From 73c27677bd671f66e95e973758b8078e1d36802a Mon Sep 17 00:00:00 2001 From: Gerhard Poul Date: Tue, 22 Dec 2020 08:58:53 +0100 Subject: [PATCH 1/2] Add a ClientVPN connection handler request/response definition (#343) * Add initial event structure and test for Client VPN * Add ClientVPN connection handler sample to README * Refactor to perform early return * Output IP addresses with %q instead of %s and change ErrorMsgOnFailedPostureCompliance message Co-authored-by: Gerhard Poul --- events/README.md | 2 + events/README_ClientVPN.md | 56 +++++++++++++++++++ events/clientvpn.go | 20 +++++++ events/clientvpn_test.go | 36 ++++++++++++ .../clientvpn-connectionhandler-request.json | 11 ++++ 5 files changed, 125 insertions(+) create mode 100644 events/README_ClientVPN.md create mode 100644 events/clientvpn.go create mode 100644 events/clientvpn_test.go create mode 100644 events/testdata/clientvpn-connectionhandler-request.json diff --git a/events/README.md b/events/README.md index 5c3ccdc9..1b43082e 100644 --- a/events/README.md +++ b/events/README.md @@ -12,6 +12,8 @@ This package provides input types for Lambda functions that process AWS events. [AppSync](README_AppSync.md) +[ClientVPN Connection Handler](README_ClientVPN.md) + [CloudFormation Events](../cfn/README.md) [CloudWatch Events](README_CloudWatch_Events.md) diff --git a/events/README_ClientVPN.md b/events/README_ClientVPN.md new file mode 100644 index 00000000..bd139b4d --- /dev/null +++ b/events/README_ClientVPN.md @@ -0,0 +1,56 @@ +# Sample Function + +The following is a sample Lambda function that receives a Client VPN connection handler request as an input and then validates the IP address input and checks whether the connection source IP is on the allowed list defined as a map inside the function. If the source IP matches an allowed IP address it allows the access, otherwise an error message is presented to the user. Debug logs are generated to CloudWatch Logs. (Note that by default anything written to Console will be logged as CloudWatch Logs events.) + +```go +import ( + "fmt" + "log" + "net" + + "encoding/json" + + "github.com/aws/aws-lambda-go/events" + "github.com/aws/aws-lambda-go/lambda" +) + +var ( + AllowedIPs = map[string]bool{ + "10.11.12.13": true, + } +) + +func handler(request events.ClientVPNConnectionHandlerRequest) (events.ClientVPNConnectionHandlerResponse, error) { + requestJson, _ := json.MarshalIndent(request, "", " ") + log.Printf("REQUEST: %s", requestJson) + + sourceIP := request.PublicIP + if net.ParseIP(sourceIP) == nil { + return events.ClientVPNConnectionHandlerResponse{}, fmt.Errorf("Invalid parameter PublicIP passed in request: %q", sourceIP) + } + + log.Printf("SOURCE IP: %q", sourceIP) + + if allowed, ok := AllowedIPs[sourceIP]; ok && allowed { + log.Printf("Allowing access from: %q", sourceIP) + return events.ClientVPNConnectionHandlerResponse{ + Allow: true, + ErrorMsgOnFailedPostureCompliance: "", + PostureComplianceStatuses: []string{}, + SchemaVersion: "v1", + }, nil + } + + log.Printf("Blocking access from: %q", sourceIP) + return events.ClientVPNConnectionHandlerResponse{ + Allow: false, + ErrorMsgOnFailedPostureCompliance: "You're trying to connect from an IP address that is not allowed.", + PostureComplianceStatuses: []string{"BlockedSourceIP"}, + SchemaVersion: "v1", + }, nil +} + +func main() { + lambda.Start(handler) +} +``` diff --git a/events/clientvpn.go b/events/clientvpn.go new file mode 100644 index 00000000..af763d00 --- /dev/null +++ b/events/clientvpn.go @@ -0,0 +1,20 @@ +package events + +type ClientVPNConnectionHandlerRequest struct { + ConnectionID string `json:"connection-id"` + EndpointID string `json:"endpoint-id"` + CommonName string `json:"common-name"` + Username string `json:"username"` + OSPlatform string `json:"platform"` + OSPlatformVersion string `json:"platform-version"` + PublicIP string `json:"public-ip"` + ClientOpenVPNVersion string `json:"client-openvpn-version"` + SchemaVersion string `json:"schema-version"` +} + +type ClientVPNConnectionHandlerResponse struct { + Allow bool `json:"allow"` + ErrorMsgOnFailedPostureCompliance string `json:"error-msg-on-failed-posture-compliance"` + PostureComplianceStatuses []string `json:"posture-compliance-statuses"` + SchemaVersion string `json:"schema-version"` +} diff --git a/events/clientvpn_test.go b/events/clientvpn_test.go new file mode 100644 index 00000000..356790ab --- /dev/null +++ b/events/clientvpn_test.go @@ -0,0 +1,36 @@ +package events + +import ( + "encoding/json" + "io/ioutil" + "testing" + + "github.com/aws/aws-lambda-go/events/test" + "github.com/stretchr/testify/assert" +) + +func TestClientVPNConnectionHandlerRequestMarshaling(t *testing.T) { + // read json from file + inputJSON, err := ioutil.ReadFile("./testdata/clientvpn-connectionhandler-request.json") + if err != nil { + t.Errorf("could not open test file. details: %v", err) + } + + // de-serialize into ClientVPNConnectionHandlerRequest + var inputEvent ClientVPNConnectionHandlerRequest + if err := json.Unmarshal(inputJSON, &inputEvent); err != nil { + t.Errorf("could not unmarshal event. details: %v", err) + } + + // serialize to json + outputJSON, err := json.Marshal(inputEvent) + if err != nil { + t.Errorf("could not marshal event. details: %v", err) + } + + assert.JSONEq(t, string(inputJSON), string(outputJSON)) +} + +func TestClientVPNConnectionHandlerRequestMarshalingMalformedJson(t *testing.T) { + test.TestMalformedJson(t, ClientVPNConnectionHandlerRequest{}) +} diff --git a/events/testdata/clientvpn-connectionhandler-request.json b/events/testdata/clientvpn-connectionhandler-request.json new file mode 100644 index 00000000..cc09cf69 --- /dev/null +++ b/events/testdata/clientvpn-connectionhandler-request.json @@ -0,0 +1,11 @@ +{ + "connection-id": "cvpn-connection-04e7e1b2f0daf9460", + "endpoint-id": "cvpn-endpoint-0f13eab7f860433cc", + "common-name": "", + "username": "username", + "platform": "", + "platform-version": "", + "public-ip": "10.11.12.13", + "client-openvpn-version": "", + "schema-version": "v1" +} From 70e75f4ede5bf4c2b3cfd12b9c028aa319b6aeb0 Mon Sep 17 00:00:00 2001 From: Ichinose Shogo Date: Tue, 22 Dec 2020 17:23:47 +0900 Subject: [PATCH 2/2] introduce reviewdog (#314) * introduce reviewdog * remove push trigger * revert changes of lint.yml * re-introduce reviewdog Co-authored-by: Bryan Moffatt --- .github/workflows/reviewdog.yml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) create mode 100644 .github/workflows/reviewdog.yml diff --git a/.github/workflows/reviewdog.yml b/.github/workflows/reviewdog.yml new file mode 100644 index 00000000..05944aef --- /dev/null +++ b/.github/workflows/reviewdog.yml @@ -0,0 +1,17 @@ +name: reviewdog +on: + pull_request: + +jobs: + test: + name: lint + runs-on: ubuntu-latest + steps: + - name: Check out code into the Go module directory + uses: actions/checkout@v2 + + - name: golangci-lint + uses: reviewdog/action-golangci-lint@v1 + with: + level: warning + reporter: github-pr-review