mirror of
https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin.git
synced 2026-09-02 20:28:50 +02:00
Compare commits
11
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 maxlerebourgandMathieu Hanotaux
|
b68c692ed1 | ||
|
mathieuHa
|
fc3da2fc2d | ||
|
Rasmus
|
1a9bdc578f | ||
|
mathieuHa
|
f2aea695fc | ||
|
Joseph Kavanagh
|
2827fef273 | ||
|
mathieuHaandMax Lerebourg
|
07c8fae927 | ||
|
mathieuHa
|
13c209be3f | ||
|
maxlerebourg
|
93340ffa55 | ||
|
maxlerebourg
|
0c2668d578 | ||
|
maxlerebourg
|
abae7ee028 | ||
|
maxlerebourg
|
1fcd4f4e2f |
@@ -30,4 +30,6 @@ Steps to reproduce the behavior:
|
||||
3. Scroll down to '....'
|
||||
4. See error
|
||||
|
||||
<!---
|
||||
If you like the plugin, please consider starring it, so you can get updates and we get some more visibility ✨
|
||||
-->
|
||||
|
||||
@@ -16,4 +16,6 @@ A clear and concise description of what you want to happen.
|
||||
**Additional context**
|
||||
Add any other context or screenshots about the feature request here.
|
||||
|
||||
<!---
|
||||
If you like the plugin, please consider starring it, so you can get updates and we get some more visibility ✨
|
||||
-->
|
||||
|
||||
@@ -20,69 +20,76 @@ clean:
|
||||
rm -rf ./vendor
|
||||
|
||||
run_dev:
|
||||
docker-compose -f docker-compose.dev.yml up -d --remove-orphans
|
||||
docker compose -f docker-compose.dev.yml up -d --remove-orphans
|
||||
|
||||
run_local:
|
||||
docker-compose -f docker-compose.local.yml up -d --remove-orphans
|
||||
docker compose -f docker-compose.local.yml up -d --remove-orphans
|
||||
|
||||
run_behindproxy:
|
||||
docker-compose -f exemples/behind-proxy/docker-compose.cloudflare.yml up -d --remove-orphans
|
||||
docker compose -f examples/behind-proxy/docker-compose.cloudflare.yml up -d --remove-orphans
|
||||
|
||||
run_cacheredis:
|
||||
docker-compose -f exemples/redis-cache/docker-compose.redis.yml up -d --remove-orphans
|
||||
docker compose -f examples/redis-cache/docker-compose.redis.yml up -d --remove-orphans
|
||||
|
||||
run_trustedips:
|
||||
docker-compose -f exemples/trusted-ips/docker-compose.trusted.yml up -d --remove-orphans
|
||||
docker compose -f examples/trusted-ips/docker-compose.trusted.yml up -d --remove-orphans
|
||||
|
||||
run_binaryvm:
|
||||
cd exemples/binary-vm/ && sudo vagrant up
|
||||
cd examples/binary-vm/ && sudo vagrant up
|
||||
|
||||
run_tlsauth:
|
||||
docker-compose -f exemples/tls-auth/docker-compose.tls-auth.yml down && docker-compose -f exemples/tls-auth/docker-compose.tls-auth.yml up -d && docker-compose -f exemples/tls-auth/docker-compose.tls-auth.yml restart && docker-compose -f exemples/tls-auth/docker-compose.tls-auth.yml logs -f
|
||||
docker compose -f examples/tls-auth/docker-compose.tls-auth.yml down && docker compose -f examples/tls-auth/docker-compose.tls-auth.yml up -d && docker compose -f examples/tls-auth/docker-compose.tls-auth.yml restart && docker compose -f examples/tls-auth/docker-compose.tls-auth.yml logs -f
|
||||
|
||||
run_appsec:
|
||||
docker compose -f examples/appsec-enabled/docker-compose.appsec-enabled.yml up -d
|
||||
|
||||
run:
|
||||
docker-compose -f docker-compose.yml up -d --remove-orphans
|
||||
docker compose -f docker-compose.yml up -d --remove-orphans
|
||||
|
||||
restart_dev:
|
||||
docker-compose -f docker-compose.dev.yml restart
|
||||
docker compose -f docker-compose.dev.yml restart
|
||||
|
||||
restart_local:
|
||||
docker-compose -f docker-compose.local.yml restart
|
||||
docker compose -f docker-compose.local.yml restart
|
||||
|
||||
restart:
|
||||
docker-compose -f docker-compose.yml restart
|
||||
docker compose -f docker-compose.yml restart
|
||||
|
||||
restart_behindproxy:
|
||||
docker-compose -f exemples/behind-proxy/docker-compose.cloudflare.yml restart
|
||||
docker compose -f examples/behind-proxy/docker-compose.cloudflare.yml restart
|
||||
|
||||
restart_cacheredis:
|
||||
docker-compose -f exemples/redis-cache/docker-compose.redis.yml restart
|
||||
docker compose -f examples/redis-cache/docker-compose.redis.yml restart
|
||||
|
||||
restart_trustedips:
|
||||
docker-compose -f exemples/trusted-ips/docker-compose.trusted.yml restart
|
||||
docker compose -f examples/trusted-ips/docker-compose.trusted.yml restart
|
||||
|
||||
restart_tlsauth:
|
||||
docker-compose -f exemples/tls-auth/docker-compose.tls-auth.yml
|
||||
docker compose -f examples/tls-auth/docker-compose.tls-auth.yml
|
||||
|
||||
restart_appsec:
|
||||
docker compose -f examples/tls-auth/docker-compose.appsec-enabled.yml
|
||||
|
||||
show_logs:
|
||||
docker-compose -f docker-compose.yml restart
|
||||
docker compose -f docker-compose.yml restart
|
||||
|
||||
show_local_logs:
|
||||
docker-compose -f docker-compose.local.yml logs -f
|
||||
docker compose -f docker-compose.local.yml logs -f
|
||||
|
||||
show_dev_logs:
|
||||
docker-compose -f docker-compose.dev.yml logs -f
|
||||
docker compose -f docker-compose.dev.yml logs -f
|
||||
|
||||
clean_all_docker:
|
||||
docker-compose -f exemples/behind-proxy/docker-compose.cloudflare.yml down --remove-orphans
|
||||
docker-compose -f exemples/redis-cache/docker-compose.redis.yml down --remove-orphans
|
||||
docker-compose -f exemples/trusted-ips/docker-compose.trusted.yml down --remove-orphans
|
||||
docker-compose -f exemples/tls-auth/docker-compose.tls-auth.yml down --remove-orphans
|
||||
docker-compose -f docker-compose.local.yml down --remove-orphans
|
||||
docker-compose -f docker-compose.yml down --remove-orphans
|
||||
docker compose -f examples/behind-proxy/docker-compose.cloudflare.yml down --remove-orphans
|
||||
docker compose -f examples/redis-cache/docker-compose.redis.yml down --remove-orphans
|
||||
docker compose -f examples/trusted-ips/docker-compose.trusted.yml down --remove-orphans
|
||||
docker compose -f examples/tls-auth/docker-compose.tls-auth.yml down --remove-orphans
|
||||
docker compose -f examples/appsec-enabled/docker-compose.appsec-enabled.yml down --remove-orphans
|
||||
docker compose -f docker-compose.local.yml down --remove-orphans
|
||||
docker compose -f docker-compose.yml down --remove-orphans
|
||||
|
||||
clean_vagrant:
|
||||
cd exemples/binary-vm/ && sudo vagrant destroy -f
|
||||
cd examples/binary-vm/ && sudo vagrant destroy -f
|
||||
|
||||
|
||||
show_metrics:
|
||||
|
||||
@@ -6,6 +6,8 @@
|
||||
|
||||
# Crowdsec Bouncer Traefik plugin
|
||||
|
||||
> New! This plugin now supports [AppSec](https://doc.crowdsec.net/docs/next/appsec/intro/) feature including virtual patching and capabilities support for your legacy ModSecurity rules.
|
||||
|
||||
This plugin aims to implement a Crowdsec Bouncer in a Traefik plugin.
|
||||
|
||||
> [CrowdSec](https://www.crowdsec.net/) is an open-source and collaborative IPS (Intrusion Prevention System) and a security suite.
|
||||
@@ -17,6 +19,16 @@ The Crowdsec utility will provide the community blocklist which contains highly
|
||||
|
||||
When used with Crowdsec it will leverage the local API which will analyze Traefik logs and take decisions on the requests made by users/bots. Malicious actors will be banned based on patterns used against your website.
|
||||
|
||||
Appsec feature is supported from plugin version 1.2.0 and Crowdsec 1.6.0.
|
||||
|
||||
The AppSec Component offers:
|
||||
|
||||
- Low-effort virtual patching capabilities.
|
||||
- Support for your legacy ModSecurity rules.
|
||||
- Combining classic WAF benefits with advanced CrowdSec features for otherwise difficult advanced behavior detection.
|
||||
More information on appsec in the [Crowdsec Documentation](https://doc.crowdsec.net/docs/next/appsec/intro/).
|
||||
|
||||
|
||||
There are 4 operating modes (CrowdsecMode) for this plugin:
|
||||
|
||||
| Mode | Description |
|
||||
@@ -29,7 +41,7 @@ There are 4 operating modes (CrowdsecMode) for this plugin:
|
||||
The `streaming mode` is recommended for performance, decisions are updated every 60 sec by default and that's the only communication between Traefik and Crowdsec. Every request that happens hits the cache for quick decisions.
|
||||
|
||||
The cache can be local to Traefik using the filesystem, or a separate Redis instance.
|
||||
Support for Redis is currently in beta (requires version 7.0.X of Redis).
|
||||
|
||||
|
||||
## Usage
|
||||
|
||||
@@ -44,18 +56,31 @@ make run
|
||||
|
||||
**/!\ Cache is shared by all services**
|
||||
*This means if an IP is banned, all services which are protected by an instance of the plugin will deny requests from that IP*
|
||||
Only one instance of the plugin is *possible*.
|
||||
|
||||
### Variables
|
||||
- Enabled
|
||||
- bool
|
||||
- default: false
|
||||
- enable the plugin
|
||||
- Enable the plugin
|
||||
- LogLevel
|
||||
- string
|
||||
- default: `INFO`, expected values are: `INFO`, `DEBUG`
|
||||
- CrowdsecMode
|
||||
- string
|
||||
- default: `live`, expected values are: `none`, `live`, `stream`, `alone`
|
||||
- CrowdsecAppsecEnabled
|
||||
- bool
|
||||
- default: false
|
||||
- Enable Crowdsec Appsec Server (WAF).
|
||||
- CrowdsecAppsecHost
|
||||
- string
|
||||
- default: "crowdsec:7422"
|
||||
- Crowdsec Appsec Server available on which host and port. The scheme will be handled by the CrowdsecLapiScheme var.
|
||||
- CrowdsecAppsecFailureBlock
|
||||
- bool
|
||||
- default: true
|
||||
- Block request when Crowdsec Appsec Server have a [status 500](https://docs.crowdsec.net/docs/next/appsec/protocol#response-code).
|
||||
- CrowdsecLapiScheme
|
||||
- string
|
||||
- default: `http`, expected values are: `http`, `https`
|
||||
@@ -107,6 +132,14 @@ make run
|
||||
- string
|
||||
- default: ""
|
||||
- Password for the Redis service
|
||||
- RedisCacheDatabase
|
||||
- string
|
||||
- default: ""
|
||||
- Database selection for the Redis service
|
||||
- HTTPTimeoutSeconds
|
||||
- int64
|
||||
- default: 10
|
||||
- Default timeout in seconds for contacting Crowdsec LAPI
|
||||
- UpdateIntervalSeconds
|
||||
- int64
|
||||
- default: 60
|
||||
@@ -138,6 +171,7 @@ experimental:
|
||||
plugins:
|
||||
bouncer:
|
||||
moduleName: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
|
||||
version: vX.Y.Z # To update
|
||||
```
|
||||
|
||||
```yaml
|
||||
@@ -167,7 +201,11 @@ http:
|
||||
logLevel: DEBUG
|
||||
updateIntervalSeconds: 60
|
||||
defaultDecisionSeconds: 60
|
||||
httpTimeoutSeconds: 10
|
||||
crowdsecMode: live
|
||||
crowdsecAppsecEnabled: false
|
||||
crowdsecAppsecHost: crowdsec:7422
|
||||
crowdsecAppsecFailureBlock: true
|
||||
crowdsecLapiKey: privateKey-foo
|
||||
crowdsecLapiKeyFile: /etc/traefik/cs-privateKey-foo
|
||||
crowdsecLapiHost: crowdsec:8080
|
||||
@@ -188,6 +226,7 @@ http:
|
||||
redisCacheEnabled: false
|
||||
redisCacheHost: "redis:6379"
|
||||
redisCachePassword: password
|
||||
redisCacheDatabase: "5"
|
||||
crowdsecLapiTLSCertificateAuthority: |-
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIEBzCCAu+gAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgZQxCzAJBgNVBAYTAlVT
|
||||
@@ -260,10 +299,10 @@ docker-compose up -d
|
||||
|
||||
#### Use certificates to authenticate with CrowdSec
|
||||
|
||||
You can follow the example in `exemples/tls-auth` to view how to authenticate with client certificates with the LAPI.
|
||||
You can follow the example in `examples/tls-auth` to view how to authenticate with client certificates with the LAPI.
|
||||
In that case, communications with the LAPI must go through HTTPS.
|
||||
|
||||
A script is available to generate certificates in `exemples/tls-auth/gencerts.sh` and must be in the same directory as the inputs for the PKI creation.
|
||||
A script is available to generate certificates in `examples/tls-auth/gencerts.sh` and must be in the same directory as the inputs for the PKI creation.
|
||||
|
||||
#### Use HTTPS to communicate with the LAPI
|
||||
|
||||
@@ -271,7 +310,7 @@ To communicate with the LAPI in HTTPS you need to either accept any certificates
|
||||
Set the `crowdsecLapiScheme` to https.
|
||||
|
||||
Crowdsec must be listening in HTTPS for this to work.
|
||||
Please see the [tls-auth exemple](https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/blob/main/exemples/tls-auth/README.md) or the official documentation: [docs.crowdsec.net/docs/local_api/tls_auth/](https://docs.crowdsec.net/docs/local_api/tls_auth/)
|
||||
Please see the [tls-auth example](https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/blob/main/examples/tls-auth/README.md) or the official documentation: [docs.crowdsec.net/docs/local_api/tls_auth/](https://docs.crowdsec.net/docs/local_api/tls_auth/)
|
||||
|
||||
#### Manually add an IP to the blocklist (for testing purposes)
|
||||
|
||||
@@ -281,21 +320,25 @@ docker exec crowdsec cscli decisions add --ip 10.0.0.10 -d 10m # this will be ef
|
||||
docker exec crowdsec cscli decisions remove --ip 10.0.0.10
|
||||
```
|
||||
|
||||
### Exemples
|
||||
### Examples
|
||||
|
||||
#### 1. Behind another proxy service (ex: clouflare) [exemples/behind-proxy/README.md](https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/blob/main/exemples/behind-proxy/README.md)
|
||||
#### 1. Behind another proxy service (ex: clouflare) [examples/behind-proxy/README.md](https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/blob/main/examples/behind-proxy/README.md)
|
||||
|
||||
#### 2. With Redis as an external shared cache [exemples/redis-cache/README.md](https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/blob/main/exemples/redis-cache/README.md)
|
||||
#### 2. With Redis as an external shared cache [examples/redis-cache/README.md](https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/blob/main/examples/redis-cache/README.md)
|
||||
|
||||
#### 3. Using Trusted IP (ex: LAN OR VPN) that won't get filtered by crowdsec [exemples/trusted-ips/README.md](https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/blob/main/exemples/trusted-ips/README.md)
|
||||
#### 3. Using Trusted IP (ex: LAN OR VPN) that won't get filtered by crowdsec [examples/trusted-ips/README.md](https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/blob/main/examples/trusted-ips/README.md)
|
||||
|
||||
#### 4. Using Crowdsec and Traefik installed as binary in a single VM [exemples/binary-vm/README.md](https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/blob/main/exemples/binary-vm/README.md)
|
||||
#### 4. Using Crowdsec and Traefik installed as binary in a single VM [examples/binary-vm/README.md](https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/blob/main/examples/binary-vm/README.md)
|
||||
|
||||
#### 5. Using https communication and tls authentication with Crowdsec [exemples/tls-auth/README.md](https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/blob/main/exemples/tls-auth/README.md)
|
||||
#### 5. Using https communication and tls authentication with Crowdsec [examples/tls-auth/README.md](https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/blob/main/examples/tls-auth/README.md)
|
||||
|
||||
#### 6. Using Crowdsec and Traefik in Kubernetes [exemples/kubernetes/README.md](https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/blob/main/exemples/kubernetes/README.md)
|
||||
#### 6. Using Crowdsec and Traefik in Kubernetes [examples/kubernetes/README.md](https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/blob/main/examples/kubernetes/README.md)
|
||||
|
||||
#### 7. Using Traefik in standalone mode without Crowdsec [examples/standalone-mode/README.md](https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/blob/main/examples/standalone-mode/README.md)
|
||||
|
||||
|
||||
#### 8. Using Traefik with AppSec feature enabled [examples/appsec-enabled/README.md](https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/blob/main/examples/appsec-enabled/README.md)
|
||||
|
||||
#### 7. Using Traefik in standalone mode without Crowdsec [exemples/standalone-mode/README.md](https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/blob/main/exemples/standalone-mode/README.md)
|
||||
|
||||
### Local Mode
|
||||
|
||||
|
||||
@@ -1,4 +1,13 @@
|
||||
---
|
||||
filenames:
|
||||
- /var/log/traefik/access.log
|
||||
labels:
|
||||
type: traefik
|
||||
|
||||
---
|
||||
listen_addr: 0.0.0.0:7422
|
||||
appsec_config: crowdsecurity/virtual-patching
|
||||
name: myAppSecComponent
|
||||
source: appsec
|
||||
labels:
|
||||
type: appsec
|
||||
|
||||
+110
-26
@@ -22,11 +22,17 @@ import (
|
||||
)
|
||||
|
||||
const (
|
||||
crowdsecAppsecIPHeader = "X-Crowdsec-Appsec-Ip"
|
||||
crowdsecAppsecURIHeader = "X-Crowdsec-Appsec-Uri"
|
||||
crowdsecAppsecHostHeader = "X-Crowdsec-Appsec-Host"
|
||||
crowdsecAppsecVerbHeader = "X-Crowdsec-Appsec-Verb"
|
||||
crowdsecAppsecHeader = "X-Crowdsec-Appsec-Api-Key"
|
||||
crowdsecLapiHeader = "X-Api-Key"
|
||||
crowdsecCapiHeader = "Authorization"
|
||||
crowdsecLapiRoute = "v1/decisions"
|
||||
crowdsecLapiStreamRoute = "v1/decisions/stream"
|
||||
crowdsecCapiLogin = "v2/watchers/login"
|
||||
crowdsecCapiHost = "api.crowdsec.net"
|
||||
crowdsecCapiHeader = "Authorization"
|
||||
crowdsecCapiLoginRoute = "v2/watchers/login"
|
||||
crowdsecCapiStreamRoute = "v2/decisions/stream"
|
||||
cacheTimeoutKey = "updated"
|
||||
)
|
||||
@@ -50,6 +56,9 @@ type Bouncer struct {
|
||||
template *template.Template
|
||||
|
||||
enabled bool
|
||||
appsecEnabled bool
|
||||
appsecHost string
|
||||
appsecFailureBlock bool
|
||||
crowdsecScheme string
|
||||
crowdsecHost string
|
||||
crowdsecKey string
|
||||
@@ -86,9 +95,9 @@ func New(ctx context.Context, next http.Handler, config *configuration.Config, n
|
||||
if config.CrowdsecMode == configuration.AloneMode {
|
||||
config.CrowdsecCapiMachineID, _ = configuration.GetVariable(config, "CrowdsecCapiMachineID")
|
||||
config.CrowdsecCapiPassword, _ = configuration.GetVariable(config, "CrowdsecCapiPassword")
|
||||
config.CrowdsecLapiHost = "api.crowdsec.net"
|
||||
config.CrowdsecLapiHost = crowdsecCapiHost
|
||||
config.CrowdsecLapiScheme = "https"
|
||||
config.UpdateIntervalSeconds = 7200
|
||||
config.UpdateIntervalSeconds = 7200 // 2 hours
|
||||
crowdsecStreamRoute = crowdsecCapiStreamRoute
|
||||
crowdsecHeader = crowdsecCapiHeader
|
||||
} else {
|
||||
@@ -114,6 +123,9 @@ func New(ctx context.Context, next http.Handler, config *configuration.Config, n
|
||||
|
||||
enabled: config.Enabled,
|
||||
crowdsecMode: config.CrowdsecMode,
|
||||
appsecEnabled: config.CrowdsecAppsecEnabled,
|
||||
appsecHost: config.CrowdsecAppsecHost,
|
||||
appsecFailureBlock: config.CrowdsecAppsecFailureBlock,
|
||||
crowdsecScheme: config.CrowdsecLapiScheme,
|
||||
crowdsecHost: config.CrowdsecLapiHost,
|
||||
crowdsecKey: config.CrowdsecLapiKey,
|
||||
@@ -137,14 +149,18 @@ func New(ctx context.Context, next http.Handler, config *configuration.Config, n
|
||||
IdleConnTimeout: 30 * time.Second,
|
||||
TLSClientConfig: tlsConfig,
|
||||
},
|
||||
Timeout: 10 * time.Second,
|
||||
Timeout: time.Duration(config.HTTPTimeoutSeconds) * time.Second,
|
||||
},
|
||||
cacheClient: &cache.Client{},
|
||||
}
|
||||
config.RedisCachePassword, _ = configuration.GetVariable(config, "RedisCachePassword")
|
||||
bouncer.cacheClient.New(config.RedisCacheEnabled, config.RedisCacheHost, config.RedisCachePassword)
|
||||
bouncer.cacheClient.New(
|
||||
config.RedisCacheEnabled,
|
||||
config.RedisCacheHost,
|
||||
config.RedisCachePassword,
|
||||
config.RedisCacheDatabase,
|
||||
)
|
||||
|
||||
//nolint:nestif
|
||||
if (config.CrowdsecMode == configuration.StreamMode || config.CrowdsecMode == configuration.AloneMode) && ticker == nil {
|
||||
if config.CrowdsecMode == configuration.AloneMode {
|
||||
if err := getToken(bouncer); err != nil {
|
||||
@@ -152,17 +168,10 @@ func New(ctx context.Context, next http.Handler, config *configuration.Config, n
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
if err := handleStreamCache(bouncer); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
handleStreamTicker(bouncer)
|
||||
isStartup = false
|
||||
ticker = startTicker(config, func() {
|
||||
if err := handleStreamCache(bouncer); err != nil {
|
||||
isCrowdsecStreamHealthy = false
|
||||
logger.Error(err.Error())
|
||||
} else {
|
||||
isCrowdsecStreamHealthy = true
|
||||
}
|
||||
handleStreamTicker(bouncer)
|
||||
})
|
||||
}
|
||||
logger.Debug(fmt.Sprintf("New initialized mode:%s", config.CrowdsecMode))
|
||||
@@ -215,7 +224,7 @@ func (bouncer *Bouncer) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
|
||||
if isBanned {
|
||||
rw.WriteHeader(http.StatusForbidden)
|
||||
} else {
|
||||
bouncer.next.ServeHTTP(rw, req)
|
||||
handleNextServeHTTP(bouncer, remoteIP, rw, req)
|
||||
}
|
||||
return
|
||||
}
|
||||
@@ -224,7 +233,7 @@ func (bouncer *Bouncer) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
|
||||
// Right here if we cannot join the stream we forbid the request to go on.
|
||||
if bouncer.crowdsecMode == configuration.StreamMode || bouncer.crowdsecMode == configuration.AloneMode {
|
||||
if isCrowdsecStreamHealthy {
|
||||
bouncer.next.ServeHTTP(rw, req)
|
||||
handleNextServeHTTP(bouncer, remoteIP, rw, req)
|
||||
} else {
|
||||
logger.Debug(fmt.Sprintf("ServeHTTP isCrowdsecStreamHealthy:false ip:%s", remoteIP))
|
||||
rw.WriteHeader(http.StatusForbidden)
|
||||
@@ -235,8 +244,7 @@ func (bouncer *Bouncer) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
|
||||
logger.Debug(fmt.Sprintf("ServeHTTP:handleNoStreamCache ip:%s isBanned:true %s", remoteIP, err.Error()))
|
||||
rw.WriteHeader(http.StatusForbidden)
|
||||
} else {
|
||||
logger.Debug(fmt.Sprintf("ServeHTTP:handleNoStreamCache ip:%s isBanned:false", remoteIP))
|
||||
bouncer.next.ServeHTTP(rw, req)
|
||||
handleNextServeHTTP(bouncer, remoteIP, rw, req)
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -269,6 +277,27 @@ type Login struct {
|
||||
Expire string `json:"expire"`
|
||||
}
|
||||
|
||||
func handleNextServeHTTP(bouncer *Bouncer, remoteIP string, rw http.ResponseWriter, req *http.Request) {
|
||||
if bouncer.appsecEnabled {
|
||||
err := appsecQuery(bouncer, remoteIP, req)
|
||||
if err != nil {
|
||||
logger.Debug(fmt.Sprintf("handleNextServeHTTP ip:%s isWaf:true %s", remoteIP, err.Error()))
|
||||
rw.WriteHeader(http.StatusForbidden)
|
||||
return
|
||||
}
|
||||
}
|
||||
bouncer.next.ServeHTTP(rw, req)
|
||||
}
|
||||
|
||||
func handleStreamTicker(bouncer *Bouncer) {
|
||||
if err := handleStreamCache(bouncer); err != nil {
|
||||
isCrowdsecStreamHealthy = false
|
||||
logger.Error(err.Error())
|
||||
} else {
|
||||
isCrowdsecStreamHealthy = true
|
||||
}
|
||||
}
|
||||
|
||||
func startTicker(config *configuration.Config, work func()) chan bool {
|
||||
ticker := time.NewTicker(time.Duration(config.UpdateIntervalSeconds) * time.Second)
|
||||
stop := make(chan bool, 1)
|
||||
@@ -336,7 +365,7 @@ func getToken(bouncer *Bouncer) error {
|
||||
loginURL := url.URL{
|
||||
Scheme: bouncer.crowdsecScheme,
|
||||
Host: bouncer.crowdsecHost,
|
||||
Path: crowdsecCapiLogin,
|
||||
Path: crowdsecCapiLoginRoute,
|
||||
}
|
||||
body, err := crowdsecQuery(bouncer, loginURL.String(), true)
|
||||
if err != nil {
|
||||
@@ -417,6 +446,11 @@ func crowdsecQuery(bouncer *Bouncer, stringURL string, isPost bool) ([]byte, err
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("crowdsecQuery url:%s %w", stringURL, err)
|
||||
}
|
||||
defer func() {
|
||||
if err = res.Body.Close(); err != nil {
|
||||
logger.Error(fmt.Sprintf("crowdsecQuery:closeBody %s", err.Error()))
|
||||
}
|
||||
}()
|
||||
if res.StatusCode == http.StatusUnauthorized && bouncer.crowdsecMode == configuration.AloneMode {
|
||||
if errToken := getToken(bouncer); errToken != nil {
|
||||
return nil, fmt.Errorf("crowdsecQuery:renewToken url:%s %w", stringURL, errToken)
|
||||
@@ -426,11 +460,6 @@ func crowdsecQuery(bouncer *Bouncer, stringURL string, isPost bool) ([]byte, err
|
||||
if res.StatusCode != http.StatusOK {
|
||||
return nil, fmt.Errorf("crowdsecQuery url:%s, statusCode:%d", stringURL, res.StatusCode)
|
||||
}
|
||||
defer func() {
|
||||
if err = res.Body.Close(); err != nil {
|
||||
logger.Error(fmt.Sprintf("crowdsecQuery:closeBody %s", err.Error()))
|
||||
}
|
||||
}()
|
||||
body, err := io.ReadAll(res.Body)
|
||||
|
||||
if err != nil {
|
||||
@@ -438,3 +467,58 @@ func crowdsecQuery(bouncer *Bouncer, stringURL string, isPost bool) ([]byte, err
|
||||
}
|
||||
return body, nil
|
||||
}
|
||||
|
||||
func appsecQuery(bouncer *Bouncer, ip string, httpReq *http.Request) error {
|
||||
routeURL := url.URL{
|
||||
Scheme: bouncer.crowdsecScheme,
|
||||
Host: bouncer.appsecHost,
|
||||
Path: "/",
|
||||
}
|
||||
var req *http.Request
|
||||
if httpReq.Body != nil && httpReq.ContentLength > 0 {
|
||||
bodyBytes, err := io.ReadAll(httpReq.Body)
|
||||
if err != nil {
|
||||
return fmt.Errorf("appsecQuery:GetBody %w", err)
|
||||
}
|
||||
httpReq.Body = io.NopCloser(bytes.NewBuffer(bodyBytes))
|
||||
req, _ = http.NewRequest(http.MethodPost, routeURL.String(), bytes.NewBuffer(bodyBytes))
|
||||
} else {
|
||||
req, _ = http.NewRequest(http.MethodGet, routeURL.String(), nil)
|
||||
}
|
||||
|
||||
for key, headers := range httpReq.Header {
|
||||
for _, value := range headers {
|
||||
req.Header.Add(key, value)
|
||||
}
|
||||
}
|
||||
req.Header.Set(crowdsecAppsecHeader, bouncer.crowdsecKey)
|
||||
req.Header.Set(crowdsecAppsecIPHeader, ip)
|
||||
req.Header.Set(crowdsecAppsecVerbHeader, httpReq.Method)
|
||||
req.Header.Set(crowdsecAppsecHostHeader, httpReq.Host)
|
||||
req.Header.Set(crowdsecAppsecURIHeader, httpReq.URL.Path)
|
||||
|
||||
res, err := bouncer.httpClient.Do(req)
|
||||
if err != nil {
|
||||
return fmt.Errorf("appsecQuery %w", err)
|
||||
}
|
||||
defer func() {
|
||||
if err = res.Body.Close(); err != nil {
|
||||
logger.Error(fmt.Sprintf("appsecQuery:closeBody %s", err.Error()))
|
||||
}
|
||||
}()
|
||||
if res.StatusCode == http.StatusInternalServerError {
|
||||
logger.Debug("crowdsecQuery statusCode:500")
|
||||
if bouncer.appsecFailureBlock {
|
||||
return fmt.Errorf("appsecQuery statusCode:%d", res.StatusCode)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
if res.StatusCode != http.StatusOK {
|
||||
return fmt.Errorf("appsecQuery statusCode:%d", res.StatusCode)
|
||||
}
|
||||
|
||||
if err != nil {
|
||||
return fmt.Errorf("appsecQuery:readBody %w", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
+12
-10
@@ -2,7 +2,7 @@ version: "3.8"
|
||||
|
||||
services:
|
||||
traefik:
|
||||
image: "traefik:v2.9.6"
|
||||
image: "traefik:v2.10.4"
|
||||
container_name: "traefik"
|
||||
restart: unless-stopped
|
||||
command:
|
||||
@@ -20,7 +20,7 @@ services:
|
||||
- logs-local:/var/log/traefik
|
||||
- ./:/plugins-local/src/github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
|
||||
ports:
|
||||
- 80:80
|
||||
- 8000:80
|
||||
- 8080:8080
|
||||
depends_on:
|
||||
- crowdsec
|
||||
@@ -31,12 +31,12 @@ services:
|
||||
restart: unless-stopped
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.router-foo.rule=Path(`/foo`)"
|
||||
- "traefik.http.routers.router-foo.rule=PathPrefix(`/foo`)"
|
||||
- "traefik.http.routers.router-foo.entrypoints=web"
|
||||
- "traefik.http.routers.router-foo.middlewares=crowdsec-foo@docker"
|
||||
- "traefik.http.services.service-foo.loadbalancer.server.port=80"
|
||||
- "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.enabled=true"
|
||||
- "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
|
||||
- "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5="
|
||||
|
||||
whoami2:
|
||||
image: traefik/whoami
|
||||
@@ -44,22 +44,23 @@ services:
|
||||
restart: unless-stopped
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.router-bar.rule=Path(`/bar`)"
|
||||
- "traefik.http.routers.router-bar.rule=PathPrefix(`/bar`)"
|
||||
- "traefik.http.routers.router-bar.entrypoints=web"
|
||||
- "traefik.http.routers.router-bar.middlewares=crowdsec-bar@docker"
|
||||
- "traefik.http.services.service-bar.loadbalancer.server.port=80"
|
||||
- "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.enabled=true"
|
||||
- "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdseclapikey=44c36dac5c4140af9f06f397508e82c7"
|
||||
- "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.loglevel=DEBUG"
|
||||
- "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdsecappsecenabled=true"
|
||||
- "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5="
|
||||
|
||||
crowdsec:
|
||||
image: crowdsecurity/crowdsec:v1.4.1
|
||||
image: crowdsecurity/crowdsec:dev
|
||||
container_name: "crowdsec"
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
COLLECTIONS: crowdsecurity/traefik
|
||||
COLLECTIONS: crowdsecurity/traefik crowdsecurity/appsec-virtual-patching
|
||||
CUSTOM_HOSTNAME: crowdsec
|
||||
BOUNCER_KEY_TRAEFIK_1: 40796d93c2958f9e58345514e67740e5
|
||||
BOUNCER_KEY_TRAEFIK_2: 44c36dac5c4140af9f06f397508e82c7
|
||||
BOUNCER_KEY_TRAEFIK: 40796d93c2958f9e58345514e67740e5=
|
||||
volumes:
|
||||
- ./acquis.yaml:/etc/crowdsec/acquis.yaml:ro
|
||||
- logs-local:/var/log/traefik:ro
|
||||
@@ -67,6 +68,7 @@ services:
|
||||
- crowdsec-config-local:/etc/crowdsec/
|
||||
labels:
|
||||
- "traefik.enable=false"
|
||||
|
||||
volumes:
|
||||
logs-local:
|
||||
crowdsec-db-local:
|
||||
|
||||
+9
-7
@@ -2,7 +2,7 @@ version: "3.8"
|
||||
|
||||
services:
|
||||
traefik:
|
||||
image: "traefik:v2.9.6"
|
||||
image: "traefik:v2.10.4"
|
||||
container_name: "traefik"
|
||||
restart: unless-stopped
|
||||
command:
|
||||
@@ -14,7 +14,7 @@ services:
|
||||
- "--entrypoints.web.address=:80"
|
||||
|
||||
- "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
|
||||
- "--experimental.plugins.bouncer.version=v1.1.8"
|
||||
- "--experimental.plugins.bouncer.version=v1.1.15"
|
||||
volumes:
|
||||
- "/var/run/docker.sock:/var/run/docker.sock:ro"
|
||||
- "logs:/var/log/traefik"
|
||||
@@ -39,7 +39,8 @@ services:
|
||||
# Definition of the middleware
|
||||
- "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.enabled=true"
|
||||
# crowdseclapikey must be unique to the middleware attached to the service
|
||||
- "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdseclapikey=FIXME-LAPI-KEY-1"
|
||||
- "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdseclapikey=FIXME-LAPI-KEY-1="
|
||||
|
||||
# forwardedheaderstrustedips should be the IP of the proxy that is in front of traefik (if any)
|
||||
- "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5"
|
||||
|
||||
@@ -58,20 +59,21 @@ services:
|
||||
# Definitin of the middleware
|
||||
- "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.enabled=true"
|
||||
# crowdseclapikey must be unique to the middleware attached to the service
|
||||
- "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdseclapikey=FIXME-LAPI-KEY-2"
|
||||
- "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdseclapikey=FIXME-LAPI-KEY-1="
|
||||
# enable AppSec real time check
|
||||
- "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdsecappsecenabled=true"
|
||||
# forwardedheaderstrustedips should be the IP of the proxy that is in front of traefik (if any)
|
||||
- "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5"
|
||||
|
||||
crowdsec:
|
||||
image: crowdsecurity/crowdsec:v1.4.1
|
||||
image: crowdsecurity/crowdsec:v1.5.3
|
||||
container_name: "crowdsec"
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
COLLECTIONS: crowdsecurity/traefik
|
||||
CUSTOM_HOSTNAME: crowdsec
|
||||
# We need to register one api key per service we will use
|
||||
BOUNCER_KEY_TRAEFIK_1: FIXME-LAPI-KEY-1
|
||||
BOUNCER_KEY_TRAEFIK_2: FIXME-LAPI-KEY-2
|
||||
BOUNCER_KEY_TRAEFIK: FIXME-LAPI-KEY-1=
|
||||
volumes:
|
||||
- ./acquis.yaml:/etc/crowdsec/acquis.yaml:ro
|
||||
- logs:/var/log/traefik:ro
|
||||
|
||||
@@ -0,0 +1,28 @@
|
||||
# Example
|
||||
## Enabling AppSec WAF feature from crowdsec
|
||||
|
||||
You mostly need to configure Crowdsec for this to work by enabling virtual patching and configuring some custom rules.
|
||||
In the example we use a whoami container protected by crowdsec with virtual patching enabled.
|
||||
|
||||
The Traefik instance just needs to know where appsec engine is located
|
||||
```yaml
|
||||
labels:
|
||||
|
||||
- "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdsecappsecenabled=true"
|
||||
- "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdsecappsechost=crowdsec:7422"
|
||||
```
|
||||
We can try to query normally the whoami server:
|
||||
```bash
|
||||
curl http://localhost:8000/foo
|
||||
```
|
||||
|
||||
And then we verify that a malicious request will be blocked:
|
||||
```bash
|
||||
curl http://localhost:8000/foo/rpc2
|
||||
```
|
||||
You should get a 403 on http://localhost:8000/foo/rpc2
|
||||
|
||||
To play the demo environment run:
|
||||
```bash
|
||||
make run_appsec
|
||||
```
|
||||
@@ -0,0 +1,12 @@
|
||||
filenames:
|
||||
- /var/log/traefik/access.log
|
||||
labels:
|
||||
type: traefik
|
||||
|
||||
---
|
||||
listen_addr: 0.0.0.0:7422
|
||||
appsec_config: crowdsecurity/virtual-patching
|
||||
name: myAppSecComponent
|
||||
source: appsec
|
||||
labels:
|
||||
type: appsec
|
||||
@@ -0,0 +1,72 @@
|
||||
version: "3.8"
|
||||
|
||||
services:
|
||||
traefik:
|
||||
image: "traefik:v2.10.7"
|
||||
container_name: "traefik"
|
||||
restart: unless-stopped
|
||||
command:
|
||||
# - "--log.level=DEBUG"
|
||||
- "--accesslog"
|
||||
- "--accesslog.filepath=/var/log/traefik/access.log"
|
||||
- "--api.insecure=true"
|
||||
- "--providers.docker=true"
|
||||
- "--providers.docker.exposedbydefault=false"
|
||||
- "--entrypoints.web.address=:80"
|
||||
|
||||
- "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
|
||||
- "--experimental.plugins.bouncer.version=v1.2.0"
|
||||
# - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
- logs-appsec-enabled:/var/log/traefik
|
||||
- ./../../:/plugins-local/src/github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
|
||||
ports:
|
||||
- 8000:80
|
||||
- 8080:8080
|
||||
depends_on:
|
||||
- crowdsec
|
||||
|
||||
whoami1:
|
||||
image: traefik/whoami
|
||||
container_name: "simple-service-foo"
|
||||
restart: unless-stopped
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
# Definition of the router
|
||||
- "traefik.http.routers.router-foo.rule=PathPrefix(`/foo`)"
|
||||
- "traefik.http.routers.router-foo.entrypoints=web"
|
||||
- "traefik.http.routers.router-foo.middlewares=crowdsec-foo@docker"
|
||||
# Definition of the service
|
||||
- "traefik.http.services.service-foo.loadbalancer.server.port=80"
|
||||
# Definition of the middleware
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.enabled=true"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.loglevel=DEBUG"
|
||||
# Enable AppSec
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdsecappsecenabled=true"
|
||||
# Define AppSec host and port informations
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdsecappsechost=crowdsec:7422"
|
||||
|
||||
|
||||
|
||||
crowdsec:
|
||||
image: crowdsecurity/crowdsec:v1.6.0
|
||||
container_name: "crowdsec"
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
COLLECTIONS: crowdsecurity/traefik
|
||||
CUSTOM_HOSTNAME: crowdsec
|
||||
BOUNCER_KEY_TRAEFIK_DEV: 40796d93c2958f9e58345514e67740e5
|
||||
volumes:
|
||||
- ./acquis.yaml:/etc/crowdsec/acquis.yaml:ro
|
||||
- logs-appsec-enabled:/var/log/traefik:ro
|
||||
- crowdsec-db-appsec-enabled:/var/lib/crowdsec/data/
|
||||
- crowdsec-config-appsec-enabled:/etc/crowdsec/
|
||||
labels:
|
||||
- "traefik.enable=false"
|
||||
|
||||
volumes:
|
||||
logs-appsec-enabled:
|
||||
crowdsec-db-appsec-enabled:
|
||||
crowdsec-config-appsec-enabled:
|
||||
@@ -1,4 +1,4 @@
|
||||
# Exemple
|
||||
# Example
|
||||
## Behind another proxy service (ex: clouflare)
|
||||
|
||||
You need to configure your Traefik to trust Forwarded headers by your front proxy
|
||||
+19
-23
@@ -2,7 +2,7 @@ version: "3.8"
|
||||
|
||||
services:
|
||||
cloudflare:
|
||||
image: "traefik:v2.9.6"
|
||||
image: "traefik:v2.10.4"
|
||||
container_name: "cloudflare"
|
||||
restart: unless-stopped
|
||||
command:
|
||||
@@ -12,17 +12,16 @@ services:
|
||||
- "--api.insecure=true"
|
||||
- "--entrypoints.web.address=:80"
|
||||
- "--providers.file.filename=/cloud.yaml"
|
||||
- "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
- ./cloudflare-exemple.yaml:/cloud.yaml:ro
|
||||
- ./cloudflare-example.yaml:/cloud.yaml:ro
|
||||
- logs-cloudflare:/var/log/traefik
|
||||
ports:
|
||||
- 80:80
|
||||
- 8080:8080
|
||||
|
||||
traefik:
|
||||
image: "traefik:v2.9.6"
|
||||
image: "traefik:v2.10.4"
|
||||
container_name: "traefik"
|
||||
restart: unless-stopped
|
||||
command:
|
||||
@@ -36,7 +35,7 @@ services:
|
||||
- "--entrypoints.web.forwardedheaders.trustedips=172.21.0.5"
|
||||
|
||||
- "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
|
||||
- "--experimental.plugins.bouncer.version=v1.1.7"
|
||||
- "--experimental.plugins.bouncer.version=v1.1.13"
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
- logs-traefik:/var/log/traefik
|
||||
@@ -46,7 +45,7 @@ services:
|
||||
depends_on:
|
||||
- crowdsec
|
||||
|
||||
whoami1:
|
||||
whoami-foo:
|
||||
image: traefik/whoami
|
||||
container_name: "simple-service-foo"
|
||||
restart: unless-stopped
|
||||
@@ -58,15 +57,14 @@ services:
|
||||
- "traefik.http.routers.router-foo.middlewares=crowdsec-foo@docker"
|
||||
# Definition of the service
|
||||
- "traefik.http.services.service-foo.loadbalancer.server.port=80"
|
||||
# Definitin of the middleware
|
||||
- "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.enabled=true"
|
||||
# crowdseclapikey must be uniq to the middleware attached to the service
|
||||
- "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
|
||||
- "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdsecmode=live"
|
||||
- "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5"
|
||||
- "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.loglevel=DEBUG"
|
||||
# Definition of the middleware
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.enabled=true"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdsecmode=live"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.loglevel=DEBUG"
|
||||
|
||||
whoami2:
|
||||
whoami-bar:
|
||||
image: traefik/whoami
|
||||
container_name: "simple-service-bar"
|
||||
restart: unless-stopped
|
||||
@@ -78,24 +76,22 @@ services:
|
||||
- "traefik.http.routers.router-bar.middlewares=crowdsec-bar@docker"
|
||||
# Definition of the service
|
||||
- "traefik.http.services.service-bar.loadbalancer.server.port=80"
|
||||
# Definitin of the middleware
|
||||
# Definition of the middleware
|
||||
- "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.enabled=true"
|
||||
# crowdseclapikey must be uniq to the middleware attached to the service
|
||||
- "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdseclapikey=44c36dac5c4140af9f06f397508e82c7"
|
||||
- "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdsecmode=live"
|
||||
- "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5"
|
||||
- "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.loglevel=DEBUG"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdsecmode=live"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.loglevel=DEBUG"
|
||||
|
||||
|
||||
crowdsec:
|
||||
image: crowdsecurity/crowdsec:v1.4.3
|
||||
image: crowdsecurity/crowdsec:v1.5.2
|
||||
container_name: "crowdsec"
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
COLLECTIONS: crowdsecurity/traefik
|
||||
CUSTOM_HOSTNAME: crowdsec
|
||||
BOUNCER_KEY_TRAEFIK_DEV_1: 40796d93c2958f9e58345514e67740e5
|
||||
BOUNCER_KEY_TRAEFIK_DEV_2: 44c36dac5c4140af9f06f397508e82c7
|
||||
BOUNCER_KEY_TRAEFIK_DEV: 40796d93c2958f9e58345514e67740e5
|
||||
volumes:
|
||||
- ./acquis.yaml:/etc/crowdsec/acquis.yaml:ro
|
||||
- logs-cloudflare:/var/log/traefik:ro
|
||||
@@ -1,4 +1,4 @@
|
||||
# Exemple
|
||||
# Example
|
||||
|
||||
### Install vagrant
|
||||
|
||||
+1
-1
@@ -2,7 +2,7 @@
|
||||
|
||||
DEBIAN_FRONTEND=noninteractive sudo apt-get update && sudo apt-get install wget -y
|
||||
# DEBIAN_FRONTEND=noninteractive sudo apt-get upgrade -y --assume-yes
|
||||
wget -O traefik.tar.gz "https://github.com/traefik/traefik/releases/download/v2.9.6/traefik_v2.9.6_linux_amd64.tar.gz"
|
||||
wget -O traefik.tar.gz "https://github.com/traefik/traefik/releases/download/v2.10.4/traefik_v2.10.4_linux_amd64.tar.gz"
|
||||
tar -zxvf traefik.tar.gz
|
||||
# inspired from https://gist.github.com/ubergesundheit/7c9d875befc2d7bfd0bf43d8b3862d85
|
||||
sudo mv ./traefik /usr/local/bin/
|
||||
+1
-1
@@ -1,7 +1,7 @@
|
||||
#!/bin/bash
|
||||
|
||||
DEBIAN_FRONTEND=noninteractive sudo apt-get update && apt-get install wget -y
|
||||
wget -O whoami.tar.gz "https://github.com/traefik/whoami/releases/download/v1.8.7/whoami_v1.8.7_linux_amd64.tar.gz"
|
||||
wget -O whoami.tar.gz "https://github.com/traefik/whoami/releases/download/v1.9.0/whoami_v1.9.0_linux_amd64.tar.gz"
|
||||
tar -zxvf whoami.tar.gz
|
||||
# inspired from https://gist.github.com/ubergesundheit/7c9d875befc2d7bfd0bf43d8b3862d85
|
||||
sudo mv ./whoami /usr/local/bin/
|
||||
@@ -1,4 +1,4 @@
|
||||
### Kubernetes Exemple
|
||||
### Kubernetes Example
|
||||
|
||||
#### Official docs
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
image:
|
||||
tag: v1.4.4-rc1
|
||||
tag: v1.5.2
|
||||
|
||||
agent:
|
||||
acquisition:
|
||||
@@ -22,4 +22,4 @@ lapi:
|
||||
value: "k8s linux test"
|
||||
# If it's a test, we don't want to share signals with CrowdSec so disable the Online API.
|
||||
- name: DISABLE_ONLINE_API
|
||||
value: true
|
||||
value: "true"
|
||||
@@ -1,5 +1,5 @@
|
||||
image:
|
||||
tag: v2.9.6
|
||||
tag: v2.10.4
|
||||
|
||||
logs:
|
||||
general:
|
||||
@@ -16,4 +16,4 @@ experimental:
|
||||
|
||||
additionalArguments:
|
||||
- "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
|
||||
- "--experimental.plugins.bouncer.version=v1.1.7-beta1"
|
||||
- "--experimental.plugins.bouncer.version=v1.1.13"
|
||||
@@ -1,4 +1,4 @@
|
||||
# Exemple
|
||||
# Example
|
||||
## With Redis as an external shared cache
|
||||
|
||||
The plugin must be configured to connect to a redis instance
|
||||
@@ -0,0 +1,114 @@
|
||||
version: "3.8"
|
||||
|
||||
services:
|
||||
traefik:
|
||||
image: "traefik:v2.10.4"
|
||||
container_name: "traefik"
|
||||
restart: unless-stopped
|
||||
command:
|
||||
# - "--log.level=DEBUG"
|
||||
- "--accesslog"
|
||||
- "--accesslog.filepath=/var/log/traefik/access.log"
|
||||
- "--api.insecure=true"
|
||||
- "--providers.docker=true"
|
||||
- "--providers.docker.exposedbydefault=false"
|
||||
- "--entrypoints.web.address=:80"
|
||||
|
||||
- "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
|
||||
- "--experimental.plugins.bouncer.version=v1.1.13"
|
||||
# - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
- logs-redis:/var/log/traefik
|
||||
# - ./../../:/plugins-local/src/github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
|
||||
ports:
|
||||
- 80:80
|
||||
- 8080:8080
|
||||
depends_on:
|
||||
- crowdsec
|
||||
# - redis-insecure
|
||||
- redis-secure
|
||||
|
||||
# Either use secure, or insecure but do not mix both
|
||||
# whoami-redis-insecure:
|
||||
# image: traefik/whoami
|
||||
# container_name: "simple-service-foo"
|
||||
# restart: unless-stopped
|
||||
# labels:
|
||||
# - "traefik.enable=true"
|
||||
# # Definition of the router
|
||||
# - "traefik.http.routers.router-foo.rule=Path(`/redis-insecure`)"
|
||||
# - "traefik.http.routers.router-foo.entrypoints=web"
|
||||
# - "traefik.http.routers.router-foo.middlewares=crowdsec-foo@docker"
|
||||
# # Definition of the service
|
||||
# - "traefik.http.services.service-foo.loadbalancer.server.port=80"
|
||||
# # Definition of the middleware
|
||||
# - "traefik.http.middlewares.crowdsec.plugin.bouncer.enabled=true"
|
||||
# - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
|
||||
# - "traefik.http.middlewares.crowdsec.plugin.bouncer.rediscacheenabled=true"
|
||||
# # Contact redis-unsecure without a password
|
||||
# - "traefik.http.middlewares.crowdsec.plugin.bouncer.rediscachehost=redis-insecure:6379"
|
||||
# - "traefik.http.middlewares.crowdsec.plugin.bouncer.loglevel=DEBUG"
|
||||
|
||||
whoami-redis-secure:
|
||||
image: traefik/whoami
|
||||
container_name: "simple-service-bar"
|
||||
restart: unless-stopped
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
# Definition of the router
|
||||
- "traefik.http.routers.router-bar.rule=Path(`/redis-secure`)"
|
||||
- "traefik.http.routers.router-bar.entrypoints=web"
|
||||
- "traefik.http.routers.router-bar.middlewares=crowdsec-bar@docker"
|
||||
# Definition of the service
|
||||
- "traefik.http.services.service-bar.loadbalancer.server.port=80"
|
||||
# Definition of the middleware
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.enabled=true"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.rediscacheenabled=true"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.rediscachepassword=FIXME"
|
||||
# Contact redis-secure with password
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.rediscachehost=redis-secure:6379"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.loglevel=DEBUG"
|
||||
|
||||
|
||||
crowdsec:
|
||||
image: crowdsecurity/crowdsec:v1.5.2
|
||||
container_name: "crowdsec"
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
COLLECTIONS: crowdsecurity/traefik
|
||||
CUSTOM_HOSTNAME: crowdsec
|
||||
BOUNCER_KEY_TRAEFIK_DEV: 40796d93c2958f9e58345514e67740e5
|
||||
volumes:
|
||||
- ./acquis.yaml:/etc/crowdsec/acquis.yaml:ro
|
||||
- logs-redis:/var/log/traefik:ro
|
||||
- crowdsec-db-redis:/var/lib/crowdsec/data/
|
||||
- crowdsec-config-redis:/etc/crowdsec/
|
||||
labels:
|
||||
- "traefik.enable=false"
|
||||
|
||||
redis-secure:
|
||||
image: "redis:7.0.12-alpine"
|
||||
container_name: "redis-secure"
|
||||
hostname: redis-secure
|
||||
restart: unless-stopped
|
||||
command: "redis-server --save 60 1 --loglevel debug --requirepass FIXME"
|
||||
volumes:
|
||||
- redis-secure-data:/data
|
||||
|
||||
# redis-insecure:
|
||||
# image: "redis:7.0.12-alpine"
|
||||
# container_name: "redis-insecure"
|
||||
# hostname: redis-unsecure
|
||||
# restart: unless-stopped
|
||||
# command: "redis-server --save 60 1 --loglevel debug"
|
||||
# volumes:
|
||||
# - redis-unsecure-data:/data
|
||||
|
||||
volumes:
|
||||
logs-redis:
|
||||
crowdsec-db-redis:
|
||||
crowdsec-config-redis:
|
||||
redis-unsecure-data:
|
||||
redis-secure-data:
|
||||
+2
-2
@@ -2,7 +2,7 @@ version: "3.8"
|
||||
|
||||
services:
|
||||
traefik:
|
||||
image: "traefik:v2.9.6"
|
||||
image: "traefik:v2.10.4"
|
||||
container_name: "traefik"
|
||||
restart: unless-stopped
|
||||
command:
|
||||
@@ -15,7 +15,7 @@ services:
|
||||
- "--entrypoints.web.address=:80"
|
||||
|
||||
- "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
|
||||
- "--experimental.plugins.bouncer.version=v1.1.7"
|
||||
- "--experimental.plugins.bouncer.version=v1.1.13"
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
ports:
|
||||
@@ -1,4 +1,4 @@
|
||||
# Exemple
|
||||
# Example
|
||||
## Using https communication and tls authentication with Crowdsec
|
||||
|
||||
##### Summary
|
||||
+27
-25
@@ -2,7 +2,7 @@ version: "3.8"
|
||||
|
||||
services:
|
||||
traefik:
|
||||
image: "traefik:v2.9.6"
|
||||
image: "traefik:v2.10.4"
|
||||
container_name: "traefik"
|
||||
restart: unless-stopped
|
||||
command:
|
||||
@@ -15,14 +15,14 @@ services:
|
||||
- "--entrypoints.web.address=:80"
|
||||
|
||||
- "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
|
||||
- "--experimental.plugins.bouncer.version=v1.1.7"
|
||||
- "--experimental.plugins.bouncer.version=v1.1.13"
|
||||
# - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
- ./LAPIKEY:/etc/traefik/LAPIKEY:ro
|
||||
- logs-tls-auth:/var/log/traefik
|
||||
- crowdsec-certs-tls-auth:/etc/traefik/crowdsec-certs
|
||||
- ./../../:/plugins-local/src/github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
|
||||
# - ./../../:/plugins-local/src/github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
|
||||
|
||||
ports:
|
||||
- 80:80
|
||||
@@ -30,22 +30,24 @@ services:
|
||||
depends_on:
|
||||
- crowdsec
|
||||
|
||||
whoami-foo:
|
||||
image: traefik/whoami
|
||||
container_name: "simple-service-foo"
|
||||
restart: unless-stopped
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.router-foo.rule=Path(`/foo`)"
|
||||
- "traefik.http.routers.router-foo.entrypoints=web"
|
||||
- "traefik.http.routers.router-foo.middlewares=crowdsec-foo@docker"
|
||||
- "traefik.http.services.service-foo.loadbalancer.server.port=80"
|
||||
- "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.enabled=true"
|
||||
- "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.loglevel=DEBUG"
|
||||
- "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
|
||||
- "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdseclapischeme=https"
|
||||
- "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdsecLapiTLSCertificateAuthorityFile=/etc/traefik/crowdsec-certs/inter.pem"
|
||||
# Use HTTPS scheme but with lapikey authentication
|
||||
# whoami-foo:
|
||||
# image: traefik/whoami
|
||||
# container_name: "simple-service-foo"
|
||||
# restart: unless-stopped
|
||||
# labels:
|
||||
# - "traefik.enable=true"
|
||||
# - "traefik.http.routers.router-foo.rule=Path(`/foo`)"
|
||||
# - "traefik.http.routers.router-foo.entrypoints=web"
|
||||
# - "traefik.http.routers.router-foo.middlewares=crowdsec-foo@docker"
|
||||
# - "traefik.http.services.service-foo.loadbalancer.server.port=80"
|
||||
# - "traefik.http.middlewares.crowdsec.plugin.bouncer.enabled=true"
|
||||
# - "traefik.http.middlewares.crowdsec.plugin.bouncer.loglevel=DEBUG"
|
||||
# - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
|
||||
# - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapischeme=https"
|
||||
# - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdsecLapiTLSCertificateAuthorityFile=/etc/traefik/crowdsec-certs/inter.pem"
|
||||
|
||||
# Use HTTPS scheme with TLS cert authentication
|
||||
whoami-bar:
|
||||
image: traefik/whoami
|
||||
container_name: "simple-service-bar"
|
||||
@@ -56,15 +58,15 @@ services:
|
||||
- "traefik.http.routers.router-bar.entrypoints=web"
|
||||
- "traefik.http.routers.router-bar.middlewares=crowdsec-bar@docker"
|
||||
- "traefik.http.services.service-bar.loadbalancer.server.port=80"
|
||||
- "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.enabled=true"
|
||||
- "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.loglevel=DEBUG"
|
||||
- "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdseclapischeme=https"
|
||||
- "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdsecLapiTLSCertificateAuthorityFile=/etc/traefik/crowdsec-certs/inter.pem"
|
||||
- "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdsecLapiTLSCertificateBouncerFile=/etc/traefik/crowdsec-certs/bouncer.pem"
|
||||
- "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdsecLapiTLSCertificateBouncerKeyFile=/etc/traefik/crowdsec-certs/bouncer-key.pem"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.enabled=true"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.loglevel=DEBUG"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapischeme=https"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdsecLapiTLSCertificateAuthorityFile=/etc/traefik/crowdsec-certs/inter.pem"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdsecLapiTLSCertificateBouncerFile=/etc/traefik/crowdsec-certs/bouncer.pem"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdsecLapiTLSCertificateBouncerKeyFile=/etc/traefik/crowdsec-certs/bouncer-key.pem"
|
||||
|
||||
crowdsec:
|
||||
image: crowdsecurity/crowdsec:v1.4.3
|
||||
image: crowdsecurity/crowdsec:v1.5.2
|
||||
container_name: "crowdsec"
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
@@ -1,4 +1,4 @@
|
||||
# Exemple
|
||||
# Example
|
||||
## Using Trusted IP (ex: LAN OR VPN) that won't get filtered by crowdsec
|
||||
|
||||
You need to configure your Traefik to trust Forwarded headers by your front proxy
|
||||
+13
-16
@@ -2,7 +2,7 @@ version: "3.8"
|
||||
|
||||
services:
|
||||
traefik:
|
||||
image: "traefik:v2.9.6"
|
||||
image: "traefik:v2.10.4"
|
||||
container_name: "traefik"
|
||||
restart: unless-stopped
|
||||
command:
|
||||
@@ -15,12 +15,12 @@ services:
|
||||
- "--entrypoints.web.address=:80"
|
||||
|
||||
- "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
|
||||
- "--experimental.plugins.bouncer.version=v1.1.7"
|
||||
- "--experimental.plugins.bouncer.version=v1.1.13"
|
||||
# - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
- logs-trustedips:/var/log/traefik
|
||||
- ./../../:/plugins-local/src/github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
|
||||
# - ./../../:/plugins-local/src/github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
|
||||
ports:
|
||||
- 80:80
|
||||
- 8080:8080
|
||||
@@ -40,12 +40,11 @@ services:
|
||||
# Definition of the service
|
||||
- "traefik.http.services.service-foo.loadbalancer.server.port=80"
|
||||
# Definition of the middleware
|
||||
- "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.enabled=true"
|
||||
# crowdseclapikey must be uniq to the middleware attached to the service
|
||||
- "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.enabled=true"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
|
||||
# Replace 10.0.10.30/32 by your IP range which is "trusted"
|
||||
- "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.clienttrustedips=10.0.10.30/32"
|
||||
- "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.loglevel=DEBUG"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.clienttrustedips=10.0.10.30/32"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.loglevel=DEBUG"
|
||||
|
||||
whoami2:
|
||||
image: traefik/whoami
|
||||
@@ -60,23 +59,21 @@ services:
|
||||
# Definition of the service
|
||||
- "traefik.http.services.service-bar.loadbalancer.server.port=80"
|
||||
# Definition of the middleware
|
||||
- "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.enabled=true"
|
||||
# crowdseclapikey must be uniq to the middleware attached to the service
|
||||
- "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdseclapikey=44c36dac5c4140af9f06f397508e82c7"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.enabled=true"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
|
||||
# Replace 10.0.10.30/32 by your IP range which is "trusted"
|
||||
- "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.clienttrustedips=10.0.10.30/32"
|
||||
- "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.loglevel=DEBUG"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.clienttrustedips=10.0.10.30/32"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.loglevel=DEBUG"
|
||||
|
||||
|
||||
crowdsec:
|
||||
image: crowdsecurity/crowdsec:v1.4.3
|
||||
image: crowdsecurity/crowdsec:v1.5.2
|
||||
container_name: "crowdsec"
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
COLLECTIONS: crowdsecurity/traefik
|
||||
CUSTOM_HOSTNAME: crowdsec
|
||||
BOUNCER_KEY_TRAEFIK_DEV_1: 40796d93c2958f9e58345514e67740e5
|
||||
BOUNCER_KEY_TRAEFIK_DEV_2: 44c36dac5c4140af9f06f397508e82c7
|
||||
BOUNCER_KEY_TRAEFIK_DEV: 40796d93c2958f9e58345514e67740e5
|
||||
volumes:
|
||||
- ./acquis.yaml:/etc/crowdsec/acquis.yaml:ro
|
||||
- logs-trustedips:/var/log/traefik:ro
|
||||
@@ -1,116 +0,0 @@
|
||||
version: "3.8"
|
||||
|
||||
services:
|
||||
traefik:
|
||||
image: "traefik:v2.9.8"
|
||||
container_name: "traefik"
|
||||
restart: unless-stopped
|
||||
command:
|
||||
# - "--log.level=DEBUG"
|
||||
- "--accesslog"
|
||||
- "--accesslog.filepath=/var/log/traefik/access.log"
|
||||
- "--api.insecure=true"
|
||||
- "--providers.docker=true"
|
||||
- "--providers.docker.exposedbydefault=false"
|
||||
- "--entrypoints.web.address=:80"
|
||||
|
||||
- "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
|
||||
- "--experimental.plugins.bouncer.version=v1.1.11-beta2"
|
||||
# - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
- logs-redis:/var/log/traefik
|
||||
# - ./../../:/plugins-local/src/github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
|
||||
ports:
|
||||
- 80:80
|
||||
- 8080:8080
|
||||
depends_on:
|
||||
- crowdsec
|
||||
- redis-insecure
|
||||
- redis-secure
|
||||
|
||||
whoami-redis-insecure:
|
||||
image: traefik/whoami
|
||||
container_name: "simple-service-foo"
|
||||
restart: unless-stopped
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
# Definition of the router
|
||||
- "traefik.http.routers.router-foo.rule=Path(`/redis-insecure`)"
|
||||
- "traefik.http.routers.router-foo.entrypoints=web"
|
||||
- "traefik.http.routers.router-foo.middlewares=crowdsec-foo@docker"
|
||||
# Definition of the service
|
||||
- "traefik.http.services.service-foo.loadbalancer.server.port=80"
|
||||
# Definition of the middleware
|
||||
- "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.enabled=true"
|
||||
# crowdseclapikey must be uniq to the middleware attached to the service
|
||||
- "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
|
||||
- "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.rediscacheenabled=true"
|
||||
# Contact redis-unsecure without a password
|
||||
- "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.redisCacheHost=redis-insecure:6379"
|
||||
- "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.loglevel=DEBUG"
|
||||
|
||||
whoami-redis-secure:
|
||||
image: traefik/whoami
|
||||
container_name: "simple-service-bar"
|
||||
restart: unless-stopped
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
# Definition of the router
|
||||
- "traefik.http.routers.router-bar.rule=Path(`/redis-secure`)"
|
||||
- "traefik.http.routers.router-bar.entrypoints=web"
|
||||
- "traefik.http.routers.router-bar.middlewares=crowdsec-bar@docker"
|
||||
# Definition of the service
|
||||
- "traefik.http.services.service-bar.loadbalancer.server.port=80"
|
||||
# Definition of the middleware
|
||||
- "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.enabled=true"
|
||||
# crowdseclapikey must be uniq to the middleware attached to the service
|
||||
- "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdseclapikey=44c36dac5c4140af9f06f397508e82c7"
|
||||
- "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.rediscacheenabled=true"
|
||||
- "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.redisCachePassword=FIXME"
|
||||
# Contact redis-secure with password
|
||||
- "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.redisCacheHost=redis-secure:6379"
|
||||
- "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.loglevel=DEBUG"
|
||||
|
||||
|
||||
crowdsec:
|
||||
image: crowdsecurity/crowdsec:v1.4.6
|
||||
container_name: "crowdsec"
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
COLLECTIONS: crowdsecurity/traefik
|
||||
CUSTOM_HOSTNAME: crowdsec
|
||||
BOUNCER_KEY_TRAEFIK_DEV_1: 40796d93c2958f9e58345514e67740e5
|
||||
BOUNCER_KEY_TRAEFIK_DEV_2: 44c36dac5c4140af9f06f397508e82c7
|
||||
volumes:
|
||||
- ./acquis.yaml:/etc/crowdsec/acquis.yaml:ro
|
||||
- logs-redis:/var/log/traefik:ro
|
||||
- crowdsec-db-redis:/var/lib/crowdsec/data/
|
||||
- crowdsec-config-redis:/etc/crowdsec/
|
||||
labels:
|
||||
- "traefik.enable=false"
|
||||
|
||||
redis-secure:
|
||||
image: "redis:7.0.9-alpine"
|
||||
container_name: "redis-secure"
|
||||
hostname: redis-secure
|
||||
restart: unless-stopped
|
||||
command: "redis-server --save 60 1 --loglevel debug --requirepass FIXME"
|
||||
volumes:
|
||||
- redis-secure-data:/data
|
||||
|
||||
redis-insecure:
|
||||
image: "redis:7.0.9-alpine"
|
||||
container_name: "redis-insecure"
|
||||
hostname: redis-unsecure
|
||||
restart: unless-stopped
|
||||
command: "redis-server --save 60 1 --loglevel debug"
|
||||
volumes:
|
||||
- redis-unsecure-data:/data
|
||||
|
||||
volumes:
|
||||
logs-redis:
|
||||
crowdsec-db-redis:
|
||||
crowdsec-config-redis:
|
||||
redis-unsecure-data:
|
||||
redis-secure-data:
|
||||
@@ -4,5 +4,5 @@ go 1.19
|
||||
|
||||
require (
|
||||
github.com/leprosus/golang-ttl-map v1.1.7
|
||||
github.com/maxlerebourg/simpleredis v1.0.6
|
||||
github.com/maxlerebourg/simpleredis v1.0.9
|
||||
)
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
github.com/leprosus/golang-ttl-map v1.1.7 h1:cF4AAFDDnJTFSV+/42sKLhmMluvLdRlCGS2UaifH6UM=
|
||||
github.com/leprosus/golang-ttl-map v1.1.7/go.mod h1:4QWHJPeVBbrkhOhXdhCv9IEiyj/YzkO04/iexy4vSe0=
|
||||
github.com/maxlerebourg/simpleredis v1.0.6 h1:dKd0hgKk7uGKjujWUMuPTVOAONYdlCys5Iqh6w3dOU4=
|
||||
github.com/maxlerebourg/simpleredis v1.0.6/go.mod h1:/DH8zOK6kDskSqoX/m5CJJdNGfkIQZd/ERBJgytDDSk=
|
||||
github.com/maxlerebourg/simpleredis v1.0.9 h1:aj1hKaYPeOVE4Ksu3TV/zsreUDDWOpKXBAvoFysiqII=
|
||||
github.com/maxlerebourg/simpleredis v1.0.9/go.mod h1:/DH8zOK6kDskSqoX/m5CJJdNGfkIQZd/ERBJgytDDSk=
|
||||
|
||||
Vendored
+2
-2
@@ -82,9 +82,9 @@ type Client struct {
|
||||
}
|
||||
|
||||
// New Initialize cache client.
|
||||
func (client *Client) New(isRedis bool, host string, pass string) {
|
||||
func (client *Client) New(isRedis bool, host, pass, database string) {
|
||||
if isRedis {
|
||||
redis.Init(host, pass)
|
||||
redis.Init(host, pass, database)
|
||||
client.cache = &redisCache{}
|
||||
} else {
|
||||
client.cache = &localCache{}
|
||||
|
||||
@@ -32,6 +32,9 @@ type Config struct {
|
||||
Enabled bool `json:"enabled,omitempty"`
|
||||
LogLevel string `json:"logLevel,omitempty"`
|
||||
CrowdsecMode string `json:"crowdsecMode,omitempty"`
|
||||
CrowdsecAppsecEnabled bool `json:"crowdsecAppsecEnabled,omitempty"`
|
||||
CrowdsecAppsecHost string `json:"crowdsecAppsecHost,omitempty"`
|
||||
CrowdsecAppsecFailureBlock bool `json:"crowdsecAppsecFailureBlock,omitempty"`
|
||||
CrowdsecLapiScheme string `json:"crowdsecLapiScheme,omitempty"`
|
||||
CrowdsecLapiHost string `json:"crowdsecLapiHost,omitempty"`
|
||||
CrowdsecLapiKey string `json:"crowdsecLapiKey,omitempty"`
|
||||
@@ -50,13 +53,15 @@ type Config struct {
|
||||
CrowdsecCapiScenarios []string `json:"crowdsecCapiScenarios,omitempty"`
|
||||
UpdateIntervalSeconds int64 `json:"updateIntervalSeconds,omitempty"`
|
||||
DefaultDecisionSeconds int64 `json:"defaultDecisionSeconds,omitempty"`
|
||||
ForwardedHeadersCustomName string `json:"forwardedheaderscustomheader,omitempty"`
|
||||
HTTPTimeoutSeconds int64 `json:"httpTimeoutSeconds,omitempty"`
|
||||
ForwardedHeadersCustomName string `json:"forwardedHeadersCustomHeader,omitempty"`
|
||||
ForwardedHeadersTrustedIPs []string `json:"forwardedHeadersTrustedIps,omitempty"`
|
||||
ClientTrustedIPs []string `json:"clientTrustedIps,omitempty"`
|
||||
RedisCacheEnabled bool `json:"redisCacheEnabled,omitempty"`
|
||||
RedisCacheHost string `json:"redisCacheHost,omitempty"`
|
||||
RedisCachePassword string `json:"redisCachePassword,omitempty"`
|
||||
RedisCachePasswordFile string `json:"redisCachePasswordFile,omitempty"`
|
||||
RedisCacheDatabase string `json:"redisCacheDatabase,omitempty"`
|
||||
}
|
||||
|
||||
func contains(source []string, target string) bool {
|
||||
@@ -74,18 +79,23 @@ func New() *Config {
|
||||
Enabled: false,
|
||||
LogLevel: "INFO",
|
||||
CrowdsecMode: LiveMode,
|
||||
CrowdsecAppsecEnabled: false,
|
||||
CrowdsecAppsecHost: "crowdsec:7422",
|
||||
CrowdsecAppsecFailureBlock: true,
|
||||
CrowdsecLapiScheme: HTTP,
|
||||
CrowdsecLapiHost: "crowdsec:8080",
|
||||
CrowdsecLapiKey: "",
|
||||
CrowdsecLapiTLSInsecureVerify: false,
|
||||
UpdateIntervalSeconds: 60,
|
||||
DefaultDecisionSeconds: 60,
|
||||
HTTPTimeoutSeconds: 10,
|
||||
ForwardedHeadersCustomName: "X-Forwarded-For",
|
||||
ForwardedHeadersTrustedIPs: []string{},
|
||||
ClientTrustedIPs: []string{},
|
||||
RedisCacheEnabled: false,
|
||||
RedisCacheHost: "redis:6379",
|
||||
RedisCachePassword: "",
|
||||
RedisCacheDatabase: "",
|
||||
}
|
||||
}
|
||||
|
||||
@@ -145,13 +155,12 @@ func ValidateParams(config *Config) error {
|
||||
return nil
|
||||
}
|
||||
|
||||
// This only check that the format of the URL scheme:// is correct and do not make requests
|
||||
testURL := url.URL{
|
||||
Scheme: config.CrowdsecLapiScheme,
|
||||
Host: config.CrowdsecLapiHost,
|
||||
if err := validateURL("CrowdsecLapi", config.CrowdsecLapiScheme, config.CrowdsecLapiHost); err != nil {
|
||||
return err
|
||||
}
|
||||
if _, err := http.NewRequest(http.MethodGet, testURL.String(), nil); err != nil {
|
||||
return fmt.Errorf("CrowdsecLapiScheme://CrowdsecLapiHost: '%v://%v' must be an URL", config.CrowdsecLapiScheme, config.CrowdsecLapiHost)
|
||||
|
||||
if err := validateURL("CrowdsecAppsec", config.CrowdsecLapiScheme, config.CrowdsecAppsecHost); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
lapiKey, err := GetVariable(config, "CrowdsecLapiKey")
|
||||
@@ -186,12 +195,21 @@ func ValidateParams(config *Config) error {
|
||||
return nil
|
||||
}
|
||||
|
||||
func validateURL(variable, scheme, host string) error {
|
||||
// This only check that the format of the URL scheme://host is correct and do not make requests
|
||||
testURL := url.URL{Scheme: scheme, Host: host}
|
||||
if _, err := http.NewRequest(http.MethodGet, testURL.String(), nil); err != nil {
|
||||
return fmt.Errorf("CrowdsecLapiScheme://%sHost: '%v://%v' must be an URL", variable, scheme, host)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// validHeaderFieldByte reports whether b is a valid byte in a header
|
||||
// field name. RFC 7230 says:
|
||||
// valid ! # $ % & ' * + - . ^ _ ` | ~ DIGIT ALPHA
|
||||
// See https://httpwg.github.io/specs/rfc7230.html#rule.token.separators
|
||||
func validateParamsAPIKey(lapiKey string) error {
|
||||
reg := regexp.MustCompile("^[a-zA-Z0-9 !#$%&'*+-.^_`|~]*$")
|
||||
reg := regexp.MustCompile("^[a-zA-Z0-9 !#$%&'*+-.^_`|~=/]*$")
|
||||
if !reg.Match([]byte(lapiKey)) {
|
||||
return fmt.Errorf("CrowdsecLapiKey doesn't valid this regexp: '/%s/'", reg.String())
|
||||
}
|
||||
@@ -239,6 +257,7 @@ func validateParamsRequired(config *Config) error {
|
||||
requiredInt := map[string]int64{
|
||||
"UpdateIntervalSeconds": config.UpdateIntervalSeconds,
|
||||
"DefaultDecisionSeconds": config.DefaultDecisionSeconds,
|
||||
"HTTPTimeoutSeconds": config.HTTPTimeoutSeconds,
|
||||
}
|
||||
for key, val := range requiredInt {
|
||||
if val < 1 {
|
||||
|
||||
+1
-1
@@ -9,7 +9,7 @@ import simpleredis "github.com/maxlerebourg/simpleredis"
|
||||
|
||||
var redis simpleredis.SimpleRedis
|
||||
|
||||
redis.Init("redis:6379", "") // redisHost, redisPass
|
||||
redis.Init("redis:6379", "", "") // redisHost, redisPass, redisDatabase
|
||||
|
||||
err := redis.Set("test", []bytes("whatever"), 60), // Set key "test" with "whatever" for 60 seconds
|
||||
if err != nil {
|
||||
|
||||
+41
-32
@@ -18,6 +18,7 @@ const (
|
||||
RedisMiss = "redis:miss"
|
||||
RedisTimeout = "redis:timeout"
|
||||
RedisNoAuth = "redis:noauth"
|
||||
RedisIssue = "redis:issue?"
|
||||
)
|
||||
|
||||
// A redisCmd is used to communicate with redis at low level using commands.
|
||||
@@ -33,6 +34,7 @@ type redisCmd struct {
|
||||
type SimpleRedis struct {
|
||||
host string
|
||||
pass string
|
||||
database string
|
||||
}
|
||||
|
||||
func genRedisArray(params ...[]byte) []byte {
|
||||
@@ -51,25 +53,7 @@ func send(wr *textproto.Writer, method string, data []byte) {
|
||||
}
|
||||
}
|
||||
|
||||
func askRedis(sr *SimpleRedis, cmd redisCmd, channel chan redisCmd) {
|
||||
dialer := net.Dialer{Timeout: 2 * time.Second}
|
||||
conn, err := dialer.Dial("tcp", sr.host)
|
||||
if err != nil {
|
||||
channel <- redisCmd{Error: fmt.Errorf(RedisUnreachable)}
|
||||
return
|
||||
}
|
||||
defer func() {
|
||||
if err := conn.Close(); err != nil {
|
||||
fmt.Printf("redis:connClose %s", err.Error())
|
||||
}
|
||||
}()
|
||||
|
||||
writer := textproto.NewWriter(bufio.NewWriter(conn))
|
||||
reader := textproto.NewReader(bufio.NewReader(conn))
|
||||
|
||||
if sr.pass != "" {
|
||||
data := genRedisArray([]byte("AUTH"), []byte(sr.pass))
|
||||
send(writer, "auth", data)
|
||||
func (sr *SimpleRedis) waitRedis(reader *textproto.Reader, channel chan redisCmd) {
|
||||
for {
|
||||
select {
|
||||
case <-time.After(time.Second * 1):
|
||||
@@ -87,6 +71,33 @@ func askRedis(sr *SimpleRedis, cmd redisCmd, channel chan redisCmd) {
|
||||
}
|
||||
}
|
||||
|
||||
func (sr *SimpleRedis) askRedis(cmd redisCmd, channel chan redisCmd) redisCmd {
|
||||
dialer := net.Dialer{Timeout: 2 * time.Second}
|
||||
conn, err := dialer.Dial("tcp", sr.host)
|
||||
if err != nil {
|
||||
return redisCmd{Error: fmt.Errorf(RedisUnreachable)}
|
||||
}
|
||||
defer func() {
|
||||
if err := conn.Close(); err != nil {
|
||||
fmt.Printf("redis:connClose %s", err.Error())
|
||||
}
|
||||
}()
|
||||
|
||||
writer := textproto.NewWriter(bufio.NewWriter(conn))
|
||||
reader := textproto.NewReader(bufio.NewReader(conn))
|
||||
|
||||
if sr.pass != "" {
|
||||
data := genRedisArray([]byte("AUTH"), []byte(sr.pass))
|
||||
send(writer, "auth", data)
|
||||
sr.waitRedis(reader, channel)
|
||||
}
|
||||
|
||||
if sr.database != "" {
|
||||
data := genRedisArray([]byte("SELECT"), []byte(sr.database))
|
||||
send(writer, "select", data)
|
||||
sr.waitRedis(reader, channel)
|
||||
}
|
||||
|
||||
switch cmd.Command {
|
||||
case "SET":
|
||||
data := genRedisArray([]byte("SET"), []byte(cmd.Name), cmd.Data, []byte("EX"), []byte(fmt.Sprintf("%d", cmd.Duration)))
|
||||
@@ -100,30 +111,29 @@ func askRedis(sr *SimpleRedis, cmd redisCmd, channel chan redisCmd) {
|
||||
for {
|
||||
select {
|
||||
case <-time.After(time.Second * 1):
|
||||
channel <- redisCmd{Error: fmt.Errorf(RedisTimeout)}
|
||||
return
|
||||
return redisCmd{Error: fmt.Errorf(RedisTimeout)}
|
||||
default:
|
||||
read, _ := reader.ReadLineBytes()
|
||||
str := string(read)
|
||||
if strings.Contains(str, "-NOAUTH") {
|
||||
channel <- redisCmd{Error: fmt.Errorf(RedisNoAuth)}
|
||||
return
|
||||
return redisCmd{Error: fmt.Errorf(RedisNoAuth)}
|
||||
} else if str != "$1" {
|
||||
channel <- redisCmd{Error: fmt.Errorf(RedisMiss)}
|
||||
return
|
||||
return redisCmd{Error: fmt.Errorf(RedisMiss)}
|
||||
}
|
||||
read, _ = reader.ReadLineBytes()
|
||||
channel <- redisCmd{Data: read}
|
||||
return
|
||||
return redisCmd{Data: read}
|
||||
|
||||
}
|
||||
}
|
||||
}
|
||||
return redisCmd{Error: fmt.Errorf(RedisIssue)}
|
||||
}
|
||||
|
||||
// Init sets the redisHost used to connect to redis.
|
||||
func (sr *SimpleRedis) Init(host string, pass string) {
|
||||
func (sr *SimpleRedis) Init(host, pass, database string) {
|
||||
sr.host = host
|
||||
sr.pass = pass
|
||||
sr.database = database
|
||||
}
|
||||
|
||||
// Get fetches the value for key name in redis.
|
||||
@@ -133,8 +143,7 @@ func (sr *SimpleRedis) Get(name string) ([]byte, error) {
|
||||
Name: name,
|
||||
}
|
||||
channel := make(chan redisCmd)
|
||||
go askRedis(sr, cmd, channel)
|
||||
resp := <-channel
|
||||
resp := sr.askRedis(cmd, channel)
|
||||
if resp.Error != nil {
|
||||
return nil, resp.Error
|
||||
}
|
||||
@@ -149,7 +158,7 @@ func (sr *SimpleRedis) Set(name string, data []byte, duration int64) error {
|
||||
Data: data,
|
||||
Duration: duration,
|
||||
}
|
||||
go askRedis(sr, cmd, nil)
|
||||
sr.askRedis(cmd, nil)
|
||||
return nil
|
||||
}
|
||||
|
||||
@@ -159,6 +168,6 @@ func (sr *SimpleRedis) Del(name string) error {
|
||||
Command: "DEL",
|
||||
Name: name,
|
||||
}
|
||||
go askRedis(sr, cmd, nil)
|
||||
sr.askRedis(cmd, nil)
|
||||
return nil
|
||||
}
|
||||
|
||||
Vendored
+1
-1
@@ -1,6 +1,6 @@
|
||||
# github.com/leprosus/golang-ttl-map v1.1.7
|
||||
## explicit; go 1.15
|
||||
github.com/leprosus/golang-ttl-map
|
||||
# github.com/maxlerebourg/simpleredis v1.0.6
|
||||
# github.com/maxlerebourg/simpleredis v1.0.9
|
||||
## explicit; go 1.19
|
||||
github.com/maxlerebourg/simpleredis
|
||||
|
||||
Reference in New Issue
Block a user