Giters

maxlerebourg / crowdsec-bouncer-traefik-plugin

Traefik plugin for Crowdsec - WAF and IP protection

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

[BUG] CrowdsecAppsecFailureBlock false should also not block when crowdsec is down

trunneml opened this issue · comments

commented

Describe the bug 🐛
Setting CrowdsecAppsecFailureBlock to false works for 500, but if a connection to crowdsec is not possible crowdsec-bouncer-traefik-plugin still returns 403

Expected behavior 👀
When crowdsec api is not available and CrowdsecAppsecFailureBlock is set to false Traefik should just work as normal.

To Reproduce
Steps to reproduce the behavior:

  1. Configure crowdsec-bouncer-traefik-plugin with CrowdsecAppsecFailureBlock set to false
  2. Stop crowdsec
  3. Try to open a service behinde Traefik
  4. See error
commented

Hi we'll look into it.
In the mean time could you provide some informations like the version of the plugin, runtime (docker, kubernetes, binary, vm..).

commented

Hey @trunneml
I looked into the code, the CrowdsecAppsecFailureBlock: false handle the appsec response status code 500 only. We followed the protocol from Crowdsec to implement our plugin.

I don't know if it's smart to totally bypass our plugin when crowdsec is unreachable.

We could add a new variable CrowdsecAppsecUnreachableBlock to handle this case, and by default is true.

What do you think ?

commented

An extra flag fixes my problem.
Background: Croudsec LAPI is in an different network segment.