mirror of
https://github.com/TecharoHQ/anubis.git
synced 2025-09-08 12:15:28 -04:00

* feat(lib/policy): add support for CEL checkers This adds the ability for administrators to use Common Expression Language[0] (CEL) for more advanced check logic than Anubis previously offered. These can be as simple as: ```yaml - name: allow-api-routes action: ALLOW expression: and: - '!(method == "HEAD" || method == "GET")' - path.startsWith("/api/") ``` or get as complicated as: ```yaml - name: allow-git-clients action: ALLOW expression: and: - userAgent.startsWith("git/") || userAgent.contains("libgit") || userAgent.startsWith("go-git") || userAgent.startsWith("JGit/") || userAgent.startsWith("JGit-") - > "Git-Protocol" in headers && headers["Git-Protocol"] == "version=2" ``` Internally these are compiled and evaluated with cel-go[1]. This also leaves room for extensibility should that be desired in the future. This will intersect with #338 and eventually intersect with TLS fingerprints as in #337. [0]: https://cel.dev/ [1]: https://github.com/google/cel-go Signed-off-by: Xe Iaso <me@xeiaso.net> * feat(data/apps): add API route allow rule for non-HEAD/GET Signed-off-by: Xe Iaso <me@xeiaso.net> * docs: document expression syntax Signed-off-by: Xe Iaso <me@xeiaso.net> * fix: fixes in review Signed-off-by: Xe Iaso <me@xeiaso.net> --------- Signed-off-by: Xe Iaso <me@xeiaso.net>
63 lines
1.3 KiB
Go
63 lines
1.3 KiB
Go
package config
|
|
|
|
import (
|
|
"encoding/json"
|
|
"errors"
|
|
"slices"
|
|
)
|
|
|
|
var (
|
|
ErrExpressionOrListMustBeStringOrObject = errors.New("config: this must be a string or an object")
|
|
ErrExpressionEmpty = errors.New("config: this expression is empty")
|
|
ErrExpressionCantHaveBoth = errors.New("config: expression block can't contain multiple expression types")
|
|
)
|
|
|
|
type ExpressionOrList struct {
|
|
Expression string `json:"-"`
|
|
All []string `json:"all"`
|
|
Any []string `json:"any"`
|
|
}
|
|
|
|
func (eol ExpressionOrList) Equal(rhs *ExpressionOrList) bool {
|
|
if eol.Expression != rhs.Expression {
|
|
return false
|
|
}
|
|
|
|
if !slices.Equal(eol.All, rhs.All) {
|
|
return false
|
|
}
|
|
|
|
if !slices.Equal(eol.Any, rhs.Any) {
|
|
return false
|
|
}
|
|
|
|
return true
|
|
}
|
|
|
|
func (eol *ExpressionOrList) UnmarshalJSON(data []byte) error {
|
|
switch string(data[0]) {
|
|
case `"`: // string
|
|
return json.Unmarshal(data, &eol.Expression)
|
|
case "{": // object
|
|
type RawExpressionOrList ExpressionOrList
|
|
var val RawExpressionOrList
|
|
if err := json.Unmarshal(data, &val); err != nil {
|
|
return err
|
|
}
|
|
eol.All = val.All
|
|
eol.Any = val.Any
|
|
|
|
return nil
|
|
}
|
|
|
|
return ErrExpressionOrListMustBeStringOrObject
|
|
}
|
|
|
|
func (eol *ExpressionOrList) Valid() error {
|
|
if len(eol.All) != 0 && len(eol.Any) != 0 {
|
|
return ErrExpressionCantHaveBoth
|
|
}
|
|
|
|
return nil
|
|
}
|