Varnish Artifact Firewall

Introduction

The Varnish Artifact Firewall is a vendor-neutral firewall for software package registries that enforces policies at request time.

The Artifact Firewall intercepts package manager traffic, parses manifests, evaluates each version against a configurable rule engine, and rewrites manifests or blocks artifact downloads. This ensures that malware, known-CVE versions, and freshly published packages never reach your CI/CD pipelines.

Installation

The Varnish Artifact Firewall is distributed as part of project Orca. This project packages both the Virtual Registry and the Artifact Firewall.

The Orca distribution offers a Docker image, a Helm chart, DEB packages and RPM packages.

Check out the Varnish Virtual Registry installation page, to learn how to install the Orca distribution.

Configuration

The Varnish Artifact Firewall can be configured through a YAML config file, the same way the Varnish Virtual Registry is configured.

Here’s an example configuration:

varnish:
  http:
    - port: 80
virtual_registry:
  registries:
    - name: npmjs
      default: true
      enable_firewall: true
      remotes:
        - url: https://registry.npmjs.org
    - name: pypi
      enable_firewall: true
      remotes:
      - url: https://pypi.org
firewall:
  address: localhost
  default_action: allow
  default_quarantine_days: 7
  rulesets:
    - git:
        name: osv-npm
        url: https://github.com/varnish/osv-rules.git
        sub_path: rulesets/npm/all.yaml
    - git:
        name: osv-pypi
        url: https://github.com/varnish/osv-rules.git
        sub_path: rulesets/pypi/all.yaml
license:
  file: /app/license.lic

This configuration file sets the standard port that Varnish listens on, and configures a list of registies that the Virtual Registry routes package requests to.

The Varnish Artifact Firewall enforces security policies for registries that have firewalling enabled. Policies in this example are synchronized from our public GitHub repository that contains auto-generated rulesets derived from the OSV vulnerability database.

In this case NPM & PyPi rules are pulled in and applied to the corresponding Virtual Registry entries.

The Varnish Artifact Firewall configuration page explains how to configure the firewall and how to define the rulesets.

Getting started

Once you have installed and configured the Varnish Virtual Registry, and once you added the Artifact Firewall configuration, you can use this deployment as the endpoint to fetch dependencies for the different packages types you configured, and enforce security policies through the Varnish Artifact Firewall.

Here are a couple examples for different types of packages. More examples and tutorials can be found in the tutorials section.

NPM example

The following example command installs the express NPM package using the npmjs.example.com registry endpoint, protected by the Varnish Artifact Firewall:

npm install express --registry=https://npmjs.example.com

This example assumes npmjs.example.com resolves to the IP address of the Artifact Firewall setup. It also assumes a registry entry called npmjs is configured that has https://registry.npmjs.org as its remote, with firewalling enabled.

Take a look at the NPM client configuration tutorial to learn more about how to connect npm to the Varnish Artifact Firewall.

Python example

The following example command installs the boto3 Python package using the pip.example.com registry endpoint, protected by the Varnish Artifact Firewall:

pip install --index-url https://pip.example.com/simple/ boto3

This example assumes python.example.com resolves to the IP address of the Artifact Firewall setup. It also assumes a registry entry called pip is configured that has https://pypi.org as its remote, with firewalling enabled.

Take a look at the Pip client configuration tutorial to learn more about how to connect pip to the Varnish Artifact Firewall.

Changelog

Check out the changelog to get an overview of Varnish Artifact Firewall releases, describing feature additions, changes, fixes and removals per version.