Merge remote-tracking branch 'origin' into 271-feature-support-decision-scope

⬆️ renovate: Update all (#375 )
Co-authored-by: Renovate Bot <22881669+maxlerebourg@users.noreply.github.com>
2026-09-02 20:28:50 +02:00 · 2026-08-24 20:51:27 +02:00 · 2026-08-20 12:05:45 +02:00 · 2026-08-07 21:10:44 +02:00 · 2026-08-07 19:11:54 +02:00 · 2026-08-07 12:15:10 +02:00
17 changed files with 35 additions and 30 deletions
@@ -19,7 +19,7 @@ jobs:
    steps:
      - uses: actions/checkout@v7
      - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
        with:
          # Track go.mod (Go 1.22) — the plugin's yaegi-bound floor. Keeps the
          # single source of truth and builds the mock on the supported version.
@@ -32,7 +32,7 @@ jobs:
      # https://github.com/marketplace/actions/setup-go-environment
      - name: Set up Go ${{ env.GO_VERSION }}
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
        with:
          go-version: ${{ env.GO_VERSION }}
@@ -28,7 +28,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Run Renovate
-        uses: renovatebot/github-action@v46.1.21
+        uses: renovatebot/github-action@v46.2.2
        with:
          token: ${{ secrets.RENOVATE_TOKEN }}
        env:
@@ -651,7 +651,12 @@ func handleStreamCache(bouncer *Bouncer) error {
 	if err.Error() != cache.CacheMiss {
 		return err
 	}
-	bouncer.cacheClient.Set(cacheTimeoutKey, cache.NoBannedValue, bouncer.updateInterval-1)
+	// To avoid every instance trying to update the cache, set 1 second at least
 	leaseDuration := bouncer.updateInterval - 1
 	if leaseDuration < 1 {
 		leaseDuration = 1
 	}
 	bouncer.cacheClient.Set(cacheTimeoutKey, cache.NoBannedValue, leaseDuration)
 	streamRouteURL := url.URL{
 		Scheme:   bouncer.crowdsecScheme,
 		Host:     bouncer.crowdsecHost,
@@ -1,6 +1,6 @@
 services:
  traefik:
-    image: "traefik:v3.7.9"
+    image: "traefik:v3.7.11"
    container_name: "traefik"
    restart: unless-stopped
    command:
@@ -1,6 +1,6 @@
 services:
  traefik:
-    image: "traefik:v3.7.9"
+    image: "traefik:v3.7.11"
    container_name: "traefik"
    restart: unless-stopped
    command:
@@ -12,7 +12,7 @@ services:
      - "--entrypoints.web.address=:80"
      - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
-      - "--experimental.plugins.bouncer.version=v1.7.0"
+      - "--experimental.plugins.bouncer.version=v1.7.1"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      # - './ban.html:/ban.html:ro'
@@ -1,6 +1,6 @@
 services:
  traefik:
-    image: "traefik:v3.7.9"
+    image: "traefik:v3.7.11"
    container_name: "traefik"
    restart: unless-stopped
    command:
@@ -13,7 +13,7 @@ services:
      - "--entrypoints.web.address=:80"
      - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
-      - "--experimental.plugins.bouncer.version=v1.7.0"
+      - "--experimental.plugins.bouncer.version=v1.7.1"
      # - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
@@ -1,6 +1,6 @@
 services:
  cloudflare:
-    image: "traefik:v3.7.9"
+    image: "traefik:v3.7.11"
    container_name: "cloudflare"
    restart: unless-stopped
    command:
@@ -19,7 +19,7 @@ services:
      - 8080:8080
  traefik:
-    image: "traefik:v3.7.9"
+    image: "traefik:v3.7.11"
    container_name: "traefik"
    restart: unless-stopped
    command:
@@ -33,7 +33,7 @@ services:
      - "--entrypoints.web.forwardedheaders.trustedips=172.21.0.5"
      - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
-      - "--experimental.plugins.bouncer.version=v1.7.0"
+      - "--experimental.plugins.bouncer.version=v1.7.1"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - logs-traefik:/var/log/traefik
@@ -1,6 +1,6 @@
 services:
  traefik:
-    image: "traefik:v3.7.9"
+    image: "traefik:v3.7.11"
    container_name: "traefik"
    restart: unless-stopped
    command:
@@ -13,7 +13,7 @@ services:
      - "--entrypoints.web.address=:80"
      - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
-      - "--experimental.plugins.bouncer.version=v1.7.0"
+      - "--experimental.plugins.bouncer.version=v1.7.1"
      # - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
@@ -1,6 +1,6 @@
 services:
  traefik:
-    image: "traefik:v3.7.9"
+    image: "traefik:v3.7.11"
    container_name: "traefik"
    restart: unless-stopped
    command:
@@ -13,7 +13,7 @@ services:
      - "--entrypoints.web.address=:80"
      - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
-      - "--experimental.plugins.bouncer.version=v1.7.0"
+      - "--experimental.plugins.bouncer.version=v1.7.1"
      # - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
@@ -1,6 +1,6 @@
 services:
  traefik:
-    image: "traefik:v3.7.9"
+    image: "traefik:v3.7.11"
    container_name: "traefik"
    restart: unless-stopped
    command:
@@ -14,7 +14,7 @@ services:
      - "--entrypoints.web.forwardedheaders.trustedips=172.18.0.0/24"
      - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
-      - "--experimental.plugins.bouncer.version=v1.7.0"
+      - "--experimental.plugins.bouncer.version=v1.7.1"
      # - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
@@ -1,5 +1,5 @@
 image:
-  tag: v3.7.9
+  tag: v3.7.11
 logs:
  general:
@@ -15,4 +15,4 @@ experimental:
  plugins:
    bouncer:
      moduleName: "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
-      version: "v1.7.0"
+      version: "v1.7.1"
@@ -1,6 +1,6 @@
 services:
  traefik:
-    image: "traefik:v3.7.9"
+    image: "traefik:v3.7.11"
    container_name: "traefik"
    restart: unless-stopped
    command:
@@ -13,7 +13,7 @@ services:
      - "--entrypoints.web.address=:80"
      - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
-      - "--experimental.plugins.bouncer.version=v1.7.0"
+      - "--experimental.plugins.bouncer.version=v1.7.1"
      # - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
@@ -87,7 +87,7 @@ services:
      - "traefik.enable=false"
  redis-secure:
-    image: "redis:8.8.1-alpine"
+    image: "redis:8.10.0-alpine"
    container_name: "redis-secure"
    hostname: redis-secure
    restart: unless-stopped
@@ -1,6 +1,6 @@
 services:
  traefik:
-    image: "traefik:v3.7.9"
+    image: "traefik:v3.7.11"
    container_name: "traefik"
    restart: unless-stopped
    command:
@@ -13,7 +13,7 @@ services:
      - "--entrypoints.web.address=:80"
      - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
-      - "--experimental.plugins.bouncer.version=v1.7.0"
+      - "--experimental.plugins.bouncer.version=v1.7.1"
      # - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
@@ -1,6 +1,6 @@
 services:
  traefik:
-    image: "traefik:v3.7.9"
+    image: "traefik:v3.7.11"
    container_name: "traefik"
    restart: unless-stopped
    command:
@@ -13,7 +13,7 @@ services:
      - "--entrypoints.web.address=:80"
      - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
-      - "--experimental.plugins.bouncer.version=v1.7.0"
+      - "--experimental.plugins.bouncer.version=v1.7.1"
      # - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
@@ -1,6 +1,6 @@
 services:
  traefik:
-    image: "traefik:v3.7.9"
+    image: "traefik:v3.7.11"
    container_name: "traefik"
    restart: unless-stopped
    command:
@@ -13,7 +13,7 @@ services:
      - "--entrypoints.web.address=:80"
      - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
-      - "--experimental.plugins.bouncer.version=v1.7.0"
+      - "--experimental.plugins.bouncer.version=v1.7.1"
      # - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
@@ -14,7 +14,7 @@
 set -euo pipefail
 # Pinned to match the Docker suite (tests/e2e/scenarios/*/docker-compose.yml).
-TRAEFIK_VERSION="${TRAEFIK_VERSION:-v3.7.9}"
+TRAEFIK_VERSION="${TRAEFIK_VERSION:-v3.7.11}"
 WEB_PORT="${WEB_PORT:-8000}"
 LAPI_PORT="${LAPI_PORT:-8090}"
Author	SHA1	Message	Date
maxlerebourg	0f8608d770	Merge remote-tracking branch 'origin' into 271-feature-support-decision-scope	2026-08-24 20:51:27 +02:00
maxlerebourgandRenovate Bot	ae7481caa5	⬆️ renovate: Update all (#375 ) Co-authored-by: Renovate Bot <22881669+maxlerebourg@users.noreply.github.com>	2026-08-20 12:05:45 +02:00
mathieuHaandClaude Opus 5	955391671c	♻️ review fixes for #368 : CIDR key correctness, lookup cost, tests (#372 ) * ♻️ cidr: build keys through net.IPNet instead of hand-masking bytes CIDRKeys masked the address byte by byte and formatted the result with string concatenation, while SetCIDR/DeleteCIDR format their keys with net.IPNet.String() via NormalizeCIDR. The two agreed only by coincidence: any divergence in formatting silently stops every range decision from matching, with no test covering the invariant. Mask with net.IP.Mask and format through net.IPNet.String() so both sides go through the same formatter. Output is byte for byte identical to the previous implementation (checked against a golden dump of both IPv4 and IPv6 keys, including ::ffff: forms). Dropping the inner byte loops also removes the only intrange violation in the tree, so the linter exclusion added for them is no longer needed, and the redundant import alias on pkg/ip goes away with it. * ⚡ cidr: only probe the prefix lengths that have a decision In stream mode nothing caches a negative result per IP, so the exact IP lookup misses on every legitimate request and each one fell through to GetCIDR, which probed every possible prefix length: 33 cache reads for an IPv4 client, 129 for an IPv6 one, even when no range decision existed at all. On the local cache that is wasted work on the request path; with redis it is 33 to 129 sequential round trips per request. Keep the set of prefix lengths that have at least one decision under a single key, written before the decision itself, and probe only those. Measured cache reads per request: 1 with no range decision (was 33 / 129), 2 with a single /24 in use, 4 with four prefix lengths in use. The set only grows, so a deleted or expired decision leaves a length behind that costs one extra read rather than risking an unmatched decision, and it is written with an effectively infinite duration since it has to outlive every decision it describes. If it is ever missing while decisions live (a redis eviction under maxmemory), range decisions stop matching until the next one arrives; it is the hottest key of the namespace, so an LRU policy evicts it last. * 🔊 cidr: log the decisions dropped for an unparsable CIDR SetCIDR and DeleteCIDR returned silently when NormalizeCIDR rejected the value, so a range decision the plugin does not understand is not enforced and nothing says why. Every other operation of the package logs, and this one fails open, which is the direction worth shouting about. Log at Error with the raw value and what the consequence is, so an unexpected decision format shows up in the logs instead of looking like a decision that was applied. * ✅ cidr: cover the invariant the range matching rests on The helpers were tested in isolation but nothing tied them together, and what actually has to hold is that the key SetCIDR writes for a decision is one of the keys GetCIDR looks up for an IP that decision covers. A formatting change on either side would have silently stopped every range decision from matching with all tests green. TestCIDRKeys_MatchNormalizeCIDR pins that both ways, including the cases worth being explicit about: a decision that is not on a network address, IPv4 mapped clients against an IPv4 range, and that the two families do not mix. Dropping the mask in cidrKey fails 9 of its cases. Also covers CIDRLookupKeys against CIDRKeys length by length, the IPv6 side of the network address test, and CIDRPrefixLen. * ✅ cache: cover the CIDR operations and what a lookup costs pkg/cache had tests for Get, Set and Delete but none for their CIDR counterparts, so the range keyspace was only exercised end to end by the e2e scenario. Test_GetCIDR covers hits, the boundaries of a range, IPv6, IPv4 mapped clients and invalid input. Test_GetCIDR_MostSpecific pins the precedence between overlapping decisions, which is deliberate behaviour that nothing was holding in place: a captcha on a /24 is not overruled by a ban on its /8. Test_DeleteCIDR checks the wider decision survives a narrower one being removed, and Test_SetCIDR_InvalidIsNotStored that a rejected value stores nothing at all. Test_GetCIDR_Reads counts cache reads through an isolated cacheInterface, so the cost of a lookup is part of the contract: probing every prefix length again turns it into 34 reads for IPv4 and 130 for IPv6 and fails. * 🐛 e2e: stop racing the deadline in the stream failure check handleStreamTicker compares updateFailure to updateMaxFailure before incrementing it, so with updateMaxFailure 2 and a 1s interval the bouncer gives up on the third consecutive failed poll, roughly 3s after the endpoint starts failing. The check slept 2s and then polled for a 200 for up to 15s, leaving about a second of margin, and once that window closes it never reopens: a runner under load turns this into a 15s wait followed by a failure. Assert the 200 immediately after the endpoint starts failing, which is always inside the window, and keep polling for the 403 that follows. * 🐛 e2e: do not fail a scenario on a single slow response The new -m 1 is right for the polling helpers, where a timed out request is just another attempt, but the assertions and the mock control plane have no retry: one request that takes over a second on a loaded runner fails the scenario, and since common.sh runs under set -euo pipefail a timed out lapi_add_decision aborts it before the decision even exists. Bound the connect at 1s instead and give the whole request 5s in the seven places that get a single attempt. Nothing waits longer on the happy path. * ⏪ e2e: restore the stream-mode failure check Revert `99673b1`. The check is not ours to change: it must stay as it was. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * 🔥 e2e: drop the comment above wait_for_status The timeout change in `3f78887` stands; only the comment goes. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-07 21:10:44 +02:00
mathieuHaandmaxlerebourg	9b8d6b937c	🐛 keep the stream lease alive when updateIntervalSeconds is 1 (#371 ) * 🐛 keep the stream lease alive when updateIntervalSeconds is 1 handleStreamCache takes a lease so a single node polls LAPI per interval, and stores it for updateInterval-1 seconds. The e2e stream scenario now sets updateIntervalSeconds to 1, which makes that a 0 second duration: golang-ttl-map returns early on a zero ttl (map.go:114) and redis rejects a non positive EX, so the lease is never stored and the guard silently does nothing. Floor the duration at 1 second. At an interval of 1 the lease can survive a tick that fires slightly early and cost one skipped poll, which is far better than every node polling every tick against a shared redis. * Adjust lease duration to prevent cache update conflicts Updated lease duration logic to ensure a minimum of 1 second. --------- Co-authored-by: maxlerebourg <maxlerebourg@gmail.com>	2026-08-07 19:11:54 +02:00
maxlerebourgandRenovate Bot	d57ead2ec7	⬆️ renovate: Update actions/setup-go action to v7 (#364 ) Co-authored-by: Renovate Bot <22881669+maxlerebourg@users.noreply.github.com>	2026-08-07 12:15:10 +02:00