Canithesis/checkpoint
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

rules: add support for resource excludes

Browse Source
This commit is contained in:
Vaxry
2025-04-15 14:49:29 +01:00
parent 15689ca20a
commit 50fbc7f5ac
7 changed files with 36 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/config/Config.cpp
View File

@@ -5,6 +5,8 @@
#include "../helpers/FsUtils.hpp"
#include "../GlobalState.hpp"
#include "../debug/log.hpp"
static CConfig::eConfigIPAction strToAction(const std::string& s) {
// TODO: allow any case I'm lazy it's 1am
if (s == "ALLOW" || s == "allow" || s == "Allow")
@@ -32,6 +34,14 @@ CConfig::CConfig() {
parsed.action = strToAction(ic.action);
parsed.difficulty = ic.difficulty;
if (!ic.exclude_regex.empty()) {
parsed.exclude_regex = std::make_unique<re2::RE2>(ic.exclude_regex);
if (parsed.exclude_regex->error_code() != RE2::NoError) {
Debug::log(CRIT, "Regex \"{}\" failed to parse", ic.exclude_regex);
throw std::runtime_error("Failed to parse regex");
}
}
for (const auto& ir : ic.ip_ranges) {
parsed.ip_ranges.emplace_back(CIPRange(ir));
}

12
src/config/Config.hpp
View File

@@ -3,6 +3,8 @@
#include <string>
#include <memory>
#include <re2/re2.h>
#include "IPRange.hpp"
class CConfig {
@@ -18,13 +20,15 @@ class CConfig {
struct SIPRangeConfig {
std::string action = "";
std::vector<std::string> ip_ranges;
int difficulty = -1;
int difficulty = -1;
std::string exclude_regex = "";
};
struct SIPRangeConfigParsed {
eConfigIPAction action = IP_ACTION_DENY;
std::vector<CIPRange> ip_ranges;
int difficulty = -1;
eConfigIPAction action = IP_ACTION_DENY;
std::vector<CIPRange> ip_ranges;
int difficulty = -1;
std::unique_ptr<re2::RE2> exclude_regex;
};
struct SConfig {

11
src/core/Handler.cpp
View File

@@ -243,6 +243,15 @@ void CServerHandler::onRequest(const Pistache::Http::Request& req, Pistache::Htt
}
if (matched) {
if (ic.difficulty != -1)
challengeDifficulty = ic.difficulty;
// if we have an exclude regex and it matches the resource, skip this rule
if (ic.exclude_regex && RE2::FullMatch(req.resource(), *ic.exclude_regex)) {
Debug::log(LOG, " | ip rule matched for {}, but resource is excluded.", REQUEST_IP);
continue;
}
if (ic.action == CConfig::IP_ACTION_ALLOW) {
Debug::log(LOG, " | Action: PASS (ip rule matched for {})", REQUEST_IP);
proxyPass(req, response);
@@ -254,8 +263,6 @@ void CServerHandler::onRequest(const Pistache::Http::Request& req, Pistache::Htt
}
// if it's challenge then it's default so just set the difficulty if applicable and proceed
if (ic.difficulty != -1)
challengeDifficulty = ic.difficulty;
break;
}
}