecLapiHost,omitempty"`
CrowdsecLapiKey string `json:"crowdsecLapiKey,omitempty"`
UpdateIntervalSeconds int64 `json:"updateIntervalSeconds,omitempty"`
DefaultDecisionSeconds int64 `json:"defaultDecisionSeconds,omitempty"`
ForwardedHeadersTrustedIPs []string `json:"forwardedheaderstrustedips,omitempty"`
}
// CreateConfig creates the default plugin configuration.
func CreateConfig() *Config {
return &Config{
Enabled: false,
CrowdsecMode: liveMode,
CrowdsecLapiScheme: "http",
CrowdsecLapiHost: "crowdsec:8080",
CrowdsecLapiKey: "",
UpdateIntervalSeconds: 60,
DefaultDecisionSeconds: 60,
Enabled: false,
CrowdsecMode: liveMode,
CrowdsecLapiScheme: "http",
CrowdsecLapiHost: "crowdsec:8080",
CrowdsecLapiKey: "",
UpdateIntervalSeconds: 60,
DefaultDecisionSeconds: 60,
ForwardedHeadersTrustedIPs: []string{},
}
}
@@ -68,6 +70,7 @@ type Bouncer struct {
crowdsecMode string
updateInterval int64
defaultDecisionTimeout int64
poolStrategy *ip.PoolStrategy
client *http.Client
cache *ttl_map.Heap
}
@@ -79,6 +82,8 @@ func New(ctx context.Context, next http.Handler, config *Config, name string) (h
return nil, err
}
checker, _ := ip.NewChecker(config.ForwardedHeadersTrustedIPs)
bouncer := &Bouncer{
next: next,
name: name,
@@ -92,6 +97,9 @@ func New(ctx context.Context, next http.Handler, config *Config, name string) (h
crowdsecKey: config.CrowdsecLapiKey,
updateInterval: config.UpdateIntervalSeconds,
defaultDecisionTimeout: config.DefaultDecisionSeconds,
poolStrategy: &ip.PoolStrategy{
Checker: checker,
},
client: &http.Client{
Transport: &http.Transport{
MaxIdleConns: 10,
@@ -124,16 +132,14 @@ func (bouncer *Bouncer) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
return
}
// TODO Make sur remote address does not include the port.
remoteHost, _, err := net.SplitHostPort(req.RemoteAddr)
remoteHost, err := getRemoteIP(bouncer, req)
if err != nil {
logger(fmt.Sprintf("failed to extract ip from remote address: %v", err))
bouncer.next.ServeHTTP(rw, req)
return
}
if bouncer.crowdsecMode == streamMode || bouncer.crowdsecMode == liveMode {
isBanned, err := getDecision(bouncer, remoteHost)
if bouncer.crowdsecMode != noneMode {
isBanned, err := getDecision(bouncer.cache, remoteHost)
if err == nil {
if isBanned {
rw.WriteHeader(http.StatusForbidden)
@@ -177,13 +183,6 @@ type Stream struct {
New []Decision `json:"new"`
}
// Login Body returned from Crowdsec Login CAPI.
type Login struct {
Code int `json:"code"`
Token string `json:"token"`
Expire string `json:"expire"`
}
func logger(str string) {
log.Printf("Crowdsec Bouncer Traefik Plugin - %s", str)
}
@@ -197,10 +196,24 @@ func contains(source []string, target string) bool {
return false
}
// It returns the first IP that is not in the pool, or the empty string otherwise.
func getRemoteIP(bouncer *Bouncer, req *http.Request) (string, error) {
remoteIP := bouncer.poolStrategy.GetIP(req)
if len(remoteIP) != 0 {
return remoteIP, nil
}
remoteIP, _, err := net.SplitHostPort(req.RemoteAddr)
if err != nil {
logger(fmt.Sprintf("failed to extract ip from remote address: %v", err))
return "", err
}
return remoteIP, nil
}
// Get Decision check in the cache if the IP has the banned / not banned value.
// Otherwise return with an error to add the IP in cache if we are on.
func getDecision(bouncer *Bouncer, clientIP string) (bool, error) {
banned, isCached := bouncer.cache.Get(clientIP)
func getDecision(cache *ttl_map.Heap, clientIP string) (bool, error) {
banned, isCached := cache.Get(clientIP)
bannedString, isValid := banned.(string)
if isCached && isValid && len(bannedString) > 0 {
return bannedString == cacheBannedValue, nil
@@ -208,20 +221,21 @@ func getDecision(bouncer *Bouncer, clientIP string) (bool, error) {
return false, fmt.Errorf("no cache data")
}
func setDecision(bouncer *Bouncer, clientIP string, isBanned bool, duration int64) {
if bouncer.crowdsecMode == noneMode {
return
}
func setDecision(cache *ttl_map.Heap, clientIP string, isBanned bool, duration int64) {
if isBanned {
logger(fmt.Sprintf("%v banned", clientIP))
bouncer.cache.Set(clientIP, cacheBannedValue, duration)
cache.Set(clientIP, cacheBannedValue, duration)
} else {
bouncer.cache.Set(clientIP, cacheNoBannedValue, duration)
cache.Set(clientIP, cacheNoBannedValue, duration)
}
}
func deleteDecision(cache *ttl_map.Heap, clientIP string) {
cache.Del(clientIP)
}
// We are now in none or live mode.
func handleNoStreamCache(bouncer *Bouncer, rw http.ResponseWriter, req *http.Request, remoteHost string) {
// We are now in none or live mode.
routeURL := url.URL{
Scheme: bouncer.crowdsecScheme,
Host: bouncer.crowdsecHost,
@@ -231,7 +245,9 @@ func handleNoStreamCache(bouncer *Bouncer, rw http.ResponseWriter, req *http.Req
body := crowdsecQuery(bouncer, routeURL.String())
if bytes.Equal(body, []byte("null")) {
setDecision(bouncer, remoteHost, false, bouncer.defaultDecisionTimeout)
if bouncer.crowdsecMode == liveMode {
setDecision(bouncer.cache, remoteHost, false, bouncer.defaultDecisionTimeout)
}
bouncer.next.ServeHTTP(rw, req)
return
}
@@ -244,7 +260,9 @@ func handleNoStreamCache(bouncer *Bouncer, rw http.ResponseWriter, req *http.Req
return
}
if len(decisions) == 0 {
setDecision(bouncer, remoteHost, false, bouncer.defaultDecisionTimeout)
if bouncer.crowdsecMode == liveMode {
setDecision(bouncer.cache, remoteHost, false, bouncer.defaultDecisionTimeout)
}
bouncer.next.ServeHTTP(rw, req)
return
}
@@ -254,7 +272,9 @@ func handleNoStreamCache(bouncer *Bouncer, rw http.ResponseWriter, req *http.Req
logger(fmt.Sprintf("failed to parse duration: %s", err))
return
}
setDecision(bouncer, remoteHost, true, int64(duration.Seconds()))
if bouncer.crowdsecMode == liveMode {
setDecision(bouncer.cache, remoteHost, true, int64(duration.Seconds()))
}
}
func handleStreamCache(bouncer *Bouncer) {
@@ -276,11 +296,11 @@ func handleStreamCache(bouncer *Bouncer) {
for _, decision := range stream.New {
duration, err := time.ParseDuration(decision.Duration)
if err == nil {
setDecision(bouncer, decision.Value, true, int64(duration.Seconds()))
setDecision(bouncer.cache, decision.Value, true, int64(duration.Seconds()))
}
}
for _, decision := range stream.Deleted {
bouncer.cache.Del(decision.Value)
deleteDecision(bouncer.cache, decision.Value)
}
bouncer.crowdsecStreamHealthy = true
}
@@ -350,5 +370,14 @@ func validateParams(config *Config) error {
if err != nil {
return fmt.Errorf("CrowdsecLapiScheme://CrowdsecLapiHost: '%v://%v' must be an URL", config.CrowdsecLapiScheme, config.CrowdsecLapiHost)
}
if len(config.ForwardedHeadersTrustedIPs) > 0 {
_, err = ip.NewChecker(config.ForwardedHeadersTrustedIPs)
if err != nil {
return fmt.Errorf("ForwardedHeadersTrustedIPs must be a list of IP/CIDR :%v", err)
}
} else {
logger("No IP provided for ForwardedHeadersTrustedIPs")
}
return nil
}