Merge pull request #32 from maxlerebourg/28-bypassing-crowdsec-for-local-ips

28 bypassing crowdsec for local ips

Makefile

@@ -28,6 +28,12 @@ run_local:
 run_behindproxy:
 	docker-compose -f exemples/behind-proxy/docker-compose.cloudflare.yml up -d --remove-orphans
 
+run_cacheredis:
+	docker-compose -f exemples/redis-cache/docker-compose.redis.yml up -d --remove-orphans
+
+run_trustedips:
+	docker-compose -f exemples/trusted-ips/docker-compose.trusted.yml up -d --remove-orphans
+
 run:
 	docker-compose -f docker-compose.yml up -d --remove-orphans
 
@@ -40,6 +46,15 @@ restart_local:
 restart:
 	docker-compose -f docker-compose.yml restart
 
+restart_behindproxy:
+	docker-compose -f exemples/behind-proxy/docker-compose.cloudflare.yml restart
+
+restart_cacheredis:
+	docker-compose -f exemples/redis-cache/docker-compose.redis.yml restart
+
+restart_trustedips:
+	docker-compose -f exemples/trusted-ips/docker-compose.trusted.yml restart
+
 show_logs:
 	docker-compose -f docker-compose.yml restart
 
@@ -51,6 +66,8 @@ show_dev_logs:
 
 clean_all_docker:
 	docker-compose -f exemples/behind-proxy/docker-compose.cloudflare.yml down --remove-orphans
+	docker-compose -f exemples/redis-cache/docker-compose.redis.yml down --remove-orphans
+	docker-compose -f exemples/trusted-ips/docker-compose.trusted.yml down --remove-orphans
 	docker-compose -f docker-compose.local.yml down --remove-orphans
 	docker-compose -f docker-compose.yml down --remove-orphans
 

README.md

@@ -26,6 +26,9 @@ There are 3 operating modes (CrowdsecMode) for this plugin:
 
 The recommanded mode for performance is the streaming mode, decisions are updated every 60 sec by default and that's the only communication between traefik and crowdsec. Every requests that happens hits the cache for quick decisions.
 
+The cache can be local to the Traefik instance using the filesystem or use of a separated redis instance.  
+The redis instance is currently in beta and support Redis 7.0.X version
+
 ## Usage
 
 To get started, use the `docker-compose.yml` file.
@@ -36,19 +39,16 @@ make run
 ```
 
 ### Note
-Each middleware in traefik has it's own data and is instanciated by service.
-This means if there are 10 services protected by the bouncer in streaming alone or live mode, the cache will be duplicated to all 10 services.
-This is because traefik does not allow plugins to store data locally that can be consummed.
 
-The synchronisation with the crowdsec service will happen also 10 times in the period selected.
+**/!\ Since Release 1.10, cache is no longer duplicated but shared by all services**
-It should be taken into account when fixing this period so each middleware has time to sync data from crowdsec.
+*This lowers the overhead of the cache in memory and the numbers of cache to fetch it from crowdsec in situation with many services*
 
-At each start of synchronisation, the middleware will wait a random number of seconds to avoid simultaneous calls to crowdsec.
 
 ### Variables
 - Enabled
   - bool
   - enable the plugin
+  - default: false
 - LogLevel
   - string
   - default: `INFO`, expected value are: `INFO`, `DEBUG`
@@ -61,7 +61,7 @@ At each start of synchronisation, the middleware will wait a random number of se
 - CrowdsecLapiHost
   - string
   - default: "crowdsec:8080"
-  - Crowdsec LAPI available on which host.
+  - Crowdsec LAPI available on which host and port.
 - CrowdsecLapiKey
   - string
   - Crowdsec LAPI generated key for the bouncer : **must be unique by service**. 
@@ -79,8 +79,20 @@ At each start of synchronisation, the middleware will wait a random number of se
   - List of IPs of trusted Proxies that are in front of traefik (ex: Cloudflare)
 - ForwardedHeadersCustomName
   - string
-  - default: X-Forwarded-For
+  - default: "X-Forwarded-For"
   - Name of the header where the real IP of the client should be retrieved
+- RedisCacheEnabled
+  - bool
+  - default: false
+  - enable redis cache instead of filesystem cache
+- RedisCacheHost
+  - string 
+  - default: "redis:6379"
+  - hostname and port for the redis service
+- ClientTrustedIPs
+  - string 
+  - default: []
+  - List of client IPs we trust, they will bypass any more check to the bouncer or cache (usefull for LAN or VPN IP)
 
 ### Configuration
 
@@ -130,7 +142,11 @@ http:
           forwardedHeadersTrustedIPs: 
             - 10.0.10.23/32
             - 10.0.20.0/24
+          clientTrustedIPs: 
+            - 192.168.1.0/24
           forwardedHeadersCustomName: X-Custom-Header
+          redisCacheEnabled: false
+          redisCacheHost: "redis:6379"
 ```
 These are the default values of the plugin except for LapiKey.
 
@@ -167,7 +183,7 @@ docker-compose up -d
 
 ```bash
 docker-compose up -d crowdsec
-docker exec crowdsec cscli decisions add --ip 10.0.0.10 # this will be effective 4h
+docker exec crowdsec cscli decisions add --ip 10.0.0.10 -d 10m # this will be effective 10min
 docker exec crowdsec cscli decisions remove --ip 10.0.0.10
 ```
 
@@ -213,6 +229,7 @@ You need to configure your Traefik to trust Forwarded headers by your front prox
 In the exemple we use another instance of traefik with the container named cloudflare to simulate a front proxy
 
 The "internal" Traefik instance is configured to trust the cloudflare forward headers
+This helps Traefik choose the right IP of the client: see https://doc.traefik.io/traefik/routing/entrypoints/#forwarded-headers
 ```yaml
   - "--entrypoints.web.forwardedheaders.trustedips=172.21.0.5"
 ```
@@ -222,11 +239,62 @@ We configure the middleware to trust as well the IP:
     - "traefik.http.middlewares.crowdsec1.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5"
 ```
 
-To run the environnement run:
+To play the demo environnement run:
 ```bash
-make run_behind_proxy
+make run_behindproxy
 ```
 
+2. With Redis as an external shared cache
+
+The plugin must be configured to connect to a redis instance
+```yaml
+  redisCacheHost: "redis:6379"
+```
+Here **redis** is the hostname of a container located in the same network as Traefik and **6379** the default port of redis
+
+To play the demo environnement run:
+```bash
+make run_cacheredis
+```
+
+3. Using Trusted IP (ex: LAN OR VPN) that won't get filtered by crowdsec
+
+You need to configure your Traefik to trust Forwarded headers by your front proxy
+In the exemple we use a whoami container protected by crowdsec, and we ban or IP before allowing using TrustedIPs
+
+If you are using another proxy in front, you need to add it's IP in the trusted IP for the forwarded headers.
+This helps Traefik choose the right IP of the client: see https://doc.traefik.io/traefik/routing/entrypoints/#forwarded-headers
+The "internal" Traefik instance is configured to trust the forward headers
+```yaml
+  - "--entrypoints.web.forwardedheaders.trustedips=172.21.0.5"
+```
+
+We configure the middleware to trust as well the IP of the intermediate proxy if needed:
+```yaml
+    - "traefik.http.middlewares.crowdsec.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5"
+```
+
+Add your IP to the ban list
+```bash
+docker exec crowdsec cscli decisions add --ip 10.0.10.30 -d 10m
+```
+You should get a 403 on http://localhost/foo
+
+> Replace *10.0.10.30* by your IP
+
+Add the IPs that will not be filtered by the plugin
+```yaml
+    - "traefik.http.middlewares.crowdsec.plugin.bouncer.clientTrustedips=10.0.10.30/32"
+```
+
+> Replace *10.0.10.30/32* by your IP or IP range, so it's not getting checked against ban cache of crowdsec
+
+You should get a 200 on http://localhost/foo even if you are on the ban cache
+
+To play the demo environnement run:
+```bash
+make run_trustedips
+```
 
 ### About
 

bouncer.go

@@ -15,6 +15,7 @@ import (
 	cache "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/pkg/cache"
 	ip "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/pkg/ip"
 	logger "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/pkg/logger"
+	simpleredis "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/pkg/redis"
 )
 
 const (
@@ -40,10 +41,13 @@ type Config struct {
 	CrowdsecLapiScheme         string   `json:"crowdsecLapiScheme,omitempty"`
 	CrowdsecLapiHost           string   `json:"crowdsecLapiHost,omitempty"`
 	CrowdsecLapiKey            string   `json:"crowdsecLapiKey,omitempty"`
-	ForwardedHeadersCustomName string   `json:"forwardedheaderscustomheader,omitempty"`
 	UpdateIntervalSeconds      int64    `json:"updateIntervalSeconds,omitempty"`
 	DefaultDecisionSeconds     int64    `json:"defaultDecisionSeconds,omitempty"`
-	ForwardedHeadersTrustedIPs []string `json:"forwardedheaderstrustedips,omitempty"`
+	ForwardedHeadersCustomName string   `json:"forwardedheaderscustomheader,omitempty"`
+	ForwardedHeadersTrustedIPs []string `json:"forwardedHeadersTrustedIps,omitempty"`
+	ClientTrustedIPs           []string `json:"clientTrustedIps,omitempty"`
+	RedisCacheEnabled          bool     `json:"redisCacheEnabled,omitempty"`
+	RedisCacheHost             string   `json:"redisCacheHost,omitempty"`
 }
 
 // CreateConfig creates the default plugin configuration.
@@ -58,7 +62,10 @@ func CreateConfig() *Config {
 		UpdateIntervalSeconds:      60,
 		DefaultDecisionSeconds:     60,
 		ForwardedHeadersTrustedIPs: []string{},
+		ClientTrustedIPs:           []string{},
 		ForwardedHeadersCustomName: "X-Forwarded-For",
+		RedisCacheEnabled:          false,
+		RedisCacheHost:             "redis:6379",
 	}
 }
 
@@ -76,7 +83,8 @@ type Bouncer struct {
 	updateInterval         int64
 	defaultDecisionTimeout int64
 	customHeader           string
-	poolStrategy           *ip.PoolStrategy
+	serverPoolStrategy     *ip.PoolStrategy
+	clientPoolStrategy     *ip.PoolStrategy
 	client                 *http.Client
 }
 
@@ -85,11 +93,12 @@ func New(ctx context.Context, next http.Handler, config *Config, name string) (h
 	logger.Init(config.LogLevel)
 	err := validateParams(config)
 	if err != nil {
-		logger.Info(fmt.Sprintf("%w", err))
+		logger.Info(err.Error())
 		return nil, err
 	}
 
-	checker, _ := ip.NewChecker(config.ForwardedHeadersTrustedIPs)
+	serverChecker, _ := ip.NewChecker(config.ForwardedHeadersTrustedIPs)
+	clientChecker, _ := ip.NewChecker(config.ClientTrustedIPs)
 
 	bouncer := &Bouncer{
 		next:     next,
@@ -104,8 +113,11 @@ func New(ctx context.Context, next http.Handler, config *Config, name string) (h
 		updateInterval:         config.UpdateIntervalSeconds,
 		customHeader:           config.ForwardedHeadersCustomName,
 		defaultDecisionTimeout: config.DefaultDecisionSeconds,
-		poolStrategy: &ip.PoolStrategy{
+		serverPoolStrategy: &ip.PoolStrategy{
-			Checker: checker,
+			Checker: serverChecker,
+		},
+		clientPoolStrategy: &ip.PoolStrategy{
+			Checker: clientChecker,
 		},
 		client: &http.Client{
 			Transport: &http.Transport{
@@ -115,16 +127,16 @@ func New(ctx context.Context, next http.Handler, config *Config, name string) (h
 			Timeout: 5 * time.Second,
 		},
 	}
-	if config.CrowdsecMode == streamMode {
+	if config.RedisCacheEnabled {
-		go func() {
+		cache.InitRedisClient(config.RedisCacheHost)
-			if ticker == nil {
+	}
-				go handleStreamCache(bouncer)
+	if config.CrowdsecMode == streamMode && ticker == nil {
 		ticker = startTicker(config, func() {
 			handleStreamCache(bouncer)
 		})
+		go handleStreamCache(bouncer)
 	}
-		}()
+
-	}
 	return bouncer, nil
 }
 
@@ -134,19 +146,36 @@ func (bouncer *Bouncer) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
 		bouncer.next.ServeHTTP(rw, req)
 		return
 	}
-
+	// Here we check for the trusted IPs in the customHeader
-	remoteHost, err := ip.GetRemoteIP(req, bouncer.poolStrategy, bouncer.customHeader)
+	remoteHost, err := ip.GetRemoteIP(req, bouncer.serverPoolStrategy, bouncer.customHeader)
 	if err != nil {
-		logger.Info(fmt.Sprintf("%w", err))
+		logger.Info(err.Error())
 		bouncer.next.ServeHTTP(rw, req)
 		return
 	}
-	logger.Debug(fmt.Sprintf("ServeHTTP ip:%v", remoteHost))
 
+	trusted, err := bouncer.clientPoolStrategy.Checker.Contains(remoteHost)
+	if err != nil {
+		logger.Info(err.Error())
+		return
+	}
+	// if our IP is in the trusted list we bypass the next checks
+	logger.Debug(fmt.Sprintf("ServeHTTP ip:%v isTrusted:%v", remoteHost, trusted))
+	if trusted {
+		bouncer.next.ServeHTTP(rw, req)
+		return
+	}
+
+	healthy := crowdsecStreamHealthy
 	if bouncer.crowdsecMode != noneMode {
 		isBanned, err := cache.GetDecision(remoteHost)
-		if err == nil {
+		if err != nil {
-			logger.Debug(fmt.Sprintf("ServeHTTP cacheHit isBanned:%v", isBanned))
+			logger.Debug(err.Error())
+			if err.Error() == simpleredis.RedisUnreachable {
+				healthy = false
+			}
+		} else {
+			logger.Debug(fmt.Sprintf("ServeHTTP cache:hit isBanned:%v", isBanned))
 			if isBanned {
 				rw.WriteHeader(http.StatusForbidden)
 			} else {
@@ -158,7 +187,7 @@ func (bouncer *Bouncer) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
 
 	// Right here if we cannot join the stream we forbid the request to go on.
 	if bouncer.crowdsecMode == streamMode {
-		if crowdsecStreamHealthy {
+		if healthy {
 			bouncer.next.ServeHTTP(rw, req)
 		} else {
 			rw.WriteHeader(http.StatusForbidden)
@@ -225,7 +254,7 @@ func handleNoStreamCache(bouncer *Bouncer, rw http.ResponseWriter, req *http.Req
 	}
 	body, err := crowdsecQuery(bouncer, routeURL.String())
 	if err != nil {
-		logger.Info(fmt.Sprintf("%w", err))
+		logger.Info(err.Error())
 		rw.WriteHeader(http.StatusForbidden)
 		return
 	}
@@ -282,7 +311,7 @@ func handleStreamCache(bouncer *Bouncer) {
 	}
 	body, err := crowdsecQuery(bouncer, streamRouteURL.String())
 	if err != nil {
-		logger.Info(fmt.Sprintf("%w", err))
+		logger.Info(err.Error())
 		crowdsecStreamHealthy = false
 		return
 	}
@@ -372,6 +401,14 @@ func validateParams(config *Config) error {
 	} else {
 		logger.Debug("No IP provided for ForwardedHeadersTrustedIPs")
 	}
+	if len(config.ClientTrustedIPs) > 0 {
+		_, err = ip.NewChecker(config.ClientTrustedIPs)
+		if err != nil {
+			return fmt.Errorf("TrustedIPs must be a list of IP/CIDR :%w", err)
+		}
+	} else {
+		logger.Debug("No IP provided for TrustedIPs")
+	}
 
 	return nil
 }

docker-compose.local.yml

@@ -2,10 +2,11 @@ version: "3.8"
 
 services:
   traefik:
-    image: "traefik:v2.9.1"
+    image: "traefik:v2.9.4"
     container_name: "traefik"
+    restart: unless-stopped
     command:
-      # - "--log.level=DEBUG"
+      - "--log.level=DEBUG"
       - "--accesslog"
       - "--accesslog.filepath=/var/log/traefik/access.log"
       - "--api.insecure=true"
@@ -24,35 +25,36 @@ services:
     depends_on:
       - crowdsec
 
-  whoami1:
+  whoami-foo:
     image: traefik/whoami
-    container_name: "simple-service1"
+    container_name: "simple-service-foo"
+    restart: unless-stopped
     labels:
       - "traefik.enable=true"
-      - "traefik.http.routers.router1.rule=Host(`localhost`) && Path(`/foo`)"
+      - "traefik.http.routers.router-foo.rule=Path(`/foo`)"
-      - "traefik.http.routers.router1.entrypoints=web"
+      - "traefik.http.routers.router-foo.entrypoints=web"
-      - "traefik.http.routers.router1.middlewares=crowdsec1@docker" 
+      - "traefik.http.routers.router-foo.middlewares=crowdsec-foo@docker" 
-      - "traefik.http.services.service1.loadbalancer.server.port=80"
+      - "traefik.http.services.service-foo.loadbalancer.server.port=80"
-      - "traefik.http.middlewares.crowdsec1.plugin.bouncer.enabled=true"
+      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.enabled=true"
-      - "traefik.http.middlewares.crowdsec1.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
+      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
-      - "traefik.http.middlewares.crowdsec1.plugin.bouncer.forwardedheaderstrustedips=172.26.0.5"
 
   whoami2:
     image: traefik/whoami
-    container_name: "simple-service2"
+    container_name: "simple-service-bar"
+    restart: unless-stopped
     labels:
       - "traefik.enable=true"
-      - "traefik.http.routers.router2.rule=Host(`localhost`) && Path(`/bar`)"
+      - "traefik.http.routers.router-bar.rule=Path(`/bar`)"
-      - "traefik.http.routers.router2.entrypoints=web"
+      - "traefik.http.routers.router-bar.entrypoints=web"
-      - "traefik.http.routers.router2.middlewares=crowdsec2@docker"
+      - "traefik.http.routers.router-bar.middlewares=crowdsec-bar@docker"
-      - "traefik.http.services.service2.loadbalancer.server.port=80"
+      - "traefik.http.services.service-bar.loadbalancer.server.port=80"
-      - "traefik.http.middlewares.crowdsec2.plugin.bouncer.enabled=true"
+      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.enabled=true"
-      - "traefik.http.middlewares.crowdsec2.plugin.bouncer.crowdseclapikey=44c36dac5c4140af9f06f397508e82c7"
+      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdseclapikey=44c36dac5c4140af9f06f397508e82c7"
-      - "traefik.http.middlewares.crowdsec2.plugin.bouncer.forwardedheaderstrustedips=172.26.0.5"
 
   crowdsec:
     image: crowdsecurity/crowdsec:v1.4.1
     container_name: "crowdsec"
+    restart: unless-stopped
     environment:
       COLLECTIONS: crowdsecurity/traefik
       CUSTOM_HOSTNAME: crowdsec

docker-compose.yml

@@ -2,8 +2,9 @@ version: "3.8"
 
 services:
   traefik:
-    image: "traefik:v2.9.1"
+    image: "traefik:v2.9.4"
     container_name: "traefik"
+    restart: unless-stopped
     command:
       - "--accesslog"
       - "--accesslog.filepath=/var/log/traefik/access.log"
@@ -13,7 +14,7 @@ services:
       - "--entrypoints.web.address=:80"
 
       - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
-      - "--experimental.plugins.bouncer.version=v1.1.0"
+      - "--experimental.plugins.bouncer.version=v1.1.2"
     volumes:
       - "/var/run/docker.sock:/var/run/docker.sock:ro"
       - "logs:/var/log/traefik"
@@ -25,43 +26,46 @@ services:
 
   whoami1:
     image: traefik/whoami
-    container_name: "simple-service-1"
+    container_name: "simple-service-foo"
+    restart: unless-stopped
     labels:
       - "traefik.enable=true"
       # Definition of the router
-      - "traefik.http.routers.router1.rule=Host(`localhost`) && Path(`/foo`)"
+      - "traefik.http.routers.router-foo.rule=Path(`/foo`)"
-      - "traefik.http.routers.router1.entrypoints=web"
+      - "traefik.http.routers.router-foo.entrypoints=web"
-      - "traefik.http.routers.router1.middlewares=crowdsec2@docker"
+      - "traefik.http.routers.router-foo.middlewares=crowdsec-foo@docker"
       # Definition of the service
-      - "traefik.http.services.service1.loadbalancer.server.port=80"
+      - "traefik.http.services.service-foo.loadbalancer.server.port=80"
       # Definition of the middleware
-      - "traefik.http.middlewares.crowdsec1.plugin.bouncer.enabled=true"
+      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.enabled=true"
       # crowdseclapikey must be unique to the middleware attached to the service
-      - "traefik.http.middlewares.crowdsec1.plugin.bouncer.crowdseclapikey=FIXME-LAPI-KEY-1"
+      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdseclapikey=FIXME-LAPI-KEY-1"
       # forwardedheaderstrustedips should be the IP of the proxy that is in front of traefik (if any)
-      - "traefik.http.middlewares.crowdsec1.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5"
+      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5"
   
   whoami2:
     image: traefik/whoami
-    container_name: "simple-service-2"
+    container_name: "simple-service-bar"
+    restart: unless-stopped
     labels:
       - "traefik.enable=true"
       # Definition of the router
-      - "traefik.http.routers.router2.rule=Host(`localhost`) && Path(`/bar`)"
+      - "traefik.http.routers.router-bar.rule=Path(`/bar`)"
-      - "traefik.http.routers.router2.entrypoints=web"
+      - "traefik.http.routers.router-bar.entrypoints=web"
-      - "traefik.http.routers.router2.middlewares=crowdsec2@docker"
+      - "traefik.http.routers.router-bar.middlewares=crowdsec-bar@docker"
       # Definition of the service
-      - "traefik.http.services.service2.loadbalancer.server.port=80"
+      - "traefik.http.services.service-bar.loadbalancer.server.port=80"
       # Definitin of the middleware
-      - "traefik.http.middlewares.crowdsec2.plugin.bouncer.enabled=true"
+      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.enabled=true"
       # crowdseclapikey must be unique to the middleware attached to the service
-      - "traefik.http.middlewares.crowdsec2.plugin.bouncer.crowdseclapikey=FIXME-LAPI-KEY-2"
+      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdseclapikey=FIXME-LAPI-KEY-2"
       # forwardedheaderstrustedips should be the IP of the proxy that is in front of traefik (if any)
-      - "traefik.http.middlewares.crowdsec2.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5"
+      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5"
 
   crowdsec:
     image: crowdsecurity/crowdsec:v1.4.1
     container_name: "crowdsec"
+    restart: unless-stopped
     environment:
       COLLECTIONS: crowdsecurity/traefik
       CUSTOM_HOSTNAME: crowdsec

exemples/behind-proxy/docker-compose.cloudflare.yml

@@ -2,8 +2,9 @@ version: "3.8"
 
 services:
   cloudflare:
-    image: "traefik:v2.9.1"
+    image: "traefik:v2.9.4"
     container_name: "cloudflare"
+    restart: unless-stopped
     command:
       # - "--log.level=DEBUG"
       - "--accesslog"
@@ -21,8 +22,9 @@ services:
       - 8080:8080
 
   traefik:
-    image: "traefik:v2.9.1"
+    image: "traefik:v2.9.4"
     container_name: "traefik"
+    restart: unless-stopped
     command:
       # - "--log.level=DEBUG"
       - "--accesslog"
@@ -34,10 +36,10 @@ services:
       - "--entrypoints.web.forwardedheaders.trustedips=172.21.0.5"
 
       - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
-      - "--experimental.plugins.bouncer.version=v1.1.0"
+      - "--experimental.plugins.bouncer.version=v1.1.3"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
-      - logs-dev:/var/log/traefik
+      - logs-traefik:/var/log/traefik
     ports:
       - 90:80
       - 9080:8080
@@ -46,26 +48,49 @@ services:
 
   whoami1:
     image: traefik/whoami
-    container_name: "simple-service1"
+    container_name: "simple-service-foo"
+    restart: unless-stopped
     labels:
       - "traefik.enable=true"
       # Definition of the router
-      - "traefik.http.routers.router1.rule=Path(`/foo`)"
+      - "traefik.http.routers.router-foo.rule=Path(`/foo`)"
-      - "traefik.http.routers.router1.entrypoints=web"
+      - "traefik.http.routers.router-foo.entrypoints=web"
-      - "traefik.http.routers.router1.middlewares=crowdsec1@docker" 
+      - "traefik.http.routers.router-foo.middlewares=crowdsec-foo@docker" 
       # Definition of the service
-      - "traefik.http.services.service1.loadbalancer.server.port=80"
+      - "traefik.http.services.service-foo.loadbalancer.server.port=80"
       # Definitin of the middleware
-      - "traefik.http.middlewares.crowdsec1.plugin.bouncer.enabled=true"
+      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.enabled=true"
       # crowdseclapikey must be uniq to the middleware attached to the service
-      - "traefik.http.middlewares.crowdsec1.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
+      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
-      - "traefik.http.middlewares.crowdsec1.plugin.bouncer.crowdsecmode=live"
+      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdsecmode=live"
-      - "traefik.http.middlewares.crowdsec1.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5"
+      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5"
+      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.loglevel=DEBUG"
+  
+  whoami2:
+    image: traefik/whoami
+    container_name: "simple-service-bar"
+    restart: unless-stopped
+    labels:
+      - "traefik.enable=true"
+      # Definition of the router
+      - "traefik.http.routers.router-bar.rule=Path(`/bar`)"
+      - "traefik.http.routers.router-bar.entrypoints=web"
+      - "traefik.http.routers.router-bar.middlewares=crowdsec-bar@docker" 
+      # Definition of the service
+      - "traefik.http.services.service-bar.loadbalancer.server.port=80"
+      # Definitin of the middleware
+      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.enabled=true"
+      # crowdseclapikey must be uniq to the middleware attached to the service
+      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdseclapikey=44c36dac5c4140af9f06f397508e82c7"
+      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdsecmode=live"
+      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5"
+      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.loglevel=DEBUG"
   
 
   crowdsec:
     image: crowdsecurity/crowdsec:v1.4.1
     container_name: "crowdsec"
+    restart: unless-stopped
     environment:
       COLLECTIONS: crowdsecurity/traefik
       CUSTOM_HOSTNAME: crowdsec
@@ -73,14 +98,14 @@ services:
       BOUNCER_KEY_TRAEFIK_DEV_2: 44c36dac5c4140af9f06f397508e82c7
     volumes:
       - ./acquis.yaml:/etc/crowdsec/acquis.yaml:ro
-      - logs-dev:/var/log/traefik:ro
+      - logs-cloudflare:/var/log/traefik:ro
-      - crowdsec-db-dev:/var/lib/crowdsec/data/
+      - crowdsec-db-cloudflare:/var/lib/crowdsec/data/
-      - crowdsec-config-dev:/etc/crowdsec/
+      - crowdsec-config-cloudflare:/etc/crowdsec/
     labels:
       - "traefik.enable=false"
 
 volumes:
-  logs-dev:
+  logs-traefik:
   logs-cloudflare:
-  crowdsec-db-dev:
+  crowdsec-db-cloudflare:
-  crowdsec-config-dev:
+  crowdsec-config-cloudflare:

exemples/redis-cache/acquis.yaml

@@ -0,0 +1,4 @@
+filenames:
+ - /var/log/traefik/access.log
+labels:
+  type: traefik

exemples/redis-cache/docker-compose.redis.yml

@@ -0,0 +1,101 @@
+version: "3.8"
+
+services:
+  traefik:
+    image: "traefik:v2.9.4"
+    container_name: "traefik"
+    restart: unless-stopped
+    command:
+      # - "--log.level=DEBUG"
+      - "--accesslog"
+      - "--accesslog.filepath=/var/log/traefik/access.log"
+      - "--api.insecure=true"
+      - "--providers.docker=true"
+      - "--providers.docker.exposedbydefault=false"
+      - "--entrypoints.web.address=:80"
+
+      - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
+      - "--experimental.plugins.bouncer.version=v1.1.3"
+      # - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - logs-redis:/var/log/traefik
+      - ./../../:/plugins-local/src/github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
+    ports:
+      - 80:80
+      - 8080:8080
+    depends_on:
+      - crowdsec
+      - redis
+
+  whoami-foo:
+    image: traefik/whoami
+    container_name: "simple-service-foo"
+    restart: unless-stopped
+    labels:
+      - "traefik.enable=true"
+      # Definition of the router
+      - "traefik.http.routers.router-foo.rule=Path(`/foo`)"
+      - "traefik.http.routers.router-foo.entrypoints=web"
+      - "traefik.http.routers.router-foo.middlewares=crowdsec-foo@docker" 
+      # Definition of the service
+      - "traefik.http.services.service-foo.loadbalancer.server.port=80"
+      # Definition of the middleware
+      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.enabled=true"
+      # crowdseclapikey must be uniq to the middleware attached to the service
+      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
+      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.rediscacheenabled=true"
+      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.loglevel=DEBUG"
+
+  whoami-bar:
+    image: traefik/whoami
+    container_name: "simple-service-bar"
+    restart: unless-stopped
+    labels:
+      - "traefik.enable=true"
+      # Definition of the router
+      - "traefik.http.routers.router-bar.rule=Path(`/bar`)"
+      - "traefik.http.routers.router-bar.entrypoints=web"
+      - "traefik.http.routers.router-bar.middlewares=crowdsec-bar@docker" 
+      # Definition of the service
+      - "traefik.http.services.service-bar.loadbalancer.server.port=80"
+      # Definition of the middleware
+      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.enabled=true"
+      # crowdseclapikey must be uniq to the middleware attached to the service
+      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdseclapikey=44c36dac5c4140af9f06f397508e82c7"
+      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.rediscacheenabled=true"
+      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.loglevel=DEBUG"
+
+
+  crowdsec:
+    image: crowdsecurity/crowdsec:v1.4.1
+    container_name: "crowdsec"
+    restart: unless-stopped
+    environment:
+      COLLECTIONS: crowdsecurity/traefik
+      CUSTOM_HOSTNAME: crowdsec
+      BOUNCER_KEY_TRAEFIK_DEV_1: 40796d93c2958f9e58345514e67740e5
+      BOUNCER_KEY_TRAEFIK_DEV_2: 44c36dac5c4140af9f06f397508e82c7
+    volumes:
+      - ./acquis.yaml:/etc/crowdsec/acquis.yaml:ro
+      - logs-redis:/var/log/traefik:ro
+      - crowdsec-db-redis:/var/lib/crowdsec/data/
+      - crowdsec-config-redis:/etc/crowdsec/
+    labels:
+      - "traefik.enable=false"
+
+  redis:
+    image: "redis:7.0.5-alpine"
+    container_name: "redis"
+    restart: unless-stopped
+    command: "redis-server --save 60 1"
+    volumes:
+      - redis-data:/data
+    ports:
+      - 6379:6379
+
+volumes:
+  logs-redis:
+  crowdsec-db-redis:
+  crowdsec-config-redis:
+  redis-data:

exemples/trusted-ips/acquis.yaml

@@ -0,0 +1,4 @@
+filenames:
+ - /var/log/traefik/access.log
+labels:
+  type: traefik

exemples/trusted-ips/docker-compose.trusted.yml

@@ -0,0 +1,91 @@
+version: "3.8"
+
+services:
+  traefik:
+    image: "traefik:v2.9.4"
+    container_name: "traefik"
+    restart: unless-stopped
+    command:
+      # - "--log.level=DEBUG"
+      - "--accesslog"
+      - "--accesslog.filepath=/var/log/traefik/access.log"
+      - "--api.insecure=true"
+      - "--providers.docker=true"
+      - "--providers.docker.exposedbydefault=false"
+      - "--entrypoints.web.address=:80"
+
+      - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
+      - "--experimental.plugins.bouncer.version=v1.1.3"
+      # - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - logs-trustedips:/var/log/traefik
+      - ./../../:/plugins-local/src/github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
+    ports:
+      - 80:80
+      - 8080:8080
+    depends_on:
+      - crowdsec
+
+  whoami1:
+    image: traefik/whoami
+    container_name: "simple-service-foo"
+    restart: unless-stopped
+    labels:
+      - "traefik.enable=true"
+      # Definition of the router
+      - "traefik.http.routers.router-foo.rule=Path(`/foo`)"
+      - "traefik.http.routers.router-foo.entrypoints=web"
+      - "traefik.http.routers.router-foo.middlewares=crowdsec-foo@docker" 
+      # Definition of the service
+      - "traefik.http.services.service-foo.loadbalancer.server.port=80"
+      # Definition of the middleware
+      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.enabled=true"
+      # crowdseclapikey must be uniq to the middleware attached to the service
+      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
+      # Replace 10.0.10.30/32 by your IP range which is "trusted"
+      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.clienttrustedips=10.0.10.30/32"
+      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.loglevel=DEBUG"
+  
+  whoami2:
+    image: traefik/whoami
+    container_name: "simple-service-bar"
+    restart: unless-stopped
+    labels:
+      - "traefik.enable=true"
+      # Definition of the router
+      - "traefik.http.routers.router-bar.rule=Path(`/bar`)"
+      - "traefik.http.routers.router-bar.entrypoints=web"
+      - "traefik.http.routers.router-bar.middlewares=crowdsec-bar@docker" 
+      # Definition of the service
+      - "traefik.http.services.service-bar.loadbalancer.server.port=80"
+      # Definition of the middleware
+      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.enabled=true"
+      # crowdseclapikey must be uniq to the middleware attached to the service
+      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdseclapikey=44c36dac5c4140af9f06f397508e82c7"
+      # Replace 10.0.10.30/32 by your IP range which is "trusted"
+      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.clienttrustedips=10.0.10.30/32"
+      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.loglevel=DEBUG"
+
+
+  crowdsec:
+    image: crowdsecurity/crowdsec:v1.4.1
+    container_name: "crowdsec"
+    restart: unless-stopped
+    environment:
+      COLLECTIONS: crowdsecurity/traefik
+      CUSTOM_HOSTNAME: crowdsec
+      BOUNCER_KEY_TRAEFIK_DEV_1: 40796d93c2958f9e58345514e67740e5
+      BOUNCER_KEY_TRAEFIK_DEV_2: 44c36dac5c4140af9f06f397508e82c7
+    volumes:
+      - ./acquis.yaml:/etc/crowdsec/acquis.yaml:ro
+      - logs-trustedips:/var/log/traefik:ro
+      - crowdsec-db-trustedips:/var/lib/crowdsec/data/
+      - crowdsec-config-trustedips:/etc/crowdsec/
+    labels:
+      - "traefik.enable=false"
+  
+volumes:
+  logs-trustedips:
+  crowdsec-db-trustedips:
+  crowdsec-config-trustedips:

go.mod

@@ -1,5 +1,5 @@
 module github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
 
-go 1.17
+go 1.18
 
 require github.com/leprosus/golang-ttl-map v1.1.7

pkg/cache/cache.go

@@ -6,34 +6,93 @@ import (
 	ttl_map "github.com/leprosus/golang-ttl-map"
 
 	logger "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/pkg/logger"
+	simpleredis "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/pkg/redis"
 )
+
 const (
 	cacheBannedValue   = "t"
 	cacheNoBannedValue = "f"
 )
 
 var cache = ttl_map.New()
+var redis simpleredis.SimpleRedis
 
-// Get Decision check in the cache if the IP has the banned / not banned value.
+var redisEnabled = false
-// Otherwise return with an error to add the IP in cache if we are on.
+
-func GetDecision(clientIP string) (bool, error) {
+// CLASSIC
+
+func getDecisionLocalCache(clientIP string) (bool, error) {
 	banned, isCached := cache.Get(clientIP)
 	bannedString, isValid := banned.(string)
 	if isCached && isValid && len(bannedString) > 0 {
 		return bannedString == cacheBannedValue, nil
 	}
-	return false, fmt.Errorf("no cache data")
+	return false, fmt.Errorf("cache:miss")
+}
+
+func setDecisionLocalCache(clientIP string, value string, duration int64) {
+	cache.Set(clientIP, value, duration)
+}
+
+func deleteDecisionLocalCache(clientIP string) {
+	cache.Del(clientIP)
+}
+
+// REDIS
+
+func getDecisionRedisCache(clientIP string) (bool, error) {
+	banned, err := redis.Get(clientIP)
+	bannedString := string(banned)
+	if err == nil && len(bannedString) > 0 {
+		return bannedString == cacheBannedValue, nil
+	}
+	return false, err
+}
+
+func setDecisionRedisCache(clientIP string, value string, duration int64) {
+	redis.Set(clientIP, []byte(value), duration)
+}
+
+func deleteDecisionRedisCache(clientIP string) {
+	redis.Del(clientIP)
+}
+
+// DeleteDecision delete decision in cache
+func DeleteDecision(clientIP string) {
+	if redisEnabled {
+		deleteDecisionRedisCache(clientIP)
+	} else {
+		deleteDecisionLocalCache(clientIP)
+	}
+}
+
+// GetDecision check in the cache if the IP has the banned / not banned value.
+// Otherwise return with an error to add the IP in cache if we are on.
+func GetDecision(clientIP string) (bool, error) {
+	if redisEnabled {
+		return getDecisionRedisCache(clientIP)
+	} else {
+		return getDecisionLocalCache(clientIP)
+	}
 }
 
 func SetDecision(clientIP string, isBanned bool, duration int64) {
+	var value string
 	if isBanned {
 		logger.Debug(fmt.Sprintf("%v banned", clientIP))
-		cache.Set(clientIP, cacheBannedValue, duration)
+		value = cacheBannedValue
 	} else {
-		cache.Set(clientIP, cacheNoBannedValue, duration)
+		value = cacheNoBannedValue
+	}
+	if redisEnabled {
+		setDecisionRedisCache(clientIP, value, duration)
+	} else {
+		setDecisionLocalCache(clientIP, value, duration)
 	}
 }
 
-func DeleteDecision(clientIP string) {
+func InitRedisClient(host string) {
-	cache.Del(clientIP)
+	redisEnabled = true
+	redis.Init(host)
+	logger.Debug("Redis initialized")
 }

pkg/ip/ip.go

@@ -6,6 +6,8 @@ import (
 	"net"
 	"net/http"
 	"strings"
+
+	"github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/pkg/logger"
 )
 
 // CHECKER
@@ -18,15 +20,12 @@ type Checker struct {
 
 // NewChecker builds a new Checker given a list of CIDR-Strings to trusted IPs.
 func NewChecker(trustedIPs []string) (*Checker, error) {
-	if len(trustedIPs) == 0 {
-		return nil, errors.New("no trusted IPs provided")
-	}
-
 	checker := &Checker{}
 
 	for _, ipMask := range trustedIPs {
 		if ipAddr := net.ParseIP(ipMask); ipAddr != nil {
 			checker.authorizedIPs = append(checker.authorizedIPs, &ipAddr)
+			logger.Debug(fmt.Sprintf("IP %v is trusted", ipAddr))
 			continue
 		}
 
@@ -35,6 +34,7 @@ func NewChecker(trustedIPs []string) (*Checker, error) {
 			return nil, fmt.Errorf("parsing CIDR trusted IPs %s: %w", ipAddr, err)
 		}
 		checker.authorizedIPsNet = append(checker.authorizedIPsNet, ipAddr)
+		logger.Debug(fmt.Sprintf("IP network %v is trusted", ipAddr))
 	}
 
 	return checker, nil

pkg/redis/redis.go

@@ -0,0 +1,122 @@
+package simpleredis
+
+import (
+	"bufio"
+	"fmt"
+	"net"
+	"net/textproto"
+	"strings"
+	"time"
+
+	logger "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/pkg/logger"
+)
+
+const (
+	RedisUnreachable = "redis:unreachable"
+	RedisMiss = "redis:miss"
+	RedisTimeout = "redis:timeout"
+)
+
+type RedisCmd struct {
+	Command  string
+	Name     string
+	Data     []byte
+	Duration int64
+	Error    error
+}
+
+type SimpleRedis struct {
+	redisHost string
+}
+
+func genRedisArray(params ...[]byte) []byte {
+	MSG := ""
+	for cntr := 0; cntr < len(params); cntr++ {
+		MSG = strings.Join([]string{MSG, string(params[cntr])}, " ")
+	}
+	MSG = strings.Trim(MSG, " ")
+	MSG = strings.Join([]string{MSG, "\r\n"}, "")
+	return []byte(MSG)
+}
+
+func askRedis(hostnamePort string, cmd RedisCmd, channel chan RedisCmd) {
+	dialer := net.Dialer{Timeout: 2 * time.Second}
+	conn, err := dialer.Dial("tcp", hostnamePort)
+	if err != nil {
+		channel <- RedisCmd{Error: fmt.Errorf(RedisUnreachable)}
+		return
+	}
+	defer conn.Close()
+
+	writer := textproto.NewWriter(bufio.NewWriter(conn))
+	reader := textproto.NewReader(bufio.NewReader(conn))
+
+	switch cmd.Command {
+	case "SET":
+		data := genRedisArray([]byte("SET"), []byte(cmd.Name), []byte(cmd.Data), []byte("EX"), []byte(fmt.Sprintf("%v", cmd.Duration)))
+		writer.PrintfLine(string(data))
+		logger.Debug("redis:set")
+	case "DEL":
+		data := genRedisArray([]byte("DEL"), []byte(cmd.Name))
+		writer.PrintfLine(string(data))
+		logger.Debug("redis:del")
+	case "GET":
+		data := genRedisArray([]byte("GET"), []byte(cmd.Name))
+		writer.PrintfLine(string(data))
+		logger.Debug("redis:get")
+		for {
+			select {
+			case <-time.After(time.Second * 1):
+				channel <- RedisCmd{Error: fmt.Errorf(RedisTimeout)}
+				return
+			default:
+				read, _ := reader.ReadLineBytes()
+				if string(read) != "$1" {
+					channel <- RedisCmd{Error: fmt.Errorf(RedisMiss)}
+					return
+				}
+				read, _ = reader.ReadLineBytes()
+				channel <- RedisCmd{Data: read}
+				return
+			}
+		}
+	}
+}
+
+func (sr *SimpleRedis) Init(redisHost string) {
+	sr.redisHost = redisHost
+}
+
+func (sr *SimpleRedis) Get(name string) ([]byte, error) {
+	redisCmd := RedisCmd{
+		Command: "GET",
+		Name:    name,
+	}
+	channel := make(chan RedisCmd)
+	go askRedis(sr.redisHost, redisCmd, channel)
+	resp := <-channel
+	if resp.Error != nil {
+		return nil, resp.Error
+	}
+	return resp.Data, nil
+}
+
+func (sr *SimpleRedis) Set(name string, data []byte, duration int64) error {
+	redisCmd := RedisCmd{
+		Command:  "SET",
+		Name:     name,
+		Data:     data,
+		Duration: duration,
+	}
+	go askRedis(sr.redisHost, redisCmd, nil)
+	return nil
+}
+
+func (sr *SimpleRedis) Del(name string) error {
+	redisCmd := RedisCmd{
+		Command: "DEL",
+		Name:    name,
+	}
+	go askRedis(sr.redisHost, redisCmd, nil)
+	return nil
+}