* 🐛 fix appsec silently 403-ing gRPC streams with unreadable body
A bidirectional gRPC stream is an HTTP/2 request with no Content-Length
whose body never reaches EOF. Since #321 removed the ContentLength guard,
appsecQuery buffered it with io.ReadAll, which blocked until the request
timed out and was turned into a 403 (issue #323). The backend was never
reached (OriginStatus:0).
Mirror the reference lua-cs-bouncer behaviour: detect an unreadable body
(ProtoMajor >= 2 && ContentLength < 0) and, instead of buffering it,
forward the request to Appsec with headers only. Add a new
CrowdsecAppsecDropUnreadableBody option (default false) that mirrors the
reference APPSEC_DROP_UNREADABLE_BODY: when true, such requests are
blocked outright instead of forwarded without their body.
Readable HTTP/1.1 bodies are still buffered and inspected, so the bypass
closed by #321 stays closed.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* 🚨 appsec: satisfy linters (gocritic ifElseChain, misspell)
Rewrite the body-handling if/else chain in appsecQuery as a switch
(gocritic) and use US spelling "behavior" (misspell).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* 🔇 appsec: drop redundant unreadable-body debug log
Address review on #332: the caller (handleNextServeHTTP) already logs the
returned error with the request IP, so the inner Debug line duplicated it.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* 🍱 increase gocyclo
* 🍱 fix lint
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: maxlerebourg <maxlerebourg@gmail.com>
* Add parameter to configure Ban Response Content-Type
* Add testing for new BanResponseContentType parameter
* Ensure there is a fallback to default Content-Type is user provided empty value
* Set Content-Type even if banTemplate is nil
* Add more edge cases for testing ban response Content-Type
* Add CR/LF validation for BanResponseContentType
* Add CaptchaResponseContentType to allow separate Content-Type configuration for captcha responses
* Add testing for new CaptchaResponseContentType
* Update README
* Split nil and CR/LF response Content-Type value validation into separate function
* Throw error instead of setting the default in case of empty parameter declaration
* Update testing accordingly
* ✨ remove HTML from var name, add tests and infer content type from filePath
* 🍱 fix lint ?
* 🍱 fix lint
* 🍱 fix lint
* 🍱 fix lint + naming
* 🍱 fix lint
* 🍱 fuck lint
---------
Co-authored-by: maxlerebourg <maxlerebourg@gmail.com>
* 🐛 fall back to system trust store when no custom TLS CA is set
Closes#327.
Until now, configuring `crowdsecLapiScheme=https` forced the operator
to either provide `crowdsecLapiTLSCertificateAuthority` (a custom CA)
or set `crowdsecLapiTLSInsecureVerify=true` — there was no way to rely
on the host's system trust store, which is the expected setup when the
LAPI sits behind a reverse proxy with a publicly trusted (e.g. Let's
Encrypt) certificate.
Two contributing bugs:
- `validateParamsTLS` rejected an empty CA up-front.
- `getTLSConfig` always allocated an empty `tls.Config.RootCAs`,
which silently disabled the standard library's fall-back to
`x509.SystemCertPool()`.
Fix: drop the validation error for the empty-CA case and only allocate
`RootCAs` when a custom CA is actually provided. Same change applies
symmetrically to the AppSec path since the helper is shared.
Add unit tests covering the four meaningful states (HTTP, HTTPS with
system CA, HTTPS with custom CA, HTTPS with insecure verify) plus the
malformed-PEM rejection. README updated to document the system trust
store as an explicit option for both LAPI and AppSec HTTPS.
* 📝 fix gofmt alignment in TLS test struct
* ✅ update existing test: https without CA is now accepted
* ♻️ tests: hoist shared validPEM to package level, rename cfgGarbage
Address review on #331:
- the self-signed validPEM block was duplicated in two test funcs; declare it
once at package level and drop both local copies.
- rename cfgGarbage -> cfgInvalidCA (and its test case) for a descriptive name.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* ✅ e2e mock: add tls-system-ca scenario (HTTPS LAPI via system trust store)
CI regression coverage for this PR: with no custom CA configured, the bouncer
must fall back to the OS/system trust store for an HTTPS LAPI.
In the binary suite the "system trust store" is whatever Go's
x509.SystemCertPool() reads, which honours SSL_CERT_FILE on the Traefik process.
The scenario mints a throwaway CA, serves the mock LAPI over HTTPS with a cert
signed by it, and runs the stack twice:
- positive: SSL_CERT_FILE = our CA -> LAPI trusted -> 200
- negative: SSL_CERT_FILE = empty bundle -> not trusted -> 403 (fail-closed)
The negative run proves the patch still VERIFIES (not an insecure skip).
- mocklapi: optional --lapi-tls-cert/--lapi-tls-key to serve the LAPI over TLS.
- common.sh: opt-in LAPI_TLS_CERT/KEY (HTTPS mock) and TRAEFIK_SSL_CERT_FILE
(inject SSL_CERT_FILE into Traefik); both default-empty, other scenarios
unaffected.
- adds openssl as a scenario-only dependency.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
The sequence diagrams used the keyword `Destroy` (capital D). Mermaid
keywords are case-sensitive, so the invalid token aborted parsing and
every diagram failed to render on GitHub.
Lowercase all `Destroy` -> `destroy` in README.md and the captcha
example README. The `create` keyword was already correct, and each
create/destroy is properly paired with an adjacent message.
Fixes#270
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* 🍱 not block on stream startup
* 🍱 fix
* 🍱 fix lint
* 🍱 fix lint
* 🍱 fix lint
* 🍱 update readme
* 📚 clarify StreamStartupBlock warning in README
Make the fail-open implication of StreamStartupBlock=false explicit:
banned IPs are allowed through until the first stream sync completes.
* 🐛 clear isCrowdsecStreamStartup on alreadyUpdated path
When cacheTimeoutKey is already set (another instance/process has
populated the stream cache within the update window), the early return
in handleStreamCache used to leave isCrowdsecStreamStartup at true,
causing this instance to keep sending startup=true on subsequent ticks.
Flip the flag in the early-return path so startup is correctly tracked
across multi-instance deployments sharing a cache.
---------
Co-authored-by: mhx <mathieu@hanotaux.fr>
* Update README.md to show simplified dynamic configuration
The full dynamic configuration can be pretty intimidating as a starting point. Provide a simplified dynamic configuration to get up & running quickly.
* Update README.md
Set enabled to true
* 🐛 fix start up config error for appsec
* :doc: add documentation on appsec variables and missing conf parameter
* 🍱 fix lint
* 🍱 fix lint
* 🍱 fix lint
* 🍱 fix after lot of tests
* update exemple tls with new variables tested
* fix exemple appsec with release and not localplugin
---------
Co-authored-by: mhx <mathieu@hanotaux.fr>
* Add parameter to specify Request header value to inject in HTML template
* Add documentation for specifying request header value
* Fix example in docs for CustomHeader
* Update parameter name to traceCustomHeader
* Ensure naming is consitent with project
* 📝 Clean documentation in Readme
* 📝 Update readme
* 📝 Place exemples in seperated README
* ⬆️ Update traefik to 2.9.6 and crowdsec to 1.4.3 in exemples
* 📝 Add exemple at the right place
* 📝 Add documentation exemple 4 for vm binary usage
* :hammer:Update binary version
* 🔨 update
* 🔨 update
* 🚧 Working Crowdsec with tls auth
* 🐛 Add changes to download the plugin from the service
* 🔧 Add config middle for https
* 🔧 Update config for the exemple
* 🔧 Add conf for certs, working example
* 📝 Add doc for binary vm Readme
* 📝 update documentation for exemple and make
* 🚨 Fix lint
* 🚨 Fix Lint End of File
* ✨ Add support for insecure tls connections to LAPI
* 📝 Add documentation for the TLS insecure parameter
* 🚧 Add tls authority certificate and checks for params
* 📝 Add example for tls communication in readme and folder
* 📝 Update documentation and example for tls
* 🚨 Fix easy lint errors
* 🦺 logic to fetch certificates
* 🚨 Fix lint on readme
* ♻️ Refactor validate to fix lint and clean
* 🚧 Add doc, cert gen for crowdsec example
* 🚧 Progress on setting up Crowdsec with tls
* 🚧 Update certs validation for example
* ♻️ Add load variable from file or value and get client cert
* ♻️ Refactor getting variables
* 🚨 Fix lint, no new line on new files
* 🐛 Fix bug on condition check lapi key cert
* ♻️ Update after review
* ♻️ Update after review
* 🍱 fix mathieu code
* ♻️ Refactor logic of loading tls certificates
* 🍱 clean code
* 🍱 last fix
* 🍱 fix lint
* ♻️ Add documentation in readme, fix lint, remove unfinished tests
* 🐛 Fix conditions logics
* 🚨 Fix Lint
* ♻️ simplify code on getVariable
Co-authored-by: Max Lerebourg <maxlerebourg@gmail.com>
