Add a ClientVPN connection handler request/response definition (#343)

* Add initial event structure and test for Client VPN

* Add ClientVPN connection handler sample to README

* Refactor to perform early return

* Output IP addresses with %q instead of %s and
change ErrorMsgOnFailedPostureCompliance message

Co-authored-by: Gerhard Poul <[email protected]>

Author: gpoul

events/README.md

@@ -12,6 +12,8 @@ This package provides input types for Lambda functions that process AWS events.
 
 [AppSync](README_AppSync.md)
 
+[ClientVPN Connection Handler](README_ClientVPN.md)
+
 [CloudFormation Events](../cfn/README.md)
 
 [CloudWatch Events](README_CloudWatch_Events.md)

events/README_ClientVPN.md

@@ -0,0 +1,56 @@
+# Sample Function
+
+The following is a sample Lambda function that receives a Client VPN connection handler request as an input and then validates the IP address input and checks whether the connection source IP is on the allowed list defined as a map inside the function. If the source IP matches an allowed IP address it allows the access, otherwise an error message is presented to the user. Debug logs are generated to CloudWatch Logs. (Note that by default anything written to Console will be logged as CloudWatch Logs events.)
+
+```go
+import (
+	"fmt"
+	"log"
+	"net"
+
+	"encoding/json"
+
+	"github.com/aws/aws-lambda-go/events"
+	"github.com/aws/aws-lambda-go/lambda"
+)
+
+var (
+	AllowedIPs = map[string]bool{
+		"10.11.12.13": true,
+	}
+)
+
+func handler(request events.ClientVPNConnectionHandlerRequest) (events.ClientVPNConnectionHandlerResponse, error) {
+	requestJson, _ := json.MarshalIndent(request, "", "  ")
+	log.Printf("REQUEST: %s", requestJson)
+
+	sourceIP := request.PublicIP
+	if net.ParseIP(sourceIP) == nil {
+		return events.ClientVPNConnectionHandlerResponse{}, fmt.Errorf("Invalid parameter PublicIP passed in request: %q", sourceIP)
+	}
+
+	log.Printf("SOURCE IP: %q", sourceIP)
+
+	if allowed, ok := AllowedIPs[sourceIP]; ok && allowed {
+		log.Printf("Allowing access from: %q", sourceIP)
+		return events.ClientVPNConnectionHandlerResponse{
+			Allow: true,
+			ErrorMsgOnFailedPostureCompliance: "",
+			PostureComplianceStatuses: []string{},
+			SchemaVersion: "v1",
+		}, nil
+	}
+
+	log.Printf("Blocking access from: %q", sourceIP)
+	return events.ClientVPNConnectionHandlerResponse{
+		Allow: false,
+		ErrorMsgOnFailedPostureCompliance: "You're trying to connect from an IP address that is not allowed.",
+		PostureComplianceStatuses: []string{"BlockedSourceIP"},
+		SchemaVersion: "v1",
+	}, nil
+}
+
+func main() {
+	lambda.Start(handler)
+}
+```

events/clientvpn.go

@@ -0,0 +1,20 @@
+package events
+
+type ClientVPNConnectionHandlerRequest struct {
+	ConnectionID         string `json:"connection-id"`
+	EndpointID           string `json:"endpoint-id"`
+	CommonName           string `json:"common-name"`
+	Username             string `json:"username"`
+	OSPlatform           string `json:"platform"`
+	OSPlatformVersion    string `json:"platform-version"`
+	PublicIP             string `json:"public-ip"`
+	ClientOpenVPNVersion string `json:"client-openvpn-version"`
+	SchemaVersion        string `json:"schema-version"`
+}
+
+type ClientVPNConnectionHandlerResponse struct {
+	Allow                             bool     `json:"allow"`
+	ErrorMsgOnFailedPostureCompliance string   `json:"error-msg-on-failed-posture-compliance"`
+	PostureComplianceStatuses         []string `json:"posture-compliance-statuses"`
+	SchemaVersion                     string   `json:"schema-version"`
+}

events/clientvpn_test.go

@@ -0,0 +1,36 @@
+package events
+
+import (
+	"encoding/json"
+	"io/ioutil"
+	"testing"
+
+	"github.com/aws/aws-lambda-go/events/test"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestClientVPNConnectionHandlerRequestMarshaling(t *testing.T) {
+	// read json from file
+	inputJSON, err := ioutil.ReadFile("./testdata/clientvpn-connectionhandler-request.json")
+	if err != nil {
+		t.Errorf("could not open test file. details: %v", err)
+	}
+
+	// de-serialize into ClientVPNConnectionHandlerRequest
+	var inputEvent ClientVPNConnectionHandlerRequest
+	if err := json.Unmarshal(inputJSON, &inputEvent); err != nil {
+		t.Errorf("could not unmarshal event. details: %v", err)
+	}
+
+	// serialize to json
+	outputJSON, err := json.Marshal(inputEvent)
+	if err != nil {
+		t.Errorf("could not marshal event. details: %v", err)
+	}
+
+	assert.JSONEq(t, string(inputJSON), string(outputJSON))
+}
+
+func TestClientVPNConnectionHandlerRequestMarshalingMalformedJson(t *testing.T) {
+	test.TestMalformedJson(t, ClientVPNConnectionHandlerRequest{})
+}

events/testdata/clientvpn-connectionhandler-request.json

@@ -0,0 +1,11 @@
+{
+	"connection-id": "cvpn-connection-04e7e1b2f0daf9460",
+	"endpoint-id": "cvpn-endpoint-0f13eab7f860433cc", 
+	"common-name": "", 
+	"username": "username", 
+	"platform": "", 
+	"platform-version": "", 
+	"public-ip": "10.11.12.13", 
+	"client-openvpn-version": "", 
+	"schema-version": "v1" 
+}