Rework variables name, and logic to check IPs with strategy

bouncer.go

@@ -45,7 +45,7 @@ type Config struct {
 	DefaultDecisionSeconds     int64    `json:"defaultDecisionSeconds,omitempty"`
 	ForwardedHeadersCustomName string   `json:"forwardedheaderscustomheader,omitempty"`
 	ForwardedHeadersTrustedIPs []string `json:"forwardedHeadersTrustedIps,omitempty"`
-	TrustedIPs                 []string `json:"TrustedIps,omitempty"`
+	ClientTrustedIPs           []string `json:"clientTrustedIps,omitempty"`
 	RedisCacheEnabled          bool     `json:"redisCacheEnabled,omitempty"`
 	RedisCacheHost             string   `json:"redisCacheHost,omitempty"`
 }
@@ -54,7 +54,7 @@ type Config struct {
 func CreateConfig() *Config {
 	return &Config{
 		Enabled:                    false,
-		LogLevel:                   "INFO",
+		LogLevel:                   "DEBUG",
 		CrowdsecMode:               liveMode,
 		CrowdsecLapiScheme:         "http",
 		CrowdsecLapiHost:           "crowdsec:8080",
@@ -62,7 +62,7 @@ func CreateConfig() *Config {
 		UpdateIntervalSeconds:      60,
 		DefaultDecisionSeconds:     60,
 		ForwardedHeadersTrustedIPs: []string{},
-		TrustedIPs:                 []string{},
+		ClientTrustedIPs:           []string{},
 		ForwardedHeadersCustomName: "X-Forwarded-For",
 		RedisCacheEnabled:          false,
 		RedisCacheHost:             "redis:6379",
@@ -83,9 +83,8 @@ type Bouncer struct {
 	updateInterval         int64
 	defaultDecisionTimeout int64
 	customHeader           string
-	poolStrategy           *ip.PoolStrategy
-	poolStrategyTrusted    *ip.PoolStrategy
-	CheckerTrusted         *ip.Checker
+	serverPoolStrategy     *ip.PoolStrategy
+	clientPoolStrategy     *ip.PoolStrategy
 	client                 *http.Client
 }
 
@@ -98,16 +97,8 @@ func New(ctx context.Context, next http.Handler, config *Config, name string) (h
 		return nil, err
 	}
 
-	checker, err := ip.NewChecker(config.ForwardedHeadersTrustedIPs)
-	if err != nil {
-		logger.Debug("Checker == nil")
-		logger.Debug(err.Error())
-	}
-	checkerTrusted, err := ip.NewChecker(config.TrustedIPs)
-	if err != nil {
-		logger.Debug("CheckerTrusted == nil")
-		logger.Debug(err.Error())
-	}
+	serverChecker, _ := ip.NewChecker(config.ForwardedHeadersTrustedIPs)
+	clientChecker, _ := ip.NewChecker(config.ClientTrustedIPs)
 
 	bouncer := &Bouncer{
 		next:     next,
@@ -122,13 +113,12 @@ func New(ctx context.Context, next http.Handler, config *Config, name string) (h
 		updateInterval:         config.UpdateIntervalSeconds,
 		customHeader:           config.ForwardedHeadersCustomName,
 		defaultDecisionTimeout: config.DefaultDecisionSeconds,
-		poolStrategy: &ip.PoolStrategy{
-			Checker: checker,
+		serverPoolStrategy: &ip.PoolStrategy{
+			Checker: serverChecker,
 		},
-		poolStrategyTrusted: &ip.PoolStrategy{
-			Checker: checkerTrusted,
+		clientPoolStrategy: &ip.PoolStrategy{
+			Checker: clientChecker,
 		},
-		CheckerTrusted: checkerTrusted,
 		client: &http.Client{
 			Transport: &http.Transport{
 				MaxIdleConns:    10,
@@ -157,36 +147,24 @@ func (bouncer *Bouncer) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
 		return
 	}
 	// Here we check for the trusted IPs in the customHeader
-	remoteHost, err := ip.GetRemoteIP(req, bouncer.poolStrategyTrusted, bouncer.customHeader)
+	remoteHost, err := ip.GetRemoteIP(req, bouncer.serverPoolStrategy, bouncer.customHeader)
 	if err != nil {
 		logger.Info(err.Error())
 		bouncer.next.ServeHTTP(rw, req)
 		return
 	}
-	if bouncer.CheckerTrusted == nil {
-		logger.Debug("CheckerTrusted == nil")
-	} else {
-		trusted, err := bouncer.CheckerTrusted.Contains(remoteHost)
-		if err != nil {
-			logger.Info(err.Error())
-			return
-		}
-		// if our IP is in the trusted list we bypass the next checks
-		if trusted {
-			logger.Debug(fmt.Sprintf("IP %v is trusted", remoteHost))
-			bouncer.next.ServeHTTP(rw, req)
-			return
-		}
-	}
 
-	// Here we get the IP from the trusted header customHeader
-	remoteHost, err = ip.GetRemoteIP(req, bouncer.poolStrategy, bouncer.customHeader)
+	trusted, err := bouncer.clientPoolStrategy.Checker.Contains(remoteHost)
 	if err != nil {
 		logger.Info(err.Error())
+		return
+	}
+	// if our IP is in the trusted list we bypass the next checks
+	logger.Debug(fmt.Sprintf("ServeHTTP ip:%v isTrusted:%v", remoteHost, trusted))
+	if trusted {
 		bouncer.next.ServeHTTP(rw, req)
 		return
 	}
-	logger.Debug(fmt.Sprintf("ServeHTTP ip:%v", remoteHost))
 
 	healthy := crowdsecStreamHealthy
 	if bouncer.crowdsecMode != noneMode {
@@ -196,7 +174,7 @@ func (bouncer *Bouncer) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
 			if err.Error() == simpleredis.RedisUnreachable {
 				healthy = false
 			}
-		} else  {
+		} else {
 			logger.Debug(fmt.Sprintf("ServeHTTP cache:hit isBanned:%v", isBanned))
 			if isBanned {
 				rw.WriteHeader(http.StatusForbidden)
@@ -423,8 +401,8 @@ func validateParams(config *Config) error {
 	} else {
 		logger.Debug("No IP provided for ForwardedHeadersTrustedIPs")
 	}
-	if len(config.TrustedIPs) > 0 {
-		_, err = ip.NewChecker(config.TrustedIPs)
+	if len(config.ClientTrustedIPs) > 0 {
+		_, err = ip.NewChecker(config.ClientTrustedIPs)
 		if err != nil {
 			return fmt.Errorf("TrustedIPs must be a list of IP/CIDR :%w", err)
 		}