feat(ip-restriction): Add TCP Support

kong/plugins/ip-restriction/handler.lua

@@ -1,3 +1,4 @@
+local cjson = require "cjson.safe"
 local lrucache = require "resty.lrucache"
 local ipmatcher = require "resty.ipmatcher"
 local kong_meta = require "kong.meta"
@@ -52,31 +53,67 @@ local function match_bin(list, binary_remote_addr)
 end
 
 
-function IpRestrictionHandler:access(conf)
+local function do_exit(status, message, is_http)
+  if is_http then
+    return kong.response.error(status, message)
+
+  else
+    local tcpsock, err = ngx.req.socket(true)
+    if err then
+      error(err)
+    end
+
+    local response = cjson.encode({
+      status  = status,
+      message = message
+    })
+
+    tcpsock:send(response)
+
+    return ngx.exit()
+  end
+end
+
+
+local function handler(conf, is_http)
   local binary_remote_addr = ngx_var.binary_remote_addr
   if not binary_remote_addr then
-    return kong.response.error(403, "Cannot identify the client IP address, unix domain sockets are not supported.")
+    local status = 403
+    local message = "Cannot identify the client IP address, unix domain sockets are not supported."
+
+    do_exit(status, message, is_http)
   end
 
   local deny = conf.deny
   local allow = conf.allow
   local status = conf.status or 403
-  local message = conf.message or "Your IP address is not allowed"
+  local default_message = string.format("IP address not allowed: %s", binary_remote_addr)
+  local message = conf.message or default_message
 
   if not isempty(deny) then
     local blocked = match_bin(deny, binary_remote_addr)
     if blocked then
-      return kong.response.error(status, message)
+      do_exit(status, message, is_http)
     end
   end
 
   if not isempty(allow) then
     local allowed = match_bin(allow, binary_remote_addr)
     if not allowed then
-      return kong.response.error(status, message)
+      do_exit(status, message, is_http)
     end
   end
 end
 
 
+function IpRestrictionHandler:access(conf)
+  return handler(conf, true)
+end
+
+
+function IpRestrictionHandler:preread(conf)
+  return handler(conf, false)
+end
+
+
 return IpRestrictionHandler

kong/plugins/ip-restriction/schema.lua

@@ -4,7 +4,7 @@ local typedefs = require "kong.db.schema.typedefs"
 return {
   name = "ip-restriction",
   fields = {
-    { protocols = typedefs.protocols_http },
+    { protocols = typedefs.protocols { default = { "http", "https", "tcp", "tls", "grpc", "grpcs" } }, },
     { config = {
         type = "record",
         fields = {