From d9d92ed92d5ac8b1debc1d5bf24f5c8b6a647b98 Mon Sep 17 00:00:00 2001 From: Max Lerebourg Date: Thu, 29 Sep 2022 22:08:52 +0200 Subject: [PATCH] :bento: lint --- README.md | 2 ++ bouncer.go | 44 ++++++++++++++++++++++++-------------------- 2 files changed, 26 insertions(+), 20 deletions(-) diff --git a/README.md b/README.md index 4e49d83..8ea9fbd 100644 --- a/README.md +++ b/README.md @@ -142,6 +142,8 @@ This LAPI key must be set where is noted FIXME-LAPI-KEY in the docker-compose-te whoami: labels: - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=FIXME-LAPI-KEY" + - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapischeme=http" + - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapihost=crowdsec:8080" ... crowdsec: environment: diff --git a/bouncer.go b/bouncer.go index b87d1e7..89c7624 100644 --- a/bouncer.go +++ b/bouncer.go @@ -19,14 +19,18 @@ import ( ) const ( - crowdsecLapiHeader = "X-Api-Key" - crowdsecCapiHeader = "Authorization" - crowdsecLapiRoute = "v1/decisions" - crowdsecLapiStreamRoute = "v1/decisions/stream" - crowdsecCapiLogin = "v2/watchers/login" - crowdsecCapiDecisions = "v2/decisions/stream" - cacheBannedValue = "t" - cacheNoBannedValue = "f" + aloneMode = "alone" + streamMode = "stream" + liveMode = "live" + noneMode = "none" + crowdsecLapiHeader = "X-Api-Key" + crowdsecCapiHeader = "Authorization" + crowdsecLapiRoute = "v1/decisions" + crowdsecLapiStreamRoute = "v1/decisions/stream" + crowdsecCapiLogin = "v2/watchers/login" + crowdsecCapiDecisions = "v2/decisions/stream" + cacheBannedValue = "t" + cacheNoBannedValue = "f" ) // Config the plugin configuration. @@ -47,7 +51,7 @@ type Config struct { func CreateConfig() *Config { return &Config{ Enabled: false, - CrowdsecMode: "alone", + CrowdsecMode: streamMode, CrowdsecLapiScheme: "http", CrowdsecLapiHost: "crowdsec:8080", CrowdsecLapiKey: "", @@ -83,7 +87,7 @@ type Bouncer struct { // New creates the crowdsec bouncer plugin. func New(ctx context.Context, next http.Handler, config *Config, name string) (http.Handler, error) { var requiredStrings map[string]string - if config.CrowdsecMode == "alone" { + if config.CrowdsecMode == aloneMode { requiredStrings = map[string]string{ "CrowdsecCapiLogin": config.CrowdsecLapiScheme, "CrowdsecCapiPwd": config.CrowdsecLapiHost, @@ -119,7 +123,7 @@ func New(ctx context.Context, next http.Handler, config *Config, name string) (h return nil, fmt.Errorf("%v: cannot be empty", key) } } - if !contains([]string{"none", "live", "stream", "alone"}, config.CrowdsecMode) { + if !contains([]string{noneMode, liveMode, streamMode, aloneMode}, config.CrowdsecMode) { return nil, fmt.Errorf("CrowdsecMode: must be one of 'none', 'live' or 'stream'") } if !contains([]string{"http", "https"}, config.CrowdsecLapiScheme) { @@ -160,9 +164,9 @@ func New(ctx context.Context, next http.Handler, config *Config, name string) (h cache: ttl_map.New(), } // if we are on a stream mode, we fetch in a go routine every minute the new decisions. - if config.CrowdsecMode == "stream" { + if config.CrowdsecMode == streamMode { go handleStreamCache(bouncer, true) - } else if config.CrowdsecMode == "alone" { + } else if config.CrowdsecMode == aloneMode { getToken(bouncer) time.AfterFunc(10*time.Second, func() { handleStreamCache(bouncer, false) @@ -186,7 +190,7 @@ func (a *Bouncer) ServeHTTP(rw http.ResponseWriter, req *http.Request) { return } - if a.crowdsecMode == "stream" || a.crowdsecMode == "live" { + if a.crowdsecMode == streamMode || a.crowdsecMode == liveMode { isBanned, err := getDecision(a.cache, remoteHost) if err == nil { if isBanned { @@ -199,7 +203,7 @@ func (a *Bouncer) ServeHTTP(rw http.ResponseWriter, req *http.Request) { } // Right here if we cannot join the stream we forbid the request to go on. - if a.crowdsecMode == "stream" { + if a.crowdsecMode == streamMode { if a.crowdsecStreamHealthy { a.next.ServeHTTP(rw, req) } else { @@ -278,7 +282,7 @@ func handleNoStreamCache(a *Bouncer, rw http.ResponseWriter, req *http.Request, body := crowdsecQuery(a, routeURL.String(), false) if bytes.Equal(body, []byte("null")) { - if a.crowdsecMode == "live" { + if a.crowdsecMode == liveMode { setDecision(a.cache, remoteHost, false, a.defaultDecisionTimeout) } a.next.ServeHTTP(rw, req) @@ -293,7 +297,7 @@ func handleNoStreamCache(a *Bouncer, rw http.ResponseWriter, req *http.Request, return } if len(decisions) == 0 { - if a.crowdsecMode == "live" { + if a.crowdsecMode == liveMode { setDecision(a.cache, remoteHost, false, a.defaultDecisionTimeout) } a.next.ServeHTTP(rw, req) @@ -315,7 +319,7 @@ func handleStreamCache(a *Bouncer, initialized bool) { }) var rawQuery string var path string - if a.crowdsecMode == "alone" { + if a.crowdsecMode == aloneMode { rawQuery = "" path = crowdsecCapiDecisions } else { @@ -380,7 +384,7 @@ func crowdsecQuery(a *Bouncer, stringURL string, isPost bool) []byte { } else { req, _ = http.NewRequest(http.MethodGet, stringURL, nil) } - if a.crowdsecMode == "alone" { + if a.crowdsecMode == aloneMode { req.Header.Add(crowdsecCapiHeader, a.crowdsecKey) } else { req.Header.Add(crowdsecLapiHeader, a.crowdsecKey) @@ -391,7 +395,7 @@ func crowdsecQuery(a *Bouncer, stringURL string, isPost bool) []byte { a.crowdsecStreamHealthy = false return nil } - if res.StatusCode == http.StatusUnauthorized && a.crowdsecMode == "alone" { + if res.StatusCode == http.StatusUnauthorized && a.crowdsecMode == aloneMode { oldToken := a.crowdsecKey getToken(a) if oldToken == a.crowdsecKey {