plugin

Documentation

Index

• Constants
• Variables
• type InjectionDetectionPlugin
  • func NewInjectionDetectionPlugin(impl Plugin) *InjectionDetectionPlugin
  • func (p *InjectionDetectionPlugin) GRPCClient(ctx context.Context, b *goplugin.GRPCBroker, c *grpc.ClientConn) (any, error)
  • func (p *InjectionDetectionPlugin) GRPCServer(b *goplugin.GRPCBroker, s *grpc.Server) error
• type Plugin
  • func (p *Plugin) GetPluginConfig(ctx context.Context, _ *v1.Struct) (*v1.Struct, error)
  • func (p *Plugin) OnTrafficFromClient(ctx context.Context, req *v1.Struct) (*v1.Struct, error)

Constants

const (
	DecodedQueryField string = "decodedQuery"
	DetectorField     string = "detector"
	QueryField        string = "query"
	ErrorField        string = "error"
	IsInjectionField  string = "is_injection"
	ResponseField     string = "response"
	ConfidenceField   string = "confidence"
	TokensField       string = "tokens"
	StringField       string = "String"
	ResponseTypeField string = "response_type"

	DeepLearningModel string = "deep_learning_model"
	Libinjection      string = "libinjection"

	ResponseType  string = "error"
	ErrorSeverity string = "EXCEPTION"
	ErrorNumber   string = "42000"
	ErrorMessage  string = "SQL injection detected"
	ErrorDetail   string = "Back off, you're not welcome here."
	LogLevel      string = "error"

	PredictPath string = "/predict"
)

Variables

var (
	GetPluginConfig = promauto.NewCounter(prometheus.CounterOpts{
		Namespace: metrics.Namespace,
		Name:      "get_plugin_config_total",
		Help:      "The total number of calls to the getPluginConfig method",
	})
	OnTrafficFromClient = promauto.NewCounter(prometheus.CounterOpts{
		Namespace: metrics.Namespace,
		Name:      "on_traffic_from_client_total",
		Help:      "The total number of calls to the onTrafficFromClient method",
	})
	Detections = promauto.NewCounterVec(prometheus.CounterOpts{
		Namespace: metrics.Namespace,
		Name:      "detections_total",
		Help:      "The total number of malicious requests detected",
	}, []string{"detector"})
	Preventions = promauto.NewCounterVec(prometheus.CounterOpts{
		Namespace: metrics.Namespace,
		Name:      "preventions_total",
		Help:      "The total number of malicious requests prevented",
	}, []string{"response_type"})
)

The following metrics are defined in the plugin and are used to track the number of times the plugin methods are called. These metrics are used as examples to test the plugin metrics functionality.

var (
	Version  = "0.0.0"
	PluginID = v1.PluginID{
		Name:      "gatewayd-plugin-sql-ids-ips",
		Version:   Version,
		RemoteUrl: "github.com/gatewayd-io/gatewayd-plugin-sql-ids-ips",
	}
	PluginMap = map[string]goplugin.Plugin{
		"gatewayd-plugin-sql-ids-ips": &InjectionDetectionPlugin{},
	}
	// TODO: Handle this in a better way
	// https://github.com/gatewayd-io/gatewayd-plugin-sdk/issues/3
	PluginConfig = map[string]interface{}{
		"id": map[string]interface{}{
			"name":      PluginID.Name,
			"version":   PluginID.Version,
			"remoteUrl": PluginID.RemoteUrl,
		},
		"description": "GatewayD plugin for detection and prevention of SQL injection attacks",
		"authors": []interface{}{
			"Mostafa Moradian <mostafa@gatewayd.io>",
		},
		"license":    "AGPL-3.0",
		"projectUrl": "https://github.com/gatewayd-io/gatewayd-plugin-sql-ids-ips",

		"config": map[string]interface{}{
			"metricsEnabled": sdkConfig.GetEnv("METRICS_ENABLED", "true"),
			"metricsUnixDomainSocket": sdkConfig.GetEnv(
				"METRICS_UNIX_DOMAIN_SOCKET", "/tmp/gatewayd-plugin-sql-ids-ips.sock"),
			"metricsEndpoint": sdkConfig.GetEnv("METRICS_ENDPOINT", "/metrics"),
			"predictionAPIAddress": sdkConfig.GetEnv(
				"PREDICTION_API_ADDRESS", "http://localhost:8000"),
			"threshold":                  sdkConfig.GetEnv("THRESHOLD", "0.8"),
			"enableLibinjection":         sdkConfig.GetEnv("ENABLE_LIBINJECTION", "true"),
			"libinjectionPermissiveMode": sdkConfig.GetEnv("LIBINJECTION_MODE", "true"),

			"responseType": sdkConfig.GetEnv("RESPONSE_TYPE", ResponseType),

			"errorMessage": sdkConfig.GetEnv("ERROR_MESSAGE", ErrorMessage),

			"errorSeverity": sdkConfig.GetEnv("ERROR_SEVERITY", ErrorSeverity),
			"errorNumber":   sdkConfig.GetEnv("ERROR_NUMBER", ErrorNumber),
			"errorDetail":   sdkConfig.GetEnv("ERROR_DETAIL", ErrorDetail),

			"logLevel": sdkConfig.GetEnv("LOG_LEVEL", LogLevel),
		},
		"hooks": []interface{}{

			int32(v1.HookName_HOOK_NAME_ON_TRAFFIC_FROM_CLIENT),
		},
		"tags":       []interface{}{"plugin", "sql", "ids", "ips", "security", "waf"},
		"categories": []interface{}{"plugin", "enterprise"},
	}
)

Types

type InjectionDetectionPlugin

type InjectionDetectionPlugin struct {
	goplugin.NetRPCUnsupportedPlugin

	Impl Plugin
}

func NewInjectionDetectionPlugin

func NewInjectionDetectionPlugin(impl Plugin) *InjectionDetectionPlugin

NewInjectionDetectionPlugin returns a new instance of the TestPlugin.

func (*InjectionDetectionPlugin) GRPCClient

func (p *InjectionDetectionPlugin) GRPCClient(
	ctx context.Context, b *goplugin.GRPCBroker, c *grpc.ClientConn,
) (any, error)

GRPCClient returns the plugin client.

func (*InjectionDetectionPlugin) GRPCServer

func (p *InjectionDetectionPlugin) GRPCServer(b *goplugin.GRPCBroker, s *grpc.Server) error

GRPCServer registers the plugin with the gRPC server.

type Plugin

type Plugin struct {
	goplugin.GRPCPlugin
	v1.GatewayDPluginServiceServer

	Logger                     hclog.Logger
	Threshold                  float32
	EnableLibinjection         bool
	LibinjectionPermissiveMode bool
	PredictionAPIAddress       string
	ResponseType               string
	ErrorMessage               string
	ErrorSeverity              string
	ErrorNumber                string
	ErrorDetail                string
	LogLevel                   string
}

func (*Plugin) GetPluginConfig

func (p *Plugin) GetPluginConfig(ctx context.Context, _ *v1.Struct) (*v1.Struct, error)

GetPluginConfig returns the plugin config. This is called by GatewayD when the plugin is loaded. The plugin config is used to configure the plugin.

func (*Plugin) OnTrafficFromClient

func (p *Plugin) OnTrafficFromClient(ctx context.Context, req *v1.Struct) (*v1.Struct, error)

OnTrafficFromClient is called when a request is received by GatewayD from the client. This can be used to modify the request or terminate the connection by returning an error or a response.