mirror of
https://github.com/TecharoHQ/anubis.git
synced 2026-05-15 03:09:36 +00:00
Xe Iaso
276b537776
* fix(policy): correctly wire subrequest mode through CEL/path checkers Previously Anubis only checked for the X-Original-Url when using subrequest mode. This header is used by the example nginx config to pass the request path through from the original client request to Anubis in order to do path-based filtering. According to facts and circumstances, Traefik hardcodes its own headers[1]: ```text httpdebug-1 | GET /.within.website/x/cmd/anubis/api/check httpdebug-1 | X-Forwarded-Method: GET httpdebug-1 | X-Forwarded-Proto: http httpdebug-1 | X-Forwarded-Server: b9a5d299c929 httpdebug-1 | X-Forwarded-Port: 8080 httpdebug-1 | X-Forwarded-Uri: / httpdebug-1 | X-Real-Ip: 172.18.0.1 httpdebug-1 | Accept-Encoding: gzip httpdebug-1 | User-Agent: curl/8.20.0 httpdebug-1 | Accept: */* httpdebug-1 | X-Forwarded-For: 172.18.0.1 httpdebug-1 | X-Forwarded-Host: localhost:8080 ``` As a result, this means that path-based filtering did not work. This commit fixes this issue by amending how path based checking logic works: * For CEL based checks, this pipes through the `subrequestMode` flag from main and alters the behaviour if either `X-Original-Url` or `X-Forwarded-Url` are found. These values are currently hardcoded for convenience but probably need to be made configurable in the policy file at a future date. * For path-based checks, this uses the existing `subrequestMode` flag from main and adds `X-Forwarded-Url` to the list of headers it checks. A smoke test was added to make sure that traefik in this mode continues to work. Thank you https://github.com/flifloo for filing a detailed issue with the relevant configuration fragments. Those configuration fragments formed the core of this smoke test. [1]: https://doc.traefik.io/traefik/v3.4/middlewares/http/forwardauth/ Closes: https://github.com/TecharoHQ/anubis/issues/1628 Signed-off-by: Xe Iaso <me@xeiaso.net> Co-Authored-By: flifloo <flifloo@gmail.com> * chore: spelling Signed-off-by: Xe Iaso <me@xeiaso.net> --------- Signed-off-by: Xe Iaso <me@xeiaso.net> Co-authored-by: flifloo <flifloo@gmail.com>
100 lines
2.2 KiB
Go
100 lines
2.2 KiB
Go
package policy
|
|
|
|
import (
|
|
"fmt"
|
|
"net/http"
|
|
|
|
"github.com/TecharoHQ/anubis/internal"
|
|
"github.com/TecharoHQ/anubis/internal/dns"
|
|
"github.com/TecharoHQ/anubis/lib/config"
|
|
"github.com/TecharoHQ/anubis/lib/policy/expressions"
|
|
"github.com/google/cel-go/cel"
|
|
"github.com/google/cel-go/common/types"
|
|
)
|
|
|
|
type CELChecker struct {
|
|
program cel.Program
|
|
src string
|
|
subRequestMode bool
|
|
}
|
|
|
|
func NewCELChecker(cfg *config.ExpressionOrList, dnsObj *dns.Dns, subRequestMode bool) (*CELChecker, error) {
|
|
env, err := expressions.BotEnvironment(dnsObj)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
program, err := expressions.Compile(env, cfg.String())
|
|
if err != nil {
|
|
return nil, fmt.Errorf("can't compile CEL program: %w", err)
|
|
}
|
|
|
|
return &CELChecker{
|
|
src: cfg.String(),
|
|
program: program,
|
|
subRequestMode: subRequestMode,
|
|
}, nil
|
|
}
|
|
|
|
func (cc *CELChecker) Hash() string {
|
|
return internal.FastHash(cc.src)
|
|
}
|
|
|
|
func (cc *CELChecker) Check(r *http.Request) (bool, error) {
|
|
result, _, err := cc.program.ContextEval(r.Context(), &CELRequest{r, cc.subRequestMode})
|
|
|
|
if err != nil {
|
|
return false, err
|
|
}
|
|
|
|
if val, ok := result.(types.Bool); ok {
|
|
return bool(val), nil
|
|
}
|
|
|
|
return false, nil
|
|
}
|
|
|
|
type CELRequest struct {
|
|
*http.Request
|
|
subRequestMode bool
|
|
}
|
|
|
|
func (cr *CELRequest) Parent() cel.Activation { return nil }
|
|
|
|
func (cr *CELRequest) ResolveName(name string) (any, bool) {
|
|
switch name {
|
|
case "remoteAddress":
|
|
return cr.Header.Get("X-Real-Ip"), true
|
|
case "contentLength":
|
|
return cr.ContentLength, true
|
|
case "host":
|
|
return cr.Host, true
|
|
case "method":
|
|
return cr.Method, true
|
|
case "userAgent":
|
|
return cr.UserAgent(), true
|
|
case "path":
|
|
if cr.subRequestMode {
|
|
if xou := cr.Header.Get("X-Original-URI"); xou != "" {
|
|
return xou, true
|
|
}
|
|
if xfu := cr.Header.Get("X-Forwarded-Uri"); xfu != "" {
|
|
return xfu, true
|
|
}
|
|
}
|
|
return cr.URL.Path, true
|
|
case "query":
|
|
return expressions.URLValues{Values: cr.URL.Query()}, true
|
|
case "headers":
|
|
return expressions.HTTPHeaders{Header: cr.Header}, true
|
|
case "load_1m":
|
|
return expressions.Load1(), true
|
|
case "load_5m":
|
|
return expressions.Load5(), true
|
|
case "load_15m":
|
|
return expressions.Load15(), true
|
|
default:
|
|
return nil, false
|
|
}
|
|
}
|