⬆️ Bump to go 1.19 (#37)

* ⬆️ Bump to go 1.19

* ⬆️ Remove depreciated function and replace io/utils calls

.github/workflows/go-cross.yml

@@ -11,7 +11,7 @@ jobs:
 
     strategy:
       matrix:
-        go-version: [ 1.17, 1.x ]
+        go-version: [ 1.19, 1.x ]
         os: [ubuntu-latest, macos-latest, windows-latest]
 
     steps:

.github/workflows/main.yml

@@ -12,9 +12,9 @@ jobs:
     name: Main Process
     runs-on: ubuntu-latest
     env:
-      GO_VERSION: 1.17
+      GO_VERSION: 1.19
-      GOLANGCI_LINT_VERSION: v1.46.2
+      GOLANGCI_LINT_VERSION: v1.50.0
-      YAEGI_VERSION: v0.13.0
+      YAEGI_VERSION: v0.14.2
       CGO_ENABLED: 0
     defaults:
       run:

.golangci.yml

@@ -29,11 +29,20 @@ linters-settings:
 linters:
   enable-all: true
   disable:
+    - deadcode # deprecated
+    - exhaustivestruct # deprecated
+    - golint # deprecated
+    - ifshort # deprecated
     - interfacer # deprecated
     - maligned # deprecated
+    - nosnakecase # deprecated
     - scopelint # deprecated
-    - golint # deprecated
+    - scopelint # deprecated
-    - exhaustivestruct # deprecated
+    - structcheck # deprecated
+    - varcheck # deprecated
+    - sqlclosecheck # not relevant (SQL)
+    - rowserrcheck # not relevant (SQL)
+    - execinquery # not relevant (SQL)
     - cyclop # duplicate of gocyclo
     - bodyclose # Too many false positives: https://github.com/timakin/bodyclose/issues/30
     - dupl
@@ -52,6 +61,9 @@ linters:
     - gomnd
     - forbidigo
     - varnamelen
+    - wastedassign # is disabled because of generics
+    - gofumpt
+    - gci
 
 issues:
   exclude-use-default: false

Makefile

@@ -25,18 +25,52 @@ run_dev:
 run_local:
 	docker-compose -f docker-compose.local.yml up -d --remove-orphans
 
+run_behindproxy:
+	docker-compose -f exemples/behind-proxy/docker-compose.cloudflare.yml up -d --remove-orphans
+
+run_cacheredis:
+	docker-compose -f exemples/redis-cache/docker-compose.redis.yml up -d --remove-orphans
+
+run_trustedips:
+	docker-compose -f exemples/trusted-ips/docker-compose.trusted.yml up -d --remove-orphans
+
 run:
 	docker-compose -f docker-compose.yml up -d --remove-orphans
 
-restart_docker_dev:
+restart_dev:
 	docker-compose -f docker-compose.dev.yml restart
 
-restart_docker_local:
+restart_local:
 	docker-compose -f docker-compose.local.yml restart
 
-restart_docker:
+restart:
 	docker-compose -f docker-compose.yml restart
 
+restart_behindproxy:
+	docker-compose -f exemples/behind-proxy/docker-compose.cloudflare.yml restart
+
+restart_cacheredis:
+	docker-compose -f exemples/redis-cache/docker-compose.redis.yml restart
+
+restart_trustedips:
+	docker-compose -f exemples/trusted-ips/docker-compose.trusted.yml restart
+
+show_logs:
+	docker-compose -f docker-compose.yml restart
+
+show_local_logs:
+	docker-compose -f docker-compose.local.yml logs -f
+
+show_dev_logs:
+	docker-compose -f docker-compose.dev.yml logs -f
+
+clean_all_docker:
+	docker-compose -f exemples/behind-proxy/docker-compose.cloudflare.yml down --remove-orphans
+	docker-compose -f exemples/redis-cache/docker-compose.redis.yml down --remove-orphans
+	docker-compose -f exemples/trusted-ips/docker-compose.trusted.yml down --remove-orphans
+	docker-compose -f docker-compose.local.yml down --remove-orphans
+	docker-compose -f docker-compose.yml down --remove-orphans
+
 show_metrics:
 	docker exec crowdsec cscli metrics
 

README.md

@@ -16,17 +16,19 @@ The crowdsec utility will provide the community blocklist which contains highly
 
 When used with crowdsec it will leverage the local API which will analyze traefik logs and take decisions on the requests made by users/bots. Malicious actors will be banned based on patterns against your website.
 
-There are 4 operating modes (CrowdsecMode) for this plugin:
+There are 3 operating modes (CrowdsecMode) for this plugin:
 
 | Mode | Description |
 |------|------|
 | none | If the client IP is on ban list, it will get a http code 403 response. Otherwise, request will continue as usual. All request call the Crowdsec LAPI |
 | live | If the client IP is on ban list, it will get a http code 403 response. Otherwise, request will continue as usual.    The bouncer can leverage use of a local cache in order to reduce the number of requests made to the Crowdsec LAPI. It will keep in cache the status for  each IP that makes queries. |
 | stream | Stream Streaming mode allows you to keep in the local cache only the Banned IPs, every requests that does not hit the cache is authorized. Every minute, the cache is updated with news from the Crowdsec LAPI. |
-| alone | Standalone mode, similar to the streaming mode but the blacklisted IPs are fetched on the CAPI. Every 2 hours, the cache is updated with news from the Crowdsec CAPI. It does not include any localy banned IP, but can work without a crowdsec service|
 
 The recommanded mode for performance is the streaming mode, decisions are updated every 60 sec by default and that's the only communication between traefik and crowdsec. Every requests that happens hits the cache for quick decisions.
 
+The cache can be local to the Traefik instance using the filesystem or use of a separated redis instance.  
+The redis instance is currently in beta and support Redis 7.0.X version
+
 ## Usage
 
 To get started, use the `docker-compose.yml` file.
@@ -37,41 +39,32 @@ make run
 ```
 
 ### Note
-Each middleware in traefik has it's own data and is instanciated by service.
-This means if there are 10 services protected by the bouncer in streaming alone or live mode, the cache will be duplicated to all 10 services.
-This is because traefik does not allow plugins to store data locally that can be consummed.
 
-The synchronisation with the crowdsec service will happen also 10 times in the period selected.
+**/!\ Since Release 1.1.0, cache is no longer duplicated but shared by all services**
-It should be taken into account when fixing this period so each middleware has time to sync data from crowdsec.
+*This lowers the overhead of the cache in memory and the numbers of cache to fetch it from crowdsec in situation with many services*
 
-At each start of synchronisation, the middleware will wait a random number of seconds to avoid simultaneous calls to crowdsec.
 
 ### Variables
 - Enabled
   - bool
   - enable the plugin
+  - default: false
+- LogLevel
+  - string
+  - default: `INFO`, expected value are: `INFO`, `DEBUG`
 - CrowdsecMode
   - string
-  - default: `stream`, expected value are: `none`, `live`, `stream`, `alone`
+  - default: `live`, expected value are: `none`, `live`, `stream`
 - CrowdsecLapiScheme
   - string
   - default: `http`, expected value are: `http`, `https`
 - CrowdsecLapiHost
   - string
   - default: "crowdsec:8080"
-  - Crowdsec LAPI available on which host.
+  - Crowdsec LAPI available on which host and port.
 - CrowdsecLapiKey
   - string
   - Crowdsec LAPI generated key for the bouncer : **must be unique by service**. 
-- CrowdsecCapiLogin
-  - string
-  - Used only in `alone` mode, login for Crowdsec CAPI
-- CrowdsecCapiPwd
-  - string
-  - Used only in `alone` mode, password for Crowdsec CAPI
-- CrowdsecCapiScenarios
-  - []string
-  - Used only in `alone` mode, scenarios for Crowdsec CAPI
 - UpdateIntervalSeconds
   - int64
   - default: 60
@@ -80,6 +73,26 @@ At each start of synchronisation, the middleware will wait a random number of se
   - int64
   - default: 60
   - Used only in `live` mode, decision duration of accepted IPs
+- ForwardedHeadersTrustedIPs
+  - []string
+  - default: []
+  - List of IPs of trusted Proxies that are in front of traefik (ex: Cloudflare)
+- ForwardedHeadersCustomName
+  - string
+  - default: "X-Forwarded-For"
+  - Name of the header where the real IP of the client should be retrieved
+- RedisCacheEnabled
+  - bool
+  - default: false
+  - enable redis cache instead of filesystem cache
+- RedisCacheHost
+  - string 
+  - default: "redis:6379"
+  - hostname and port for the redis service
+- ClientTrustedIPs
+  - string 
+  - default: []
+  - List of client IPs we trust, they will bypass any more check to the bouncer or cache (usefull for LAN or VPN IP)
 
 ### Configuration
 
@@ -122,21 +135,22 @@ http:
           enabled: false
           updateIntervalSeconds: 60
           defaultDecisionSeconds: 60
-          crowdsecMode: stream
+          crowdsecMode: live
           crowdsecLapiKey: privateKey
           crowdsecLapiHost: crowdsec:8080
           crowdsecLapiScheme: http
-          crowdsecCapiLogin: login
+          forwardedHeadersTrustedIPs: 
-          crowdsecCapiPwd: password
+            - 10.0.10.23/32
-          crowdsecCapiScenarios:
+            - 10.0.20.0/24
-            - scenario1
+          clientTrustedIPs: 
-            - scenario2
+            - 192.168.1.0/24
-            ...
+          forwardedHeadersCustomName: X-Custom-Header
-
+          redisCacheEnabled: false
+          redisCacheHost: "redis:6379"
 ```
-Except for the crowdsecLapiKey, crowdsecCapiLogin, crowdsecCapiPwd, crowdsecCapiScenarios, these are the default value of the plugin.
+These are the default values of the plugin except for LapiKey.
 
-#### Generate LAPI KEY (exept for `alone` mode)
+#### Generate LAPI KEY
 You need to generate a crowdsec API key for the LAPI.
 You can follow the documentation here: https://docs.crowdsec.net/docs/user_guides/lapi_mgmt/
 
@@ -165,41 +179,11 @@ You can then run all the containers:
 docker-compose up -d
 ```
 
-#### Generate CAPI credentials (only for `alone` mode)
-You need to create a crowdsec API credentials for the CAPI.
-You can follow the documentation here: https://docs.crowdsec.net/docs/central_api/intro
-
-```bash
-curl -X POST "https://api.crowdsec.net/v2/watchers" -H  "accept: application/json" -H  "Content-Type: application/json" -d "{ \"password\": \"PASSWORD\",  \"machine_id\": \"LOGIN\"}"
-```
-
-These CAPI credentials must be set in your docker-compose.yml or in your config files
-```yaml
-...
-traefik:
-  command:
-    ...
-    - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
-    - "--experimental.plugins.bouncer.version=v1.0.0"
-    ...
-whoami:
-  labels:
-    - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseccapilogin=LOGIN"
-    - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseccapipwd=PASSWORD"
-    - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseccapiscenarios=scenario1, scenario2, ..."
-    - "traefik.http.middlewares.crowdsec.plugin.bouncer.enabled=true"
-```
-
-You can then run all the containers:
-```bash
-docker-compose up -d
-```
-
 #### Add manually an IP to the blocklist (testing purpose)
 
 ```bash
 docker-compose up -d crowdsec
-docker exec crowdsec cscli decisions add --ip 10.0.0.10 # this will be effective 4h
+docker exec crowdsec cscli decisions add --ip 10.0.0.10 -d 10m # this will be effective 10min
 docker exec crowdsec cscli decisions remove --ip 10.0.0.10
 ```
 
@@ -232,6 +216,85 @@ For local developpement a docker-compose.local.yml is provided and reproduce the
 ```bash
 docker-compose -f docker-compose.local.yml up -d
 ```
+Equivalent to
+```bash
+make run_local
+```
+
+### Exemples
+
+1. Behind another proxy service (ex: clouflare)
+
+You need to configure your Traefik to trust Forwarded headers by your front proxy
+In the exemple we use another instance of traefik with the container named cloudflare to simulate a front proxy
+
+The "internal" Traefik instance is configured to trust the cloudflare forward headers
+This helps Traefik choose the right IP of the client: see https://doc.traefik.io/traefik/routing/entrypoints/#forwarded-headers
+```yaml
+  - "--entrypoints.web.forwardedheaders.trustedips=172.21.0.5"
+```
+
+We configure the middleware to trust as well the IP:
+```yaml
+    - "traefik.http.middlewares.crowdsec1.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5"
+```
+
+To play the demo environnement run:
+```bash
+make run_behindproxy
+```
+
+2. With Redis as an external shared cache
+
+The plugin must be configured to connect to a redis instance
+```yaml
+  redisCacheHost: "redis:6379"
+```
+Here **redis** is the hostname of a container located in the same network as Traefik and **6379** the default port of redis
+
+To play the demo environnement run:
+```bash
+make run_cacheredis
+```
+
+3. Using Trusted IP (ex: LAN OR VPN) that won't get filtered by crowdsec
+
+You need to configure your Traefik to trust Forwarded headers by your front proxy
+In the exemple we use a whoami container protected by crowdsec, and we ban or IP before allowing using TrustedIPs
+
+If you are using another proxy in front, you need to add it's IP in the trusted IP for the forwarded headers.
+This helps Traefik choose the right IP of the client: see https://doc.traefik.io/traefik/routing/entrypoints/#forwarded-headers
+The "internal" Traefik instance is configured to trust the forward headers
+```yaml
+  - "--entrypoints.web.forwardedheaders.trustedips=172.21.0.5"
+```
+
+We configure the middleware to trust as well the IP of the intermediate proxy if needed:
+```yaml
+    - "traefik.http.middlewares.crowdsec.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5"
+```
+
+Add your IP to the ban list
+```bash
+docker exec crowdsec cscli decisions add --ip 10.0.10.30 -d 10m
+```
+You should get a 403 on http://localhost/foo
+
+> Replace *10.0.10.30* by your IP
+
+Add the IPs that will not be filtered by the plugin
+```yaml
+    - "traefik.http.middlewares.crowdsec.plugin.bouncer.clientTrustedips=10.0.10.30/32"
+```
+
+> Replace *10.0.10.30/32* by your IP or IP range, so it's not getting checked against ban cache of crowdsec
+
+You should get a 200 on http://localhost/foo even if you are on the ban cache
+
+To play the demo environnement run:
+```bash
+make run_trustedips
+```
 
 ### About
 

bouncer.go

@@ -1,4 +1,6 @@
-package crowdsec_bouncer_traefik_plugin
+// Package crowdsec_bouncer_traefik_plugin implements a middleware that communicates with crowdsec.
+// It can cache results to filesystem or redis, or even ask crowdsec for every requests.
+package crowdsec_bouncer_traefik_plugin //nolint:revive,stylecheck
 
 import (
 	"bytes"
@@ -6,108 +8,119 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
-	"io/ioutil"
-	"log"
-	"math/rand"
-	"net"
 	"net/http"
 	"net/url"
-	"strings"
 	"text/template"
 	"time"
 
-	ttl_map "github.com/leprosus/golang-ttl-map"
+	cache "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/pkg/cache"
+	ip "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/pkg/ip"
+	logger "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/pkg/logger"
+	simpleredis "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/pkg/simpleredis"
 )
 
 const (
-	aloneMode               = "alone"
 	streamMode              = "stream"
 	liveMode                = "live"
 	noneMode                = "none"
 	crowdsecLapiHeader      = "X-Api-Key"
-	crowdsecCapiHeader      = "Authorization"
 	crowdsecLapiRoute       = "v1/decisions"
 	crowdsecLapiStreamRoute = "v1/decisions/stream"
-	crowdsecCapiLogin       = "v2/watchers/login"
+	cacheTimeoutKey         = "updated"
-	crowdsecCapiDecisions   = "v2/decisions/stream"
+)
-	cacheBannedValue        = "t"
+
-	cacheNoBannedValue      = "f"
+//nolint:gochecknoglobals
+var (
+	crowdsecStreamHealthy = false
+	ticker                chan bool
 )
 
 // Config the plugin configuration.
 type Config struct {
 	Enabled                    bool     `json:"enabled,omitempty"`
+	LogLevel                   string   `json:"logLevel,omitempty"`
 	CrowdsecMode               string   `json:"crowdsecMode,omitempty"`
 	CrowdsecLapiScheme         string   `json:"crowdsecLapiScheme,omitempty"`
 	CrowdsecLapiHost           string   `json:"crowdsecLapiHost,omitempty"`
 	CrowdsecLapiKey            string   `json:"crowdsecLapiKey,omitempty"`
-	CrowdsecCapiLogin      string   `json:"crowdsecCapiLogin,omitempty"`
-	CrowdsecCapiPwd        string   `json:"crowdsecCapiPwd,omitempty"`
-	CrowdsecCapiScenarios  []string `json:"crowdsecCapiScenarios,omitempty"`
 	UpdateIntervalSeconds      int64    `json:"updateIntervalSeconds,omitempty"`
 	DefaultDecisionSeconds     int64    `json:"defaultDecisionSeconds,omitempty"`
+	ForwardedHeadersCustomName string   `json:"forwardedheaderscustomheader,omitempty"`
+	ForwardedHeadersTrustedIPs []string `json:"forwardedHeadersTrustedIps,omitempty"`
+	ClientTrustedIPs           []string `json:"clientTrustedIps,omitempty"`
+	RedisCacheEnabled          bool     `json:"redisCacheEnabled,omitempty"`
+	RedisCacheHost             string   `json:"redisCacheHost,omitempty"`
 }
 
 // CreateConfig creates the default plugin configuration.
 func CreateConfig() *Config {
 	return &Config{
 		Enabled:                    false,
-		CrowdsecMode:           streamMode,
+		LogLevel:                   "INFO",
+		CrowdsecMode:               liveMode,
 		CrowdsecLapiScheme:         "http",
 		CrowdsecLapiHost:           "crowdsec:8080",
 		CrowdsecLapiKey:            "",
-		CrowdsecCapiLogin:      "",
-		CrowdsecCapiPwd:        "",
-		CrowdsecCapiScenarios:  []string{},
 		UpdateIntervalSeconds:      60,
 		DefaultDecisionSeconds:     60,
+		ClientTrustedIPs:           []string{},
+		ForwardedHeadersTrustedIPs: []string{},
+		ForwardedHeadersCustomName: "X-Forwarded-For",
+		RedisCacheEnabled:          false,
+		RedisCacheHost:             "redis:6379",
 	}
 }
 
-// Bouncer a Bouncer plugin.
+// Bouncer a Bouncer struct.
 type Bouncer struct {
 	next     http.Handler
 	name     string
 	template *template.Template
 
 	enabled                bool
-	crowdsecStreamHealthy  bool
 	crowdsecScheme         string
 	crowdsecHost           string
 	crowdsecKey            string
 	crowdsecMode           string
 	updateInterval         int64
 	defaultDecisionTimeout int64
-	crowdsecLogin          string
+	customHeader           string
-	crowdsecPwd            string
+	clientPoolStrategy     *ip.PoolStrategy
-	crowdsecScenarios      []string
+	serverPoolStrategy     *ip.PoolStrategy
 	client                 *http.Client
-	cache                  *ttl_map.Heap
 }
 
 // New creates the crowdsec bouncer plugin.
 func New(ctx context.Context, next http.Handler, config *Config, name string) (http.Handler, error) {
+	logger.Init(config.LogLevel)
 	err := validateParams(config)
 	if err != nil {
+		logger.Info(err.Error())
 		return nil, err
 	}
 
+	serverChecker, _ := ip.NewChecker(config.ForwardedHeadersTrustedIPs)
+	clientChecker, _ := ip.NewChecker(config.ClientTrustedIPs)
+
 	bouncer := &Bouncer{
 		next:     next,
 		name:     name,
 		template: template.New("CrowdsecBouncer").Delims("[[", "]]"),
 
 		enabled:                config.Enabled,
-		crowdsecStreamHealthy:  false,
 		crowdsecMode:           config.CrowdsecMode,
 		crowdsecScheme:         config.CrowdsecLapiScheme,
 		crowdsecHost:           config.CrowdsecLapiHost,
 		crowdsecKey:            config.CrowdsecLapiKey,
-		crowdsecLogin:          config.CrowdsecCapiLogin,
-		crowdsecPwd:            config.CrowdsecCapiPwd,
-		crowdsecScenarios:      config.CrowdsecCapiScenarios,
 		updateInterval:         config.UpdateIntervalSeconds,
+		customHeader:           config.ForwardedHeadersCustomName,
 		defaultDecisionTimeout: config.DefaultDecisionSeconds,
+		serverPoolStrategy: &ip.PoolStrategy{
+			Checker: serverChecker,
+		},
+		clientPoolStrategy: &ip.PoolStrategy{
+			Checker: clientChecker,
+		},
 		client: &http.Client{
 			Transport: &http.Transport{
 				MaxIdleConns:    10,
@@ -115,60 +128,77 @@ func New(ctx context.Context, next http.Handler, config *Config, name string) (h
 			},
 			Timeout: 5 * time.Second,
 		},
-		cache: ttl_map.New(),
 	}
-	if config.CrowdsecMode == streamMode || config.CrowdsecMode == aloneMode {
+	if config.RedisCacheEnabled {
-		rand.Seed(time.Now().UnixNano())
+		cache.InitRedisClient(config.RedisCacheHost)
-		if config.CrowdsecMode == aloneMode {
-			getToken(bouncer)
 	}
-		ticker := time.NewTicker(time.Duration(config.UpdateIntervalSeconds) * time.Second)
+	if config.CrowdsecMode == streamMode && ticker == nil {
-		go func() {
+		ticker = startTicker(config, func() {
-			go handleStreamCache(bouncer)
+			handleStreamCache(bouncer)
-			for range ticker.C {
+		})
 		go handleStreamCache(bouncer)
 	}
-		}()
+
-	}
 	return bouncer, nil
 }
 
 // ServeHTTP principal function of plugin.
-func (a *Bouncer) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
+//
-	if !a.enabled {
+//nolint:nestif
-		a.next.ServeHTTP(rw, req)
+func (bouncer *Bouncer) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
+	if !bouncer.enabled {
+		bouncer.next.ServeHTTP(rw, req)
 		return
 	}
 
-	// TODO Make sur remote address does not include the port.
+	// Here we check for the trusted IPs in the customHeader
-	remoteHost, _, err := net.SplitHostPort(req.RemoteAddr)
+	remoteIP, err := ip.GetRemoteIP(req, bouncer.serverPoolStrategy, bouncer.customHeader)
 	if err != nil {
-		logger(fmt.Sprintf("failed to extract ip from remote address: %v", err))
+		logger.Error(fmt.Sprintf("ServeHTTP ip:%s %s", remoteIP, err.Error()))
-		a.next.ServeHTTP(rw, req)
+		rw.WriteHeader(http.StatusForbidden)
+		return
+	}
+	trusted, err := bouncer.clientPoolStrategy.Checker.Contains(remoteIP)
+	if err != nil {
+		logger.Info(err.Error())
+		return
+	}
+	// if our IP is in the trusted list we bypass the next checks
+	logger.Debug(fmt.Sprintf("ServeHTTP ip:%s isTrusted:%v", remoteIP, trusted))
+	if trusted {
+		bouncer.next.ServeHTTP(rw, req)
 		return
 	}
 
-	if a.crowdsecMode == streamMode || a.crowdsecMode == aloneMode || a.crowdsecMode == liveMode {
+	// TODO This should be simplified
-		isBanned, err := getDecision(a, remoteHost)
+	healthy := crowdsecStreamHealthy
-		if err == nil {
+	if bouncer.crowdsecMode != noneMode {
+		isBanned, err := cache.GetDecision(remoteIP)
+		if err != nil {
+			logger.Error(err.Error())
+			if err.Error() == simpleredis.RedisUnreachable {
+				healthy = false
+			}
+		} else {
+			logger.Debug(fmt.Sprintf("ServeHTTP ip:%s cache:hit isBanned:%v", remoteIP, isBanned))
 			if isBanned {
 				rw.WriteHeader(http.StatusForbidden)
 			} else {
-				a.next.ServeHTTP(rw, req)
+				bouncer.next.ServeHTTP(rw, req)
 			}
 			return
 		}
 	}
 
 	// Right here if we cannot join the stream we forbid the request to go on.
-	if a.crowdsecMode == streamMode || a.crowdsecMode == aloneMode {
+	if bouncer.crowdsecMode == streamMode {
-		if a.crowdsecStreamHealthy {
+		if healthy {
-			a.next.ServeHTTP(rw, req)
+			bouncer.next.ServeHTTP(rw, req)
 		} else {
 			rw.WriteHeader(http.StatusForbidden)
 		}
 	} else {
-		handleNoStreamCache(a, rw, req, remoteHost)
+		handleNoStreamCache(bouncer, rw, req, remoteIP)
 	}
 }
 
@@ -193,226 +223,149 @@ type Stream struct {
 	New     []Decision `json:"new"`
 }
 
-// Login Body returned from Crowdsec Login CAPI.
-type Login struct {
-	Code   int    `json:"code"`
-	Token  string `json:"token"`
-	Expire string `json:"expire"`
-}
-
-func logger(str string) {
-	log.Printf("Crowdsec Bouncer Traefik Plugin - %s", str)
-}
-
 func contains(source []string, target string) bool {
-	for _, a := range source {
+	for _, item := range source {
-		if a == target {
+		if item == target {
 			return true
 		}
 	}
 	return false
 }
 
-// Get Decision check in the cache if the IP has the banned / not banned value.
+func startTicker(config *Config, work func()) chan bool {
-// Otherwise return with an error to add the IP in cache if we are on.
+	ticker := time.NewTicker(time.Duration(config.UpdateIntervalSeconds) * time.Second)
-func getDecision(a *Bouncer, clientIP string) (bool, error) {
+	stop := make(chan bool, 1)
-	banned, isCached := a.cache.Get(clientIP)
+	go func() {
-	bannedString, isValid := banned.(string)
+		defer logger.Debug("ticker:stopped")
-	if isCached && isValid && len(bannedString) > 0 {
+		for {
-		return bannedString == cacheBannedValue, nil
+			select {
-	}
+			case <-ticker.C:
-	return false, fmt.Errorf("no cache data")
+				go work()
-}
+			case <-stop:
-
-func setDecision(a *Bouncer, clientIP string, isBanned bool, duration int64) {
-	if a.crowdsecMode == noneMode {
 				return
 			}
-	if isBanned {
-		logger(fmt.Sprintf("%v banned", clientIP))
-		a.cache.Set(clientIP, cacheBannedValue, duration)
-	} else {
-		a.cache.Set(clientIP, cacheNoBannedValue, duration)
 		}
+	}()
+	return stop
 }
 
-func handleNoStreamCache(a *Bouncer, rw http.ResponseWriter, req *http.Request, remoteHost string) {
 // We are now in none or live mode.
+func handleNoStreamCache(bouncer *Bouncer, rw http.ResponseWriter, req *http.Request, remoteIP string) {
 	routeURL := url.URL{
-		Scheme:   a.crowdsecScheme,
+		Scheme:   bouncer.crowdsecScheme,
-		Host:     a.crowdsecHost,
+		Host:     bouncer.crowdsecHost,
 		Path:     crowdsecLapiRoute,
-		RawQuery: fmt.Sprintf("ip=%v&banned=true", remoteHost),
+		RawQuery: fmt.Sprintf("ip=%v&banned=true", remoteIP),
+	}
+	body, err := crowdsecQuery(bouncer, routeURL.String())
+	if err != nil {
+		logger.Info(err.Error())
+		rw.WriteHeader(http.StatusForbidden)
+		return
 	}
-	body := crowdsecQuery(a, routeURL.String(), false)
 
 	if bytes.Equal(body, []byte("null")) {
-		setDecision(a, remoteHost, false, a.defaultDecisionTimeout)
+		if bouncer.crowdsecMode == liveMode {
-		a.next.ServeHTTP(rw, req)
+			cache.SetDecision(remoteIP, false, bouncer.defaultDecisionTimeout)
+		}
+		bouncer.next.ServeHTTP(rw, req)
 		return
 	}
 
 	var decisions []Decision
-	err := json.Unmarshal(body, &decisions)
+	err = json.Unmarshal(body, &decisions)
 	if err != nil {
-		logger(fmt.Sprintf("failed to parse body: %s", err))
+		logger.Info(fmt.Sprintf("failed to parse body: %s", err))
 		rw.WriteHeader(http.StatusForbidden)
 		return
 	}
 	if len(decisions) == 0 {
-		setDecision(a, remoteHost, false, a.defaultDecisionTimeout)
+		if bouncer.crowdsecMode == liveMode {
-		a.next.ServeHTTP(rw, req)
+			cache.SetDecision(remoteIP, false, bouncer.defaultDecisionTimeout)
+		}
+		bouncer.next.ServeHTTP(rw, req)
 		return
 	}
 	rw.WriteHeader(http.StatusForbidden)
 	duration, err := time.ParseDuration(decisions[0].Duration)
 	if err != nil {
-		logger(fmt.Sprintf("failed to parse duration: %s", err))
+		logger.Info(fmt.Sprintf("failed to parse duration: %s", err))
 		return
 	}
-	setDecision(a, remoteHost, true, int64(duration.Seconds()))
+	if bouncer.crowdsecMode == liveMode {
+		cache.SetDecision(remoteIP, true, int64(duration.Seconds()))
+	}
 }
 
-func waitStream() {
+func handleStreamCache(bouncer *Bouncer) {
-	logger("Start Wait Stream")
-	sec := rand.Int63n(30)
-	logger(fmt.Sprintf("Sec=%v", sec))
-	time.Sleep(time.Duration(sec) * time.Second)
-	logger("End Wait Stream")
-}
-
-func handleStreamCache(a *Bouncer) {
-	logger(fmt.Sprintf("Start handleStreamCache with health=%v", a.crowdsecStreamHealthy))
 	// TODO clean properly on exit.
-
+	// Instead of blocking the goroutine interval for all the secondary node,
-	waitStream()
+	// if the master service is shut down, other goroutine can take the lead
-	// wait random number of sec
+	// because updated routine information is in the cache
-	var rawQuery string
+	logger.Debug("handleStreamCache")
-	var path string
+	_, err := cache.GetDecision(cacheTimeoutKey)
-	if a.crowdsecMode == aloneMode {
+	if err == nil {
-		rawQuery = ""
+		return
-		path = crowdsecCapiDecisions
-	} else {
-		rawQuery = fmt.Sprintf("startup=%t", !a.crowdsecStreamHealthy)
-		path = crowdsecLapiStreamRoute
 	}
+	cache.SetDecision(cacheTimeoutKey, false, bouncer.updateInterval-1)
 	streamRouteURL := url.URL{
-		Scheme:   a.crowdsecScheme,
+		Scheme:   bouncer.crowdsecScheme,
-		Host:     a.crowdsecHost,
+		Host:     bouncer.crowdsecHost,
-		Path:     path,
+		Path:     crowdsecLapiStreamRoute,
-		RawQuery: rawQuery,
+		RawQuery: fmt.Sprintf("startup=%t", !crowdsecStreamHealthy),
 	}
-	body := crowdsecQuery(a, streamRouteURL.String(), false)
+	body, err := crowdsecQuery(bouncer, streamRouteURL.String())
-	var stream Stream
-	err := json.Unmarshal(body, &stream)
 	if err != nil {
-		logger(fmt.Sprintf("error while parsing body: %s", err))
+		logger.Info(err.Error())
-		a.crowdsecStreamHealthy = false
+		crowdsecStreamHealthy = false
+		return
+	}
+	var stream Stream
+	err = json.Unmarshal(body, &stream)
+	if err != nil {
+		logger.Info(fmt.Sprintf("error while parsing body: %s", err))
+		crowdsecStreamHealthy = false
 		return
 	}
 	for _, decision := range stream.New {
 		duration, err := time.ParseDuration(decision.Duration)
 		if err == nil {
-			setDecision(a, decision.Value, true, int64(duration.Seconds()))
+			cache.SetDecision(decision.Value, true, int64(duration.Seconds()))
 		}
 	}
 	for _, decision := range stream.Deleted {
-		a.cache.Del(decision.Value)
+		cache.DeleteDecision(decision.Value)
 	}
-	a.crowdsecStreamHealthy = true
+	crowdsecStreamHealthy = true
-	logger(fmt.Sprintf("End handleStreamCache with health=%v", a.crowdsecStreamHealthy))
 }
 
-func getToken(a *Bouncer) {
+func crowdsecQuery(bouncer *Bouncer, stringURL string) ([]byte, error) {
-	loginURL := url.URL{
-		Scheme: a.crowdsecScheme,
-		Host:   a.crowdsecHost,
-		Path:   crowdsecCapiLogin,
-	}
-	body := crowdsecQuery(a, loginURL.String(), true)
-	var login Login
-	err := json.Unmarshal(body, &login)
-	if err != nil {
-		logger(fmt.Sprintf("error while parsing body: %s", err))
-		a.crowdsecStreamHealthy = false
-		return
-	}
-	if login.Code == 200 && len(login.Token) > 0 {
-		a.crowdsecKey = login.Token
-	}
-}
-
-func crowdsecQuery(a *Bouncer, stringURL string, isPost bool) []byte {
 	var req *http.Request
-	if isPost {
-		data := []byte(fmt.Sprintf(
-			`{"machine_id": "%v","password": "%v","scenarios": ["%v"]}`,
-			a.crowdsecLogin,
-			a.crowdsecPwd,
-			strings.Join(a.crowdsecScenarios, `","`),
-		))
-		req, _ = http.NewRequest(http.MethodPost, stringURL, bytes.NewBuffer(data))
-	} else {
 	req, _ = http.NewRequest(http.MethodGet, stringURL, nil)
-	}
+	req.Header.Add(crowdsecLapiHeader, bouncer.crowdsecKey)
-	if a.crowdsecMode == aloneMode {
+	res, err := bouncer.client.Do(req)
-		req.Header.Add(crowdsecCapiHeader, a.crowdsecKey)
-	} else {
-		req.Header.Add(crowdsecLapiHeader, a.crowdsecKey)
-	}
-	res, err := a.client.Do(req)
 	if err != nil {
-		logger(fmt.Sprintf("error while fetching %v: %s", stringURL, err))
+		return nil, fmt.Errorf("error while fetching %v: %w", stringURL, err)
-		a.crowdsecStreamHealthy = false
-		return nil
-	}
-	if res.StatusCode == http.StatusUnauthorized && a.crowdsecMode == aloneMode {
-		oldToken := a.crowdsecKey
-		getToken(a)
-		if oldToken == a.crowdsecKey {
-			a.crowdsecStreamHealthy = false
-			return nil
-		}
-		return crowdsecQuery(a, stringURL, false)
 	}
 	if res.StatusCode != http.StatusOK {
-		logger(fmt.Sprintf("error while fetching %v, status code: %d", stringURL, res.StatusCode))
+		return nil, fmt.Errorf("error while fetching %v, status code: %d", stringURL, res.StatusCode)
-		a.crowdsecStreamHealthy = false
-		return nil
 	}
 	defer func(body io.ReadCloser) {
 		err = body.Close()
 		if err != nil {
-			logger(fmt.Sprintf("failed to close body reader: %s", err))
+			logger.Error(fmt.Sprintf("failed to close body reader: %s", err.Error()))
 		}
 	}(res.Body)
-	body, err := ioutil.ReadAll(res.Body)
+	body, err := io.ReadAll(res.Body)
+
 	if err != nil {
-		logger(fmt.Sprintf("error while reading body: %s", err))
+		return nil, fmt.Errorf("error while reading body: %w", err)
-		a.crowdsecStreamHealthy = false
-		return nil
 	}
-	return body
+	return body, nil
 }
 
 func validateParams(config *Config) error {
-	var requiredStrings map[string]string
+	requiredStrings := map[string]string{
-	if config.CrowdsecMode == aloneMode {
-		requiredStrings = map[string]string{
-			"CrowdsecCapiLogin": config.CrowdsecLapiScheme,
-			"CrowdsecCapiPwd":   config.CrowdsecLapiHost,
-		}
-		for _, val := range config.CrowdsecCapiScenarios {
-			if len(val) == 0 {
-				return fmt.Errorf("CrowdsecCapiScenarios: one or more scenario are empty")
-			}
-		}
-		config.UpdateIntervalSeconds = 7200
-		config.CrowdsecLapiKey = ""
-		config.CrowdsecLapiScheme = "https"
-		config.CrowdsecLapiHost = "api.crowdsec.net"
-	} else {
-		requiredStrings = map[string]string{
 		"CrowdsecLapiScheme": config.CrowdsecLapiScheme,
 		"CrowdsecLapiHost":   config.CrowdsecLapiHost,
 		"CrowdsecLapiKey":    config.CrowdsecLapiKey,
@@ -427,13 +380,12 @@ func validateParams(config *Config) error {
 			return fmt.Errorf("%v: cannot be less than 1", key)
 		}
 	}
-	}
 	for key, val := range requiredStrings {
 		if len(val) == 0 {
 			return fmt.Errorf("%v: cannot be empty", key)
 		}
 	}
-	if !contains([]string{noneMode, liveMode, streamMode, aloneMode}, config.CrowdsecMode) {
+	if !contains([]string{noneMode, liveMode, streamMode}, config.CrowdsecMode) {
 		return fmt.Errorf("CrowdsecMode: must be one of 'none', 'live' or 'stream'")
 	}
 	if !contains([]string{"http", "https"}, config.CrowdsecLapiScheme) {
@@ -447,5 +399,22 @@ func validateParams(config *Config) error {
 	if err != nil {
 		return fmt.Errorf("CrowdsecLapiScheme://CrowdsecLapiHost: '%v://%v' must be an URL", config.CrowdsecLapiScheme, config.CrowdsecLapiHost)
 	}
+	if len(config.ForwardedHeadersTrustedIPs) > 0 {
+		_, err = ip.NewChecker(config.ForwardedHeadersTrustedIPs)
+		if err != nil {
+			return fmt.Errorf("ForwardedHeadersTrustedIPs must be a list of IP/CIDR :%w", err)
+		}
+	} else {
+		logger.Debug("No IP provided for ForwardedHeadersTrustedIPs")
+	}
+	if len(config.ClientTrustedIPs) > 0 {
+		_, err = ip.NewChecker(config.ClientTrustedIPs)
+		if err != nil {
+			return fmt.Errorf("TrustedIPs must be a list of IP/CIDR :%w", err)
+		}
+	} else {
+		logger.Debug("No IP provided for TrustedIPs")
+	}
+
 	return nil
 }

bouncer_test.go

@@ -1,22 +1,20 @@
-package crowdsec_bouncer_traefik_plugin_test
+package crowdsec_bouncer_traefik_plugin //nolint:revive,stylecheck
 
 import (
 	"context"
 	"net/http"
 	"net/http/httptest"
 	"testing"
-
-	crowdsec_bouncer_traefik_plugin "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
 )
 
 func TestCrowdSec(t *testing.T) {
-	cfg := crowdsec_bouncer_traefik_plugin.CreateConfig()
+	cfg := CreateConfig()
-	cfg.CrowdsecLapiKey = "caca"
+	cfg.CrowdsecLapiKey = "test"
 
 	ctx := context.Background()
 	next := http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {})
 
-	handler, err := crowdsec_bouncer_traefik_plugin.New(ctx, next, cfg, "demo-plugin")
+	handler, err := New(ctx, next, cfg, "demo-plugin")
 	if err != nil {
 		t.Fatal(err)
 	}

docker-compose.local.yml

@@ -2,10 +2,11 @@ version: "3.8"
 
 services:
   traefik:
-    image: "traefik:v2.8.8"
+    image: "traefik:v2.9.4"
     container_name: "traefik"
+    restart: unless-stopped
     command:
-      # - "--log.level=DEBUG"
+      - "--log.level=DEBUG"
       - "--accesslog"
       - "--accesslog.filepath=/var/log/traefik/access.log"
       - "--api.insecure=true"
@@ -18,53 +19,42 @@ services:
       - /var/run/docker.sock:/var/run/docker.sock:ro
       - logs-local:/var/log/traefik
       - ./:/plugins-local/src/github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.middlewares.crowdsec.plugin.bouncer.enabled=true"
-      - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
-      - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseccapilogin=3829a6c9870e4726a377d8951ebb64a1m8psGvMaq1ykJ3zX"
-      - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseccapipwd=Q5pgN8bRNInHGdx6QCksdPOJVLeLQ7ipJntSeuP3r8088zXzRVs4G8liXAKfI1k6"
-      - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseccapiscenarios=crowdsecurity/http-backdoors-attempts,baudneo/zoneminder-bf"
     ports:
       - 80:80
       - 8080:8080
     depends_on:
       - crowdsec
 
-  whoami1:
+  whoami-foo:
     image: traefik/whoami
-    container_name: "simple-service1"
+    container_name: "simple-service-foo"
+    restart: unless-stopped
     labels:
       - "traefik.enable=true"
-      # Definition of the router
+      - "traefik.http.routers.router-foo.rule=Path(`/foo`)"
-      - "traefik.http.routers.router1.rule=Host(`localhost`) && Path(`/foo`)"
+      - "traefik.http.routers.router-foo.entrypoints=web"
-      - "traefik.http.routers.router1.entrypoints=web"
+      - "traefik.http.routers.router-foo.middlewares=crowdsec-foo@docker" 
-      - "traefik.http.routers.router1.middlewares=crowdsec1@docker" 
+      - "traefik.http.services.service-foo.loadbalancer.server.port=80"
-      # Definition of the service
+      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.enabled=true"
-      - "traefik.http.services.service1.loadbalancer.server.port=80"
+      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
-      # Definitin of the middleware
+
-      - "traefik.http.middlewares.crowdsec1.plugin.bouncer.enabled=true"
-      # crowdseclapikey must be uniq to the middleware attached to the service
-      - "traefik.http.middlewares.crowdsec1.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
   whoami2:
     image: traefik/whoami
-    container_name: "simple-service2"
+    container_name: "simple-service-bar"
+    restart: unless-stopped
     labels:
       - "traefik.enable=true"
-      # Definition of the router
+      - "traefik.http.routers.router-bar.rule=Path(`/bar`)"
-      - "traefik.http.routers.router2.rule=Host(`localhost`) && Path(`/bar`)"
+      - "traefik.http.routers.router-bar.entrypoints=web"
-      - "traefik.http.routers.router2.entrypoints=web"
+      - "traefik.http.routers.router-bar.middlewares=crowdsec-bar@docker"
-      - "traefik.http.routers.router2.middlewares=crowdsec2@docker"
+      - "traefik.http.services.service-bar.loadbalancer.server.port=80"
-      # Definition of the service
+      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.enabled=true"
-      - "traefik.http.services.service2.loadbalancer.server.port=80"
+      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdseclapikey=44c36dac5c4140af9f06f397508e82c7"
-      # Definitin of the middleware
-      - "traefik.http.middlewares.crowdsec2.plugin.bouncer.enabled=true"
-      # crowdseclapikey must be uniq to the middleware attached to the service
-      - "traefik.http.middlewares.crowdsec2.plugin.bouncer.crowdseclapikey=44c36dac5c4140af9f06f397508e82c7"
 
   crowdsec:
     image: crowdsecurity/crowdsec:v1.4.1
     container_name: "crowdsec"
+    restart: unless-stopped
     environment:
       COLLECTIONS: crowdsecurity/traefik
       CUSTOM_HOSTNAME: crowdsec

docker-compose.yml

@@ -2,10 +2,10 @@ version: "3.8"
 
 services:
   traefik:
-    image: "traefik:v2.8.8"
+    image: "traefik:v2.9.4"
     container_name: "traefik"
+    restart: unless-stopped
     command:
-      # - "--log.level=DEBUG"
       - "--accesslog"
       - "--accesslog.filepath=/var/log/traefik/access.log"
       - "--api.insecure=true"
@@ -14,7 +14,7 @@ services:
       - "--entrypoints.web.address=:80"
 
       - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
-      - "--experimental.plugins.bouncer.version=v1.0.6"
+      - "--experimental.plugins.bouncer.version=v1.1.3"
     volumes:
       - "/var/run/docker.sock:/var/run/docker.sock:ro"
       - "logs:/var/log/traefik"
@@ -26,39 +26,46 @@ services:
 
   whoami1:
     image: traefik/whoami
-    container_name: "simple-service-1"
+    container_name: "simple-service-foo"
+    restart: unless-stopped
     labels:
       - "traefik.enable=true"
       # Definition of the router
-      - "traefik.http.routers.router1.rule=Host(`localhost`) && Path(`/foo`)"
+      - "traefik.http.routers.router-foo.rule=Path(`/foo`)"
-      - "traefik.http.routers.router1.entrypoints=web"
+      - "traefik.http.routers.router-foo.entrypoints=web"
-      - "traefik.http.routers.router1.middlewares=crowdsec2@docker"
+      - "traefik.http.routers.router-foo.middlewares=crowdsec-foo@docker"
       # Definition of the service
-      - "traefik.http.services.service1.loadbalancer.server.port=80"
+      - "traefik.http.services.service-foo.loadbalancer.server.port=80"
-      # Definitin of the middleware
+      # Definition of the middleware
-      - "traefik.http.middlewares.crowdsec1.plugin.bouncer.enabled=true"
+      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.enabled=true"
-      # crowdseclapikey must be uniq to the middleware attached to the service
+      # crowdseclapikey must be unique to the middleware attached to the service
-      - "traefik.http.middlewares.crowdsec1.plugin.bouncer.crowdseclapikey=FIXME-LAPI-KEY-1"
+      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdseclapikey=FIXME-LAPI-KEY-1"
+      # forwardedheaderstrustedips should be the IP of the proxy that is in front of traefik (if any)
+      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5"
   
   whoami2:
     image: traefik/whoami
-    container_name: "simple-service-2"
+    container_name: "simple-service-bar"
+    restart: unless-stopped
     labels:
       - "traefik.enable=true"
       # Definition of the router
-      - "traefik.http.routers.router2.rule=Host(`localhost`) && Path(`/bar`)"
+      - "traefik.http.routers.router-bar.rule=Path(`/bar`)"
-      - "traefik.http.routers.router2.entrypoints=web"
+      - "traefik.http.routers.router-bar.entrypoints=web"
-      - "traefik.http.routers.router2.middlewares=crowdsec2@docker"
+      - "traefik.http.routers.router-bar.middlewares=crowdsec-bar@docker"
       # Definition of the service
-      - "traefik.http.services.service2.loadbalancer.server.port=80"
+      - "traefik.http.services.service-bar.loadbalancer.server.port=80"
       # Definitin of the middleware
-      - "traefik.http.middlewares.crowdsec2.plugin.bouncer.enabled=true"
+      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.enabled=true"
-      # crowdseclapikey must be uniq to the middleware attached to the service
+      # crowdseclapikey must be unique to the middleware attached to the service
-      - "traefik.http.middlewares.crowdsec2.plugin.bouncer.crowdseclapikey=FIXME-LAPI-KEY-2"
+      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdseclapikey=FIXME-LAPI-KEY-2"
+      # forwardedheaderstrustedips should be the IP of the proxy that is in front of traefik (if any)
+      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5"
 
   crowdsec:
     image: crowdsecurity/crowdsec:v1.4.1
     container_name: "crowdsec"
+    restart: unless-stopped
     environment:
       COLLECTIONS: crowdsecurity/traefik
       CUSTOM_HOSTNAME: crowdsec

exemples/behind-proxy/acquis.yaml

@@ -0,0 +1,4 @@
+filenames:
+ - /var/log/traefik/access.log
+labels:
+  type: traefik

exemples/behind-proxy/cloudflare-exemple.yaml

@@ -0,0 +1,15 @@
+http:
+  # Add the router
+  routers:
+    router0:
+      entryPoints:
+      - web
+      service: service-foo
+      rule: Path(`/foo`)
+
+  # Add the service
+  services:
+    service-foo:
+      loadBalancer:
+        servers:
+        - url: http://traefik/foo:80

exemples/behind-proxy/docker-compose.cloudflare.yml

@@ -0,0 +1,111 @@
+version: "3.8"
+
+services:
+  cloudflare:
+    image: "traefik:v2.9.4"
+    container_name: "cloudflare"
+    restart: unless-stopped
+    command:
+      # - "--log.level=DEBUG"
+      - "--accesslog"
+      - "--accesslog.filepath=/var/log/traefik/access.log"
+      - "--api.insecure=true"
+      - "--entrypoints.web.address=:80"
+      - "--providers.file.filename=/cloud.yaml"
+      - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - ./cloudflare-exemple.yaml:/cloud.yaml:ro
+      - logs-cloudflare:/var/log/traefik
+    ports:
+      - 80:80
+      - 8080:8080
+
+  traefik:
+    image: "traefik:v2.9.4"
+    container_name: "traefik"
+    restart: unless-stopped
+    command:
+      # - "--log.level=DEBUG"
+      - "--accesslog"
+      - "--accesslog.filepath=/var/log/traefik/access.log"
+      - "--api.insecure=true"
+      - "--providers.docker=true"
+      - "--providers.docker.exposedbydefault=false"
+      - "--entrypoints.web.address=:80"
+      - "--entrypoints.web.forwardedheaders.trustedips=172.21.0.5"
+
+      - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
+      - "--experimental.plugins.bouncer.version=v1.1.3"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - logs-traefik:/var/log/traefik
+    ports:
+      - 90:80
+      - 9080:8080
+    depends_on:
+      - crowdsec
+
+  whoami1:
+    image: traefik/whoami
+    container_name: "simple-service-foo"
+    restart: unless-stopped
+    labels:
+      - "traefik.enable=true"
+      # Definition of the router
+      - "traefik.http.routers.router-foo.rule=Path(`/foo`)"
+      - "traefik.http.routers.router-foo.entrypoints=web"
+      - "traefik.http.routers.router-foo.middlewares=crowdsec-foo@docker" 
+      # Definition of the service
+      - "traefik.http.services.service-foo.loadbalancer.server.port=80"
+      # Definitin of the middleware
+      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.enabled=true"
+      # crowdseclapikey must be uniq to the middleware attached to the service
+      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
+      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdsecmode=live"
+      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5"
+      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.loglevel=DEBUG"
+  
+  whoami2:
+    image: traefik/whoami
+    container_name: "simple-service-bar"
+    restart: unless-stopped
+    labels:
+      - "traefik.enable=true"
+      # Definition of the router
+      - "traefik.http.routers.router-bar.rule=Path(`/bar`)"
+      - "traefik.http.routers.router-bar.entrypoints=web"
+      - "traefik.http.routers.router-bar.middlewares=crowdsec-bar@docker" 
+      # Definition of the service
+      - "traefik.http.services.service-bar.loadbalancer.server.port=80"
+      # Definitin of the middleware
+      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.enabled=true"
+      # crowdseclapikey must be uniq to the middleware attached to the service
+      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdseclapikey=44c36dac5c4140af9f06f397508e82c7"
+      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdsecmode=live"
+      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5"
+      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.loglevel=DEBUG"
+  
+
+  crowdsec:
+    image: crowdsecurity/crowdsec:v1.4.1
+    container_name: "crowdsec"
+    restart: unless-stopped
+    environment:
+      COLLECTIONS: crowdsecurity/traefik
+      CUSTOM_HOSTNAME: crowdsec
+      BOUNCER_KEY_TRAEFIK_DEV_1: 40796d93c2958f9e58345514e67740e5
+      BOUNCER_KEY_TRAEFIK_DEV_2: 44c36dac5c4140af9f06f397508e82c7
+    volumes:
+      - ./acquis.yaml:/etc/crowdsec/acquis.yaml:ro
+      - logs-cloudflare:/var/log/traefik:ro
+      - crowdsec-db-cloudflare:/var/lib/crowdsec/data/
+      - crowdsec-config-cloudflare:/etc/crowdsec/
+    labels:
+      - "traefik.enable=false"
+
+volumes:
+  logs-traefik:
+  logs-cloudflare:
+  crowdsec-db-cloudflare:
+  crowdsec-config-cloudflare:

exemples/redis-cache/acquis.yaml

@@ -0,0 +1,4 @@
+filenames:
+ - /var/log/traefik/access.log
+labels:
+  type: traefik

exemples/redis-cache/docker-compose.redis.yml

@@ -0,0 +1,101 @@
+version: "3.8"
+
+services:
+  traefik:
+    image: "traefik:v2.9.4"
+    container_name: "traefik"
+    restart: unless-stopped
+    command:
+      # - "--log.level=DEBUG"
+      - "--accesslog"
+      - "--accesslog.filepath=/var/log/traefik/access.log"
+      - "--api.insecure=true"
+      - "--providers.docker=true"
+      - "--providers.docker.exposedbydefault=false"
+      - "--entrypoints.web.address=:80"
+
+      - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
+      - "--experimental.plugins.bouncer.version=v1.1.3"
+      # - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - logs-redis:/var/log/traefik
+      - ./../../:/plugins-local/src/github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
+    ports:
+      - 80:80
+      - 8080:8080
+    depends_on:
+      - crowdsec
+      - redis
+
+  whoami-foo:
+    image: traefik/whoami
+    container_name: "simple-service-foo"
+    restart: unless-stopped
+    labels:
+      - "traefik.enable=true"
+      # Definition of the router
+      - "traefik.http.routers.router-foo.rule=Path(`/foo`)"
+      - "traefik.http.routers.router-foo.entrypoints=web"
+      - "traefik.http.routers.router-foo.middlewares=crowdsec-foo@docker" 
+      # Definition of the service
+      - "traefik.http.services.service-foo.loadbalancer.server.port=80"
+      # Definition of the middleware
+      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.enabled=true"
+      # crowdseclapikey must be uniq to the middleware attached to the service
+      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
+      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.rediscacheenabled=true"
+      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.loglevel=DEBUG"
+
+  whoami-bar:
+    image: traefik/whoami
+    container_name: "simple-service-bar"
+    restart: unless-stopped
+    labels:
+      - "traefik.enable=true"
+      # Definition of the router
+      - "traefik.http.routers.router-bar.rule=Path(`/bar`)"
+      - "traefik.http.routers.router-bar.entrypoints=web"
+      - "traefik.http.routers.router-bar.middlewares=crowdsec-bar@docker" 
+      # Definition of the service
+      - "traefik.http.services.service-bar.loadbalancer.server.port=80"
+      # Definition of the middleware
+      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.enabled=true"
+      # crowdseclapikey must be uniq to the middleware attached to the service
+      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdseclapikey=44c36dac5c4140af9f06f397508e82c7"
+      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.rediscacheenabled=true"
+      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.loglevel=DEBUG"
+
+
+  crowdsec:
+    image: crowdsecurity/crowdsec:v1.4.1
+    container_name: "crowdsec"
+    restart: unless-stopped
+    environment:
+      COLLECTIONS: crowdsecurity/traefik
+      CUSTOM_HOSTNAME: crowdsec
+      BOUNCER_KEY_TRAEFIK_DEV_1: 40796d93c2958f9e58345514e67740e5
+      BOUNCER_KEY_TRAEFIK_DEV_2: 44c36dac5c4140af9f06f397508e82c7
+    volumes:
+      - ./acquis.yaml:/etc/crowdsec/acquis.yaml:ro
+      - logs-redis:/var/log/traefik:ro
+      - crowdsec-db-redis:/var/lib/crowdsec/data/
+      - crowdsec-config-redis:/etc/crowdsec/
+    labels:
+      - "traefik.enable=false"
+
+  redis:
+    image: "redis:7.0.5-alpine"
+    container_name: "redis"
+    restart: unless-stopped
+    command: "redis-server --save 60 1"
+    volumes:
+      - redis-data:/data
+    ports:
+      - 6379:6379
+
+volumes:
+  logs-redis:
+  crowdsec-db-redis:
+  crowdsec-config-redis:
+  redis-data:

exemples/trusted-ips/acquis.yaml

@@ -0,0 +1,4 @@
+filenames:
+ - /var/log/traefik/access.log
+labels:
+  type: traefik

exemples/trusted-ips/docker-compose.trusted.yml

@@ -0,0 +1,91 @@
+version: "3.8"
+
+services:
+  traefik:
+    image: "traefik:v2.9.4"
+    container_name: "traefik"
+    restart: unless-stopped
+    command:
+      # - "--log.level=DEBUG"
+      - "--accesslog"
+      - "--accesslog.filepath=/var/log/traefik/access.log"
+      - "--api.insecure=true"
+      - "--providers.docker=true"
+      - "--providers.docker.exposedbydefault=false"
+      - "--entrypoints.web.address=:80"
+
+      - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
+      - "--experimental.plugins.bouncer.version=v1.1.3"
+      # - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - logs-trustedips:/var/log/traefik
+      - ./../../:/plugins-local/src/github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
+    ports:
+      - 80:80
+      - 8080:8080
+    depends_on:
+      - crowdsec
+
+  whoami1:
+    image: traefik/whoami
+    container_name: "simple-service-foo"
+    restart: unless-stopped
+    labels:
+      - "traefik.enable=true"
+      # Definition of the router
+      - "traefik.http.routers.router-foo.rule=Path(`/foo`)"
+      - "traefik.http.routers.router-foo.entrypoints=web"
+      - "traefik.http.routers.router-foo.middlewares=crowdsec-foo@docker" 
+      # Definition of the service
+      - "traefik.http.services.service-foo.loadbalancer.server.port=80"
+      # Definition of the middleware
+      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.enabled=true"
+      # crowdseclapikey must be uniq to the middleware attached to the service
+      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
+      # Replace 10.0.10.30/32 by your IP range which is "trusted"
+      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.clienttrustedips=10.0.10.30/32"
+      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.loglevel=DEBUG"
+  
+  whoami2:
+    image: traefik/whoami
+    container_name: "simple-service-bar"
+    restart: unless-stopped
+    labels:
+      - "traefik.enable=true"
+      # Definition of the router
+      - "traefik.http.routers.router-bar.rule=Path(`/bar`)"
+      - "traefik.http.routers.router-bar.entrypoints=web"
+      - "traefik.http.routers.router-bar.middlewares=crowdsec-bar@docker" 
+      # Definition of the service
+      - "traefik.http.services.service-bar.loadbalancer.server.port=80"
+      # Definition of the middleware
+      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.enabled=true"
+      # crowdseclapikey must be uniq to the middleware attached to the service
+      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdseclapikey=44c36dac5c4140af9f06f397508e82c7"
+      # Replace 10.0.10.30/32 by your IP range which is "trusted"
+      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.clienttrustedips=10.0.10.30/32"
+      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.loglevel=DEBUG"
+
+
+  crowdsec:
+    image: crowdsecurity/crowdsec:v1.4.1
+    container_name: "crowdsec"
+    restart: unless-stopped
+    environment:
+      COLLECTIONS: crowdsecurity/traefik
+      CUSTOM_HOSTNAME: crowdsec
+      BOUNCER_KEY_TRAEFIK_DEV_1: 40796d93c2958f9e58345514e67740e5
+      BOUNCER_KEY_TRAEFIK_DEV_2: 44c36dac5c4140af9f06f397508e82c7
+    volumes:
+      - ./acquis.yaml:/etc/crowdsec/acquis.yaml:ro
+      - logs-trustedips:/var/log/traefik:ro
+      - crowdsec-db-trustedips:/var/lib/crowdsec/data/
+      - crowdsec-config-trustedips:/etc/crowdsec/
+    labels:
+      - "traefik.enable=false"
+  
+volumes:
+  logs-trustedips:
+  crowdsec-db-trustedips:
+  crowdsec-config-trustedips:

go.mod

@@ -1,5 +1,5 @@
 module github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
 
-go 1.17
+go 1.19
 
 require github.com/leprosus/golang-ttl-map v1.1.7

pkg/cache/cache.go

@@ -0,0 +1,107 @@
+// Package cache implements utility routines for manipulating cache.
+// It supports currently local file and redis cache.
+package cache
+
+import (
+	"fmt"
+
+	ttl_map "github.com/leprosus/golang-ttl-map"
+
+	logger "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/pkg/logger"
+	simpleredis "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/pkg/simpleredis"
+)
+
+const (
+	cacheBannedValue   = "t"
+	cacheNoBannedValue = "f"
+)
+
+//nolint:gochecknoglobals
+var (
+	cache        = ttl_map.New()
+	redis        simpleredis.SimpleRedis
+	redisEnabled = false
+)
+
+// FileSystem Cache
+
+func getDecisionLocalCache(clientIP string) (bool, error) {
+	banned, isCached := cache.Get(clientIP)
+	bannedString, isValid := banned.(string)
+	if isCached && isValid && len(bannedString) > 0 {
+		return bannedString == cacheBannedValue, nil
+	}
+	return false, fmt.Errorf("cache:miss")
+}
+
+func setDecisionLocalCache(clientIP string, value string, duration int64) {
+	cache.Set(clientIP, value, duration)
+}
+
+func deleteDecisionLocalCache(clientIP string) {
+	cache.Del(clientIP)
+}
+
+// Redis Cache
+
+func getDecisionRedisCache(clientIP string) (bool, error) {
+	banned, err := redis.Get(clientIP)
+	bannedString := string(banned)
+	if err == nil && len(bannedString) > 0 {
+		return bannedString == cacheBannedValue, nil
+	}
+	return false, err
+}
+
+func setDecisionRedisCache(clientIP string, value string, duration int64) {
+	if err := redis.Set(clientIP, []byte(value), duration); err != nil {
+		logger.Error(fmt.Sprintf("cache:setDecisionRedisCache %s", err.Error()))
+	}
+}
+
+func deleteDecisionRedisCache(clientIP string) {
+	if err := redis.Del(clientIP); err != nil {
+		logger.Error(fmt.Sprintf("cache:deleteDecisionRedisCache %s", err.Error()))
+	}
+}
+
+// DeleteDecision delete decision in cache.
+func DeleteDecision(clientIP string) {
+	if redisEnabled {
+		deleteDecisionRedisCache(clientIP)
+	} else {
+		deleteDecisionLocalCache(clientIP)
+	}
+}
+
+// GetDecision check in the cache if the IP has the banned / not banned value.
+// Otherwise return with an error to add the IP in cache if we are on.
+func GetDecision(clientIP string) (bool, error) {
+	if redisEnabled {
+		return getDecisionRedisCache(clientIP)
+	}
+	return getDecisionLocalCache(clientIP)
+}
+
+// SetDecision update the cache with the IP as key and the value banned / not banned.
+func SetDecision(clientIP string, isBanned bool, duration int64) {
+	var value string
+	if isBanned {
+		logger.Debug(fmt.Sprintf("cache:SetDecision ip:%v banned", clientIP))
+		value = cacheBannedValue
+	} else {
+		value = cacheNoBannedValue
+	}
+	if redisEnabled {
+		setDecisionRedisCache(clientIP, value, duration)
+	} else {
+		setDecisionLocalCache(clientIP, value, duration)
+	}
+}
+
+// InitRedisClient loads variables.
+func InitRedisClient(host string) {
+	redisEnabled = true
+	redis.Init(host)
+	logger.Debug("cache:InitRedisClient redis:initialized")
+}

pkg/ip/ip.go

@@ -0,0 +1,129 @@
+// Package ip implements utility routines for to manipulates IP and CIDR.
+// It allows to find on IP on a list, and find if an IP is part of a list of CIDR.
+package ip
+
+import (
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"strings"
+
+	"github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/pkg/logger"
+)
+
+// CHECKER
+
+// Checker allows to check that addresses are in a trusted IPs.
+type Checker struct {
+	authorizedIPs    []*net.IP
+	authorizedIPsNet []*net.IPNet
+}
+
+// NewChecker builds a new Checker given a list of CIDR-Strings to trusted IPs.
+func NewChecker(trustedIPs []string) (*Checker, error) {
+	checker := &Checker{}
+
+	for _, ipMask := range trustedIPs {
+		if ipAddr := net.ParseIP(ipMask); ipAddr != nil {
+			checker.authorizedIPs = append(checker.authorizedIPs, &ipAddr)
+			logger.Debug(fmt.Sprintf("IP %v is trusted", ipAddr))
+			continue
+		}
+
+		_, ipAddr, err := net.ParseCIDR(ipMask)
+		if err != nil {
+			return nil, fmt.Errorf("parsing CIDR trusted IPs %s: %w", ipAddr, err)
+		}
+		checker.authorizedIPsNet = append(checker.authorizedIPsNet, ipAddr)
+		logger.Debug(fmt.Sprintf("IP network %v is trusted", ipAddr))
+	}
+
+	return checker, nil
+}
+
+// Contains checks if provided address is in the trusted IPs.
+func (ip *Checker) Contains(addr string) (bool, error) {
+	if len(addr) == 0 {
+		return false, errors.New("empty IP address")
+	}
+
+	ipAddr, err := parseIP(addr)
+	if err != nil {
+		return false, fmt.Errorf("unable to parse address: %s: %w", addr, err)
+	}
+
+	return ip.ContainsIP(ipAddr), nil
+}
+
+// ContainsIP checks if provided address is in the trusted IPs.
+func (ip *Checker) ContainsIP(addr net.IP) bool {
+	for _, authorizedIP := range ip.authorizedIPs {
+		if authorizedIP.Equal(addr) {
+			return true
+		}
+	}
+
+	for _, authorizedNet := range ip.authorizedIPsNet {
+		if authorizedNet.Contains(addr) {
+			return true
+		}
+	}
+
+	return false
+}
+
+func parseIP(addr string) (net.IP, error) {
+	userIP := net.ParseIP(addr)
+	if userIP == nil {
+		return nil, fmt.Errorf("can't parse IP from address %s", addr)
+	}
+
+	return userIP, nil
+}
+
+// STRATEGY
+
+// PoolStrategy is a strategy based on an IP Checker.
+// It allows to check whether addresses are in a given pool of IPs.
+type PoolStrategy struct {
+	Checker *Checker
+}
+
+// GetIP checks the list of Forwarded IPs (most recent first) against the
+// Checker pool of IPs. It returns the first IP that is not in the pool, or the
+// empty string otherwise.
+func (s *PoolStrategy) getIP(req *http.Request, customHeader string) string {
+	if s.Checker == nil {
+		return ""
+	}
+
+	xff := req.Header.Get(customHeader)
+
+	xffs := strings.Split(xff, ",")
+
+	for i := len(xffs) - 1; i >= 0; i-- {
+		xffTrimmed := strings.TrimSpace(xffs[i])
+		if len(xffTrimmed) == 0 {
+			continue
+		}
+		if contain, _ := s.Checker.Contains(xffTrimmed); !contain {
+			return xffTrimmed
+		}
+	}
+
+	return ""
+}
+
+// GetRemoteIP It returns the first IP that is not in the pool, or the empty string otherwise.
+func GetRemoteIP(req *http.Request, strategy *PoolStrategy, customHeader string) (string, error) {
+	remoteIP := strategy.getIP(req, customHeader)
+	if len(remoteIP) != 0 {
+		return remoteIP, nil
+	}
+	remoteIP, _, err := net.SplitHostPort(req.RemoteAddr)
+	if err != nil {
+		return "", fmt.Errorf("failed to extract ip from remote address: %w", err)
+	}
+	return remoteIP, nil
+}

pkg/logger/logger.go

@@ -0,0 +1,39 @@
+// Package logger implements utility routines to write to stdout and stderr.
+// It supports debug, info and error level
+package logger
+
+import (
+	"io"
+	"log"
+	"os"
+)
+
+var (
+	loggerInfo  = log.New(io.Discard, "INFO: CrowdsecBouncerTraefikPlugin: ", log.Ldate|log.Ltime)  //nolint:gochecknoglobals
+	loggerDebug = log.New(io.Discard, "DEBUG: CrowdsecBouncerTraefikPlugin: ", log.Ldate|log.Ltime) //nolint:gochecknoglobals
+	loggerError = log.New(io.Discard, "ERROR: CrowdsecBouncerTraefikPlugin: ", log.Ldate|log.Ltime) //nolint:gochecknoglobals
+)
+
+// Init Set Default log level to info in case log level to defined.
+func Init(logLevel string) {
+	loggerError.SetOutput(os.Stderr)
+	loggerInfo.SetOutput(os.Stdout)
+	if logLevel == "DEBUG" {
+		loggerDebug.SetOutput(os.Stdout)
+	}
+}
+
+// Info log to Stdout.
+func Info(str string) {
+	loggerInfo.Printf(str)
+}
+
+// Debug log to Stdout.
+func Debug(str string) {
+	loggerDebug.Printf(str)
+}
+
+// Error log to Stderr.
+func Error(str string) {
+	loggerError.Printf(str)
+}

pkg/simpleredis/simpleredis.go

@@ -0,0 +1,141 @@
+// Package simpleredis implements utility routines for interacting.
+// It supports currently the following operations: GET, SET, DELETE,
+// and support timetoleave for keys.
+package simpleredis
+
+import (
+	"bufio"
+	"fmt"
+	"net"
+	"net/textproto"
+	"strings"
+	"time"
+
+	logger "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/pkg/logger"
+)
+
+// Error strings for redis.
+const (
+	RedisUnreachable = "redis:unreachable"
+	RedisMiss        = "redis:miss"
+	RedisTimeout     = "redis:timeout"
+)
+
+// A RedisCmd is used to communicate with redis at low level using commands.
+type RedisCmd struct {
+	Command  string
+	Name     string
+	Data     []byte
+	Duration int64
+	Error    error
+}
+
+// A SimpleRedis is used to communicate with redis.
+type SimpleRedis struct {
+	redisHost string
+}
+
+func genRedisArray(params ...[]byte) []byte {
+	MSG := ""
+	for cntr := 0; cntr < len(params); cntr++ {
+		MSG = strings.Join([]string{MSG, string(params[cntr])}, " ")
+	}
+	MSG = strings.Trim(MSG, " ")
+	MSG = strings.Join([]string{MSG, "\r\n"}, "")
+	return []byte(MSG)
+}
+
+func send(wr *textproto.Writer, method string, data []byte) {
+	if err := wr.PrintfLine(string(data)); err != nil {
+		logger.Error(fmt.Sprintf("redis:%s  %s", method, err.Error()))
+	} else {
+		logger.Debug(fmt.Sprintf("redis:%s", method))
+	}
+}
+
+func askRedis(hostnamePort string, cmd RedisCmd, channel chan RedisCmd) {
+	dialer := net.Dialer{Timeout: 2 * time.Second}
+	conn, err := dialer.Dial("tcp", hostnamePort)
+	if err != nil {
+		channel <- RedisCmd{Error: fmt.Errorf(RedisUnreachable)}
+		return
+	}
+	defer func() {
+		if err := conn.Close(); err != nil {
+			logger.Error(fmt.Sprintf("redis:connClose %s", err.Error()))
+		}
+	}()
+
+	writer := textproto.NewWriter(bufio.NewWriter(conn))
+	reader := textproto.NewReader(bufio.NewReader(conn))
+
+	switch cmd.Command {
+	case "SET":
+		data := genRedisArray([]byte("SET"), []byte(cmd.Name), cmd.Data, []byte("EX"), []byte(fmt.Sprintf("%d", cmd.Duration)))
+		send(writer, "set", data)
+	case "DEL":
+		data := genRedisArray([]byte("DEL"), []byte(cmd.Name))
+		send(writer, "del", data)
+	case "GET":
+		data := genRedisArray([]byte("GET"), []byte(cmd.Name))
+		send(writer, "get", data)
+		for {
+			select {
+			case <-time.After(time.Second * 1):
+				channel <- RedisCmd{Error: fmt.Errorf(RedisTimeout)}
+				return
+			default:
+				read, _ := reader.ReadLineBytes()
+				if string(read) != "$1" {
+					channel <- RedisCmd{Error: fmt.Errorf(RedisMiss)}
+					return
+				}
+				read, _ = reader.ReadLineBytes()
+				channel <- RedisCmd{Data: read}
+				return
+			}
+		}
+	}
+}
+
+// Init sets the redisHost used to connect to redis.
+func (sr *SimpleRedis) Init(redisHost string) {
+	sr.redisHost = redisHost
+}
+
+// Get fetches the value for key name in redis.
+func (sr *SimpleRedis) Get(name string) ([]byte, error) {
+	redisCmd := RedisCmd{
+		Command: "GET",
+		Name:    name,
+	}
+	channel := make(chan RedisCmd)
+	go askRedis(sr.redisHost, redisCmd, channel)
+	resp := <-channel
+	if resp.Error != nil {
+		return nil, resp.Error
+	}
+	return resp.Data, nil
+}
+
+// Set update the value for key name in redis with value data for duration.
+func (sr *SimpleRedis) Set(name string, data []byte, duration int64) error {
+	redisCmd := RedisCmd{
+		Command:  "SET",
+		Name:     name,
+		Data:     data,
+		Duration: duration,
+	}
+	go askRedis(sr.redisHost, redisCmd, nil)
+	return nil
+}
+
+// Del remove the key name in redis.
+func (sr *SimpleRedis) Del(name string) error {
+	redisCmd := RedisCmd{
+		Command: "DEL",
+		Name:    name,
+	}
+	go askRedis(sr.redisHost, redisCmd, nil)
+	return nil
+}