Canithesis/checkpoint
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

rules: add exclude actions

Browse Source
This commit is contained in:
Vaxry
2025-04-15 14:54:26 +01:00
parent 50fbc7f5ac
commit 871284672c
4 changed files with 30 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
example/config.jsonc
View File

@@ -34,8 +34,9 @@
"127.0.0.1/24", "127.0.0.1/24",
"::1/128" "::1/128"
], ],
// if this regex matches the resource requested, this rule will not be applied // if this regex matches the resource requested, a different rule will be applied
"exclude_regex": ".*/commit/.*" "exclude_regex": ".*/commit/.*",
"action_on_exclude": "DENY"
} }
] ]
} }

7
src/config/Config.cpp
View File

@@ -9,6 +9,9 @@
static CConfig::eConfigIPAction strToAction(const std::string& s) { static CConfig::eConfigIPAction strToAction(const std::string& s) {
// TODO: allow any case I'm lazy it's 1am // TODO: allow any case I'm lazy it's 1am
if (s.empty())
return CConfig::IP_ACTION_NONE;
if (s == "ALLOW" || s == "allow" || s == "Allow") if (s == "ALLOW" || s == "allow" || s == "Allow")
return CConfig::IP_ACTION_ALLOW; return CConfig::IP_ACTION_ALLOW;
if (s == "Deny" || s == "deny" || s == "Deny") if (s == "Deny" || s == "deny" || s == "Deny")
@@ -16,7 +19,8 @@ static CConfig::eConfigIPAction strToAction(const std::string& s) {
if (s == "CHALLENGE" || s == "challenge" || s == "Challenge") if (s == "CHALLENGE" || s == "challenge" || s == "Challenge")
return CConfig::IP_ACTION_CHALLENGE; return CConfig::IP_ACTION_CHALLENGE;
throw std::runtime_error("Invalid ip config action"); Debug::log(ERR, "Invalid action: {}, assuming NONE", s);
return CConfig::IP_ACTION_NONE;
} }
CConfig::CConfig() { CConfig::CConfig() {
@@ -33,6 +37,7 @@ CConfig::CConfig() {
SIPRangeConfigParsed parsed; SIPRangeConfigParsed parsed;
parsed.action = strToAction(ic.action); parsed.action = strToAction(ic.action);
parsed.difficulty = ic.difficulty; parsed.difficulty = ic.difficulty;
parsed.action_on_exclude = strToAction(ic.action_on_exclude);
if (!ic.exclude_regex.empty()) { if (!ic.exclude_regex.empty()) {
parsed.exclude_regex = std::make_unique<re2::RE2>(ic.exclude_regex); parsed.exclude_regex = std::make_unique<re2::RE2>(ic.exclude_regex);

5
src/config/Config.hpp
View File

@@ -12,7 +12,8 @@ class CConfig {
CConfig(); CConfig();
enum eConfigIPAction : uint8_t { enum eConfigIPAction : uint8_t {
IP_ACTION_DENY = 0, IP_ACTION_NONE = 0,
IP_ACTION_DENY,
IP_ACTION_ALLOW, IP_ACTION_ALLOW,
IP_ACTION_CHALLENGE IP_ACTION_CHALLENGE
}; };
@@ -22,6 +23,7 @@ class CConfig {
std::vector<std::string> ip_ranges; std::vector<std::string> ip_ranges;
int difficulty = -1; int difficulty = -1;
std::string exclude_regex = ""; std::string exclude_regex = "";
std::string action_on_exclude = "";
}; };
struct SIPRangeConfigParsed { struct SIPRangeConfigParsed {
@@ -29,6 +31,7 @@ class CConfig {
std::vector<CIPRange> ip_ranges; std::vector<CIPRange> ip_ranges;
int difficulty = -1; int difficulty = -1;
std::unique_ptr<re2::RE2> exclude_regex; std::unique_ptr<re2::RE2> exclude_regex;
eConfigIPAction action_on_exclude = IP_ACTION_NONE;
}; };
struct SConfig { struct SConfig {

14
src/core/Handler.cpp
View File

@@ -248,7 +248,19 @@ void CServerHandler::onRequest(const Pistache::Http::Request& req, Pistache::Htt
// if we have an exclude regex and it matches the resource, skip this rule // if we have an exclude regex and it matches the resource, skip this rule
if (ic.exclude_regex && RE2::FullMatch(req.resource(), *ic.exclude_regex)) { if (ic.exclude_regex && RE2::FullMatch(req.resource(), *ic.exclude_regex)) {
Debug::log(LOG, " | ip rule matched for {}, but resource is excluded.", REQUEST_IP); if (ic.action_on_exclude == CConfig::IP_ACTION_ALLOW) {
Debug::log(LOG, " | Action: PASS (ip rule matched for {}, excluded resource, exclude action is PASS)", REQUEST_IP);
proxyPass(req, response);
return;
} else if (ic.action_on_exclude == CConfig::IP_ACTION_DENY) {
Debug::log(LOG, " | Action: DENY (ip rule matched for {}, excluded resource, exclude action is DENY)", REQUEST_IP);
response.send(Pistache::Http::Code::Forbidden, "Forbidden");
return;
} else if (ic.action_on_exclude == CConfig::IP_ACTION_CHALLENGE) {
Debug::log(LOG, " | ip rule matched for {}, excluded resource, exclude action is CHALLENGE", REQUEST_IP);
break;
}
Debug::log(LOG, " | ip rule matched for {}, excluded resource, exclude action is NONE", REQUEST_IP);
continue; continue;
} }