mirror of
https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin.git
synced 2026-09-03 04:28:52 +02:00
mhx
99673b1087
handleStreamTicker compares updateFailure to updateMaxFailure before incrementing it, so with updateMaxFailure 2 and a 1s interval the bouncer gives up on the third consecutive failed poll, roughly 3s after the endpoint starts failing. The check slept 2s and then polled for a 200 for up to 15s, leaving about a second of margin, and once that window closes it never reopens: a runner under load turns this into a 15s wait followed by a failure. Assert the 200 immediately after the endpoint starts failing, which is always inside the window, and keep polling for the 403 that follows.
52 lines
2.2 KiB
Bash
Executable File
52 lines
2.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
HERE="$(cd "$(dirname "$0")" && pwd)"
|
|
# shellcheck source=../../lib/common.sh
|
|
source "$HERE/../../lib/common.sh"
|
|
|
|
SCENARIO=stream-mode
|
|
|
|
body() {
|
|
echo "[$SCENARIO] no decision yet -> request allowed"
|
|
assert_status "http://127.0.0.1:${WEB_PORT}/foo" 200 -H "X-Forwarded-For: 1.2.3.4"
|
|
|
|
echo "[$SCENARIO] adding ban decision for 1.2.3.4 and 10.0.0.0/8"
|
|
lapi_add_decision 1.2.3.4 ban 5m
|
|
lapi_add_decision 10.0.0.0/24 ban 5m
|
|
|
|
echo "[$SCENARIO] banned IP must be blocked once the next stream poll lands (HTTP 403)"
|
|
wait_for_status "http://127.0.0.1:${WEB_PORT}/foo" 403 15 -H "X-Forwarded-For: 1.2.3.4"
|
|
|
|
echo "[$SCENARIO] non-banned IP must still pass (HTTP 200)"
|
|
assert_status "http://127.0.0.1:${WEB_PORT}/foo" 200 -H "X-Forwarded-For: 5.6.7.8"
|
|
|
|
echo "[$SCENARIO] banned IP in CIDR must be blocked once polled (HTTP 403)"
|
|
wait_for_status "http://127.0.0.1:${WEB_PORT}/foo" 403 15 -H "X-Forwarded-For: 10.0.0.1"
|
|
|
|
echo "[$SCENARIO] deleting ban decision for 1.2.3.4 and 10.0.0.0/8"
|
|
lapi_delete_decision 1.2.3.4
|
|
lapi_delete_decision 10.0.0.0/24
|
|
|
|
echo "[$SCENARIO] previously banned IP must pass again once the deletion is polled"
|
|
wait_for_status "http://127.0.0.1:${WEB_PORT}/foo" 200 15 -H "X-Forwarded-For: 1.2.3.4"
|
|
|
|
echo "[$SCENARIO] previously CIDR-banned IP must pass again once deletion is polled"
|
|
wait_for_status "http://127.0.0.1:${WEB_PORT}/foo" 200 15 -H "X-Forwarded-For: 10.0.0.1"
|
|
|
|
echo "[$SCENARIO] making the stream endpoint fail -> bouncer must still pass (updateMaxFailure: 2)"
|
|
lapi_set_stream_fail
|
|
# No sleep: the bouncer gives up on the third failed poll, so at a 1s interval the
|
|
# window where it still serves is ~3s wide and never reopens. Assert inside it.
|
|
assert_status "http://127.0.0.1:${WEB_PORT}/foo" 200 -H "X-Forwarded-For: 8.8.8.8"
|
|
|
|
echo "[$SCENARIO] bouncer must block everything (isStreamHealthy: false)"
|
|
wait_for_status "http://127.0.0.1:${WEB_PORT}/foo" 403 15 -H "X-Forwarded-For: 8.8.8.8"
|
|
|
|
echo "[$SCENARIO] restoring the stream endpoint -> bouncer must recover and pass again"
|
|
lapi_clear_stream_fail
|
|
wait_for_status "http://127.0.0.1:${WEB_PORT}/foo" 200 15 -H "X-Forwarded-For: 8.8.8.8"
|
|
}
|
|
|
|
run_scenario "$SCENARIO" "$HERE" body
|