Expressions

A policy is written with Common Expression Language (CEL) expressions to determine on which connections it is applicable. Each policy expression must evaluate to true in order for the policy's actions to take effect against a connection.

Variables

Attributes of the connection are exposed on the conn struct. The following variables are available using this struct:

Variables

Attributes of the connection are exposed on the conn struct. The following variables are available using this struct:

Name	Type	Description
conn.ClientIP	string	The source IP of the TLS connection to the ngrok endpoint.
conn.Geo.CountryCode	string	The two-letter ISO country code based on the client IP.
conn.Geo.Latitude	string	The approximate latitude based on the client IP.
conn.Geo.LatLongRadiusKm	string	The radius in kilometers around the latitude and longitude where the client IP is likely to originate.
conn.Geo.Longitude	string	The approximate longitude based on the client IP.
conn.TLS.CertCN	string	The subject common name of the leaf TLS certificate
conn.TLS.CipherSuite	string	The cipher suite negotiated on the connection.
conn.TLS.SNI	string	The Server Name Indication extension sent.
conn.TLS.Version	string	The TLS Version used on the connection.

conn.ClientIP

The source IP of the TCP connection to the ngrok endpoint as a string.

- "conn.ClientIP in ['::1', '127.0.0.1']"

conn.Geo.CountryCode

The two-letter ISO country code based on the client IP.

- "conn.Geo.CountryCode != 'US'"

conn.Geo.Latitude

The approximate latitude based on the client IP.

- "double(conn.Geo.Latitude) >= 45.0"

conn.Geo.LatLongRadiusKm

The radius in kilometers around the latitude and longitude where the client IP is likely to originate.

- "conn.Geo.LatLongRadiusKm <= '20'"

conn.Geo.Longitude

The approximate longitude based on the client IP.

- "double(conn.Geo.Longitude) <= -93.0"

conn.TLS.CertCN

The subject common name of the leaf TLS certificate.

- "conn.TLS.CertCN.startsWith('example')"

conn.TLS.CipherSuite

The cipher suite negotiated on the connection.

- "conn.TLS.CipherSuite.contains('SHA256')"

conn.TLS.SNI

The Server Name Indication extension sent.

- "conn.TLS.SNI.startsWith('domain')"

conn.TLS.Version

The TLS Version used on the connection.

- "conn.TLS.Version.contains('1.3')"