A kong plugin which uses a kubernetes CRD

[cybercoder]

I've planned a Kong WAF plugin using go lang.

package main

import (
	"context"
	"fmt"
	"log"
	"os"
	"sync"

	"github.com/Kong/go-pdk"
	"github.com/Kong/go-pdk/server"
	"github.com/corazawaf/coraza/v3"
	"github.com/corazawaf/coraza/v3/types"
	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/runtime/schema"
	"k8s.io/client-go/dynamic"
	"k8s.io/client-go/rest"
	"k8s.io/client-go/tools/clientcmd"
)

const PluginName = "corakong"

var Version = "0.0.1"
var Priority = 1

type Config struct {
	Namespace string `json:"namespace"`
	Gateway   string `json:"gateway"`
}

func New() interface{} {
	return &Config{}
}

var (
	dynamicClient *dynamic.DynamicClient
	once          sync.Once
	gvr           = schema.GroupVersionResource{
		Group:    "waf.ik8s.ir",
		Version:  "v1alpha1",
		Resource: "wafrules",
	}
)

func main() {
	once.Do(func() {
		config, err := createConfig()
		if err != nil {
			log.Fatalf("Error creating config: %v", err)
		}

		dynamicClient, err = dynamic.NewForConfig(config)
		if err != nil {
			log.Fatalf("Error creating dynamic client: %v\n", err)
		}
	})

	err := server.StartServer(New, Version, Priority)
	if err != nil {
		log.Fatalf("Failed start %s plugin", PluginName)
	}
}

func (conf Config) Access(kong *pdk.PDK) {
	kong.Log.Debug("asghar is here")
	// directives := `SecDebugLogLevel 9
	// SecDebugLog /dev/stdout

	// SecRule ARGS:id "@eq 0" "id:1, phase:1,deny, status:403,msg:'Invalid id',log,auditlog"

	// SecRequestBodyAccess On
	// SecRule REQUEST_BODY "@contains password" "id:100, phase:2,deny, status:403,msg:'Invalid request body',log,auditlog"`

	// List custom resource items with specific gateway
	options := v1.ListOptions{
		LabelSelector: "gateway=" + conf.Gateway,
	}

	items, err := dynamicClient.Resource(gvr).Namespace(conf.Namespace).List(context.Background(), options)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Error listing custom resource items: %v\n", err)
		// os.Exit(1)
	}

	directives := ""
	for _, item := range items.Items {
		// Convert unstructured object to map[string]interface{}
		obj := item.Object
		spec, ok := obj["spec"].(map[string]interface{})
		if !ok {
			continue
		}

		// Check if enabled=true
		enabled, ok := spec["enabled"].(bool)
		if !ok || !enabled {
			continue
		}

		// Get and print rule value
		rule, ok := spec["rule"].(string)
		if !ok {
			continue
		}
		directives += rule + "\n"
	}

	fmt.Println(directives)

	waf := createWaf(directives)
	tx := waf.NewTransaction()
	defer func() {
		tx.ProcessLogging()
		tx.Close()
	}()
	p, err1 := processRequest(tx, kong)
	if err1 != nil {
		kong.Log.Debug(err1)
		kong.Log.Err(err1)
		kong.Response.Exit(403, nil, nil)
	}
	fmt.Printf("%v \n", p)
}

func createWaf(rules string) coraza.WAF {
	waf, err := coraza.NewWAF(coraza.NewWAFConfig().WithDirectives(rules))
	if err != nil {
		log.Fatal(err)
	}
	return waf
}

func processRequest(tx types.Transaction, kong *pdk.PDK) (*types.Interruption, error) {

	client, _ := kong.Client.GetIp()
	cport, _ := kong.Client.GetPort()
	fmt.Println(client, cport)

	// There is no socket access in the request object, so we neither know the server client nor port.
	tx.ProcessConnection(client, cport, "", 0)

	scheme, _ := kong.Request.GetScheme()
	host, _ := kong.Request.GetHeader("host")
	path, _ := kong.Request.GetPathWithQuery()
	url := fmt.Sprintf("%s://%s%s", scheme, host, path)
	fmt.Println(url)
	method, _ := kong.Request.GetMethod()
	httpver, _ := kong.Request.GetHttpVersion()
	tx.ProcessURI(url, method, fmt.Sprintf("%f", httpver))
	headers, _ := kong.Request.GetHeaders(-1)

	for k, vr := range headers {
		for _, v := range vr {
			tx.AddRequestHeader(k, v)
		}
	}

	if host != "" {
		tx.AddRequestHeader("Host", host)
		// This connector relies on the host header (now host field) to populate ServerName
		tx.SetServerName(host)
	}

	if client != "" {
		fmt.Println("Adding Client address to the http header")
		tx.AddRequestHeader("X-Forwarded-For", client)
		tx.AddRequestHeader("REMOTE_ADDR", client)
		tx.AddRequestHeader("X-Real-IP", client)
	}

	in := tx.ProcessRequestHeaders()
	if in != nil {
		return in, nil
	}
	return tx.ProcessRequestBody()
}

func createConfig() (*rest.Config, error) {
	configFile := "/home/kong/.kube/config"
	_, err := os.Stat(configFile)
	if err != nil {
		return rest.InClusterConfig()
	}
	return clientcmd.BuildConfigFromFlags("", configFile)
}

The only fetchee directive is SecRule REMOTE_ADDR "@ipMatch 172.16.220.11" "id:1000,phase:1,log,deny"

But it seems it's not blocking.

The log:

SecRule REMOTE_ADDR "@ipMatch 172.16.220.11" "id:1000,phase:1,log,deny"

client: 172.16.220.11 cport: 56762
http://test.cdn.example.com:8000/

&{1000 deny 0 }

What's the problem? Doesn't ProcessConnection includes phase 1 ?

[jptosso]

Hey! Phase 1 is processed during ProcessRequestHeaders

[cybercoder]

Hi, I have added X-Forwarded-For , X-Real-IP. But it passes!

[jptosso]

Coraza is not aware of that header. That has to be part a manual part of your implementation. We only trust ProcessConnection. Then you can overwrite the ip address using the RemoteAddr.Set method
This is by design

[cybercoder]

So this sec rule

SecRule REMOTE_ADDR "@ipMatch 172.16.220.11" "id:1000,phase:1,log,deny"

Won't work, because it's in phase 1, yes?
What is the correct rule?

[cybercoder]

There was a logical bug in my code, and have fixed.

https://github.com/ik8s-ir/corakong