mc/mc-proxy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add L7 policies for user-agent blocking and required headers

Browse Source 
Per-route HTTP-level blocking policies for L7 routes. Two rule types:
block_user_agent (substring match against User-Agent, returns 403)
and require_header (named header must be present, returns 403).

Config: L7Policy struct with type/value fields, added as L7Policies
slice on Route. Validated in config (type enum, non-empty value,
warning if set on L4 routes).

DB: Migration 4 creates l7_policies table with route_id FK (cascade
delete), type CHECK constraint, UNIQUE(route_id, type, value). New
l7policies.go with ListL7Policies, CreateL7Policy, DeleteL7Policy,
GetRouteID. Seed updated to persist policies from config.

L7 middleware: PolicyMiddleware in internal/l7/policy.go evaluates
rules in order, returns 403 on first match, no-op if empty. Composed
into the handler chain between context injection and reverse proxy.

Server: L7PolicyRule type on RouteInfo with AddL7Policy/RemoveL7Policy
mutation methods on ListenerState. handleL7 threads policies into
l7.RouteConfig. Startup loads policies per L7 route from DB.

Proto: L7Policy message, repeated l7_policies on Route. Three new
RPCs: ListL7Policies, AddL7Policy, RemoveL7Policy. All follow the
write-through pattern.

Client: L7Policy type, ListL7Policies/AddL7Policy/RemoveL7Policy
methods. CLI: mcproxyctl policies list/add/remove subcommands.

Tests: 6 PolicyMiddleware unit tests (no policies, UA match/no-match,
header present/absent, multiple rules). 4 DB tests (CRUD, cascade,
duplicate, GetRouteID). 3 gRPC tests (add+list, remove, validation).
2 end-to-end L7 tests (UA block, required header with allow/deny).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Kyle Isom
2026-03-25 17:11:05 -07:00
parent 1ad42dbbee
commit 42c7fffc3e
20 changed files with 1613 additions and 136 deletions
Download Patch File Download Diff File Expand all files Collapse all files

48
proto/mc_proxy/v1/admin.proto
View File

@@ -20,20 +20,31 @@ service ProxyAdminService {
// Connection limits
rpc SetListenerMaxConnections(SetListenerMaxConnectionsRequest) returns (SetListenerMaxConnectionsResponse);
// L7 policies
rpc ListL7Policies(ListL7PoliciesRequest) returns (ListL7PoliciesResponse);
rpc AddL7Policy(AddL7PolicyRequest) returns (AddL7PolicyResponse);
rpc RemoveL7Policy(RemoveL7PolicyRequest) returns (RemoveL7PolicyResponse);
// Status
rpc GetStatus(GetStatusRequest) returns (GetStatusResponse);
}
// Routes
message L7Policy {
string type = 1; // "block_user_agent" or "require_header"
string value = 2;
}
message Route {
string hostname = 1;
string backend = 2;
string mode = 3; // "l4" (default) or "l7"
string tls_cert = 4; // PEM certificate path (L7 only)
string tls_key = 5; // PEM private key path (L7 only)
bool backend_tls = 6; // re-encrypt to backend (L7 only)
bool send_proxy_protocol = 7; // send PROXY v2 header to backend
string mode = 3; // "l4" (default) or "l7"
string tls_cert = 4; // PEM certificate path (L7 only)
string tls_key = 5; // PEM private key path (L7 only)
bool backend_tls = 6; // re-encrypt to backend (L7 only)
bool send_proxy_protocol = 7; // send PROXY v2 header to backend
repeated L7Policy l7_policies = 8; // HTTP-level policies (L7 only)
}
message ListRoutesRequest {
@@ -59,6 +70,33 @@ message RemoveRouteRequest {
message RemoveRouteResponse {}
// L7 Policies
message ListL7PoliciesRequest {
string listener_addr = 1;
string hostname = 2;
}
message ListL7PoliciesResponse {
repeated L7Policy policies = 1;
}
message AddL7PolicyRequest {
string listener_addr = 1;
string hostname = 2;
L7Policy policy = 3;
}
message AddL7PolicyResponse {}
message RemoveL7PolicyRequest {
string listener_addr = 1;
string hostname = 2;
L7Policy policy = 3;
}
message RemoveL7PolicyResponse {}
// Firewall
enum FirewallRuleType {