Kyle Isom
42c7fffc3e
Per-route HTTP-level blocking policies for L7 routes. Two rule types: block_user_agent (substring match against User-Agent, returns 403) and require_header (named header must be present, returns 403). Config: L7Policy struct with type/value fields, added as L7Policies slice on Route. Validated in config (type enum, non-empty value, warning if set on L4 routes). DB: Migration 4 creates l7_policies table with route_id FK (cascade delete), type CHECK constraint, UNIQUE(route_id, type, value). New l7policies.go with ListL7Policies, CreateL7Policy, DeleteL7Policy, GetRouteID. Seed updated to persist policies from config. L7 middleware: PolicyMiddleware in internal/l7/policy.go evaluates rules in order, returns 403 on first match, no-op if empty. Composed into the handler chain between context injection and reverse proxy. Server: L7PolicyRule type on RouteInfo with AddL7Policy/RemoveL7Policy mutation methods on ListenerState. handleL7 threads policies into l7.RouteConfig. Startup loads policies per L7 route from DB. Proto: L7Policy message, repeated l7_policies on Route. Three new RPCs: ListL7Policies, AddL7Policy, RemoveL7Policy. All follow the write-through pattern. Client: L7Policy type, ListL7Policies/AddL7Policy/RemoveL7Policy methods. CLI: mcproxyctl policies list/add/remove subcommands. Tests: 6 PolicyMiddleware unit tests (no policies, UA match/no-match, header present/absent, multiple rules). 4 DB tests (CRUD, cascade, duplicate, GetRouteID). 3 gRPC tests (add+list, remove, validation). 2 end-to-end L7 tests (UA block, required header with allow/deny). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
78 lines
2.2 KiB
Go
78 lines
2.2 KiB
Go
package db
|
|
|
|
import (
|
|
"fmt"
|
|
"strings"
|
|
|
|
"git.wntrmute.dev/kyle/mc-proxy/internal/config"
|
|
)
|
|
|
|
// Seed populates the database from TOML config data. Only called when the
|
|
// database is empty (first run).
|
|
func (s *Store) Seed(listeners []config.Listener, fw config.Firewall) error {
|
|
tx, err := s.db.Begin()
|
|
if err != nil {
|
|
return fmt.Errorf("beginning seed transaction: %w", err)
|
|
}
|
|
defer tx.Rollback()
|
|
|
|
for _, l := range listeners {
|
|
result, err := tx.Exec(
|
|
"INSERT INTO listeners (addr, proxy_protocol, max_connections) VALUES (?, ?, ?)",
|
|
l.Addr, l.ProxyProtocol, l.MaxConnections,
|
|
)
|
|
if err != nil {
|
|
return fmt.Errorf("seeding listener %q: %w", l.Addr, err)
|
|
}
|
|
listenerID, _ := result.LastInsertId()
|
|
|
|
for _, r := range l.Routes {
|
|
mode := r.Mode
|
|
if mode == "" {
|
|
mode = "l4"
|
|
}
|
|
routeResult, err := tx.Exec(
|
|
`INSERT INTO routes (listener_id, hostname, backend, mode, tls_cert, tls_key, backend_tls, send_proxy_protocol)
|
|
VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
|
|
listenerID, strings.ToLower(r.Hostname), r.Backend,
|
|
mode, r.TLSCert, r.TLSKey, r.BackendTLS, r.SendProxyProtocol,
|
|
)
|
|
if err != nil {
|
|
return fmt.Errorf("seeding route %q on listener %q: %w", r.Hostname, l.Addr, err)
|
|
}
|
|
|
|
if len(r.L7Policies) > 0 {
|
|
routeID, _ := routeResult.LastInsertId()
|
|
for _, p := range r.L7Policies {
|
|
if _, err := tx.Exec(
|
|
"INSERT INTO l7_policies (route_id, type, value) VALUES (?, ?, ?)",
|
|
routeID, p.Type, p.Value,
|
|
); err != nil {
|
|
return fmt.Errorf("seeding l7 policy on route %q: %w", r.Hostname, err)
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
for _, ip := range fw.BlockedIPs {
|
|
if _, err := tx.Exec("INSERT INTO firewall_rules (type, value) VALUES ('ip', ?)", ip); err != nil {
|
|
return fmt.Errorf("seeding blocked IP %q: %w", ip, err)
|
|
}
|
|
}
|
|
|
|
for _, cidr := range fw.BlockedCIDRs {
|
|
if _, err := tx.Exec("INSERT INTO firewall_rules (type, value) VALUES ('cidr', ?)", cidr); err != nil {
|
|
return fmt.Errorf("seeding blocked CIDR %q: %w", cidr, err)
|
|
}
|
|
}
|
|
|
|
for _, code := range fw.BlockedCountries {
|
|
if _, err := tx.Exec("INSERT INTO firewall_rules (type, value) VALUES ('country', ?)", strings.ToUpper(code)); err != nil {
|
|
return fmt.Errorf("seeding blocked country %q: %w", code, err)
|
|
}
|
|
}
|
|
|
|
return tx.Commit()
|
|
}
|