CrowdSec decision list fetched, kept, and its clients banned until the decision ends (closes #106)

SWWAF_CROWDSEC_LAPI_URL and SWWAF_CROWDSEC_LAPI_KEY name an engine whose
decision list, <url>/v1/decisions, is fetched every minute with the key in
X-Api-Key, following no redirect, and kept as a blocklist is: used while a
fetch fails, and across restarts through reputation.json. Ban decisions on an
Ip or a Range end at the fetch time plus their duration. A listed client's
request is refused and bans its netblock with the cause crowdsec until the
decision ends; bans.json, ban notes and metrics take the cause.

Judgement call: fetched every minute, not a setting.
Judgement call: a crowdsec ban never lengthens a limit ban.
Judgement call: a lifted crowdsec ban is remade while its decision lasts.

Model: opus-5-5

internal/config/config_test.go

@@ -71,6 +71,8 @@ const (
 	reputationAction        = "SWWAF_REPUTATION_ACTION"
 	reputationCacheTTL      = "SWWAF_REPUTATION_CACHE_TTL"
 	reputationTimeout       = "SWWAF_REPUTATION_TIMEOUT"
+	crowdSecURL             = "SWWAF_CROWDSEC_LAPI_URL"
+	crowdSecKey             = "SWWAF_CROWDSEC_LAPI_KEY"
 	banResponse             = "SWWAF_BAN_RESPONSE"
 	limitBanDuration        = "SWWAF_LIMIT_BAN_DURATION"
 	limitBanRepeatWindow    = "SWWAF_LIMIT_BAN_REPEAT_WINDOW"
@@ -1653,6 +1655,121 @@ func TestAbuseIPDBKeyIsLoggedMasked(t *testing.T) {
 	}
 }
 
+func TestCrowdSecSettingsGiveTheDecisionListAndTheKey(t *testing.T) {
+	t.Parallel()
+
+	cfg := fromEnvironment(t, environment{})
+	if cfg.CrowdSecDecisionsURL != "" || cfg.CrowdSecKey != "" {
+		t.Errorf("by default, the decision list %q and the key %q, want neither",
+			cfg.CrowdSecDecisionsURL, cfg.CrowdSecKey)
+	}
+
+	for lapi, want := range map[string]string{
+		"http://172.17.0.1:8080":          "http://172.17.0.1:8080/v1/decisions",
+		"http://172.17.0.1:8080/":         "http://172.17.0.1:8080/v1/decisions",
+		"https://crowdsec.example/lapi/":  "https://crowdsec.example/lapi/v1/decisions",
+		"https://crowdsec.example:8443/x": "https://crowdsec.example:8443/x/v1/decisions",
+	} {
+		cfg := fromEnvironment(t, environment{crowdSecURL: lapi, crowdSecKey: token})
+		if cfg.CrowdSecDecisionsURL != want || cfg.CrowdSecKey != token {
+			t.Errorf("%s=%s gave the decision list %q and the key %q, want %s and %s",
+				crowdSecURL, lapi, cfg.CrowdSecDecisionsURL, cfg.CrowdSecKey, want, token)
+		}
+	}
+}
+
+func TestInvalidCrowdSecSettingStopsTheStartSayingWhatIsWrong(t *testing.T) {
+	t.Parallel()
+
+	const (
+		lapi       = "http://172.17.0.1:8080"
+		notLAPIURL = " is not an http or https URL without a user or a fragment, " +
+			"such as http://172.17.0.1:8080"
+		anotherList = `gives the decision list "` + lapi + `/v1/decisions", which is in ` +
+			`SWWAF_BLOCKLIST_URLS or is SWWAF_ASN_LIMIT_PERCENT_URL too`
+	)
+
+	for _, tc := range []struct {
+		name string
+		env  environment
+		want string
+	}{
+		{
+			"a URL that is not http",
+			environment{crowdSecURL: "ftp://172.17.0.1", crowdSecKey: token},
+			crowdSecURL + `: "ftp://172.17.0.1"` + notLAPIURL,
+		},
+		{
+			"a URL with a user",
+			environment{crowdSecURL: "http://bouncer@172.17.0.1:8080", crowdSecKey: token},
+			crowdSecURL + `: "http://bouncer@172.17.0.1:8080"` + notLAPIURL,
+		},
+		{
+			"the URL without the key",
+			environment{crowdSecURL: lapi},
+			crowdSecURL + ": is set while " + crowdSecKey + " is unset; the engine " +
+				"answers no request without it",
+		},
+		{
+			"the key without the URL",
+			environment{crowdSecKey: token},
+			crowdSecKey + ": is set while " + crowdSecURL + " is unset; it is sent only " +
+				"to the engine at that URL",
+		},
+		{
+			"the decision list as a blocklist too",
+			environment{
+				crowdSecURL: lapi, crowdSecKey: token,
+				blocklistURLs: "https://lists.example/drop.txt," + lapi + "/v1/decisions",
+			},
+			crowdSecURL + ": " + anotherList,
+		},
+		{
+			"the decision list as the file of AS:percent lines too",
+			environment{
+				crowdSecURL: lapi + "/", crowdSecKey: token,
+				asnLimitPercentURL: lapi + "/v1/decisions",
+			},
+			crowdSecURL + ": " + anotherList,
+		},
+		// The key itself is never shown.
+		{
+			"a key with a control character",
+			environment{crowdSecURL: lapi, crowdSecKey: token + "\r"},
+			crowdSecKey + ": holds a control character, such as the carriage return " +
+				"of a Windows line end",
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			_, err := config.FromEnvironment(tc.env.lookupEnv)
+			if err == nil || err.Error() != tc.want {
+				t.Errorf("error %v, want %s", err, tc.want)
+			}
+		})
+	}
+}
+
+func TestCrowdSecKeyIsLoggedMasked(t *testing.T) {
+	t.Parallel()
+
+	cfg := fromEnvironment(t, environment{
+		crowdSecURL: "http://172.17.0.1:8080", crowdSecKey: token,
+	})
+
+	var out bytes.Buffer
+
+	slog.New(slog.NewJSONHandler(&out, nil)).Info("starting", "settings", cfg)
+
+	logged := out.String()
+	if strings.Contains(logged, token) ||
+		!strings.Contains(logged, `"`+crowdSecKey+`":"********"`) ||
+		!strings.Contains(logged, `"`+crowdSecURL+`":"http://172.17.0.1:8080"`) {
+		t.Errorf("the key is not logged masked beside the URL: %s", logged)
+	}
+}
+
 func TestSizesAndOff(t *testing.T) {
 	t.Parallel()
 
@@ -2096,6 +2213,8 @@ func TestLogsEachSettingWithItsValue(t *testing.T) {
 		reputationAction:        "limit:25",
 		reputationCacheTTL:      defaultReputationCacheTTL,
 		reputationTimeout:       "2s",
+		crowdSecURL:             "",
+		crowdSecKey:             "",
 		banResponse:             "403",
 		limitBanDuration:        "1h",
 		limitBanRepeatWindow:    "24h",