865d513e35
* feat(lib/policy): add support for CEL checkers
This adds the ability for administrators to use Common Expression
Language[0] (CEL) for more advanced check logic than Anubis previously
offered.
These can be as simple as:
```yaml
- name: allow-api-routes
action: ALLOW
expression:
and:
- '!(method == "HEAD" || method == "GET")'
- path.startsWith("/api/")
```
or get as complicated as:
```yaml
- name: allow-git-clients
action: ALLOW
expression:
and:
- userAgent.startsWith("git/") || userAgent.contains("libgit") || userAgent.startsWith("go-git") || userAgent.startsWith("JGit/") || userAgent.startsWith("JGit-")
- >
"Git-Protocol" in headers && headers["Git-Protocol"] == "version=2"
```
Internally these are compiled and evaluated with cel-go[1]. This also
leaves room for extensibility should that be desired in the future. This
will intersect with #338 and eventually intersect with TLS fingerprints
as in #337.
[0]: https://cel.dev/
[1]: https://github.com/google/cel-go
Signed-off-by: Xe Iaso <me@xeiaso.net>
* feat(data/apps): add API route allow rule for non-HEAD/GET
Signed-off-by: Xe Iaso <me@xeiaso.net>
* docs: document expression syntax
Signed-off-by: Xe Iaso <me@xeiaso.net>
* fix: fixes in review
Signed-off-by: Xe Iaso <me@xeiaso.net>
---------
Signed-off-by: Xe Iaso <me@xeiaso.net>
90 lines
2 KiB
Go
90 lines
2 KiB
Go
package expressions
|
|
|
|
import (
|
|
"errors"
|
|
"testing"
|
|
|
|
"github.com/google/cel-go/cel"
|
|
)
|
|
|
|
func TestJoin(t *testing.T) {
|
|
env, err := NewEnvironment()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
for _, tt := range []struct {
|
|
name string
|
|
clauses []string
|
|
op JoinOperator
|
|
err error
|
|
resultStr string
|
|
}{
|
|
{
|
|
name: "no-clauses",
|
|
clauses: []string{},
|
|
op: JoinAnd,
|
|
err: ErrNoExpressions,
|
|
},
|
|
{
|
|
name: "one-clause-identity",
|
|
clauses: []string{`remoteAddress == "8.8.8.8"`},
|
|
op: JoinAnd,
|
|
err: nil,
|
|
resultStr: `remoteAddress == "8.8.8.8"`,
|
|
},
|
|
{
|
|
name: "multi-clause-and",
|
|
clauses: []string{
|
|
`remoteAddress == "8.8.8.8"`,
|
|
`host == "anubis.techaro.lol"`,
|
|
},
|
|
op: JoinAnd,
|
|
err: nil,
|
|
resultStr: `remoteAddress == "8.8.8.8" && host == "anubis.techaro.lol"`,
|
|
},
|
|
{
|
|
name: "multi-clause-or",
|
|
clauses: []string{
|
|
`remoteAddress == "8.8.8.8"`,
|
|
`host == "anubis.techaro.lol"`,
|
|
},
|
|
op: JoinOr,
|
|
err: nil,
|
|
resultStr: `remoteAddress == "8.8.8.8" || host == "anubis.techaro.lol"`,
|
|
},
|
|
{
|
|
name: "git-user-agent",
|
|
clauses: []string{
|
|
`userAgent.startsWith("git/") || userAgent.contains("libgit")`,
|
|
`"Git-Protocol" in headers && headers["Git-Protocol"] == "version=2"`,
|
|
},
|
|
op: JoinAnd,
|
|
err: nil,
|
|
resultStr: `(userAgent.startsWith("git/") || userAgent.contains("libgit")) && "Git-Protocol" in headers &&
|
|
headers["Git-Protocol"] == "version=2"`,
|
|
},
|
|
} {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
result, err := Join(env, tt.op, tt.clauses...)
|
|
if !errors.Is(err, tt.err) {
|
|
t.Errorf("wanted error %v but got: %v", tt.err, err)
|
|
}
|
|
|
|
if tt.err != nil {
|
|
return
|
|
}
|
|
|
|
program, err := cel.AstToString(result)
|
|
if err != nil {
|
|
t.Fatalf("can't decompile program: %v", err)
|
|
}
|
|
|
|
if tt.resultStr != program {
|
|
t.Logf("wanted: %s", tt.resultStr)
|
|
t.Logf("got: %s", program)
|
|
t.Error("program did not compile as expected")
|
|
}
|
|
})
|
|
}
|
|
}
|