Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enrich policy input #540

Merged
merged 7 commits into from
May 24, 2024
Merged

Enrich policy input #540

merged 7 commits into from
May 24, 2024

Conversation

mostafa
Copy link
Member

@mostafa mostafa commented May 23, 2024

Ticket(s)

Closes #462.

Description

This PR adds hook information to the policy Input data. This adds yet another piece of information that can be leveraged by policies with better granularity. These are now passed to the policies:

  1. Hook.Name: the name of the plugin hook that was run and received the Act signals.
  2. Hook.Priority: the priority of the plugin hook. This shows at which point from the top of the list of registered hook the plugin hook was called from.
  3. Hook.Params: the parameters passed to the plugin hook.
  4. Hook.Result: the result of running the plugin hook. This is usually a superset of the Hook.Params, because the plugin hook must return the same request that was passed to it by the Hook.Params.

This feature will work with all the future signals, policies and actions and will enable a lot of interesting use cases. For example, these initial scenarios and policies can be written after merging this PR:

  1. The current terminate policy can be updated to check for IP address of the incoming client or outgoing connection to the database. The example below means that terminating the request only happens if the request isn't coming from 127.0.0.1 (localhost). Note that the trafficData internal help function injects these values into the parameters that are passed to the plugin hook.
    policies:
      - name: terminate
        policy: |
          Signal.terminate == true &&
          Policy.terminate == 'stop' &&
          split(Hook.Params.client.remote, ':')[0] != '127.0.0.1'
        metadata:
          terminate: "stop"
  2. We might want to terminate a request, but only log an audit trail (as an error) if the request doesn't come from an specific IP address:
    policies:
      - name: log
        policy: |
          Signal.log == true &&
          Policy.log == 'log' &&
          split(Hook.Params.client.remote, ':')[0] != '192.168.0.1'
        metadata:
          log: "log"

TODO

Related PRs

Development Checklist

  • I have added a descriptive title to this PR.
  • I have squashed related commits together.
  • I have rebased my branch on top of the latest main branch.
  • I have performed a self-review of my own code.
  • I have commented on my code, particularly in hard-to-understand areas.
  • I have added docstring(s) to my code.
  • I have made corresponding changes to the documentation (docs).
  • I have updated docs using make gen-docs command.
  • I have added tests for my changes.
  • I have signed all the commits.

Legal Checklist

@mostafa mostafa self-assigned this May 23, 2024
Copy link
Contributor

@Hamsajj Hamsajj left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me! great feature and use-cases.

I only have on minor comment. Maybe it is good to have a test with an actual policy that uses some hook result (like the log example in the PR description)
That can work as a test, but also as a great example on how this new feature can be helpful and accessed in policies,

@mostafa
Copy link
Member Author

mostafa commented May 24, 2024

@Hamsajj

Tried to address your comments in 78203ed.

@mostafa mostafa force-pushed the enrich-policy-input branch from 78203ed to 7ad9ece Compare May 24, 2024 09:25
@Hamsajj
Copy link
Contributor

Hamsajj commented May 24, 2024

Great! I have no more comments 🚀

@mostafa mostafa merged commit 1c8196f into main May 24, 2024
3 of 4 checks passed
@mostafa mostafa deleted the enrich-policy-input branch May 24, 2024 09:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Enrich policy input
2 participants