Skip to content

Commit 6a43a8c

Browse files
membphismembphis
authored
feature: implemented plugin uri-blocklist . (#1727)
first step: #1617
1 parent 748e337 commit 6a43a8c

File tree

10 files changed

+460
-5
lines changed

10 files changed

+460
-5
lines changed

‎README.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,8 @@ A/B testing, canary release, blue-green deployment, limit rate, defense against
9090
- [Limit-count](doc/plugins/limit-count.md)
9191
- [Limit-concurrency](doc/plugins/limit-conn.md)
9292
- Anti-ReDoS(Regular expression Denial of Service): Built-in policies to Anti ReDoS without configuration.
93-
- [CORS](doc/plugins/cors.md)
93+
- [CORS](doc/plugins/cors.md) Enable CORS(Cross-origin resource sharing) for your API.
94+
- [uri-blocker](plugins/uri-blocker.md): Block client request by URI.
9495

9596
- **OPS friendly**
9697
- OpenTracing: support [Apache Skywalking](doc/plugins/skywalking.md) and [Zipkin](doc/plugins/zipkin.md)

‎README_CN.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,8 @@ A/B 测试、金丝雀发布(灰度发布)、蓝绿部署、限流限速、抵
9090
- [限制请求数](doc/zh-cn/plugins/limit-count.md)
9191
- [限制并发](doc/zh-cn/plugins/limit-conn.md)
9292
- 防御 ReDoS(正则表达式拒绝服务)：内置策略，无需配置即可抵御 ReDoS。
93-
- [CORS](doc/zh-cn/plugins/cors.md)
93+
- [CORS](doc/zh-cn/plugins/cors.md)：为你的API启用 CORS。
94+
- [uri-blocker](plugins/uri-blocker.md)：根据 URI 拦截用户请求。
9495

9596
- **运维友好**
9697
- OpenTracing 可观测性: 支持 [Apache Skywalking](doc/zh-cn/plugins/skywalking.md) 和 [Zipkin](doc/zh-cn/plugins/zipkin.md)。

‎apisix/plugins/uri-blocker.lua‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
--
2+
-- Licensed to the Apache Software Foundation (ASF) under one or more
3+
-- contributor license agreements. See the NOTICE file distributed with
4+
-- this work for additional information regarding copyright ownership.
5+
-- The ASF licenses this file to You under the Apache License, Version 2.0
6+
-- (the "License"); you may not use this file except in compliance with
7+
-- the License. You may obtain a copy of the License at
8+
--
9+
-- http://www.apache.org/licenses/LICENSE-2.0
10+
--
11+
-- Unless required by applicable law or agreed to in writing, software
12+
-- distributed under the License is distributed on an "AS IS" BASIS,
13+
-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
-- See the License for the specific language governing permissions and
15+
-- limitations under the License.
16+
--
17+
local core = require("apisix.core")
18+
local re_compile = require("resty.core.regex").re_match_compile
19+
local re_find = ngx.re.find
20+
local ipairs = ipairs
21+
22+
local schema = {
23+
type = "object",
24+
properties = {
25+
block_rules = {
26+
type = "array",
27+
items = {
28+
type = "string",
29+
minLength = 1,
30+
maxLength = 4096,
31+
},
32+
uniqueItems = true
33+
},
34+
rejected_code = {
35+
type = "integer",
36+
minimum = 200,
37+
default = 403
38+
},
39+
},
40+
required = {"block_rules"},
41+
}
42+
43+
44+
local plugin_name = "uri-blocker"
45+
46+
local _M = {
47+
version = 0.1,
48+
priority = 2900,
49+
name = plugin_name,
50+
schema = schema,
51+
}
52+
53+
54+
function _M.check_schema(conf)
55+
local ok, err = core.schema.check(schema, conf)
56+
if not ok then
57+
return false, err
58+
end
59+
60+
local block_rules = {}
61+
for i, re_rule in ipairs(conf.block_rules) do
62+
local ok, err = re_compile(re_rule, "j")
63+
-- core.log.warn("ok: ", tostring(ok), " err: ", tostring(err), " re_rule: ", re_rule)
64+
if not ok then
65+
return false, err
66+
end
67+
block_rules[i] = re_rule
68+
end
69+
70+
conf.block_rules_concat = core.table.concat(block_rules, "|")
71+
core.log.info("concat block_rules: ", conf.block_rules_concat)
72+
return true
73+
end
74+
75+
76+
function _M.rewrite(conf, ctx)
77+
core.log.info("uri: ", ctx.var.request_uri)
78+
core.log.info("block uri rules: ", conf.block_rules_concat)
79+
local from = re_find(ctx.var.request_uri, conf.block_rules_concat, "jo")
80+
if from then
81+
core.response.exit(conf.rejected_code)
82+
end
83+
end
84+
85+
86+
return _M

‎conf/config.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@ apisix:
9595
ssl_ciphers: "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA"
9696
key_encrypt_salt: "edd1c9f0985e76a2" # If not set, will save origin ssl key into etcd.
9797
# If set this, must be a string of length 16. And it will encrypt ssl key with AES-128-CBC
98-
# !!! So do not change it after saving your ssl, it can't decrypt the ssl keys have be saved if you change !!
98+
# !!! So do not change it after saving your ssl, it can't decrypt the ssl keys have be saved if you change !!
9999
# discovery: eureka # service discovery center
100100
nginx_config: # config for render the template to genarate nginx.conf
101101
error_log: "logs/error.log"
@@ -168,6 +168,7 @@ plugins: # plugin list
168168
- skywalking
169169
- echo
170170
- authz-keycloak
171+
- uri-blocker
171172

172173
stream_plugins:
173174
- mqtt-proxy

‎doc/README.md‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,10 +65,12 @@ Plugins
6565
* [kafka-logger](plugins/kafka-logger.md): Log requests to External Kafka servers.
6666
* [cors](plugins/cors.md): Enable CORS(Cross-origin resource sharing) for your API.
6767
* [batch-requests](plugins/batch-requests.md): Allow you send mutiple http api via **http pipeline**.
68-
* [authz-keycloak](plugins/authz-keycloak.md): Authorization with Keycloak Identity Server
68+
* [authz-keycloak](plugins/authz-keycloak.md): Authorization with Keycloak Identity Server.
69+
* [uri-blocker](plugins/uri-blocker.md): Block client request by URI.
6970

7071
Deploy to the Cloud
7172
=======
73+
7274
### AWS
7375

7476
The recommended approach is to deploy APISIX with [AWS CDK](https://aws.amazon.com/cdk/) on [AWS Fargate](https://aws.amazon.com/fargate/) which helps you decouple the APISIX layer and the upstream layer on top of a fully-managed and secure serverless container compute environment with autoscaling capabilities.

‎doc/plugins/uri-blocker.md‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
<!--
2+
#
3+
# Licensed to the Apache Software Foundation (ASF) under one or more
4+
# contributor license agreements. See the NOTICE file distributed with
5+
# this work for additional information regarding copyright ownership.
6+
# The ASF licenses this file to You under the Apache License, Version 2.0
7+
# (the "License"); you may not use this file except in compliance with
8+
# the License. You may obtain a copy of the License at
9+
#
10+
# http://www.apache.org/licenses/LICENSE-2.0
11+
#
12+
# Unless required by applicable law or agreed to in writing, software
13+
# distributed under the License is distributed on an "AS IS" BASIS,
14+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
# See the License for the specific language governing permissions and
16+
# limitations under the License.
17+
#
18+
-->
19+
20+
[Chinese](uri-blocker.md)
21+
22+
# Summary
23+
24+
- [**Name**](#name)
25+
- [**Attributes**](#attributes)
26+
- [**How To Enable**](#how-to-enable)
27+
- [**Test Plugin**](#test-plugin)
28+
- [**Disable Plugin**](#disable-plugin)
29+
30+
## Name
31+
32+
The plugin helps we intercept user requests, we only need to indicate the `block_rules`.
33+
34+
## Attributes
35+
36+
|Name |Requirement |Description|
37+
|--------- |--------|-----------|
38+
|block_rules |required|Regular filter rule array. Each of these items is a regular rule. If the current request URI hits any one of them, set the response code to rejected_code to exit the current user request. Example: `["root.exe", "root.m+"]`.|
39+
|rejected_code |optional|The HTTP status code returned when the request URI hit any of `filter_rule`, default `403`.|
40+
41+
## How To Enable
42+
43+
Here's an example, enable the `uri blocker` plugin on the specified route:
44+
45+
```shell
46+
curl -i http://127.0.0.1:9080/apisix/admin/routes/1 -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
47+
{
48+
"uri": "/*",
49+
"plugins": {
50+
"uri-blocker": {
51+
"block_rules": ["root.exe", "root.m+"]
52+
}
53+
},
54+
"upstream": {
55+
"type": "roundrobin",
56+
"nodes": {
57+
"127.0.0.1:1980": 1
58+
}
59+
}
60+
}'
61+
```
62+
63+
## Test Plugin
64+
65+
```shell
66+
$ curl -i http://127.0.0.1:9080/root.exe?a=a
67+
HTTP/1.1 403 Forbidden
68+
Date: Wed, 17 Jun 2020 13:55:41 GMT
69+
Content-Type: text/html; charset=utf-8
70+
Content-Length: 150
71+
Connection: keep-alive
72+
Server: APISIX web server
73+
74+
... ...
75+
```
76+
77+
## Disable Plugin
78+
79+
When you want to disable the `uri blocker` plugin, it is very simple,
80+
you can delete the corresponding json configuration in the plugin configuration,
81+
no need to restart the service, it will take effect immediately:
82+
83+
```shell
84+
curl http://127.0.0.1:9080/apisix/admin/routes/1 -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
85+
{
86+
"uri": "/*",
87+
"upstream": {
88+
"type": "roundrobin",
89+
"nodes": {
90+
"127.0.0.1:1980": 1
91+
}
92+
}
93+
}'
94+
```
95+
96+
The `uri blocker` plugin has been disabled now. It works for other plugins.

‎doc/zh-cn/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,3 +67,4 @@ Reference document
6767
* [cors](plugins/cors.md): 为你的API启用 CORS
6868
* [batch-requests](plugins/batch-requests.md): 以 **http pipeline** 的方式在网关一次性发起多个 `http` 请求。
6969
* [authz-keycloak](plugins/authz-keycloak-cn.md): 支持 Keycloak 身份认证服务器
70+
* [uri-blocker](plugins/uri-blocker.md): 根据 URI 拦截用户请求。

‎t/admin/plugins.t‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ __DATA__
3030
--- request
3131
GET /apisix/admin/plugins/list
3232
--- response_body_like eval
33-
qr/\["limit-req","limit-count","limit-conn","key-auth","basic-auth","prometheus","node-status","jwt-auth","zipkin","ip-restriction","grpc-transcode","serverless-pre-function","serverless-post-function","openid-connect","proxy-rewrite","redirect","response-rewrite","fault-injection","udp-logger","wolf-rbac","proxy-cache","tcp-logger","proxy-mirror","kafka-logger","cors","consumer-restriction","syslog","batch-requests","http-logger","skywalking","echo","authz-keycloak"\]/
33+
qr/\["limit-req","limit-count","limit-conn","key-auth","basic-auth","prometheus","node-status","jwt-auth","zipkin","ip-restriction","grpc-transcode","serverless-pre-function","serverless-post-function","openid-connect","proxy-rewrite","redirect","response-rewrite","fault-injection","udp-logger","wolf-rbac","proxy-cache","tcp-logger","proxy-mirror","kafka-logger","cors","consumer-restriction","syslog","batch-requests","http-logger","skywalking","echo","authz-keycloak","uri-blocker"\]/
3434
--- no_error_log
3535
[error]
3636

‎t/debug/debug-mode.t‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,7 @@ loaded plugin and sort by priority: 10000 name: serverless-pre-function
6060
loaded plugin and sort by priority: 4010 name: batch-requests
6161
loaded plugin and sort by priority: 4000 name: cors
6262
loaded plugin and sort by priority: 3000 name: ip-restriction
63+
loaded plugin and sort by priority: 2900 name: uri-blocker
6364
loaded plugin and sort by priority: 2599 name: openid-connect
6465
loaded plugin and sort by priority: 2555 name: wolf-rbac
6566
loaded plugin and sort by priority: 2520 name: basic-auth

0 commit comments

Comments
 (0)