865d513e35
* feat(lib/policy): add support for CEL checkers
This adds the ability for administrators to use Common Expression
Language[0] (CEL) for more advanced check logic than Anubis previously
offered.
These can be as simple as:
```yaml
- name: allow-api-routes
action: ALLOW
expression:
and:
- '!(method == "HEAD" || method == "GET")'
- path.startsWith("/api/")
```
or get as complicated as:
```yaml
- name: allow-git-clients
action: ALLOW
expression:
and:
- userAgent.startsWith("git/") || userAgent.contains("libgit") || userAgent.startsWith("go-git") || userAgent.startsWith("JGit/") || userAgent.startsWith("JGit-")
- >
"Git-Protocol" in headers && headers["Git-Protocol"] == "version=2"
```
Internally these are compiled and evaluated with cel-go[1]. This also
leaves room for extensibility should that be desired in the future. This
will intersect with #338 and eventually intersect with TLS fingerprints
as in #337.
[0]: https://cel.dev/
[1]: https://github.com/google/cel-go
Signed-off-by: Xe Iaso <me@xeiaso.net>
* feat(data/apps): add API route allow rule for non-HEAD/GET
Signed-off-by: Xe Iaso <me@xeiaso.net>
* docs: document expression syntax
Signed-off-by: Xe Iaso <me@xeiaso.net>
* fix: fixes in review
Signed-off-by: Xe Iaso <me@xeiaso.net>
---------
Signed-off-by: Xe Iaso <me@xeiaso.net>
52 lines
1.1 KiB
Go
52 lines
1.1 KiB
Go
package expressions
|
|
|
|
import (
|
|
"net/http"
|
|
"testing"
|
|
|
|
"github.com/google/cel-go/common/types"
|
|
)
|
|
|
|
func TestHTTPHeaders(t *testing.T) {
|
|
headers := HTTPHeaders{
|
|
Header: http.Header{
|
|
"Content-Type": {"application/json"},
|
|
"Cf-Worker": {"true"},
|
|
"User-Agent": {"Go-http-client/2"},
|
|
},
|
|
}
|
|
|
|
t.Run("contains-existing-header", func(t *testing.T) {
|
|
resp := headers.Contains(types.String("User-Agent"))
|
|
if !bool(resp.(types.Bool)) {
|
|
t.Fatal("headers does not contain User-Agent")
|
|
}
|
|
})
|
|
|
|
t.Run("not-contains-missing-header", func(t *testing.T) {
|
|
resp := headers.Contains(types.String("Xxx-Random-Header"))
|
|
if bool(resp.(types.Bool)) {
|
|
t.Fatal("headers does not contain User-Agent")
|
|
}
|
|
})
|
|
|
|
t.Run("get-existing-header", func(t *testing.T) {
|
|
val := headers.Get(types.String("User-Agent"))
|
|
switch val.(type) {
|
|
case types.String:
|
|
// ok
|
|
default:
|
|
t.Fatalf("result was wrong type %T", val)
|
|
}
|
|
})
|
|
|
|
t.Run("not-get-missing-header", func(t *testing.T) {
|
|
val := headers.Get(types.String("Xxx-Random-Header"))
|
|
switch val.(type) {
|
|
case *types.Err:
|
|
// ok
|
|
default:
|
|
t.Fatalf("result was wrong type %T", val)
|
|
}
|
|
})
|
|
}
|