Merge pull request #2 from maxlerebourg/dev

initial documentation and review

.traefik.yml

@@ -4,9 +4,11 @@ iconPath: .assets/icon.png
 
 import: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
 
-summary: 'Add Request Header'
+summary: 'Crowdsec Bouncer Traefik Plugin'
 
 testData:
-  Headers:
+  crowdsec:
-    X-Demo: test
+    bouncer:
-    X-URL: '{{URL}}'
+      enabled: true
+      crowdseclapikey: 40796d93c2958f9e58345514e67740e5
+

README.md

@@ -0,0 +1,74 @@
+[![Build Status](https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/workflows/Main/badge.svg?branch=master)](https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/actions)
+
+# Crowdsec Bouncer Traefik plugin
+
+This plugins aims to implement a Crowdsec Bouncer into a traefik plugin
+
+## Usage
+
+
+### Configuration
+
+For each plugin, the Traefik static configuration must define the module name (as is usual for Go packages).
+
+The following declaration (given here in YAML) defines a plugin:
+
+```yaml
+# Static configuration
+
+experimental:
+  localPlugins:
+    bouncer:
+      moduleName: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
+```
+
+```yaml
+# Dynamic configuration
+
+http:
+  routers:
+    my-router:
+      rule: host(`woami.localhost`)
+      service: service-foo
+      entryPoints:
+        - web
+      middlewares:
+        - my-plugin
+
+  services:
+    service-foo:
+      loadBalancer:
+        servers:
+          - url: http://127.0.0.1:5000
+  
+  middlewares:
+    crowdsec:
+      plugin:
+        bouncer:
+          enabled: true
+          crowdseclapikey: 40796d93c2958f9e58345514e67740e5
+```
+
+### Local Mode
+
+Traefik also offers a developer mode that can be used for temporary testing of plugins not hosted on GitHub.
+To use a plugin in local mode, the Traefik static configuration must define the module name (as is usual for Go packages) and a path to a [Go workspace](https://golang.org/doc/gopath_code.html#Workspaces), which can be the local GOPATH or any directory.
+
+The plugins must be placed in `./plugins-local` directory,
+which should be in the working directory of the process running the Traefik binary.
+The source code of the plugin should be organized as follows:
+
+```
+./plugins-local/
+    └── src
+        └── github.com
+            └── maxlerebourg
+                └── crowdsec-bouncer-traefik-plugin
+                    ├── bouncer.go
+                    ├── bouncer_test.go
+                    ├── go.mod
+                    ├── LICENSE
+                    ├── Makefile
+                    ├── readme.md
+                    └── vendor/* 
+```

bouncer.go

@@ -17,8 +17,6 @@ import (
 )
 
 const (
-	realIpHeader                = "X-Real-Ip"
-	forwardHeader               = "X-Forwarded-For"
 	crowdsecAuthHeader  = "X-Api-Key"
 	crowdsecRoute       = "v1/decisions"
 	crowdsecStreamRoute = "v1/decisions/stream"
@@ -66,7 +64,7 @@ type Bouncer struct {
 	client                 *http.Client
 }
 
-// New created a new Demo plugin.
+// New creates the crowdsec bouncer plugin.
 func New(ctx context.Context, next http.Handler, config *Config, name string) (http.Handler, error) {
 	requiredStrings := map[string]string{
 		"CrowdsecLapiScheme": config.CrowdsecLapiScheme,
@@ -88,6 +86,16 @@ func New(ctx context.Context, next http.Handler, config *Config, name string) (h
 			return nil, fmt.Errorf("%v cannot be less than 1", key)
 		}
 	}
+	// none -> If the client IP is on ban list, it will get a http code 403 response.
+	//         Otherwise, request will continue as usual. All request call the Crowdsec LAPI
+	// live ->  If the client IP is on ban list, it will get a http code 403 response.
+	//          Otherwise, request will continue as usual.
+	//          The bouncer can leverage use of a local cache in order to reduce the number
+	//          of requests made to the Crowdsec LAPI. It will keep in cache the status for
+	//          each IP that makes queries.
+	// stream -> Stream Streaming mode allows you to keep in the local cache only the Banned IPs,
+	// 			every requests that does not hit the cache is authorized.
+	// 			Every minute, the cache is updated with news from the Crowdsec LAPI.
 	if !contains([]string{"none", "live", "stream"}, config.CrowdsecMode) {
 		return nil, fmt.Errorf("CrowdsecMode must be one of: none, live or stream")
 	}
@@ -125,18 +133,22 @@ func New(ctx context.Context, next http.Handler, config *Config, name string) (h
 			Timeout: 5 * time.Second,
 		},
 	}
-	go handleStreamCache(bouncer, "true")
+	// if we are on a stream mode, we fetch in a go routine every minute the new decisions
+	if config.CrowdsecMode == "stream" {
+		go handleStreamCache(bouncer, true)
+	}
 	return bouncer, nil
 }
 
+// TODO the serve HTTP should be split as it's too long
 func (a *Bouncer) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
-	log.Printf("not enabled, %v", a.enabled )
 	if !a.enabled {
-		log.Printf("not enabled")
+		log.Printf("Crowdsec Bouncer not enabled")
 		a.next.ServeHTTP(rw, req)
 		return
 	}
 
+	// TODO Make sur remote address does not include the port
 	remoteHost, _, err := net.SplitHostPort(req.RemoteAddr)
 	if err != nil {
 		log.Printf("failed to extract ip from remote address: %v", err)
@@ -156,6 +168,7 @@ func (a *Bouncer) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
 		}
 	}
 
+	// Right here if we cannot join the stream we forbid the request to go on
 	if a.crowdsecMode == "stream" {
 		if a.crowdsecStreamHealthy {
 			a.next.ServeHTTP(rw, req)
@@ -165,7 +178,7 @@ func (a *Bouncer) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
 		return
 	}
 
-	if a.crowdsecMode == "none" || a.crowdsecMode == "live" {
+	// We are now in none or live mode
 	noneUrl := url.URL{
 		Scheme:   a.crowdsecScheme,
 		Host:     a.crowdsecHost,
@@ -221,14 +234,10 @@ func (a *Bouncer) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
 		setDecision(remoteHost, false, a.defaultDecisionTimeout)
 	}
 	a.next.ServeHTTP(rw, req)
-		return
-	}
-
-	a.next.ServeHTTP(rw, req)
 }
 
 // CUSTOM CODE
-
+// TODO place in another file
 type Decision struct {
 	Id        int    `json:"id"`
 	Origin    string `json:"origin"`
@@ -254,6 +263,8 @@ func contains(source []string, target string) bool {
 	return false
 }
 
+// Get Decision check in the cache if the IP has the banned / not banned value
+// Otherwise return with an error to add the IP in cache if we are on
 func getDecision(clientIP string) (bool, error) {
 	isBanned, ok := cache.Get(clientIP)
 	if ok && len(isBanned.(string)) > 0 {
@@ -274,15 +285,16 @@ func setDecision(clientIP string, isBanned bool, duration int64) {
 	}
 }
 
-func handleStreamCache(a *Bouncer, initialized string) {
+func handleStreamCache(a *Bouncer, initialized bool) {
-	time.AfterFunc(time.Duration(a.updateInterval) * time.Second, func () {
+	// TODO clean properly on exit
-		handleStreamCache(a, "false")
+	time.AfterFunc(time.Duration(a.updateInterval)*time.Second, func() {
+		handleStreamCache(a, false)
 	})
 	streamUrl := url.URL{
 		Scheme:   a.crowdsecScheme,
 		Host:     a.crowdsecHost,
 		Path:     crowdsecStreamRoute,
-		RawQuery: fmt.Sprintf("startup=%s", initialized),
+		RawQuery: fmt.Sprintf("startup=%t", initialized),
 	}
 	req, _ := http.NewRequest(http.MethodGet, streamUrl.String(), nil)
 	req.Header.Add(crowdsecAuthHeader, a.crowdsecKey)

bouncer_test.go

@@ -6,10 +6,10 @@ import (
 	"net/http/httptest"
 	"testing"
 
-	"github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
+	crowdsec_bouncer_traefik_plugin "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
 )
 
-func TestDemo(t *testing.T) {
+func TestCrowdSec(t *testing.T) {
 	cfg := crowdsec_bouncer_traefik_plugin.CreateConfig()
 	cfg.CrowdsecLapiKey = "caca"
 

docker-compose.yml

@@ -29,11 +29,9 @@ services:
       - "traefik.enable=true"
       - "traefik.http.routers.whoami.rule=Host(`localhost`)"
       - "traefik.http.routers.whoami.entrypoints=web"
-      - "traefik.http.routers.whoami.middlewares=testo@docker"
+      - "traefik.http.routers.whoami.middlewares=crowdsec@docker"
-      - "traefik.http.middlewares.testo.plugin.bouncer.enabled=true"
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.enabled=true"
-      - "traefik.http.middlewares.testo.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
-      # - "traefik.http.routers.whoami.middlewares=blacklist@docker"
-      # - "traefik.http.middlewares.blacklist.ipblacklist.sourcerange=127.0.0.1/32, 192.168.1.7"
 
   crowdsec:
     image: crowdsecurity/crowdsec:v1.4.1