🍱 fix waiter

✨ fix loop

.github/workflows/main.yml

@@ -3,7 +3,7 @@ name: Main
 on:
   push:
     branches:
-      - master
+      - main
   pull_request:
 
 jobs:

.gitignore

@@ -1,2 +1,6 @@
 .idea/
 .DS_Store
+config
+db
+logs
+docker-compose.dev.yml

.traefik.yml

@@ -4,11 +4,9 @@ iconPath: .assets/icon.png
 
 import: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
 
-summary: 'Crowdsec Bouncer Traefik Plugin'
+summary: Middleware plugin which forwards the request IP to local Crowdsec agent, which can be used to allow/deny the request  
 
 testData:
-  crowdsec:
-    bouncer:
-      enabled: true
+  Enabled: false
   CrowdsecLapiKey: 40796d93c2958f9e58345514e67740e5
 

Makefile

@@ -18,3 +18,25 @@ vendor:
 
 clean:
 	rm -rf ./vendor
+
+run_dev:
+	docker-compose -f docker-compose.dev.yml up -d --remove-orphans
+
+run_local:
+	docker-compose -f docker-compose.local.yml up -d --remove-orphans
+
+run:
+	docker-compose -f docker-compose.yml up -d --remove-orphans
+
+restart_docker_dev:
+	docker-compose -f docker-compose.dev.yml restart
+
+restart_docker_local:
+	docker-compose -f docker-compose.local.yml restart
+
+restart_docker:
+	docker-compose -f docker-compose.yml restart
+
+show_metrics:
+	docker exec crowdsec cscli metrics
+

README.md

@@ -1,4 +1,8 @@
-[![Build Status](https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/workflows/Main/badge.svg?branch=master)](https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/actions)
+![GitHub](https://img.shields.io/github/license/maxlerebourg/crowdsec-bouncer-traefik-plugin)
+![GitHub go.mod Go version](https://img.shields.io/github/go-mod/go-version/maxlerebourg/crowdsec-bouncer-traefik-plugin)
+![GitHub tag (latest SemVer)](https://img.shields.io/github/v/tag/maxlerebourg/crowdsec-bouncer-traefik-plugin)
+[![Build Status](https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/actions/workflows/go-cross.yml/badge.svg)](https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/actions)
+[![Go Report Card](https://goreportcard.com/badge/github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin)](https://goreportcard.com/badge/github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin)
 
 # Crowdsec Bouncer Traefik plugin
 
@@ -6,9 +10,76 @@ This plugins aims to implement a Crowdsec Bouncer into a traefik plugin.
 > [CrowdSec](https://www.crowdsec.net/) is an open-source and collaborative IPS (Intrusion Prevention   System) and a security suite.
 > We leverage local behavior analysis and crowd power to build the largest CTI network in the world.
 
+The purpose is to enable treafik to authorize or block requests from IP based and their reputation and behavior.
+
+The crowdsec utility will provide the community blocklist which contains highly reported and validated IP banned from the crowdsec network.
+
+When used with crowdsec it will leverage the local API which will analyze traefik logs and take decisions on the requests made by users/bots. Malicious actors will be banned based on patterns against your website.
+
+There are 4 operating modes (CrowdsecMode) for this plugin:
+
+| Mode | Description |
+|------|------|
+| none | If the client IP is on ban list, it will get a http code 403 response. Otherwise, request will continue as usual. All request call the Crowdsec LAPI |
+| live | If the client IP is on ban list, it will get a http code 403 response. Otherwise, request will continue as usual.    The bouncer can leverage use of a local cache in order to reduce the number of requests made to the Crowdsec LAPI. It will keep in cache the status for  each IP that makes queries. |
+| stream | Stream Streaming mode allows you to keep in the local cache only the Banned IPs, every requests that does not hit the cache is authorized. Every minute, the cache is updated with news from the Crowdsec LAPI. |
+| alone | Standalone mode, similar to the streaming mode but the blacklisted IPs are fetched on the CAPI. Every 2 hours, the cache is updated with news from the Crowdsec CAPI. It does not include any localy banned IP, but can work without a crowdsec service|
+
+The recommanded mode for performance is the streaming mode, decisions are updated every 60 sec by default and that's the only communication between traefik and crowdsec. Every requests that happens hits the cache for quick decisions.
+
 ## Usage
 
+To get started, use the `docker-compose.yml` file.
 
+You can run it with:
+```bash
+make run
+```
+
+### Note
+Each middleware in traefik has it's own data and is instanciated by service.
+This means if there are 10 services protected by the bouncer in streaming alone or live mode, the cache will be duplicated to all 10 services.
+This is because traefik does not allow plugins to store data locally that can be consummed.
+
+The synchronisation with the crowdsec service will happen also 10 times in the period selected.
+It should be taken into account when fixing this period so each middleware has time to sync data from crowdsec.
+
+At each start of synchronisation, the middleware will wait a random number of seconds to avoid simultaneous calls to crowdsec.
+
+### Variables
+- Enabled
+  - bool
+  - enable the plugin
+- CrowdsecMode
+  - string
+  - default: `stream`, expected value are: `none`, `live`, `stream`, `alone`
+- CrowdsecLapiScheme
+  - string
+  - default: `http`, expected value are: `http`, `https`
+- CrowdsecLapiHost
+  - string
+  - default: "crowdsec:8080"
+  - Crowdsec LAPI available on which host.
+- CrowdsecLapiKey
+  - string
+  - Crowdsec LAPI generated key for the bouncer : **must be unique by service**. 
+- CrowdsecCapiLogin
+  - string
+  - Used only in `alone` mode, login for Crowdsec CAPI
+- CrowdsecCapiPwd
+  - string
+  - Used only in `alone` mode, password for Crowdsec CAPI
+- CrowdsecCapiScenarios
+  - []string
+  - Used only in `alone` mode, scenarios for Crowdsec CAPI
+- UpdateIntervalSeconds
+  - int64
+  - default: 60
+  - Used only in `stream` mode, interval between fetching blacklisted IPs from LAPI
+- DefaultDecisionSeconds
+  - int64
+  - default: 60
+  - Used only in `live` mode, decision duration of accepted IPs
 
 ### Configuration
 
@@ -20,7 +91,7 @@ The following declaration (given here in YAML) defines a plugin:
 # Static configuration
 
 experimental:
-  localPlugins:
+  plugins:
     bouncer:
       moduleName: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
 ```
@@ -36,7 +107,7 @@ http:
       entryPoints:
         - web
       middlewares:
-        - my-plugin
+        - crowdsec
 
   services:
     service-foo:
@@ -48,8 +119,88 @@ http:
     crowdsec:
       plugin:
         bouncer:
-          enabled: true
-          crowdseclapikey: 40796d93c2958f9e58345514e67740e5
+          enabled: false
+          updateIntervalSeconds: 60
+          defaultDecisionSeconds: 60
+          crowdsecMode: stream
+          crowdsecLapiKey: privateKey
+          crowdsecLapiHost: crowdsec:8080
+          crowdsecLapiScheme: http
+          crowdsecCapiLogin: login
+          crowdsecCapiPwd: password
+          crowdsecCapiScenarios:
+            - scenario1
+            - scenario2
+            ...
+
+```
+Except for the crowdsecLapiKey, crowdsecCapiLogin, crowdsecCapiPwd, crowdsecCapiScenarios, these are the default value of the plugin.
+
+#### Generate LAPI KEY (exept for `alone` mode)
+You need to generate a crowdsec API key for the LAPI.
+You can follow the documentation here: https://docs.crowdsec.net/docs/user_guides/lapi_mgmt/
+
+```bash
+docker-compose -f docker-compose-local.yml up -d crowdsec
+docker exec crowdsec cscli bouncers add crowdsecBouncer
+```
+
+This LAPI key must be set where is noted FIXME-LAPI-KEY in the docker-compose-test.yml
+```yaml
+...
+whoami:
+  labels:
+    - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=FIXME-LAPI-KEY"
+    - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapischeme=http"
+    - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapihost=crowdsec:8080"
+...
+crowdsec:
+  environment:
+    BOUNCER_KEY_TRAEFIK: FIXME-LAPI-KEY
+...
+```
+
+You can then run all the containers:
+```bash
+docker-compose up -d
+```
+
+#### Generate CAPI credentials (only for `alone` mode)
+You need to create a crowdsec API credentials for the CAPI.
+You can follow the documentation here: https://docs.crowdsec.net/docs/central_api/intro
+
+```bash
+curl -X POST "https://api.crowdsec.net/v2/watchers" -H  "accept: application/json" -H  "Content-Type: application/json" -d "{ \"password\": \"PASSWORD\",  \"machine_id\": \"LOGIN\"}"
+```
+
+These CAPI credentials must be set in your docker-compose.yml or in your config files
+```yaml
+...
+traefik:
+  command:
+    ...
+    - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
+    - "--experimental.plugins.bouncer.version=v1.0.0"
+    ...
+whoami:
+  labels:
+    - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseccapilogin=LOGIN"
+    - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseccapipwd=PASSWORD"
+    - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseccapiscenarios=scenario1, scenario2, ..."
+    - "traefik.http.middlewares.crowdsec.plugin.bouncer.enabled=true"
+```
+
+You can then run all the containers:
+```bash
+docker-compose up -d
+```
+
+#### Add manually an IP to the blocklist (testing purpose)
+
+```bash
+docker-compose up -d crowdsec
+docker exec crowdsec cscli decisions add --ip 10.0.0.10 # this will be effective 4h
+docker exec crowdsec cscli decisions remove --ip 10.0.0.10
 ```
 
 ### Local Mode
@@ -75,13 +226,20 @@ The source code of the plugin should be organized as follows:
                     ├── readme.md
                     └── vendor/* 
 ```
+
+For local developpement a docker-compose.local.yml is provided and reproduce the directory layout needed by traefik. This works once you have generated and filled your LAPI-KEY (crowdsecLapiKey), if not look below for informations
+
+```bash
+docker-compose -f docker-compose.local.yml up -d
+```
+
 ### About
 
-[maxlerebourg](https://github.com/maxlerebourg) and [I](https://github.com/mhanotaux) have been using traefik since 2020.
-We come from developper and security engineer background and wanted to add the power of a very promesing technologie (Crowdsec) into the edge router we love.
+Me and [mathieuHa](https://github.com/mathieuHa) have been using traefik since 2020 at [Primadviz](https://primadviz.com).
+We come from web developper and security engineer background and wanted to add the power of a very promesing technology (Crowdsec) into the edge router we love.
 
 We initially run into this project: https://github.com/fbonalair/traefik-crowdsec-bouncer
 It was using traefik and forward auth middleware to verify every requests.
 They had to go through a webserver which then contacts of another webservice (the crowdsec LAPI) to make a decision based on the source IP.
-We initially proposed some improvement by implementing a streaming mode and a local cache
+We initially proposed some improvement by implementing a streaming mode and a local cache.
 With the Traefik hackathon we deciced to implement our solution directly as a traefik plugin which could be found by every one on plugins.traefik.io and be more performant.

acquis.yaml

@@ -1,4 +1,4 @@
 filenames:
- - /var/log/traefik/*.log
+ - /var/log/traefik/access.log
 labels:
   type: traefik

bouncer.go

@@ -5,11 +5,14 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"io"
 	"io/ioutil"
 	"log"
+	"math/rand"
 	"net"
 	"net/http"
 	"net/url"
+	"strings"
 	"text/template"
 	"time"
 
@@ -17,37 +20,51 @@ import (
 )
 
 const (
-	crowdsecAuthHeader  = "X-Api-Key"
-	crowdsecRoute       = "v1/decisions"
-	crowdsecStreamRoute = "v1/decisions/stream"
+	aloneMode               = "alone"
+	streamMode              = "stream"
+	liveMode                = "live"
+	noneMode                = "none"
+	crowdsecLapiHeader      = "X-Api-Key"
+	crowdsecCapiHeader      = "Authorization"
+	crowdsecLapiRoute       = "v1/decisions"
+	crowdsecLapiStreamRoute = "v1/decisions/stream"
+	crowdsecCapiLogin       = "v2/watchers/login"
+	crowdsecCapiDecisions   = "v2/decisions/stream"
 	cacheBannedValue        = "t"
 	cacheNoBannedValue      = "f"
 )
 
-var cache = ttl_map.New()
-
+// Config the plugin configuration.
 type Config struct {
 	Enabled                bool     `json:"enabled,omitempty"`
 	CrowdsecMode           string   `json:"crowdsecMode,omitempty"`
 	CrowdsecLapiScheme     string   `json:"crowdsecLapiScheme,omitempty"`
 	CrowdsecLapiHost       string   `json:"crowdsecLapiHost,omitempty"`
 	CrowdsecLapiKey        string   `json:"crowdsecLapiKey,omitempty"`
+	CrowdsecCapiLogin      string   `json:"crowdsecCapiLogin,omitempty"`
+	CrowdsecCapiPwd        string   `json:"crowdsecCapiPwd,omitempty"`
+	CrowdsecCapiScenarios  []string `json:"crowdsecCapiScenarios,omitempty"`
 	UpdateIntervalSeconds  int64    `json:"updateIntervalSeconds,omitempty"`
 	DefaultDecisionSeconds int64    `json:"defaultDecisionSeconds,omitempty"`
 }
 
+// CreateConfig creates the default plugin configuration.
 func CreateConfig() *Config {
 	return &Config{
 		Enabled:                false,
-		CrowdsecMode:           "none",
+		CrowdsecMode:           streamMode,
 		CrowdsecLapiScheme:     "http",
 		CrowdsecLapiHost:       "crowdsec:8080",
 		CrowdsecLapiKey:        "",
+		CrowdsecCapiLogin:      "",
+		CrowdsecCapiPwd:        "",
+		CrowdsecCapiScenarios:  []string{},
 		UpdateIntervalSeconds:  60,
 		DefaultDecisionSeconds: 60,
 	}
 }
 
+// Bouncer a Bouncer plugin.
 type Bouncer struct {
 	next     http.Handler
 	name     string
@@ -61,55 +78,18 @@ type Bouncer struct {
 	crowdsecMode           string
 	updateInterval         int64
 	defaultDecisionTimeout int64
+	crowdsecLogin          string
+	crowdsecPwd            string
+	crowdsecScenarios      []string
 	client                 *http.Client
+	cache                  *ttl_map.Heap
 }
 
 // New creates the crowdsec bouncer plugin.
 func New(ctx context.Context, next http.Handler, config *Config, name string) (http.Handler, error) {
-	requiredStrings := map[string]string{
-		"CrowdsecLapiScheme": config.CrowdsecLapiScheme,
-		"CrowdsecLapiHost":   config.CrowdsecLapiHost,
-		"CrowdsecLapiKey":    config.CrowdsecLapiKey,
-		"CrowdsecMode":       config.CrowdsecMode,
-	}
-	for key, val := range requiredStrings {
-		if len(val) == 0 {
-			return nil, fmt.Errorf("%v cannot be empty", key)
-		}
-	}
-	requiredInt := map[string]int64{
-		"UpdateIntervalSeconds":  config.UpdateIntervalSeconds,
-		"DefaultDecisionSeconds": config.DefaultDecisionSeconds,
-	}
-	for key, val := range requiredInt {
-		if val < 1 {
-			return nil, fmt.Errorf("%v cannot be less than 1", key)
-		}
-	}
-	// none -> If the client IP is on ban list, it will get a http code 403 response.
-	//         Otherwise, request will continue as usual. All request call the Crowdsec LAPI
-	// live ->  If the client IP is on ban list, it will get a http code 403 response.
-	//          Otherwise, request will continue as usual.
-	//          The bouncer can leverage use of a local cache in order to reduce the number
-	//          of requests made to the Crowdsec LAPI. It will keep in cache the status for
-	//          each IP that makes queries.
-	// stream -> Stream Streaming mode allows you to keep in the local cache only the Banned IPs,
-	// 			every requests that does not hit the cache is authorized.
-	// 			Every minute, the cache is updated with news from the Crowdsec LAPI.
-	if !contains([]string{"none", "live", "stream"}, config.CrowdsecMode) {
-		return nil, fmt.Errorf("CrowdsecMode must be one of: none, live or stream")
-	}
-	if !contains([]string{"http", "https"}, config.CrowdsecLapiScheme) {
-		return nil, fmt.Errorf("CrowdsecLapiScheme must be one of: http, https")
-	}
-	testUrl := url.URL{
-		Scheme: config.CrowdsecLapiScheme,
-		Host:   config.CrowdsecLapiHost,
-		Path:   crowdsecRoute,
-	}
-	_, err := http.NewRequest(http.MethodGet, testUrl.String(), nil)
+	err := validateParams(config)
 	if err != nil {
-		return nil, fmt.Errorf("CrowdsecLapiScheme://CrowdsecLapiHost: '%v://%v' must be an URL", config.CrowdsecLapiScheme, config.CrowdsecLapiHost)
+		return nil, err
 	}
 
 	bouncer := &Bouncer{
@@ -123,6 +103,9 @@ func New(ctx context.Context, next http.Handler, config *Config, name string) (h
 		crowdsecScheme:         config.CrowdsecLapiScheme,
 		crowdsecHost:           config.CrowdsecLapiHost,
 		crowdsecKey:            config.CrowdsecLapiKey,
+		crowdsecLogin:          config.CrowdsecCapiLogin,
+		crowdsecPwd:            config.CrowdsecCapiPwd,
+		crowdsecScenarios:      config.CrowdsecCapiScenarios,
 		updateInterval:         config.UpdateIntervalSeconds,
 		defaultDecisionTimeout: config.DefaultDecisionSeconds,
 		client: &http.Client{
@@ -132,32 +115,44 @@ func New(ctx context.Context, next http.Handler, config *Config, name string) (h
 			},
 			Timeout: 5 * time.Second,
 		},
+		cache: ttl_map.New(),
 	}
-	// if we are on a stream mode, we fetch in a go routine every minute the new decisions
-	if config.CrowdsecMode == "stream" {
-		go handleStreamCache(bouncer, true)
+	if config.CrowdsecMode == streamMode || config.CrowdsecMode == aloneMode {
+		go func() {
+			rand.Seed(time.Now().UnixNano())
+			timeout := rand.Int63n(30)
+			logger(fmt.Sprintf("Wait: %v", timeout))
+			time.Sleep(time.Duration(timeout) * time.Second)
+			if config.CrowdsecMode == aloneMode {
+				getToken(bouncer)
+			}
+			go handleStreamCache(bouncer)
+			ticker := time.NewTicker(time.Duration(config.UpdateIntervalSeconds) * time.Second)
+			for range ticker.C {
+				go handleStreamCache(bouncer)
+			}
+		}()
 	}
 	return bouncer, nil
 }
 
-// TODO the serve HTTP should be split as it's too long
+// ServeHTTP principal function of plugin.
 func (a *Bouncer) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
 	if !a.enabled {
-		log.Printf("Crowdsec Bouncer not enabled")
 		a.next.ServeHTTP(rw, req)
 		return
 	}
 
-	// TODO Make sur remote address does not include the port
+	// TODO Make sur remote address does not include the port.
 	remoteHost, _, err := net.SplitHostPort(req.RemoteAddr)
 	if err != nil {
-		log.Printf("failed to extract ip from remote address: %v", err)
+		logger(fmt.Sprintf("failed to extract ip from remote address: %v", err))
 		a.next.ServeHTTP(rw, req)
 		return
 	}
 
-	if a.crowdsecMode == "stream" || a.crowdsecMode == "live" {
-		isBanned, err := getDecision(remoteHost)
+	if a.crowdsecMode == streamMode || a.crowdsecMode == aloneMode || a.crowdsecMode == liveMode {
+		isBanned, err := getDecision(a, remoteHost)
 		if err == nil {
 			if isBanned {
 				rw.WriteHeader(http.StatusForbidden)
@@ -168,78 +163,24 @@ func (a *Bouncer) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
 		}
 	}
 
-	// Right here if we cannot join the stream we forbid the request to go on
-	if a.crowdsecMode == "stream" {
+	// Right here if we cannot join the stream we forbid the request to go on.
+	if a.crowdsecMode == streamMode || a.crowdsecMode == aloneMode {
 		if a.crowdsecStreamHealthy {
 			a.next.ServeHTTP(rw, req)
 		} else {
 			rw.WriteHeader(http.StatusForbidden)
 		}
-		return
+	} else {
+		handleNoStreamCache(a, rw, req, remoteHost)
 	}
-
-	// We are now in none or live mode
-	noneUrl := url.URL{
-		Scheme:   a.crowdsecScheme,
-		Host:     a.crowdsecHost,
-		Path:     crowdsecRoute,
-		RawQuery: fmt.Sprintf("ip=%v&banned=true", remoteHost),
-	}
-	request, _ := http.NewRequest(http.MethodGet, noneUrl.String(), nil)
-	request.Header.Add(crowdsecAuthHeader, a.crowdsecKey)
-	res, err := a.client.Do(request)
-	if err != nil {
-		log.Printf("failed to get decision: %s", err)
-		rw.WriteHeader(http.StatusForbidden)
-		return
-	}
-	defer res.Body.Close()
-	if res.StatusCode != 200 {
-		log.Printf("failed to get decision, status code: %d", res.StatusCode)
-		rw.WriteHeader(http.StatusForbidden)
-		return
-	}
-	body, err := ioutil.ReadAll(res.Body)
-	if err != nil {
-		log.Printf("failed to read body: %s", err)
-		rw.WriteHeader(http.StatusForbidden)
-		return
-	}
-	if !bytes.Equal(body, []byte("null")) {
-		var decisions []Decision
-		err = json.Unmarshal(body, &decisions)
-		if err != nil {
-			log.Printf("failed to parse body: %s", err)
-			rw.WriteHeader(http.StatusForbidden)
-			return
-		}
-		if len(decisions) == 0 {
-			if a.crowdsecMode == "live" {
-				setDecision(remoteHost, false, a.defaultDecisionTimeout)
-			}
-			a.next.ServeHTTP(rw, req)
-			return
-		}
-		duration, err := time.ParseDuration(decisions[0].Duration)
-		if err != nil {
-			log.Printf("failed to parse duration: %s", err)
-			rw.WriteHeader(http.StatusForbidden)
-			return
-		}
-		rw.WriteHeader(http.StatusForbidden)
-		setDecision(remoteHost, true, int64(duration.Seconds()))
-		return
-	}
-	if a.crowdsecMode == "live" {
-		setDecision(remoteHost, false, a.defaultDecisionTimeout)
-	}
-	a.next.ServeHTTP(rw, req)
 }
 
-// CUSTOM CODE
-// TODO place in another file
+// CUSTOM CODE.
+// TODO place in another file.
+
+// Decision Body returned from Crowdsec LAPI.
 type Decision struct {
-	Id        int    `json:"id"`
+	ID        int    `json:"id"`
 	Origin    string `json:"origin"`
 	Type      string `json:"type"`
 	Scope     string `json:"scope"`
@@ -249,11 +190,23 @@ type Decision struct {
 	Simulated bool   `json:"simulated"`
 }
 
+// Stream Body returned from Crowdsec Stream LAPI.
 type Stream struct {
 	Deleted []Decision `json:"deleted"`
 	New     []Decision `json:"new"`
 }
 
+// Login Body returned from Crowdsec Login CAPI.
+type Login struct {
+	Code   int    `json:"code"`
+	Token  string `json:"token"`
+	Expire string `json:"expire"`
+}
+
+func logger(str string) {
+	log.Printf("Crowdsec Bouncer Traefik Plugin - %s", str)
+}
+
 func contains(source []string, target string) bool {
 	for _, a := range source {
 		if a == target {
@@ -263,74 +216,226 @@ func contains(source []string, target string) bool {
 	return false
 }
 
-// Get Decision check in the cache if the IP has the banned / not banned value
-// Otherwise return with an error to add the IP in cache if we are on
-func getDecision(clientIP string) (bool, error) {
-	isBanned, ok := cache.Get(clientIP)
-	if ok && len(isBanned.(string)) > 0 {
-		if isBanned == cacheNoBannedValue {
-			return false, nil
-		} else {
-			return true, nil
+// Get Decision check in the cache if the IP has the banned / not banned value.
+// Otherwise return with an error to add the IP in cache if we are on.
+func getDecision(a *Bouncer, clientIP string) (bool, error) {
+	banned, isCached := a.cache.Get(clientIP)
+	bannedString, isValid := banned.(string)
+	if isCached && isValid && len(bannedString) > 0 {
+		return bannedString == cacheBannedValue, nil
 	}
-	}
-	return false, fmt.Errorf("no data")
+	return false, fmt.Errorf("no cache data")
 }
 
-func setDecision(clientIP string, isBanned bool, duration int64) {
+func setDecision(a *Bouncer, clientIP string, isBanned bool, duration int64) {
+	if a.crowdsecMode == noneMode {
+		return
+	}
 	if isBanned {
-		cache.Set(clientIP, cacheBannedValue, duration)
+		logger(fmt.Sprintf("%v banned", clientIP))
+		a.cache.Set(clientIP, cacheBannedValue, duration)
 	} else {
-		cache.Set(clientIP, cacheNoBannedValue, duration)
+		a.cache.Set(clientIP, cacheNoBannedValue, duration)
 	}
 }
 
-func handleStreamCache(a *Bouncer, initialized bool) {
-	// TODO clean properly on exit
-	time.AfterFunc(time.Duration(a.updateInterval)*time.Second, func() {
-		handleStreamCache(a, false)
-	})
-	streamUrl := url.URL{
+func handleNoStreamCache(a *Bouncer, rw http.ResponseWriter, req *http.Request, remoteHost string) {
+	// We are now in none or live mode.
+	routeURL := url.URL{
 		Scheme:   a.crowdsecScheme,
 		Host:     a.crowdsecHost,
-		Path:     crowdsecStreamRoute,
-		RawQuery: fmt.Sprintf("startup=%t", initialized),
+		Path:     crowdsecLapiRoute,
+		RawQuery: fmt.Sprintf("ip=%v&banned=true", remoteHost),
 	}
-	req, _ := http.NewRequest(http.MethodGet, streamUrl.String(), nil)
-	req.Header.Add(crowdsecAuthHeader, a.crowdsecKey)
-	res, err := a.client.Do(req)
-	if err != nil || res.StatusCode == http.StatusForbidden {
-		log.Printf("error while fetching decisions: %s", err)
-		a.crowdsecStreamHealthy = false
+	body := crowdsecQuery(a, routeURL.String(), false)
+
+	if bytes.Equal(body, []byte("null")) {
+		setDecision(a, remoteHost, false, a.defaultDecisionTimeout)
+		a.next.ServeHTTP(rw, req)
 		return
 	}
-	if res.StatusCode == http.StatusForbidden {
-		log.Printf("error while fetching decisions, status code: %d", res.StatusCode)
-		a.crowdsecStreamHealthy = false
-		return
-	}
-	defer res.Body.Close()
-	body, err := ioutil.ReadAll(res.Body)
+
+	var decisions []Decision
+	err := json.Unmarshal(body, &decisions)
 	if err != nil {
-		log.Printf("error while reading body: %s", err)
-		a.crowdsecStreamHealthy = false
+		logger(fmt.Sprintf("failed to parse body: %s", err))
+		rw.WriteHeader(http.StatusForbidden)
 		return
 	}
+	if len(decisions) == 0 {
+		setDecision(a, remoteHost, false, a.defaultDecisionTimeout)
+		a.next.ServeHTTP(rw, req)
+		return
+	}
+	rw.WriteHeader(http.StatusForbidden)
+	duration, err := time.ParseDuration(decisions[0].Duration)
+	if err != nil {
+		logger(fmt.Sprintf("failed to parse duration: %s", err))
+		return
+	}
+	setDecision(a, remoteHost, true, int64(duration.Seconds()))
+}
+
+func handleStreamCache(a *Bouncer) {
+	// TODO clean properly on exit.
+	var rawQuery string
+	var path string
+	if a.crowdsecMode == aloneMode {
+		rawQuery = ""
+		path = crowdsecCapiDecisions
+	} else {
+		rawQuery = fmt.Sprintf("startup=%t", !a.crowdsecStreamHealthy)
+		path = crowdsecLapiStreamRoute
+	}
+	streamRouteURL := url.URL{
+		Scheme:   a.crowdsecScheme,
+		Host:     a.crowdsecHost,
+		Path:     path,
+		RawQuery: rawQuery,
+	}
+	body := crowdsecQuery(a, streamRouteURL.String(), false)
 	var stream Stream
-	err = json.Unmarshal(body, &stream)
+	err := json.Unmarshal(body, &stream)
 	if err != nil {
-		log.Printf("error while parsing body: %s", err)
+		logger(fmt.Sprintf("error while parsing body: %s", err))
 		a.crowdsecStreamHealthy = false
 		return
 	}
 	for _, decision := range stream.New {
 		duration, err := time.ParseDuration(decision.Duration)
 		if err == nil {
-			setDecision(decision.Value, true, int64(duration.Seconds()))
+			setDecision(a, decision.Value, true, int64(duration.Seconds()))
 		}
 	}
 	for _, decision := range stream.Deleted {
-		cache.Del(decision.Value)
+		a.cache.Del(decision.Value)
 	}
 	a.crowdsecStreamHealthy = true
 }
+
+func getToken(a *Bouncer) {
+	loginURL := url.URL{
+		Scheme: a.crowdsecScheme,
+		Host:   a.crowdsecHost,
+		Path:   crowdsecCapiLogin,
+	}
+	body := crowdsecQuery(a, loginURL.String(), true)
+	var login Login
+	err := json.Unmarshal(body, &login)
+	if err != nil {
+		logger(fmt.Sprintf("error while parsing body: %s", err))
+		a.crowdsecStreamHealthy = false
+		return
+	}
+	if login.Code == 200 && len(login.Token) > 0 {
+		a.crowdsecKey = login.Token
+	}
+}
+
+func crowdsecQuery(a *Bouncer, stringURL string, isPost bool) []byte {
+	var req *http.Request
+	if isPost {
+		data := []byte(fmt.Sprintf(
+			`{"machine_id": "%v","password": "%v","scenarios": ["%v"]}`,
+			a.crowdsecLogin,
+			a.crowdsecPwd,
+			strings.Join(a.crowdsecScenarios, `","`),
+		))
+		req, _ = http.NewRequest(http.MethodPost, stringURL, bytes.NewBuffer(data))
+	} else {
+		req, _ = http.NewRequest(http.MethodGet, stringURL, nil)
+	}
+	if a.crowdsecMode == aloneMode {
+		req.Header.Add(crowdsecCapiHeader, a.crowdsecKey)
+	} else {
+		req.Header.Add(crowdsecLapiHeader, a.crowdsecKey)
+	}
+	res, err := a.client.Do(req)
+	if err != nil {
+		logger(fmt.Sprintf("error while fetching %v: %s", stringURL, err))
+		a.crowdsecStreamHealthy = false
+		return nil
+	}
+	if res.StatusCode == http.StatusUnauthorized && a.crowdsecMode == aloneMode {
+		oldToken := a.crowdsecKey
+		getToken(a)
+		if oldToken == a.crowdsecKey {
+			a.crowdsecStreamHealthy = false
+			return nil
+		}
+		return crowdsecQuery(a, stringURL, false)
+	}
+	if res.StatusCode != http.StatusOK {
+		logger(fmt.Sprintf("error while fetching %v, status code: %d", stringURL, res.StatusCode))
+		a.crowdsecStreamHealthy = false
+		return nil
+	}
+	defer func(body io.ReadCloser) {
+		err = body.Close()
+		if err != nil {
+			logger(fmt.Sprintf("failed to close body reader: %s", err))
+		}
+	}(res.Body)
+	body, err := ioutil.ReadAll(res.Body)
+	if err != nil {
+		logger(fmt.Sprintf("error while reading body: %s", err))
+		a.crowdsecStreamHealthy = false
+		return nil
+	}
+	return body
+}
+
+func validateParams(config *Config) error {
+	var requiredStrings map[string]string
+	if config.CrowdsecMode == aloneMode {
+		requiredStrings = map[string]string{
+			"CrowdsecCapiLogin": config.CrowdsecLapiScheme,
+			"CrowdsecCapiPwd":   config.CrowdsecLapiHost,
+		}
+		for _, val := range config.CrowdsecCapiScenarios {
+			if len(val) == 0 {
+				return fmt.Errorf("CrowdsecCapiScenarios: one or more scenario are empty")
+			}
+		}
+		config.UpdateIntervalSeconds = 7200
+		config.CrowdsecLapiKey = ""
+		config.CrowdsecLapiScheme = "https"
+		config.CrowdsecLapiHost = "api.crowdsec.net"
+	} else {
+		requiredStrings = map[string]string{
+			"CrowdsecLapiScheme": config.CrowdsecLapiScheme,
+			"CrowdsecLapiHost":   config.CrowdsecLapiHost,
+			"CrowdsecLapiKey":    config.CrowdsecLapiKey,
+			"CrowdsecMode":       config.CrowdsecMode,
+		}
+		requiredInt := map[string]int64{
+			"UpdateIntervalSeconds":  config.UpdateIntervalSeconds,
+			"DefaultDecisionSeconds": config.DefaultDecisionSeconds,
+		}
+		for key, val := range requiredInt {
+			if val < 1 {
+				return fmt.Errorf("%v: cannot be less than 1", key)
+			}
+		}
+	}
+	for key, val := range requiredStrings {
+		if len(val) == 0 {
+			return fmt.Errorf("%v: cannot be empty", key)
+		}
+	}
+	if !contains([]string{noneMode, liveMode, streamMode, aloneMode}, config.CrowdsecMode) {
+		return fmt.Errorf("CrowdsecMode: must be one of 'none', 'live' or 'stream'")
+	}
+	if !contains([]string{"http", "https"}, config.CrowdsecLapiScheme) {
+		return fmt.Errorf("CrowdsecLapiScheme: must be one of 'http' or 'https'")
+	}
+	testURL := url.URL{
+		Scheme: config.CrowdsecLapiScheme,
+		Host:   config.CrowdsecLapiHost,
+	}
+	_, err := http.NewRequest(http.MethodGet, testURL.String(), nil)
+	if err != nil {
+		return fmt.Errorf("CrowdsecLapiScheme://CrowdsecLapiHost: '%v://%v' must be an URL", config.CrowdsecLapiScheme, config.CrowdsecLapiHost)
+	}
+	return nil
+}

docker-compose.local.yml

@@ -0,0 +1,83 @@
+version: "3.8"
+
+services:
+  traefik:
+    image: "traefik:v2.8.8"
+    container_name: "traefik"
+    command:
+      # - "--log.level=DEBUG"
+      - "--accesslog"
+      - "--accesslog.filepath=/var/log/traefik/access.log"
+      - "--api.insecure=true"
+      - "--providers.docker=true"
+      - "--providers.docker.exposedbydefault=false"
+      - "--entrypoints.web.address=:80"
+
+      - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - logs-local:/var/log/traefik
+      - ./:/plugins-local/src/github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.enabled=true"
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseccapilogin=3829a6c9870e4726a377d8951ebb64a1m8psGvMaq1ykJ3zX"
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseccapipwd=Q5pgN8bRNInHGdx6QCksdPOJVLeLQ7ipJntSeuP3r8088zXzRVs4G8liXAKfI1k6"
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseccapiscenarios=crowdsecurity/http-backdoors-attempts,baudneo/zoneminder-bf"
+    ports:
+      - 80:80
+      - 8080:8080
+    depends_on:
+      - crowdsec
+
+  whoami1:
+    image: traefik/whoami
+    container_name: "simple-service1"
+    labels:
+      - "traefik.enable=true"
+      # Definition of the router
+      - "traefik.http.routers.router1.rule=Host(`localhost`) && Path(`/foo`)"
+      - "traefik.http.routers.router1.entrypoints=web"
+      - "traefik.http.routers.router1.middlewares=crowdsec1@docker" 
+      # Definition of the service
+      - "traefik.http.services.service1.loadbalancer.server.port=80"
+      # Definitin of the middleware
+      - "traefik.http.middlewares.crowdsec1.plugin.bouncer.enabled=true"
+      # crowdseclapikey must be uniq to the middleware attached to the service
+      - "traefik.http.middlewares.crowdsec1.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
+  whoami2:
+    image: traefik/whoami
+    container_name: "simple-service2"
+    labels:
+      - "traefik.enable=true"
+      # Definition of the router
+      - "traefik.http.routers.router2.rule=Host(`localhost`) && Path(`/bar`)"
+      - "traefik.http.routers.router2.entrypoints=web"
+      - "traefik.http.routers.router2.middlewares=crowdsec2@docker"
+      # Definition of the service
+      - "traefik.http.services.service2.loadbalancer.server.port=80"
+      # Definitin of the middleware
+      - "traefik.http.middlewares.crowdsec2.plugin.bouncer.enabled=true"
+      # crowdseclapikey must be uniq to the middleware attached to the service
+      - "traefik.http.middlewares.crowdsec2.plugin.bouncer.crowdseclapikey=44c36dac5c4140af9f06f397508e82c7"
+
+  crowdsec:
+    image: crowdsecurity/crowdsec:v1.4.1
+    container_name: "crowdsec"
+    environment:
+      COLLECTIONS: crowdsecurity/traefik
+      CUSTOM_HOSTNAME: crowdsec
+      BOUNCER_KEY_TRAEFIK_1: 40796d93c2958f9e58345514e67740e5
+      BOUNCER_KEY_TRAEFIK_2: 44c36dac5c4140af9f06f397508e82c7
+    volumes:
+      - ./acquis.yaml:/etc/crowdsec/acquis.yaml:ro
+      - logs-local:/var/log/traefik:ro
+      - crowdsec-db-local:/var/lib/crowdsec/data/
+      - crowdsec-config-local:/etc/crowdsec/
+    labels:
+      - "traefik.enable=false"
+volumes:
+  logs-local:
+  crowdsec-db-local:
+  crowdsec-config-local:

docker-compose.yml

@@ -2,54 +2,76 @@ version: "3.8"
 
 services:
   traefik:
-    image: "traefik:v2.8.5"
+    image: "traefik:v2.8.8"
     container_name: "traefik"
     command:
       # - "--log.level=DEBUG"
       - "--accesslog"
-      - "--accesslog.filepath=/var/log/traefik/traefik.log"
+      - "--accesslog.filepath=/var/log/traefik/access.log"
       - "--api.insecure=true"
       - "--providers.docker=true"
       - "--providers.docker.exposedbydefault=false"
       - "--entrypoints.web.address=:80"
 
-      - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
+      - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
+      - "--experimental.plugins.bouncer.version=v1.0.6"
     volumes:
       - "/var/run/docker.sock:/var/run/docker.sock:ro"
       - "logs:/var/log/traefik"
-      - ./:/plugins-local/src/github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
     ports:
       - 8000:80
       - 8080:8080
+    depends_on:
+      - 'crowdsec'
 
-  whoami:
+  whoami1:
     image: traefik/whoami
-    container_name: "simple-service"
+    container_name: "simple-service-1"
     labels:
       - "traefik.enable=true"
-      - "traefik.http.routers.whoami.rule=Host(`localhost`)"
-      - "traefik.http.routers.whoami.entrypoints=web"
-      - "traefik.http.routers.whoami.middlewares=crowdsec@docker"
-      - "traefik.http.middlewares.crowdsec.plugin.bouncer.enabled=true"
-      - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
+      # Definition of the router
+      - "traefik.http.routers.router1.rule=Host(`localhost`) && Path(`/foo`)"
+      - "traefik.http.routers.router1.entrypoints=web"
+      - "traefik.http.routers.router1.middlewares=crowdsec2@docker"
+      # Definition of the service
+      - "traefik.http.services.service1.loadbalancer.server.port=80"
+      # Definitin of the middleware
+      - "traefik.http.middlewares.crowdsec1.plugin.bouncer.enabled=true"
+      # crowdseclapikey must be uniq to the middleware attached to the service
+      - "traefik.http.middlewares.crowdsec1.plugin.bouncer.crowdseclapikey=FIXME-LAPI-KEY-1"
+  
+  whoami2:
+    image: traefik/whoami
+    container_name: "simple-service-2"
+    labels:
+      - "traefik.enable=true"
+      # Definition of the router
+      - "traefik.http.routers.router2.rule=Host(`localhost`) && Path(`/bar`)"
+      - "traefik.http.routers.router2.entrypoints=web"
+      - "traefik.http.routers.router2.middlewares=crowdsec2@docker"
+      # Definition of the service
+      - "traefik.http.services.service2.loadbalancer.server.port=80"
+      # Definitin of the middleware
+      - "traefik.http.middlewares.crowdsec2.plugin.bouncer.enabled=true"
+      # crowdseclapikey must be uniq to the middleware attached to the service
+      - "traefik.http.middlewares.crowdsec2.plugin.bouncer.crowdseclapikey=FIXME-LAPI-KEY-2"
 
   crowdsec:
     image: crowdsecurity/crowdsec:v1.4.1
     container_name: "crowdsec"
-    command: rm -rf /etc/crowdsec/acquis.yaml
     environment:
       COLLECTIONS: crowdsecurity/traefik
       CUSTOM_HOSTNAME: crowdsec
-      BOUNCER_KEY_TRAEFIK: 40796d93c2958f9e58345514e67740e5
-    depends_on:
-      - 'traefik'
+      # We need to register one api key per service we will use
+      BOUNCER_KEY_TRAEFIK_1: FIXME-LAPI-KEY-1
+      BOUNCER_KEY_TRAEFIK_2: FIXME-LAPI-KEY-2
     volumes:
       - ./acquis.yaml:/etc/crowdsec/acquis.yaml:ro
-      - logs:/var/log/traefik
+      - logs:/var/log/traefik:ro
       - crowdsec-db:/var/lib/crowdsec/data/
       - crowdsec-config:/etc/crowdsec/
-    ports:
-      - "8083:8080"
+    labels:
+      - "traefik.enable=false"
 
 volumes:
   logs: