Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add a ClientVPN connection handler request/response definition (#343)
* Add initial event structure and test for Client VPN * Add ClientVPN connection handler sample to README * Refactor to perform early return * Output IP addresses with %q instead of %s and change ErrorMsgOnFailedPostureCompliance message Co-authored-by: Gerhard Poul <gpoul@amazon.at>
- Loading branch information
Showing
5 changed files
with
125 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,56 @@ | ||
# Sample Function | ||
|
||
The following is a sample Lambda function that receives a Client VPN connection handler request as an input and then validates the IP address input and checks whether the connection source IP is on the allowed list defined as a map inside the function. If the source IP matches an allowed IP address it allows the access, otherwise an error message is presented to the user. Debug logs are generated to CloudWatch Logs. (Note that by default anything written to Console will be logged as CloudWatch Logs events.) | ||
|
||
```go | ||
import ( | ||
"fmt" | ||
"log" | ||
"net" | ||
|
||
"encoding/json" | ||
|
||
"github.com/aws/aws-lambda-go/events" | ||
"github.com/aws/aws-lambda-go/lambda" | ||
) | ||
|
||
var ( | ||
AllowedIPs = map[string]bool{ | ||
"10.11.12.13": true, | ||
} | ||
) | ||
|
||
func handler(request events.ClientVPNConnectionHandlerRequest) (events.ClientVPNConnectionHandlerResponse, error) { | ||
requestJson, _ := json.MarshalIndent(request, "", " ") | ||
log.Printf("REQUEST: %s", requestJson) | ||
|
||
sourceIP := request.PublicIP | ||
if net.ParseIP(sourceIP) == nil { | ||
return events.ClientVPNConnectionHandlerResponse{}, fmt.Errorf("Invalid parameter PublicIP passed in request: %q", sourceIP) | ||
} | ||
|
||
log.Printf("SOURCE IP: %q", sourceIP) | ||
|
||
if allowed, ok := AllowedIPs[sourceIP]; ok && allowed { | ||
log.Printf("Allowing access from: %q", sourceIP) | ||
return events.ClientVPNConnectionHandlerResponse{ | ||
Allow: true, | ||
ErrorMsgOnFailedPostureCompliance: "", | ||
PostureComplianceStatuses: []string{}, | ||
SchemaVersion: "v1", | ||
}, nil | ||
} | ||
|
||
log.Printf("Blocking access from: %q", sourceIP) | ||
return events.ClientVPNConnectionHandlerResponse{ | ||
Allow: false, | ||
ErrorMsgOnFailedPostureCompliance: "You're trying to connect from an IP address that is not allowed.", | ||
PostureComplianceStatuses: []string{"BlockedSourceIP"}, | ||
SchemaVersion: "v1", | ||
}, nil | ||
} | ||
|
||
func main() { | ||
lambda.Start(handler) | ||
} | ||
``` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,20 @@ | ||
package events | ||
|
||
type ClientVPNConnectionHandlerRequest struct { | ||
ConnectionID string `json:"connection-id"` | ||
EndpointID string `json:"endpoint-id"` | ||
CommonName string `json:"common-name"` | ||
Username string `json:"username"` | ||
OSPlatform string `json:"platform"` | ||
OSPlatformVersion string `json:"platform-version"` | ||
PublicIP string `json:"public-ip"` | ||
ClientOpenVPNVersion string `json:"client-openvpn-version"` | ||
SchemaVersion string `json:"schema-version"` | ||
} | ||
|
||
type ClientVPNConnectionHandlerResponse struct { | ||
Allow bool `json:"allow"` | ||
ErrorMsgOnFailedPostureCompliance string `json:"error-msg-on-failed-posture-compliance"` | ||
PostureComplianceStatuses []string `json:"posture-compliance-statuses"` | ||
SchemaVersion string `json:"schema-version"` | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,36 @@ | ||
package events | ||
|
||
import ( | ||
"encoding/json" | ||
"io/ioutil" | ||
"testing" | ||
|
||
"github.com/aws/aws-lambda-go/events/test" | ||
"github.com/stretchr/testify/assert" | ||
) | ||
|
||
func TestClientVPNConnectionHandlerRequestMarshaling(t *testing.T) { | ||
// read json from file | ||
inputJSON, err := ioutil.ReadFile("./testdata/clientvpn-connectionhandler-request.json") | ||
if err != nil { | ||
t.Errorf("could not open test file. details: %v", err) | ||
} | ||
|
||
// de-serialize into ClientVPNConnectionHandlerRequest | ||
var inputEvent ClientVPNConnectionHandlerRequest | ||
if err := json.Unmarshal(inputJSON, &inputEvent); err != nil { | ||
t.Errorf("could not unmarshal event. details: %v", err) | ||
} | ||
|
||
// serialize to json | ||
outputJSON, err := json.Marshal(inputEvent) | ||
if err != nil { | ||
t.Errorf("could not marshal event. details: %v", err) | ||
} | ||
|
||
assert.JSONEq(t, string(inputJSON), string(outputJSON)) | ||
} | ||
|
||
func TestClientVPNConnectionHandlerRequestMarshalingMalformedJson(t *testing.T) { | ||
test.TestMalformedJson(t, ClientVPNConnectionHandlerRequest{}) | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,11 @@ | ||
{ | ||
"connection-id": "cvpn-connection-04e7e1b2f0daf9460", | ||
"endpoint-id": "cvpn-endpoint-0f13eab7f860433cc", | ||
"common-name": "", | ||
"username": "username", | ||
"platform": "", | ||
"platform-version": "", | ||
"public-ip": "10.11.12.13", | ||
"client-openvpn-version": "", | ||
"schema-version": "v1" | ||
} |