feat(ip-restriction): Add TCP Support

kong/plugins/ip-restriction/handler.lua

@@ -1,9 +1,11 @@
+local cjson = require "cjson.safe"
 local lrucache = require "resty.lrucache"
 local ipmatcher = require "resty.ipmatcher"
 local kong_meta = require "kong.meta"
 
 
 local ngx_var = ngx.var
+local ngx_req = ngx.req
 local kong = kong
 local error = error
 
@@ -29,6 +31,31 @@ do
 end
 
 
+local is_http_subsystem = ngx.config.subsystem == "http"
+
+
+local do_exit
+if is_http_subsystem then
+  do_exit = function(status, message)
+    return kong.response.error(status, message)
+  end
+else
+  do_exit = function(status, message)
+    local cjson_encode = cjson.encode
+    local tcpsock, err = ngx_req.socket(true)
+    if err then
+      error(err)
+    end
+
+    tcpsock:send(cjson_encode({
+      status  = status,
+      message = message
+    }))
+
+    return ngx.exit()
+  end
+end
+
 local function match_bin(list, binary_remote_addr)
   local matcher, err
 
@@ -52,31 +79,45 @@ local function match_bin(list, binary_remote_addr)
 end
 
 
-function IpRestrictionHandler:access(conf)
+local function handler(conf)
   local binary_remote_addr = ngx_var.binary_remote_addr
   if not binary_remote_addr then
-    return kong.response.error(403, "Cannot identify the client IP address, unix domain sockets are not supported.")
+    local status = 403
+    local message = "Cannot identify the client IP address, unix domain sockets are not supported."
+
+    do_exit(status, message)
   end
 
   local deny = conf.deny
   local allow = conf.allow
   local status = conf.status or 403
-  local message = conf.message or "Your IP address is not allowed"
+  local default_message = string.format("IP address not allowed: %s", binary_remote_addr)
+  local message = conf.message or default_message
 
   if not isempty(deny) then
     local blocked = match_bin(deny, binary_remote_addr)
     if blocked then
-      return kong.response.error(status, message)
+      do_exit(status, message)
     end
   end
 
   if not isempty(allow) then
     local allowed = match_bin(allow, binary_remote_addr)
     if not allowed then
-      return kong.response.error(status, message)
+      do_exit(status, message)
     end
   end
 end
 
 
+function IpRestrictionHandler:access(conf)
+  return handler(conf)
+end
+
+
+function IpRestrictionHandler:preread(conf)
+  return handler(conf)
+end
+
+
 return IpRestrictionHandler

kong/plugins/ip-restriction/schema.lua

@@ -4,7 +4,7 @@ local typedefs = require "kong.db.schema.typedefs"
 return {
   name = "ip-restriction",
   fields = {
-    { protocols = typedefs.protocols_http },
+    { protocols = typedefs.protocols { default = { "http", "https", "tcp", "tls", "grpc", "grpcs" } }, },
     { config = {
         type = "record",
         fields = {

spec/03-plugins/17-ip-restriction/02-access_spec.lua

@@ -248,7 +248,7 @@ for _, strategy in helpers.each_strategy() do
         })
         local body = assert.res_status(403, res)
         local json = cjson.decode(body)
-        assert.same({ message = "Your IP address is not allowed" }, json)
+        assert.is_true(string.find(json, "IP address not allowed"))
       end)
 
       it("blocks a request when the IP is denied with status/message", function()
@@ -310,7 +310,7 @@ for _, strategy in helpers.each_strategy() do
         })
         local body = assert.res_status(403, res)
         local json = cjson.decode(body)
-        assert.same({ message = "Your IP address is not allowed" }, json)
+        assert.is_true(string.find(json, "IP address not allowed"))
       end)
       it("blocks an IP on a allowed CIDR range", function()
         local res = assert(proxy_client:send {
@@ -322,7 +322,7 @@ for _, strategy in helpers.each_strategy() do
         })
         local body = assert.res_status(403, res)
         local json = cjson.decode(body)
-        assert.same({ message = "Your IP address is not allowed" }, json)
+        assert.is_true(string.find(json, "IP address not allowed"))
       end)
       it("takes precedence over an allowed IP", function()
         local res = assert(proxy_client:send {
@@ -334,7 +334,7 @@ for _, strategy in helpers.each_strategy() do
         })
         local body = assert.res_status(403, res)
         local json = cjson.decode(body)
-        assert.same({ message = "Your IP address is not allowed" }, json)
+        assert.is_true(string.find(json, "IP address not allowed"))
       end)
       it("takes precedence over an allowed CIDR range", function()
         local res = assert(proxy_client:send {
@@ -346,7 +346,7 @@ for _, strategy in helpers.each_strategy() do
         })
         local body = assert.res_status(403, res)
         local json = cjson.decode(body)
-        assert.same({ message = "Your IP address is not allowed" }, json)
+        assert.is_true(string.find(json, "IP address not allowed"))
       end)
 
       describe("X-Forwarded-For", function()
@@ -386,7 +386,7 @@ for _, strategy in helpers.each_strategy() do
           })
           local body = assert.res_status(403, res)
           local json = cjson.decode(body)
-          assert.same({ message = "Your IP address is not allowed" }, json)
+          assert.is_true(string.find(json, "IP address not allowed"))
         end)
       end)
     end)
@@ -402,7 +402,7 @@ for _, strategy in helpers.each_strategy() do
         })
         local body = assert.res_status(403, res)
         local json = cjson.decode(body)
-        assert.same({ message = "Your IP address is not allowed" }, json)
+        assert.is_true(string.find(json, "IP address not allowed"))
       end)
       it("allows a allowed IP", function()
         local res = assert(proxy_client:send {
@@ -426,7 +426,7 @@ for _, strategy in helpers.each_strategy() do
           })
           local body = assert.res_status(403, res)
           local json = cjson.decode(body)
-          assert.same({ message = "Your IP address is not allowed" }, json)
+          assert.is_true(string.find(json, "IP address not allowed"))
         end)
         it("block with not allowed X-Forwarded-For header", function()
           local res = assert(proxy_client:send {
@@ -439,7 +439,7 @@ for _, strategy in helpers.each_strategy() do
           })
           local body = assert.res_status(403, res)
           local json = cjson.decode(body)
-          assert.same({ message = "Your IP address is not allowed" }, json)
+          assert.is_true(string.find(json, "IP address not allowed"))
         end)
         it("block with not allowed X-Forwarded-For header #grpc", function()
           local ok, err = helpers.proxy_client_grpc(){
@@ -522,7 +522,7 @@ for _, strategy in helpers.each_strategy() do
       })
       local body = assert.res_status(403, res)
       local json = cjson.decode(body)
-      assert.same({ message = "Your IP address is not allowed" }, json)
+      assert.is_true(string.find(json, "IP address not allowed"))
 
       res = assert(admin_client:send {
         method  = "PATCH",
@@ -722,7 +722,7 @@ for _, strategy in helpers.each_strategy() do
         })
         local body = assert.res_status(403, res)
         local json = cjson.decode(body)
-        assert.same({ message = "Your IP address is not allowed" }, json)
+        assert.is_true(string.find(json, "IP address not allowed"))
       end)
       it("allows a request when the IPv6 is not denied", function()
         local res = assert(proxy_client:send {
@@ -748,7 +748,7 @@ for _, strategy in helpers.each_strategy() do
         })
         local body = assert.res_status(403, res)
         local json = cjson.decode(body)
-        assert.same({ message = "Your IP address is not allowed" }, json)
+        assert.is_true(string.find(json, "IP address not allowed"))
       end)
       it("blocks an IPv6 on a allowed IPv6 CIDR range", function()
         local res = assert(proxy_client:send {
@@ -761,7 +761,7 @@ for _, strategy in helpers.each_strategy() do
         })
         local body = assert.res_status(403, res)
         local json = cjson.decode(body)
-        assert.same({ message = "Your IP address is not allowed" }, json)
+        assert.is_true(string.find(json, "IP address not allowed"))
       end)
       it("takes precedence over an allowed IPv6", function()
         local res = assert(proxy_client:send {
@@ -774,7 +774,7 @@ for _, strategy in helpers.each_strategy() do
         })
         local body = assert.res_status(403, res)
         local json = cjson.decode(body)
-        assert.same({ message = "Your IP address is not allowed" }, json)
+        assert.is_true(string.find(json, "IP address not allowed"))
       end)
       it("takes precedence over an allowed IPv6 CIDR range", function()
         local res = assert(proxy_client:send {
@@ -786,7 +786,7 @@ for _, strategy in helpers.each_strategy() do
         })
         local body = assert.res_status(403, res)
         local json = cjson.decode(body)
-        assert.same({ message = "Your IP address is not allowed" }, json)
+        assert.is_true(string.find(json, "IP address not allowed"))
       end)
     end)
 
@@ -802,7 +802,7 @@ for _, strategy in helpers.each_strategy() do
         })
         local body = assert.res_status(403, res)
         local json = cjson.decode(body)
-        assert.same({ message = "Your IP address is not allowed" }, json)
+        assert.is_true(string.find(json, "IP address not allowed"))
       end)
       it("allows a allowed IPv6", function()
         local res = assert(proxy_client:send {
@@ -865,7 +865,7 @@ for _, strategy in helpers.each_strategy() do
       })
       local body = assert.res_status(403, res)
       local json = cjson.decode(body)
-      assert.same({ message = "Your IP address is not allowed" }, json)
+      assert.is_true(string.find(json, "IP address not allowed"))
 
       res = assert(admin_client:send {
         method  = "PATCH",
@@ -1002,7 +1002,7 @@ for _, strategy in helpers.each_strategy() do
         })
         local body = assert.res_status(403, res)
         local json = cjson.decode(body)
-        assert.same({ message = "Your IP address is not allowed" }, json)
+        assert.is_true(string.find(json, "IP address not allowed"))
       end)
       it("blocks with blocked complex X-Forwarded-For header", function()
         local res = assert(proxy_client:send {
@@ -1015,7 +1015,7 @@ for _, strategy in helpers.each_strategy() do
         })
         local body = assert.res_status(403, res)
         local json = cjson.decode(body)
-        assert.same({ message = "Your IP address is not allowed" }, json)
+        assert.is_true(string.find(json, "IP address not allowed"))
       end)
       it("allows with allowed complex X-Forwarded-For header", function()
         local res = assert(proxy_client:send {
@@ -1044,7 +1044,7 @@ for _, strategy in helpers.each_strategy() do
         })
         local body = assert.res_status(403, res)
         local json = cjson.decode(body)
-        assert.same({ message = "Your IP address is not allowed" }, json)
+        assert.is_true(string.find(json, "IP address not allowed"))
       end)
       it("allows with allowed X-Forwarded-For header", function()
         local res = assert(proxy_client:send {
@@ -1083,7 +1083,7 @@ for _, strategy in helpers.each_strategy() do
         })
         local body = assert.res_status(403, res)
         local json = cjson.decode(body)
-        assert.same({ message = "Your IP address is not allowed" }, json)
+        assert.is_true(string.find(json, "IP address not allowed"))
       end)
     end)
   end)