mirror of
https://github.com/TecharoHQ/anubis.git
synced 2025-08-04 02:08:59 -04:00
865d513e35
* feat(lib/policy): add support for CEL checkers
This adds the ability for administrators to use Common Expression
Language[0] (CEL) for more advanced check logic than Anubis previously
offered.
These can be as simple as:
```yaml
- name: allow-api-routes
action: ALLOW
expression:
and:
- '!(method == "HEAD" || method == "GET")'
- path.startsWith("/api/")
```
or get as complicated as:
```yaml
- name: allow-git-clients
action: ALLOW
expression:
and:
- userAgent.startsWith("git/") || userAgent.contains("libgit") || userAgent.startsWith("go-git") || userAgent.startsWith("JGit/") || userAgent.startsWith("JGit-")
- >
"Git-Protocol" in headers && headers["Git-Protocol"] == "version=2"
```
Internally these are compiled and evaluated with cel-go[1]. This also
leaves room for extensibility should that be desired in the future. This
will intersect with #338 and eventually intersect with TLS fingerprints
as in #337.
[0]: https://cel.dev/
[1]: https://github.com/google/cel-go
Signed-off-by: Xe Iaso <me@xeiaso.net>
* feat(data/apps): add API route allow rule for non-HEAD/GET
Signed-off-by: Xe Iaso <me@xeiaso.net>
* docs: document expression syntax
Signed-off-by: Xe Iaso <me@xeiaso.net>
* fix: fixes in review
Signed-off-by: Xe Iaso <me@xeiaso.net>
---------
Signed-off-by: Xe Iaso <me@xeiaso.net>
105 lines
2.4 KiB
Go
105 lines
2.4 KiB
Go
package expressions
|
|
|
|
import (
|
|
"errors"
|
|
"fmt"
|
|
"strings"
|
|
|
|
"github.com/google/cel-go/cel"
|
|
)
|
|
|
|
// JoinOperator is a type wrapper for and/or operators.
|
|
//
|
|
// This is a separate type so that validation can be done at the type level.
|
|
type JoinOperator string
|
|
|
|
// Possible values for JoinOperator
|
|
const (
|
|
JoinAnd JoinOperator = "&&"
|
|
JoinOr JoinOperator = "||"
|
|
)
|
|
|
|
// Valid ensures that JoinOperator is semantically valid.
|
|
func (jo JoinOperator) Valid() error {
|
|
switch jo {
|
|
case JoinAnd, JoinOr:
|
|
return nil
|
|
default:
|
|
return ErrWrongJoinOperator
|
|
}
|
|
}
|
|
|
|
var (
|
|
ErrWrongJoinOperator = errors.New("expressions: invalid join operator")
|
|
ErrNoExpressions = errors.New("expressions: cannot join zero expressions")
|
|
ErrCantCompile = errors.New("expressions: can't compile one expression")
|
|
)
|
|
|
|
// JoinClauses joins a list of compiled clauses into one big if statement.
|
|
//
|
|
// Imagine the following two clauses:
|
|
//
|
|
// ball.color == "red"
|
|
// ball.shape == "round"
|
|
//
|
|
// JoinClauses would emit one "joined" clause such as:
|
|
//
|
|
// ( ball.color == "red" ) && ( ball.shape == "round" )
|
|
func JoinClauses(env *cel.Env, operator JoinOperator, clauses ...*cel.Ast) (*cel.Ast, error) {
|
|
if err := operator.Valid(); err != nil {
|
|
return nil, fmt.Errorf("%w: wanted && or ||, got: %q", err, operator)
|
|
}
|
|
|
|
switch len(clauses) {
|
|
case 0:
|
|
return nil, ErrNoExpressions
|
|
case 1:
|
|
return clauses[0], nil
|
|
}
|
|
|
|
var exprs []string
|
|
var errs []error
|
|
|
|
for _, clause := range clauses {
|
|
clauseStr, err := cel.AstToString(clause)
|
|
if err != nil {
|
|
errs = append(errs, err)
|
|
continue
|
|
}
|
|
|
|
exprs = append(exprs, "( "+clauseStr+" )")
|
|
}
|
|
|
|
if len(errs) != 0 {
|
|
return nil, fmt.Errorf("errors while decompiling statements: %w", errors.Join(errs...))
|
|
}
|
|
|
|
statement := strings.Join(exprs, " "+string(operator)+" ")
|
|
result, iss := env.Compile(statement)
|
|
if iss != nil {
|
|
return nil, iss.Err()
|
|
}
|
|
|
|
return result, nil
|
|
}
|
|
|
|
func Join(env *cel.Env, operator JoinOperator, clauses ...string) (*cel.Ast, error) {
|
|
var statements []*cel.Ast
|
|
var errs []error
|
|
|
|
for _, clause := range clauses {
|
|
stmt, iss := env.Compile(clause)
|
|
if iss != nil && iss.Err() != nil {
|
|
errs = append(errs, fmt.Errorf("%w: %q gave: %w", ErrCantCompile, clause, iss.Err()))
|
|
continue
|
|
}
|
|
statements = append(statements, stmt)
|
|
}
|
|
|
|
if len(errs) != 0 {
|
|
return nil, fmt.Errorf("errors while joining clauses: %w", errors.Join(errs...))
|
|
}
|
|
|
|
return JoinClauses(env, operator, statements...)
|
|
}
|