Merge pull request #25 from maxlerebourg/prepare-for-release-1.1.0

Update exemple traefik to version 2.9.1 and version of plugin 1.1.0 in exemples

.gitignore

@@ -1,2 +1,6 @@
 .idea/
 .DS_Store
+config
+db
+logs
+docker-compose.dev.yml

Makefile

@@ -18,3 +18,42 @@ vendor:
 
 clean:
 	rm -rf ./vendor
+
+run_dev:
+	docker-compose -f docker-compose.dev.yml up -d --remove-orphans
+
+run_local:
+	docker-compose -f docker-compose.local.yml up -d --remove-orphans
+
+run_behindproxy:
+	docker-compose -f exemples/behind-proxy/docker-compose.cloudflare.yml up -d --remove-orphans
+
+run:
+	docker-compose -f docker-compose.yml up -d --remove-orphans
+
+restart_dev:
+	docker-compose -f docker-compose.dev.yml restart
+
+restart_local:
+	docker-compose -f docker-compose.local.yml restart
+
+restart:
+	docker-compose -f docker-compose.yml restart
+
+show_logs:
+	docker-compose -f docker-compose.yml restart
+
+show_local_logs:
+	docker-compose -f docker-compose.local.yml logs -f
+
+show_dev_logs:
+	docker-compose -f docker-compose.dev.yml logs -f
+
+clean_all_docker:
+	docker-compose -f exemples/behind-proxy/docker-compose.cloudflare.yml down --remove-orphans
+	docker-compose -f docker-compose.local.yml down --remove-orphans
+	docker-compose -f docker-compose.yml down --remove-orphans
+
+show_metrics:
+	docker exec crowdsec cscli metrics
+

README.md

@@ -17,24 +17,70 @@ The crowdsec utility will provide the community blocklist which contains highly
 When used with crowdsec it will leverage the local API which will analyze traefik logs and take decisions on the requests made by users/bots. Malicious actors will be banned based on patterns against your website.
 
 There are 3 operating modes (CrowdsecMode) for this plugin:
-- none -> If the client IP is on ban list, it will get a http code 403 response.
-         Otherwise, request will continue as usual. All request call the Crowdsec LAPI
 
-- live -> If the client IP is on ban list, it will get a http code 403 response.
-          Otherwise, request will continue as usual.
-          The bouncer can leverage use of a local cache in order to reduce the number
-          of requests made to the Crowdsec LAPI. It will keep in cache the status for
-          each IP that makes queries.
-
-- stream -> Stream Streaming mode allows you to keep in the local cache only the Banned IPs,
- 			every requests that does not hit the cache is authorized.
- 			Every minute, the cache is updated with news from the Crowdsec LAPI.
+| Mode | Description |
+|------|------|
+| none | If the client IP is on ban list, it will get a http code 403 response. Otherwise, request will continue as usual. All request call the Crowdsec LAPI |
+| live | If the client IP is on ban list, it will get a http code 403 response. Otherwise, request will continue as usual.    The bouncer can leverage use of a local cache in order to reduce the number of requests made to the Crowdsec LAPI. It will keep in cache the status for  each IP that makes queries. |
+| stream | Stream Streaming mode allows you to keep in the local cache only the Banned IPs, every requests that does not hit the cache is authorized. Every minute, the cache is updated with news from the Crowdsec LAPI. |
 
 The recommanded mode for performance is the streaming mode, decisions are updated every 60 sec by default and that's the only communication between traefik and crowdsec. Every requests that happens hits the cache for quick decisions.
 
 ## Usage
 
+To get started, use the `docker-compose.yml` file.
 
+You can run it with:
+```bash
+make run
+```
+
+### Note
+Each middleware in traefik has it's own data and is instanciated by service.
+This means if there are 10 services protected by the bouncer in streaming alone or live mode, the cache will be duplicated to all 10 services.
+This is because traefik does not allow plugins to store data locally that can be consummed.
+
+The synchronisation with the crowdsec service will happen also 10 times in the period selected.
+It should be taken into account when fixing this period so each middleware has time to sync data from crowdsec.
+
+At each start of synchronisation, the middleware will wait a random number of seconds to avoid simultaneous calls to crowdsec.
+
+### Variables
+- Enabled
+  - bool
+  - enable the plugin
+- LogLevel
+  - string
+  - default: `INFO`, expected value are: `INFO`, `DEBUG`
+- CrowdsecMode
+  - string
+  - default: `live`, expected value are: `none`, `live`, `stream`
+- CrowdsecLapiScheme
+  - string
+  - default: `http`, expected value are: `http`, `https`
+- CrowdsecLapiHost
+  - string
+  - default: "crowdsec:8080"
+  - Crowdsec LAPI available on which host.
+- CrowdsecLapiKey
+  - string
+  - Crowdsec LAPI generated key for the bouncer : **must be unique by service**. 
+- UpdateIntervalSeconds
+  - int64
+  - default: 60
+  - Used only in `stream` mode, interval between fetching blacklisted IPs from LAPI
+- DefaultDecisionSeconds
+  - int64
+  - default: 60
+  - Used only in `live` mode, decision duration of accepted IPs
+- ForwardedHeadersTrustedIPs
+  - []string
+  - default: []
+  - List of IPs of trusted Proxies that are in front of traefik (ex: Cloudflare)
+- ForwardedHeadersCustomName
+  - string
+  - default: X-Forwarded-For
+  - Name of the header where the real IP of the client should be retrieved
 
 ### Configuration
 
@@ -75,14 +121,55 @@ http:
       plugin:
         bouncer:
           enabled: false
+          updateIntervalSeconds: 60
+          defaultDecisionSeconds: 60
+          crowdsecMode: live
           crowdsecLapiKey: privateKey
           crowdsecLapiHost: crowdsec:8080
           crowdsecLapiScheme: http
-          crowdsecMode: stream
-          updateIntervalSeconds: 60
-          defaultDecisionSeconds: 60
+          forwardedHeadersTrustedIPs: 
+            - 10.0.10.23/32
+            - 10.0.20.0/24
+          forwardedHeadersCustomName: X-Custom-Header
+```
+These are the default values of the plugin except for LapiKey.
+
+#### Generate LAPI KEY
+You need to generate a crowdsec API key for the LAPI.
+You can follow the documentation here: https://docs.crowdsec.net/docs/user_guides/lapi_mgmt/
+
+```bash
+docker-compose -f docker-compose-local.yml up -d crowdsec
+docker exec crowdsec cscli bouncers add crowdsecBouncer
+```
+
+This LAPI key must be set where is noted FIXME-LAPI-KEY in the docker-compose-test.yml
+```yaml
+...
+whoami:
+  labels:
+    - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=FIXME-LAPI-KEY"
+    - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapischeme=http"
+    - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapihost=crowdsec:8080"
+...
+crowdsec:
+  environment:
+    BOUNCER_KEY_TRAEFIK: FIXME-LAPI-KEY
+...
+```
+
+You can then run all the containers:
+```bash
+docker-compose up -d
+```
+
+#### Add manually an IP to the blocklist (testing purpose)
+
+```bash
+docker-compose up -d crowdsec
+docker exec crowdsec cscli decisions add --ip 10.0.0.10 # this will be effective 4h
+docker exec crowdsec cscli decisions remove --ip 10.0.0.10
 ```
-Except for the crowdsecLapiKey, these are the default value of the plugin.
 
 ### Local Mode
 
@@ -113,72 +200,37 @@ For local developpement a docker-compose.local.yml is provided and reproduce the
 ```bash
 docker-compose -f docker-compose.local.yml up -d
 ```
-
-#### Generate LAPI-KEY
-You need to generate a crowdsec API key for the LAPI.
-You can follow the documentation here: https://docs.crowdsec.net/docs/user_guides/lapi_mgmt/
-
+Equivalent to
 ```bash
-docker-compose -f docker-compose.local.yml up -d crowdsec
-docker exec crowdsec cscli bouncers add TRAEFIK
+make run_local
 ```
 
-This LApi key must be set where is noted FIXME-LAPI-KEY in the docker-compose-test.yml
+### Exemples
+
+1. Behind another proxy service (ex: clouflare)
+
+You need to configure your Traefik to trust Forwarded headers by your front proxy
+In the exemple we use another instance of traefik with the container named cloudflare to simulate a front proxy
+
+The "internal" Traefik instance is configured to trust the cloudflare forward headers
 ```yaml
-...
-whoami:
-  labels:
-    - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=FIXME-LAPI-KEY"
-...
-crowdsec:
-  environment:
-    BOUNCER_KEY_TRAEFIK: FIXME-LAPI-KEY
-...
+  - "--entrypoints.web.forwardedheaders.trustedips=172.21.0.5"
 ```
 
-You can then run all the containers:
-```bash
-docker-compose -f docker-compose-local.yml up -d
-```
-
-#### Generate LAPI-KEY
-You need to generate a crowdsec API key for the LAPI.
-You can follow the documentation here: https://docs.crowdsec.net/docs/user_guides/lapi_mgmt/
-
-```bash
-docker-compose -f docker-compose-local.yml up -d crowdsec
-docker exec crowdsec cscli bouncers add crowdsecBouncer
-```
-
-This LApi key must be set where is noted FIXME-LAPI-KEY in the docker-compose-test.yml
+We configure the middleware to trust as well the IP:
 ```yaml
-...
-whoami:
-  labels:
-    - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=FIXME-LAPI-KEY"
-...
-crowdsec:
-  environment:
-    BOUNCER_KEY_TRAEFIK: FIXME-LAPI-KEY
-...
+    - "traefik.http.middlewares.crowdsec1.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5"
 ```
 
-You can then run all the containers:
+To run the environnement run:
 ```bash
-docker-compose -f docker-compose-local.yml up -d
+make run_behind_proxy
 ```
 
-#### Add manually an IP to the blocklist
-
-```bash
-docker-compose -f docker-compose-local.yml up -d crowdsec
-docker exec crowdsec cscli decisions add --ip 10.0.0.10 # this will be effective 4h
-docker exec crowdsec cscli decisions remove --ip 10.0.0.10
-```
 
 ### About
 
-[maxlerebourg](https://github.com/maxlerebourg) and [I](https://github.com/mhanotaux) have been using traefik since 2020.
+Me and [mathieuHa](https://github.com/mathieuHa) have been using traefik since 2020 at [Primadviz](https://primadviz.com).
 We come from web developper and security engineer background and wanted to add the power of a very promesing technology (Crowdsec) into the edge router we love.
 
 We initially run into this project: https://github.com/fbonalair/traefik-crowdsec-bouncer

acquis.yaml

@@ -1,4 +1,4 @@
 filenames:
- - /var/log/traefik/*.log
+ - /var/log/traefik/access.log
 labels:
   type: traefik

bouncer.go

@@ -7,127 +7,106 @@ import (
 	"fmt"
 	"io"
 	"io/ioutil"
-	"log"
-	"net"
 	"net/http"
 	"net/url"
 	"text/template"
 	"time"
 
-	ttl_map "github.com/leprosus/golang-ttl-map"
+	cache "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/pkg/cache"
+	ip "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/pkg/ip"
+	logger "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/pkg/logger"
 )
 
 const (
-	crowdsecAuthHeader  = "X-Api-Key"
-	crowdsecRoute       = "v1/decisions"
-	crowdsecStreamRoute = "v1/decisions/stream"
-	cacheBannedValue    = "t"
-	cacheNoBannedValue  = "f"
+	streamMode              = "stream"
+	liveMode                = "live"
+	noneMode                = "none"
+	crowdsecLapiHeader      = "X-Api-Key"
+	crowdsecLapiRoute       = "v1/decisions"
+	crowdsecLapiStreamRoute = "v1/decisions/stream"
+	cacheTimeoutKey         = "updated"
+)
+
+var (
+	crowdsecStreamHealthy = false
+	ticker                chan bool
 )
 
 // Config the plugin configuration.
 type Config struct {
-	Enabled                bool   `json:"enabled,omitempty"`
-	CrowdsecMode           string `json:"crowdsecMode,omitempty"`
-	CrowdsecLapiScheme     string `json:"crowdsecLapiScheme,omitempty"`
-	CrowdsecLapiHost       string `json:"crowdsecLapiHost,omitempty"`
-	CrowdsecLapiKey        string `json:"crowdsecLapiKey,omitempty"`
-	UpdateIntervalSeconds  int64  `json:"updateIntervalSeconds,omitempty"`
-	DefaultDecisionSeconds int64  `json:"defaultDecisionSeconds,omitempty"`
+	Enabled                    bool     `json:"enabled,omitempty"`
+	LogLevel                   string   `json:"logLevel,omitempty"`
+	CrowdsecMode               string   `json:"crowdsecMode,omitempty"`
+	CrowdsecLapiScheme         string   `json:"crowdsecLapiScheme,omitempty"`
+	CrowdsecLapiHost           string   `json:"crowdsecLapiHost,omitempty"`
+	CrowdsecLapiKey            string   `json:"crowdsecLapiKey,omitempty"`
+	ForwardedHeadersCustomName string   `json:"forwardedheaderscustomheader,omitempty"`
+	UpdateIntervalSeconds      int64    `json:"updateIntervalSeconds,omitempty"`
+	DefaultDecisionSeconds     int64    `json:"defaultDecisionSeconds,omitempty"`
+	ForwardedHeadersTrustedIPs []string `json:"forwardedheaderstrustedips,omitempty"`
 }
 
 // CreateConfig creates the default plugin configuration.
 func CreateConfig() *Config {
 	return &Config{
-		Enabled:                false,
-		CrowdsecMode:           "stream",
-		CrowdsecLapiScheme:     "http",
-		CrowdsecLapiHost:       "crowdsec:8080",
-		CrowdsecLapiKey:        "",
-		UpdateIntervalSeconds:  60,
-		DefaultDecisionSeconds: 60,
+		Enabled:                    false,
+		LogLevel:                   "INFO",
+		CrowdsecMode:               liveMode,
+		CrowdsecLapiScheme:         "http",
+		CrowdsecLapiHost:           "crowdsec:8080",
+		CrowdsecLapiKey:            "",
+		UpdateIntervalSeconds:      60,
+		DefaultDecisionSeconds:     60,
+		ForwardedHeadersTrustedIPs: []string{},
+		ForwardedHeadersCustomName: "X-Forwarded-For",
 	}
 }
 
-// Bouncer a Bouncer plugin.
+// Bouncer a Bouncer struct.
 type Bouncer struct {
 	next     http.Handler
 	name     string
 	template *template.Template
 
 	enabled                bool
-	crowdsecStreamHealthy  bool
 	crowdsecScheme         string
 	crowdsecHost           string
 	crowdsecKey            string
 	crowdsecMode           string
 	updateInterval         int64
 	defaultDecisionTimeout int64
+	customHeader           string
+	poolStrategy           *ip.PoolStrategy
 	client                 *http.Client
-	cache                  *ttl_map.Heap
 }
 
 // New creates the crowdsec bouncer plugin.
 func New(ctx context.Context, next http.Handler, config *Config, name string) (http.Handler, error) {
-	requiredStrings := map[string]string{
-		"CrowdsecLapiScheme": config.CrowdsecLapiScheme,
-		"CrowdsecLapiHost":   config.CrowdsecLapiHost,
-		"CrowdsecLapiKey":    config.CrowdsecLapiKey,
-		"CrowdsecMode":       config.CrowdsecMode,
-	}
-	for key, val := range requiredStrings {
-		if len(val) == 0 {
-			return nil, fmt.Errorf("%v cannot be empty", key)
-		}
-	}
-	requiredInt := map[string]int64{
-		"UpdateIntervalSeconds":  config.UpdateIntervalSeconds,
-		"DefaultDecisionSeconds": config.DefaultDecisionSeconds,
-	}
-	for key, val := range requiredInt {
-		if val < 1 {
-			return nil, fmt.Errorf("%v cannot be less than 1", key)
-		}
-	}
-	// none -> If the client IP is on ban list, it will get a http code 403 response.
-	//         Otherwise, request will continue as usual. All request call the Crowdsec LAPI
-	// live ->  If the client IP is on ban list, it will get a http code 403 response.
-	//          Otherwise, request will continue as usual.
-	//          The bouncer can leverage use of a local cache in order to reduce the number
-	//          of requests made to the Crowdsec LAPI. It will keep in cache the status for
-	//          each IP that makes queries.
-	// stream -> Stream Streaming mode allows you to keep in the local cache only the Banned IPs,
-	// 			every requests that does not hit the cache is authorized.
-	// 			Every minute, the cache is updated with news from the Crowdsec LAPI.
-	if !contains([]string{"none", "live", "stream"}, config.CrowdsecMode) {
-		return nil, fmt.Errorf("CrowdsecMode must be one of: none, live or stream")
-	}
-	if !contains([]string{"http", "https"}, config.CrowdsecLapiScheme) {
-		return nil, fmt.Errorf("CrowdsecLapiScheme must be one of: http, https")
-	}
-	testURL := url.URL{
-		Scheme: config.CrowdsecLapiScheme,
-		Host:   config.CrowdsecLapiHost,
-		Path:   crowdsecRoute,
-	}
-	_, err := http.NewRequest(http.MethodGet, testURL.String(), nil)
+	logger.Init(config.LogLevel)
+	err := validateParams(config)
 	if err != nil {
-		return nil, fmt.Errorf("CrowdsecLapiScheme://CrowdsecLapiHost: '%v://%v' must be an URL", config.CrowdsecLapiScheme, config.CrowdsecLapiHost)
+		logger.Info(fmt.Sprintf("%w", err))
+		return nil, err
 	}
 
+	checker, _ := ip.NewChecker(config.ForwardedHeadersTrustedIPs)
+
 	bouncer := &Bouncer{
 		next:     next,
 		name:     name,
 		template: template.New("CrowdsecBouncer").Delims("[[", "]]"),
 
 		enabled:                config.Enabled,
-		crowdsecStreamHealthy:  false,
 		crowdsecMode:           config.CrowdsecMode,
 		crowdsecScheme:         config.CrowdsecLapiScheme,
 		crowdsecHost:           config.CrowdsecLapiHost,
 		crowdsecKey:            config.CrowdsecLapiKey,
 		updateInterval:         config.UpdateIntervalSeconds,
+		customHeader:           config.ForwardedHeadersCustomName,
 		defaultDecisionTimeout: config.DefaultDecisionSeconds,
+		poolStrategy: &ip.PoolStrategy{
+			Checker: checker,
+		},
 		client: &http.Client{
 			Transport: &http.Transport{
 				MaxIdleConns:    10,
@@ -135,51 +114,57 @@ func New(ctx context.Context, next http.Handler, config *Config, name string) (h
 			},
 			Timeout: 5 * time.Second,
 		},
-		cache: ttl_map.New(),
 	}
-	// if we are on a stream mode, we fetch in a go routine every minute the new decisions.
-	if config.CrowdsecMode == "stream" {
-		go handleStreamCache(bouncer, true)
+	if config.CrowdsecMode == streamMode {
+		go func() {
+			if ticker == nil {
+				go handleStreamCache(bouncer)
+				ticker = startTicker(config, func() {
+					handleStreamCache(bouncer)
+				})
+			}
+		}()
 	}
 	return bouncer, nil
 }
 
 // ServeHTTP principal function of plugin.
-func (a *Bouncer) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
-	if !a.enabled {
-		a.next.ServeHTTP(rw, req)
+func (bouncer *Bouncer) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
+	if !bouncer.enabled {
+		bouncer.next.ServeHTTP(rw, req)
 		return
 	}
 
-	// TODO Make sur remote address does not include the port.
-	remoteHost, _, err := net.SplitHostPort(req.RemoteAddr)
+	remoteHost, err := ip.GetRemoteIP(req, bouncer.poolStrategy, bouncer.customHeader)
 	if err != nil {
-		log.Printf("failed to extract ip from remote address: %v", err)
-		a.next.ServeHTTP(rw, req)
+		logger.Info(fmt.Sprintf("%w", err))
+		bouncer.next.ServeHTTP(rw, req)
 		return
 	}
+	logger.Debug(fmt.Sprintf("ServeHTTP ip:%v", remoteHost))
 
-	if a.crowdsecMode == "stream" || a.crowdsecMode == "live" {
-		isBanned, err := getDecision(a.cache, remoteHost)
+	if bouncer.crowdsecMode != noneMode {
+		isBanned, err := cache.GetDecision(remoteHost)
 		if err == nil {
+			logger.Debug(fmt.Sprintf("ServeHTTP cacheHit isBanned:%v", isBanned))
 			if isBanned {
 				rw.WriteHeader(http.StatusForbidden)
 			} else {
-				a.next.ServeHTTP(rw, req)
+				bouncer.next.ServeHTTP(rw, req)
 			}
 			return
 		}
 	}
 
 	// Right here if we cannot join the stream we forbid the request to go on.
-	if a.crowdsecMode == "stream" {
-		if a.crowdsecStreamHealthy {
-			a.next.ServeHTTP(rw, req)
+	if bouncer.crowdsecMode == streamMode {
+		if crowdsecStreamHealthy {
+			bouncer.next.ServeHTTP(rw, req)
 		} else {
 			rw.WriteHeader(http.StatusForbidden)
 		}
 	} else {
-		handleNoStreamCache(a, rw, req, remoteHost)
+		handleNoStreamCache(bouncer, rw, req, remoteHost)
 	}
 }
 
@@ -205,131 +190,188 @@ type Stream struct {
 }
 
 func contains(source []string, target string) bool {
-	for _, a := range source {
-		if a == target {
+	for _, item := range source {
+		if item == target {
 			return true
 		}
 	}
 	return false
 }
 
-// Get Decision check in the cache if the IP has the banned / not banned value.
-// Otherwise return with an error to add the IP in cache if we are on.
-func getDecision(cache *ttl_map.Heap, clientIP string) (bool, error) {
-	banned, isCached := cache.Get(clientIP)
-	bannedString, isValid := banned.(string)
-	if isCached && isValid && len(bannedString) > 0 {
-		return bannedString == cacheBannedValue, nil
-	}
-	return false, fmt.Errorf("no cache data")
+func startTicker(config *Config, work func()) chan bool {
+	ticker := time.NewTicker(time.Duration(config.UpdateIntervalSeconds) * time.Second)
+	stop := make(chan bool, 1)
+	go func() {
+		defer logger.Debug("ticker:stopped")
+		for {
+			select {
+			case <-ticker.C:
+				go work()
+			case <-stop:
+				return
+			}
+		}
+	}()
+	return stop
 }
 
-func setDecision(cache *ttl_map.Heap, clientIP string, isBanned bool, duration int64) {
-	if isBanned {
-		cache.Set(clientIP, cacheBannedValue, duration)
-	} else {
-		cache.Set(clientIP, cacheNoBannedValue, duration)
-	}
-}
-
-func handleNoStreamCache(a *Bouncer, rw http.ResponseWriter, req *http.Request, remoteHost string) {
-	// We are now in none or live mode.
+// We are now in none or live mode.
+func handleNoStreamCache(bouncer *Bouncer, rw http.ResponseWriter, req *http.Request, remoteHost string) {
 	routeURL := url.URL{
-		Scheme:   a.crowdsecScheme,
-		Host:     a.crowdsecHost,
-		Path:     crowdsecRoute,
+		Scheme:   bouncer.crowdsecScheme,
+		Host:     bouncer.crowdsecHost,
+		Path:     crowdsecLapiRoute,
 		RawQuery: fmt.Sprintf("ip=%v&banned=true", remoteHost),
 	}
-	body := crowdsecQuery(a, routeURL.String())
+	body, err := crowdsecQuery(bouncer, routeURL.String())
+	if err != nil {
+		logger.Info(fmt.Sprintf("%w", err))
+		rw.WriteHeader(http.StatusForbidden)
+		return
+	}
 
 	if bytes.Equal(body, []byte("null")) {
-		if a.crowdsecMode == "live" {
-			setDecision(a.cache, remoteHost, false, a.defaultDecisionTimeout)
+		if bouncer.crowdsecMode == liveMode {
+			cache.SetDecision(remoteHost, false, bouncer.defaultDecisionTimeout)
 		}
-		a.next.ServeHTTP(rw, req)
+		bouncer.next.ServeHTTP(rw, req)
 		return
 	}
 
 	var decisions []Decision
-	err := json.Unmarshal(body, &decisions)
+	err = json.Unmarshal(body, &decisions)
 	if err != nil {
-		log.Printf("failed to parse body: %s", err)
+		logger.Info(fmt.Sprintf("failed to parse body: %s", err))
 		rw.WriteHeader(http.StatusForbidden)
 		return
 	}
 	if len(decisions) == 0 {
-		if a.crowdsecMode == "live" {
-			setDecision(a.cache, remoteHost, false, a.defaultDecisionTimeout)
+		if bouncer.crowdsecMode == liveMode {
+			cache.SetDecision(remoteHost, false, bouncer.defaultDecisionTimeout)
 		}
-		a.next.ServeHTTP(rw, req)
+		bouncer.next.ServeHTTP(rw, req)
 		return
 	}
 	rw.WriteHeader(http.StatusForbidden)
 	duration, err := time.ParseDuration(decisions[0].Duration)
 	if err != nil {
-		log.Printf("failed to parse duration: %s", err)
+		logger.Info(fmt.Sprintf("failed to parse duration: %s", err))
 		return
 	}
-	setDecision(a.cache, remoteHost, true, int64(duration.Seconds()))
+	if bouncer.crowdsecMode == liveMode {
+		cache.SetDecision(remoteHost, true, int64(duration.Seconds()))
+	}
 }
 
-func handleStreamCache(a *Bouncer, initialized bool) {
+func handleStreamCache(bouncer *Bouncer) {
 	// TODO clean properly on exit.
-	time.AfterFunc(time.Duration(a.updateInterval)*time.Second, func() {
-		handleStreamCache(a, false)
-	})
-	streamRouteURL := url.URL{
-		Scheme:   a.crowdsecScheme,
-		Host:     a.crowdsecHost,
-		Path:     crowdsecStreamRoute,
-		RawQuery: fmt.Sprintf("startup=%t", initialized),
+	// Instead of blocking the goroutine interval for all the secondary node,
+	// if the master service is shut down, other goroutine can take the lead
+	// because updated routine information is in the cache
+	logger.Debug("handleStreamCache")
+	_, err := cache.GetDecision(cacheTimeoutKey)
+	if err == nil {
+		return
 	}
-	body := crowdsecQuery(a, streamRouteURL.String())
-	var stream Stream
-	err := json.Unmarshal(body, &stream)
+	cache.SetDecision(cacheTimeoutKey, false, bouncer.updateInterval-1)
+	streamRouteURL := url.URL{
+		Scheme:   bouncer.crowdsecScheme,
+		Host:     bouncer.crowdsecHost,
+		Path:     crowdsecLapiStreamRoute,
+		RawQuery: fmt.Sprintf("startup=%t", !crowdsecStreamHealthy),
+	}
+	body, err := crowdsecQuery(bouncer, streamRouteURL.String())
 	if err != nil {
-		log.Printf("error while parsing body: %s", err)
-		a.crowdsecStreamHealthy = false
+		logger.Info(fmt.Sprintf("%w", err))
+		crowdsecStreamHealthy = false
+		return
+	}
+	var stream Stream
+	err = json.Unmarshal(body, &stream)
+	if err != nil {
+		logger.Info(fmt.Sprintf("error while parsing body: %s", err))
+		crowdsecStreamHealthy = false
 		return
 	}
 	for _, decision := range stream.New {
 		duration, err := time.ParseDuration(decision.Duration)
 		if err == nil {
-			setDecision(a.cache, decision.Value, true, int64(duration.Seconds()))
+			cache.SetDecision(decision.Value, true, int64(duration.Seconds()))
 		}
 	}
 	for _, decision := range stream.Deleted {
-		a.cache.Del(decision.Value)
+		cache.DeleteDecision(decision.Value)
 	}
-	a.crowdsecStreamHealthy = true
+	crowdsecStreamHealthy = true
 }
 
-func crowdsecQuery(a *Bouncer, stringURL string) ([]byte) {
-	req, _ := http.NewRequest(http.MethodGet, stringURL, nil)
-	req.Header.Add(crowdsecAuthHeader, a.crowdsecKey)
-	res, err := a.client.Do(req)
+func crowdsecQuery(bouncer *Bouncer, stringURL string) ([]byte, error) {
+	var req *http.Request
+	req, _ = http.NewRequest(http.MethodGet, stringURL, nil)
+	req.Header.Add(crowdsecLapiHeader, bouncer.crowdsecKey)
+	res, err := bouncer.client.Do(req)
 	if err != nil {
-		log.Printf("error while fetching %v: %s", stringURL, err)
-		a.crowdsecStreamHealthy = false
-		return nil
+		return nil, fmt.Errorf("error while fetching %v: %s", stringURL, err)
 	}
-	if res.StatusCode == http.StatusForbidden {
-		log.Printf("error while fetching %v, status code: %d", stringURL, res.StatusCode)
-		a.crowdsecStreamHealthy = false
-		return nil
+	if res.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("error while fetching %v, status code: %d", stringURL, res.StatusCode)
 	}
-	defer func (body io.ReadCloser) {
+	defer func(body io.ReadCloser) {
 		err = body.Close()
 		if err != nil {
-			log.Printf("failed to close body reader: %s", err)
+			logger.Info(fmt.Sprintf("failed to close body reader: %s", err))
 		}
 	}(res.Body)
 	body, err := ioutil.ReadAll(res.Body)
 	if err != nil {
-		log.Printf("error while reading body: %s", err)
-		a.crowdsecStreamHealthy = false
-		return nil
+		return nil, fmt.Errorf("error while reading body: %s", err)
 	}
-	return body
+	return body, nil
 }
 
+func validateParams(config *Config) error {
+	requiredStrings := map[string]string{
+		"CrowdsecLapiScheme": config.CrowdsecLapiScheme,
+		"CrowdsecLapiHost":   config.CrowdsecLapiHost,
+		"CrowdsecLapiKey":    config.CrowdsecLapiKey,
+		"CrowdsecMode":       config.CrowdsecMode,
+	}
+	requiredInt := map[string]int64{
+		"UpdateIntervalSeconds":  config.UpdateIntervalSeconds,
+		"DefaultDecisionSeconds": config.DefaultDecisionSeconds,
+	}
+	for key, val := range requiredInt {
+		if val < 1 {
+			return fmt.Errorf("%v: cannot be less than 1", key)
+		}
+	}
+	for key, val := range requiredStrings {
+		if len(val) == 0 {
+			return fmt.Errorf("%v: cannot be empty", key)
+		}
+	}
+	if !contains([]string{noneMode, liveMode, streamMode}, config.CrowdsecMode) {
+		return fmt.Errorf("CrowdsecMode: must be one of 'none', 'live' or 'stream'")
+	}
+	if !contains([]string{"http", "https"}, config.CrowdsecLapiScheme) {
+		return fmt.Errorf("CrowdsecLapiScheme: must be one of 'http' or 'https'")
+	}
+	testURL := url.URL{
+		Scheme: config.CrowdsecLapiScheme,
+		Host:   config.CrowdsecLapiHost,
+	}
+	_, err := http.NewRequest(http.MethodGet, testURL.String(), nil)
+	if err != nil {
+		return fmt.Errorf("CrowdsecLapiScheme://CrowdsecLapiHost: '%v://%v' must be an URL", config.CrowdsecLapiScheme, config.CrowdsecLapiHost)
+	}
+	if len(config.ForwardedHeadersTrustedIPs) > 0 {
+		_, err = ip.NewChecker(config.ForwardedHeadersTrustedIPs)
+		if err != nil {
+			return fmt.Errorf("ForwardedHeadersTrustedIPs must be a list of IP/CIDR :%w", err)
+		}
+	} else {
+		logger.Debug("No IP provided for ForwardedHeadersTrustedIPs")
+	}
+
+	return nil
+}

bouncer_test.go

@@ -1,22 +1,20 @@
-package crowdsec_bouncer_traefik_plugin_test
+package crowdsec_bouncer_traefik_plugin
 
 import (
 	"context"
 	"net/http"
 	"net/http/httptest"
 	"testing"
-
-	crowdsec_bouncer_traefik_plugin "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
 )
 
 func TestCrowdSec(t *testing.T) {
-	cfg := crowdsec_bouncer_traefik_plugin.CreateConfig()
-	cfg.CrowdsecLapiKey = "caca"
+	cfg := CreateConfig()
+	cfg.CrowdsecLapiKey = "test"
 
 	ctx := context.Background()
 	next := http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {})
 
-	handler, err := crowdsec_bouncer_traefik_plugin.New(ctx, next, cfg, "demo-plugin")
+	handler, err := New(ctx, next, cfg, "demo-plugin")
 	if err != nil {
 		t.Fatal(err)
 	}

docker-compose.local.yml

@@ -2,12 +2,12 @@ version: "3.8"
 
 services:
   traefik:
-    image: "traefik:v2.8.7"
+    image: "traefik:v2.9.1"
     container_name: "traefik"
     command:
       # - "--log.level=DEBUG"
       - "--accesslog"
-      - "--accesslog.filepath=/var/log/traefik/traefik.log"
+      - "--accesslog.filepath=/var/log/traefik/access.log"
       - "--api.insecure=true"
       - "--providers.docker=true"
       - "--providers.docker.exposedbydefault=false"
@@ -15,41 +15,57 @@ services:
 
       - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
     volumes:
-      - "/var/run/docker.sock:/var/run/docker.sock:ro"
-      - "logs:/var/log/traefik"
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - logs-local:/var/log/traefik
       - ./:/plugins-local/src/github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
     ports:
-      - 8000:80
+      - 80:80
       - 8080:8080
     depends_on:
-      - 'crowdsec'
+      - crowdsec
 
-  whoami:
+  whoami1:
     image: traefik/whoami
-    container_name: "simple-service"
+    container_name: "simple-service1"
     labels:
       - "traefik.enable=true"
-      - "traefik.http.routers.whoami.rule=Host(`localhost`)"
-      - "traefik.http.routers.whoami.entrypoints=web"
-      - "traefik.http.routers.whoami.middlewares=crowdsec@docker"
-      - "traefik.http.middlewares.crowdsec.plugin.bouncer.enabled=true"
-      - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
+      - "traefik.http.routers.router1.rule=Host(`localhost`) && Path(`/foo`)"
+      - "traefik.http.routers.router1.entrypoints=web"
+      - "traefik.http.routers.router1.middlewares=crowdsec1@docker" 
+      - "traefik.http.services.service1.loadbalancer.server.port=80"
+      - "traefik.http.middlewares.crowdsec1.plugin.bouncer.enabled=true"
+      - "traefik.http.middlewares.crowdsec1.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
+      - "traefik.http.middlewares.crowdsec1.plugin.bouncer.forwardedheaderstrustedips=172.26.0.5"
+
+  whoami2:
+    image: traefik/whoami
+    container_name: "simple-service2"
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.router2.rule=Host(`localhost`) && Path(`/bar`)"
+      - "traefik.http.routers.router2.entrypoints=web"
+      - "traefik.http.routers.router2.middlewares=crowdsec2@docker"
+      - "traefik.http.services.service2.loadbalancer.server.port=80"
+      - "traefik.http.middlewares.crowdsec2.plugin.bouncer.enabled=true"
+      - "traefik.http.middlewares.crowdsec2.plugin.bouncer.crowdseclapikey=44c36dac5c4140af9f06f397508e82c7"
+      - "traefik.http.middlewares.crowdsec2.plugin.bouncer.forwardedheaderstrustedips=172.26.0.5"
 
   crowdsec:
     image: crowdsecurity/crowdsec:v1.4.1
     container_name: "crowdsec"
-    command: rm -rf /etc/crowdsec/acquis.yaml
     environment:
       COLLECTIONS: crowdsecurity/traefik
       CUSTOM_HOSTNAME: crowdsec
-      BOUNCER_KEY_TRAEFIK: 40796d93c2958f9e58345514e67740e5
+      BOUNCER_KEY_TRAEFIK_1: 40796d93c2958f9e58345514e67740e5
+      BOUNCER_KEY_TRAEFIK_2: 44c36dac5c4140af9f06f397508e82c7
     volumes:
       - ./acquis.yaml:/etc/crowdsec/acquis.yaml:ro
-      - logs:/var/log/traefik:ro
-      - crowdsec-db:/var/lib/crowdsec/data/
-      - crowdsec-config:/etc/crowdsec/
-
+      - logs-local:/var/log/traefik:ro
+      - crowdsec-db-local:/var/lib/crowdsec/data/
+      - crowdsec-config-local:/etc/crowdsec/
+    labels:
+      - "traefik.enable=false"
 volumes:
-  logs:
-  crowdsec-db:
-  crowdsec-config:
+  logs-local:
+  crowdsec-db-local:
+  crowdsec-config-local:

docker-compose.yml

@@ -2,18 +2,18 @@ version: "3.8"
 
 services:
   traefik:
-    image: "traefik:v2.8.7"
+    image: "traefik:v2.9.1"
     container_name: "traefik"
     command:
-      # - "--log.level=DEBUG"
       - "--accesslog"
-      - "--accesslog.filepath=/var/log/traefik/traefik.log"
+      - "--accesslog.filepath=/var/log/traefik/access.log"
       - "--api.insecure=true"
       - "--providers.docker=true"
       - "--providers.docker.exposedbydefault=false"
       - "--entrypoints.web.address=:80"
 
       - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
+      - "--experimental.plugins.bouncer.version=v1.1.0"
     volumes:
       - "/var/run/docker.sock:/var/run/docker.sock:ro"
       - "logs:/var/log/traefik"
@@ -23,30 +23,58 @@ services:
     depends_on:
       - 'crowdsec'
 
-  whoami:
+  whoami1:
     image: traefik/whoami
-    container_name: "simple-service"
+    container_name: "simple-service-1"
     labels:
       - "traefik.enable=true"
-      - "traefik.http.routers.whoami.rule=Host(`localhost`)"
-      - "traefik.http.routers.whoami.entrypoints=web"
-      - "traefik.http.routers.whoami.middlewares=crowdsec@docker"
-      - "traefik.http.middlewares.crowdsec.plugin.bouncer.enabled=true"
-      - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=FIXME-LAPI-KEY"
+      # Definition of the router
+      - "traefik.http.routers.router1.rule=Host(`localhost`) && Path(`/foo`)"
+      - "traefik.http.routers.router1.entrypoints=web"
+      - "traefik.http.routers.router1.middlewares=crowdsec2@docker"
+      # Definition of the service
+      - "traefik.http.services.service1.loadbalancer.server.port=80"
+      # Definition of the middleware
+      - "traefik.http.middlewares.crowdsec1.plugin.bouncer.enabled=true"
+      # crowdseclapikey must be unique to the middleware attached to the service
+      - "traefik.http.middlewares.crowdsec1.plugin.bouncer.crowdseclapikey=FIXME-LAPI-KEY-1"
+      # forwardedheaderstrustedips should be the IP of the proxy that is in front of traefik (if any)
+      - "traefik.http.middlewares.crowdsec1.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5"
+  
+  whoami2:
+    image: traefik/whoami
+    container_name: "simple-service-2"
+    labels:
+      - "traefik.enable=true"
+      # Definition of the router
+      - "traefik.http.routers.router2.rule=Host(`localhost`) && Path(`/bar`)"
+      - "traefik.http.routers.router2.entrypoints=web"
+      - "traefik.http.routers.router2.middlewares=crowdsec2@docker"
+      # Definition of the service
+      - "traefik.http.services.service2.loadbalancer.server.port=80"
+      # Definitin of the middleware
+      - "traefik.http.middlewares.crowdsec2.plugin.bouncer.enabled=true"
+      # crowdseclapikey must be unique to the middleware attached to the service
+      - "traefik.http.middlewares.crowdsec2.plugin.bouncer.crowdseclapikey=FIXME-LAPI-KEY-2"
+      # forwardedheaderstrustedips should be the IP of the proxy that is in front of traefik (if any)
+      - "traefik.http.middlewares.crowdsec2.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5"
 
   crowdsec:
     image: crowdsecurity/crowdsec:v1.4.1
     container_name: "crowdsec"
-    command: rm -rf /etc/crowdsec/acquis.yaml
     environment:
       COLLECTIONS: crowdsecurity/traefik
       CUSTOM_HOSTNAME: crowdsec
-      BOUNCER_KEY_TRAEFIK: FIXME-LAPI-KEY
+      # We need to register one api key per service we will use
+      BOUNCER_KEY_TRAEFIK_1: FIXME-LAPI-KEY-1
+      BOUNCER_KEY_TRAEFIK_2: FIXME-LAPI-KEY-2
     volumes:
       - ./acquis.yaml:/etc/crowdsec/acquis.yaml:ro
       - logs:/var/log/traefik:ro
       - crowdsec-db:/var/lib/crowdsec/data/
       - crowdsec-config:/etc/crowdsec/
+    labels:
+      - "traefik.enable=false"
 
 volumes:
   logs:

exemples/behind-proxy/acquis.yaml

@@ -0,0 +1,4 @@
+filenames:
+ - /var/log/traefik/access.log
+labels:
+  type: traefik

exemples/behind-proxy/cloudflare-exemple.yaml

@@ -0,0 +1,15 @@
+http:
+  # Add the router
+  routers:
+    router0:
+      entryPoints:
+      - web
+      service: service-foo
+      rule: Path(`/foo`)
+
+  # Add the service
+  services:
+    service-foo:
+      loadBalancer:
+        servers:
+        - url: http://traefik/foo:80

exemples/behind-proxy/docker-compose.cloudflare.yml

@@ -0,0 +1,86 @@
+version: "3.8"
+
+services:
+  cloudflare:
+    image: "traefik:v2.9.1"
+    container_name: "cloudflare"
+    command:
+      # - "--log.level=DEBUG"
+      - "--accesslog"
+      - "--accesslog.filepath=/var/log/traefik/access.log"
+      - "--api.insecure=true"
+      - "--entrypoints.web.address=:80"
+      - "--providers.file.filename=/cloud.yaml"
+      - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - ./cloudflare-exemple.yaml:/cloud.yaml:ro
+      - logs-cloudflare:/var/log/traefik
+    ports:
+      - 80:80
+      - 8080:8080
+
+  traefik:
+    image: "traefik:v2.9.1"
+    container_name: "traefik"
+    command:
+      # - "--log.level=DEBUG"
+      - "--accesslog"
+      - "--accesslog.filepath=/var/log/traefik/access.log"
+      - "--api.insecure=true"
+      - "--providers.docker=true"
+      - "--providers.docker.exposedbydefault=false"
+      - "--entrypoints.web.address=:80"
+      - "--entrypoints.web.forwardedheaders.trustedips=172.21.0.5"
+
+      - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
+      - "--experimental.plugins.bouncer.version=v1.1.0"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - logs-dev:/var/log/traefik
+    ports:
+      - 90:80
+      - 9080:8080
+    depends_on:
+      - crowdsec
+
+  whoami1:
+    image: traefik/whoami
+    container_name: "simple-service1"
+    labels:
+      - "traefik.enable=true"
+      # Definition of the router
+      - "traefik.http.routers.router1.rule=Path(`/foo`)"
+      - "traefik.http.routers.router1.entrypoints=web"
+      - "traefik.http.routers.router1.middlewares=crowdsec1@docker" 
+      # Definition of the service
+      - "traefik.http.services.service1.loadbalancer.server.port=80"
+      # Definitin of the middleware
+      - "traefik.http.middlewares.crowdsec1.plugin.bouncer.enabled=true"
+      # crowdseclapikey must be uniq to the middleware attached to the service
+      - "traefik.http.middlewares.crowdsec1.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
+      - "traefik.http.middlewares.crowdsec1.plugin.bouncer.crowdsecmode=live"
+      - "traefik.http.middlewares.crowdsec1.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5"
+  
+
+  crowdsec:
+    image: crowdsecurity/crowdsec:v1.4.1
+    container_name: "crowdsec"
+    environment:
+      COLLECTIONS: crowdsecurity/traefik
+      CUSTOM_HOSTNAME: crowdsec
+      BOUNCER_KEY_TRAEFIK_DEV_1: 40796d93c2958f9e58345514e67740e5
+      BOUNCER_KEY_TRAEFIK_DEV_2: 44c36dac5c4140af9f06f397508e82c7
+    volumes:
+      - ./acquis.yaml:/etc/crowdsec/acquis.yaml:ro
+      - logs-dev:/var/log/traefik:ro
+      - crowdsec-db-dev:/var/lib/crowdsec/data/
+      - crowdsec-config-dev:/etc/crowdsec/
+    labels:
+      - "traefik.enable=false"
+
+volumes:
+  logs-dev:
+  logs-cloudflare:
+  crowdsec-db-dev:
+  crowdsec-config-dev:

pkg/cache/cache.go

@@ -0,0 +1,39 @@
+package cache
+
+import (
+	"fmt"
+
+	ttl_map "github.com/leprosus/golang-ttl-map"
+
+	logger "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/pkg/logger"
+)
+const (
+	cacheBannedValue        = "t"
+	cacheNoBannedValue      = "f"
+)
+
+var cache = ttl_map.New()
+
+// Get Decision check in the cache if the IP has the banned / not banned value.
+// Otherwise return with an error to add the IP in cache if we are on.
+func GetDecision(clientIP string) (bool, error) {
+	banned, isCached := cache.Get(clientIP)
+	bannedString, isValid := banned.(string)
+	if isCached && isValid && len(bannedString) > 0 {
+		return bannedString == cacheBannedValue, nil
+	}
+	return false, fmt.Errorf("no cache data")
+}
+
+func SetDecision(clientIP string, isBanned bool, duration int64) {
+	if isBanned {
+		logger.Debug(fmt.Sprintf("%v banned", clientIP))
+		cache.Set(clientIP, cacheBannedValue, duration)
+	} else {
+		cache.Set(clientIP, cacheNoBannedValue, duration)
+	}
+}
+
+func DeleteDecision(clientIP string) {
+	cache.Del(clientIP)
+}

pkg/ip/ip.go

@@ -0,0 +1,127 @@
+package ip
+
+import (
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"strings"
+)
+
+// CHECKER
+
+// Checker allows to check that addresses are in a trusted IPs.
+type Checker struct {
+	authorizedIPs    []*net.IP
+	authorizedIPsNet []*net.IPNet
+}
+
+// NewChecker builds a new Checker given a list of CIDR-Strings to trusted IPs.
+func NewChecker(trustedIPs []string) (*Checker, error) {
+	if len(trustedIPs) == 0 {
+		return nil, errors.New("no trusted IPs provided")
+	}
+
+	checker := &Checker{}
+
+	for _, ipMask := range trustedIPs {
+		if ipAddr := net.ParseIP(ipMask); ipAddr != nil {
+			checker.authorizedIPs = append(checker.authorizedIPs, &ipAddr)
+			continue
+		}
+
+		_, ipAddr, err := net.ParseCIDR(ipMask)
+		if err != nil {
+			return nil, fmt.Errorf("parsing CIDR trusted IPs %s: %w", ipAddr, err)
+		}
+		checker.authorizedIPsNet = append(checker.authorizedIPsNet, ipAddr)
+	}
+
+	return checker, nil
+}
+
+// Contains checks if provided address is in the trusted IPs.
+func (ip *Checker) Contains(addr string) (bool, error) {
+	if len(addr) == 0 {
+		return false, errors.New("empty IP address")
+	}
+
+	ipAddr, err := parseIP(addr)
+	if err != nil {
+		return false, fmt.Errorf("unable to parse address: %s: %w", addr, err)
+	}
+
+	return ip.ContainsIP(ipAddr), nil
+}
+
+// ContainsIP checks if provided address is in the trusted IPs.
+func (ip *Checker) ContainsIP(addr net.IP) bool {
+	for _, authorizedIP := range ip.authorizedIPs {
+		if authorizedIP.Equal(addr) {
+			return true
+		}
+	}
+
+	for _, authorizedNet := range ip.authorizedIPsNet {
+		if authorizedNet.Contains(addr) {
+			return true
+		}
+	}
+
+	return false
+}
+
+func parseIP(addr string) (net.IP, error) {
+	userIP := net.ParseIP(addr)
+	if userIP == nil {
+		return nil, fmt.Errorf("can't parse IP from address %s", addr)
+	}
+
+	return userIP, nil
+}
+
+// STRATEGY
+
+// PoolStrategy is a strategy based on an IP Checker.
+// It allows to check whether addresses are in a given pool of IPs.
+type PoolStrategy struct {
+	Checker *Checker
+}
+
+// GetIP checks the list of Forwarded IPs (most recent first) against the
+// Checker pool of IPs. It returns the first IP that is not in the pool, or the
+// empty string otherwise.
+func (s *PoolStrategy) getIP(req *http.Request, customHeader string) string {
+	if s.Checker == nil {
+		return ""
+	}
+
+	xff := req.Header.Get(customHeader)
+
+	xffs := strings.Split(xff, ",")
+
+	for i := len(xffs) - 1; i >= 0; i-- {
+		xffTrimmed := strings.TrimSpace(xffs[i])
+		if len(xffTrimmed) == 0 {
+			continue
+		}
+		if contain, _ := s.Checker.Contains(xffTrimmed); !contain {
+			return xffTrimmed
+		}
+	}
+
+	return ""
+}
+
+// GetRemoteIP It returns the first IP that is not in the pool, or the empty string otherwise.
+func GetRemoteIP(req *http.Request, strategy *PoolStrategy, customHeader string) (string, error) {
+	remoteIP := strategy.getIP(req, customHeader)
+	if len(remoteIP) != 0 {
+		return remoteIP, nil
+	}
+	remoteIP, _, err := net.SplitHostPort(req.RemoteAddr)
+	if err != nil {
+		return "", fmt.Errorf("failed to extract ip from remote address: %w", err)
+	}
+	return remoteIP, nil
+}

pkg/logger/logger.go

@@ -0,0 +1,35 @@
+package logger
+
+import (
+	"io"
+	"log"
+	"os"
+)
+
+var (
+	loggerInfo  = log.New(io.Discard, "INFO: CrowdsecBouncerTraefikPlugin: ", log.Ldate|log.Ltime)
+	loggerDebug = log.New(io.Discard, "DEBUG: CrowdsecBouncerTraefikPlugin: ", log.Ldate|log.Ltime)
+)
+
+// Init Set Default log level to info in case log level to defined
+func Init(logLevel string) {
+	switch logLevel {
+		case "INFO":
+			loggerInfo.SetOutput(os.Stdout)
+		case "DEBUG":
+			loggerInfo.SetOutput(os.Stdout)
+			loggerDebug.SetOutput(os.Stdout)
+		default:
+			loggerInfo.SetOutput(os.Stdout)
+	}
+}
+
+// Info Log info
+func Info(str string) {
+	loggerInfo.Printf(str)
+}
+
+// Info Log debug
+func Debug(str string) {
+	loggerDebug.Printf(str)
+}