58 lines
1.4 KiB
Rego
58 lines
1.4 KiB
Rego
package styx
|
|
|
|
import input.request as http_request
|
|
|
|
default permit := false
|
|
default reject := 0
|
|
default template := ""
|
|
|
|
# Bogon networks
|
|
bogons := [
|
|
"0.0.0.0/8", # "This" network
|
|
"10.0.0.0/8", # RFC1918 Private-use networks
|
|
"100.64.0.0/10", # Carrier-grade NAT
|
|
"127.0.0.0/8", # Loopback
|
|
"169.254.0.0/16", # Link local
|
|
"172.16.0.0/12", # RFC1918 Private-use networks
|
|
"192.0.0.0/24", # IETF protocol assignments
|
|
"192.0.2.0/24", # TEST-NET-1
|
|
"192.168.0.0/16", # RFC1918 Private-use networks
|
|
"198.18.0.0/15", # Network interconnect device benchmark testing
|
|
"198.51.100.0/24", # TEST-NET-2
|
|
"203.0.113.0/24", # TEST-NET-3
|
|
"224.0.0.0/4", # Multicast
|
|
"240.0.0.0/4", # Reserved for future use
|
|
"255.255.255.255/32", # Limited broadcast
|
|
]
|
|
|
|
# Resolve HTTP host to IPs
|
|
addrs := styx.lookup_ip_addr(http_request.host)
|
|
|
|
template := "template/blocked.html" if {
|
|
some cidr in bogons
|
|
net.cidr_contains(cidr, http_request.host)
|
|
}
|
|
|
|
template := "template/blocked.html" if {
|
|
some addr in addrs
|
|
some cidr in bogons
|
|
net.cidr_contains(cidr, addr)
|
|
}
|
|
|
|
permit if {
|
|
template == ""
|
|
}
|
|
|
|
errors contains "Bogon destination not allowed" if {
|
|
template != ""
|
|
}
|
|
|
|
errors contains "Could not lookup host" if {
|
|
count(addrs) == 0
|
|
}
|
|
|
|
errors contains addr if {
|
|
some addr in addrs
|
|
some cidr in bogons
|
|
net.cidr_contains(cidr, addr)
|
|
} |