/middleware_ip_whitelist_test.go

https://gitlab.com/jjae2124/tyk · Go · 382 lines · 338 code · 44 blank · 0 comment · 28 complexity · 58db410ca33b765c2f0fcc1fd64f9dfb MD5 · raw file 

    

  1. package main
    2. 

  2. 

  3. import (
    4. 

  4. 	"github.com/gorilla/mux"
    5. 

  5. 	"net/http"
    6. 

  6. 	"net/http/httptest"
    7. 

  7. 	"net/url"
    8. 

  8. 	"testing"
    9. 

  9. )
    10. 

  10. 

  11. var ipMiddlewareTestDefinitionEnabledFail string = `
    12. 

    13. 

  13. 	{
    14. 

  14. 		"name": "Tyk Test API - IPCONF Fail",
    15. 

  15. 		"api_id": "1",
    16. 

  16. 		"org_id": "default",
    17. 

  17. 		"definition": {
    18. 

  18. 			"location": "header",
    19. 

  19. 			"key": "version"
    20. 

  20. 		},
    21. 

  21. 		"auth": {
    22. 

  22. 			"auth_header_name": "authorization"
    23. 

  23. 		},
    24. 

  24. 		"version_data": {
    25. 

  25. 			"not_versioned": true,
    26. 

  26. 			"versions": {
    27. 

  27. 				"v1": {
    28. 

  28. 					"name": "v1",
    29. 

  29. 					"expires": "2100-01-02 15:04",
    30. 

  30. 					"use_extended_paths": true,
    31. 

  31. 					"paths": {
    32. 

  32. 						"ignored": [],
    33. 

  33. 						"white_list": [],
    34. 

  34. 						"black_list": []
    35. 

  35. 					}
    36. 

  36. 				}
    37. 

  37. 			}
    38. 

  38. 		},
    39. 

  39. 		"proxy": {
    40. 

  40. 			"listen_path": "/v1",
    41. 

  41. 			"target_url": "http://lonelycode.com",
    42. 

  42. 			"strip_listen_path": false
    43. 

  43. 		},
    44. 

  44. 		"enable_ip_whitelisting": true,
    45. 

  45. 		"allowed_ips": ["12.12.12.12"]
    46. 

  46. 	}
    47. 

  47. `
    48. 

  48. 

  49. var ipMiddlewareTestDefinitionEnabledPass string = `
    50. 

    51. 

  51. 	{
    52. 

  52. 		"name": "Tyk Test API",
    53. 

  53. 		"api_id": "1",
    54. 

  54. 		"org_id": "default",
    55. 

  55. 		"definition": {
    56. 

  56. 			"location": "header",
    57. 

  57. 			"key": "version"
    58. 

  58. 		},
    59. 

  59. 		"auth": {
    60. 

  60. 			"auth_header_name": "authorization"
    61. 

  61. 		},
    62. 

  62. 		"version_data": {
    63. 

  63. 			"not_versioned": true,
    64. 

  64. 			"versions": {
    65. 

  65. 				"v1": {
    66. 

  66. 					"name": "v1",
    67. 

  67. 					"expires": "2100-01-02 15:04",
    68. 

  68. 					"use_extended_paths": true,
    69. 

  69. 					"paths": {
    70. 

  70. 						"ignored": [],
    71. 

  71. 						"white_list": [],
    72. 

  72. 						"black_list": []
    73. 

  73. 					}
    74. 

  74. 				}
    75. 

  75. 			}
    76. 

  76. 		},
    77. 

  77. 		"proxy": {
    78. 

  78. 			"listen_path": "/v1",
    79. 

  79. 			"target_url": "http://lonelycode.com",
    80. 

  80. 			"strip_listen_path": false
    81. 

  81. 		},
    82. 

  82. 		"enable_ip_whitelisting": true,
    83. 

  83. 		"allowed_ips": ["127.0.0.1", "127.0.0.1/24"]
    84. 

  84. 	}
    85. 

  85. `
    86. 

  86. 

  87. var ipMiddlewareTestDefinitionDisabled string = `
    88. 

    89. 

  89. 	{
    90. 

  90. 		"name": "Tyk Test API",
    91. 

  91. 		"api_id": "1",
    92. 

  92. 		"org_id": "default",
    93. 

  93. 		"definition": {
    94. 

  94. 			"location": "header",
    95. 

  95. 			"key": "version"
    96. 

  96. 		},
    97. 

  97. 		"auth": {
    98. 

  98. 			"auth_header_name": "authorization"
    99. 

  99. 		},
    100. 

  100. 		"version_data": {
    101. 

  101. 			"not_versioned": true,
    102. 

  102. 			"versions": {
    103. 

  103. 				"v1": {
    104. 

  104. 					"name": "v1",
    105. 

  105. 					"expires": "2100-01-02 15:04",
    106. 

  106. 					"use_extended_paths": true,
    107. 

  107. 					"paths": {
    108. 

  108. 						"ignored": [],
    109. 

  109. 						"white_list": [],
    110. 

  110. 						"black_list": []
    111. 

  111. 					}
    112. 

  112. 				}
    113. 

  113. 			}
    114. 

  114. 		},
    115. 

  115. 		"proxy": {
    116. 

  116. 			"listen_path": "/v1",
    117. 

  117. 			"target_url": "http://lonelycode.com",
    118. 

  118. 			"strip_listen_path": false
    119. 

  119. 		},
    120. 

  120. 		"enable_ip_whitelisting": false,
    121. 

  121. 		"allowed_ips": []
    122. 

  122. 	}
    123. 

  123. `
    124. 

  124. 

  125. var ipMiddlewareTestDefinitionMissing string = `
    126. 

    127. 

  127. 	{
    128. 

  128. 		"name": "Tyk Test API",
    129. 

  129. 		"api_id": "1",
    130. 

  130. 		"org_id": "default",
    131. 

  131. 		"definition": {
    132. 

  132. 			"location": "header",
    133. 

  133. 			"key": "version"
    134. 

  134. 		},
    135. 

  135. 		"auth": {
    136. 

  136. 			"auth_header_name": "authorization"
    137. 

  137. 		},
    138. 

  138. 		"version_data": {
    139. 

  139. 			"not_versioned": true,
    140. 

  140. 			"versions": {
    141. 

  141. 				"v1": {
    142. 

  142. 					"name": "v1",
    143. 

  143. 					"expires": "2100-01-02 15:04",
    144. 

  144. 					"use_extended_paths": true,
    145. 

  145. 					"paths": {
    146. 

  146. 						"ignored": [],
    147. 

  147. 						"white_list": [],
    148. 

  148. 						"black_list": []
    149. 

  149. 					}
    150. 

  150. 				}
    151. 

  151. 			}
    152. 

  152. 		},
    153. 

  153. 		"proxy": {
    154. 

  154. 			"listen_path": "/v1",
    155. 

  155. 			"target_url": "http://lonelycode.com",
    156. 

  156. 			"strip_listen_path": false
    157. 

  157. 		}
    158. 

  158. 	}
    159. 

  159. `
    160. 

  160. 

  161. func MakeIPSampleAPI(apiTestDef string) *APISpec {
    162. 

  162. 	log.Debug("CREATING TEMPORARY API FOR IP WHITELIST")
    163. 

  163. 	thisSpec := createDefinitionFromString(apiTestDef)
    164. 

  164. 	redisStore := RedisStorageManager{KeyPrefix: "apikey-"}
    165. 

  165. 	healthStore := &RedisStorageManager{KeyPrefix: "apihealth."}
    166. 

  166. 	orgStore := &RedisStorageManager{KeyPrefix: "orgKey."}
    167. 

  167. 	thisSpec.Init(&redisStore, &redisStore, healthStore, orgStore)
    168. 

  168. 

  169. 	specs := &[]*APISpec{&thisSpec}
    170. 

  170. 	newMuxes := mux.NewRouter()
    171. 

  171. 	loadAPIEndpoints(newMuxes)
    172. 

  172. 	loadApps(specs, newMuxes)
    173. 

  173. 	newHttpMuxer := http.NewServeMux()
    174. 

  174. 	newHttpMuxer.Handle("/", newMuxes)
    175. 

  175. 

  176. 	http.DefaultServeMux = newHttpMuxer
    177. 

  177. 	log.Debug("IP TEST Reload complete")
    178. 

  178. 

  179. 	return &thisSpec
    180. 

  180. }
    181. 

  181. 

  182. func TestIpMiddlewareIPFail(t *testing.T) {
    183. 

  183. 	spec := MakeIPSampleAPI(ipMiddlewareTestDefinitionEnabledFail)
    184. 

  184. 	redisStore := RedisStorageManager{KeyPrefix: "apikey-"}
    185. 

  185. 	healthStore := &RedisStorageManager{KeyPrefix: "apihealth."}
    186. 

  186. 	orgStore := &RedisStorageManager{KeyPrefix: "orgKey."}
    187. 

  187. 	spec.Init(&redisStore, &redisStore, healthStore, orgStore)
    188. 

  188. 	thisSession := createNonThrottledSession()
    189. 

  189. 	spec.SessionManager.UpdateSession("1234wer", thisSession, 60)
    190. 

  190. 	uri := "/about-lonelycoder/"
    191. 

  191. 	method := "GET"
    192. 

  192. 

  193. 	recorder := httptest.NewRecorder()
    194. 

  194. 	param := make(url.Values)
    195. 

  195. 	req, err := http.NewRequest(method, uri+param.Encode(), nil)
    196. 

  196. 	req.RemoteAddr = "127.0.0.1"
    197. 

  197. 	req.Header.Add("authorization", "1234wer")
    198. 

  198. 

  199. 	if err != nil {
    200. 

  200. 		t.Fatal(err)
    201. 

  201. 	}
    202. 

  202. 

  203. 	chain := getChain(*spec)
    204. 

  204. 	chain.ServeHTTP(recorder, req)
    205. 

  205. 

  206. 	if recorder.Code != 403 {
    207. 

  207. 		t.Error("Invalid response code, should be 403:  \n", recorder.Code, recorder.Body)
    208. 

  208. 	}
    209. 

  209. }
    210. 

  210. 

  211. func TestIpMiddlewareIPPass(t *testing.T) {
    212. 

  212. 	spec := MakeIPSampleAPI(ipMiddlewareTestDefinitionEnabledPass)
    213. 

  213. 	redisStore := RedisStorageManager{KeyPrefix: "apikey-"}
    214. 

  214. 	healthStore := &RedisStorageManager{KeyPrefix: "apihealth."}
    215. 

  215. 	orgStore := &RedisStorageManager{KeyPrefix: "orgKey."}
    216. 

  216. 	spec.Init(&redisStore, &redisStore, healthStore, orgStore)
    217. 

  217. 	thisSession := createNonThrottledSession()
    218. 

  218. 	spec.SessionManager.UpdateSession("gfgg1234", thisSession, 60)
    219. 

  219. 	uri := "/about-lonelycoder/"
    220. 

  220. 	method := "GET"
    221. 

  221. 

  222. 	recorder := httptest.NewRecorder()
    223. 

  223. 	param := make(url.Values)
    224. 

  224. 	req, err := http.NewRequest(method, uri+param.Encode(), nil)
    225. 

  225. 	req.RemoteAddr = "127.0.0.1"
    226. 

  226. 	req.Header.Add("authorization", "gfgg1234")
    227. 

  227. 

  228. 	if err != nil {
    229. 

  229. 		t.Fatal(err)
    230. 

  230. 	}
    231. 

  231. 

  232. 	chain := getChain(*spec)
    233. 

  233. 	chain.ServeHTTP(recorder, req)
    234. 

  234. 

  235. 	if recorder.Code != 200 {
    236. 

  236. 		t.Error("Invalid response code, should be 200:  \n", recorder.Code, recorder.Body, req.RemoteAddr)
    237. 

  237. 	}
    238. 

  238. }
    239. 

  239. 

  240. func TestIpMiddlewareIPPassCIDR(t *testing.T) {
    241. 

  241. 	spec := MakeIPSampleAPI(ipMiddlewareTestDefinitionEnabledPass)
    242. 

  242. 	redisStore := RedisStorageManager{KeyPrefix: "apikey-"}
    243. 

  243. 	healthStore := &RedisStorageManager{KeyPrefix: "apihealth."}
    244. 

  244. 	orgStore := &RedisStorageManager{KeyPrefix: "orgKey."}
    245. 

  245. 	spec.Init(&redisStore, &redisStore, healthStore, orgStore)
    246. 

  246. 	thisSession := createNonThrottledSession()
    247. 

  247. 	spec.SessionManager.UpdateSession("gfgg1234", thisSession, 60)
    248. 

  248. 	uri := "/about-lonelycoder/"
    249. 

  249. 	method := "GET"
    250. 

  250. 

  251. 	recorder := httptest.NewRecorder()
    252. 

  252. 	param := make(url.Values)
    253. 

  253. 	req, err := http.NewRequest(method, uri+param.Encode(), nil)
    254. 

  254. 	req.RemoteAddr = "127.0.0.2"
    255. 

  255. 	req.Header.Add("authorization", "gfgg1234")
    256. 

  256. 

  257. 	if err != nil {
    258. 

  258. 		t.Fatal(err)
    259. 

  259. 	}
    260. 

  260. 

  261. 	chain := getChain(*spec)
    262. 

  262. 	chain.ServeHTTP(recorder, req)
    263. 

  263. 

  264. 	if recorder.Code != 200 {
    265. 

  265. 		t.Error("Invalid response code, should be 200:  \n", recorder.Code, recorder.Body, req.RemoteAddr)
    266. 

  266. 	}
    267. 

  267. }
    268. 

  268. 

  269. func TestIPMiddlewareIPFailXForwardedFor(t *testing.T) {
    270. 

  270. 	spec := MakeIPSampleAPI(ipMiddlewareTestDefinitionEnabledPass)
    271. 

  271. 	redisStore := RedisStorageManager{KeyPrefix: "apikey-"}
    272. 

  272. 	healthStore := &RedisStorageManager{KeyPrefix: "apihealth."}
    273. 

  273. 	orgStore := &RedisStorageManager{KeyPrefix: "orgKey."}
    274. 

  274. 	spec.Init(&redisStore, &redisStore, healthStore, orgStore)
    275. 

  275. 	thisSession := createNonThrottledSession()
    276. 

  276. 	spec.SessionManager.UpdateSession("gfgg1234", thisSession, 60)
    277. 

  277. 	uri := "/about-lonelycoder/"
    278. 

  278. 	method := "GET"
    279. 

  279. 

  280. 	recorder := httptest.NewRecorder()
    281. 

  281. 	param := make(url.Values)
    282. 

  282. 	req, err := http.NewRequest(method, uri+param.Encode(), nil)
    283. 

  283. 	req.RemoteAddr = "10.0.0.1"
    284. 

  284. 	req.Header.Add("authorization", "gfgg1234")
    285. 

  285. 

  286. 	if err != nil {
    287. 

  287. 		t.Fatal(err)
    288. 

  288. 	}
    289. 

  289. 

  290. 	chain := getChain(*spec)
    291. 

  291. 	chain.ServeHTTP(recorder, req)
    292. 

  292. 

  293. 	if recorder.Code != 403 {
    294. 

  294. 		t.Error("Invalid response code, should be 403:  \n", recorder.Code, recorder.Body, req.RemoteAddr)
    295. 

  295. 	}
    296. 

  296. }
    297. 

  297. 

  298. func TestIPMiddlewareIPPassXForwardedFor(t *testing.T) {
    299. 

  299. 	spec := MakeIPSampleAPI(ipMiddlewareTestDefinitionEnabledPass)
    300. 

  300. 	redisStore := RedisStorageManager{KeyPrefix: "apikey-"}
    301. 

  301. 	healthStore := &RedisStorageManager{KeyPrefix: "apihealth."}
    302. 

  302. 	orgStore := &RedisStorageManager{KeyPrefix: "orgKey."}
    303. 

  303. 	spec.Init(&redisStore, &redisStore, healthStore, orgStore)
    304. 

  304. 	thisSession := createNonThrottledSession()
    305. 

  305. 	spec.SessionManager.UpdateSession("gfgg1234", thisSession, 60)
    306. 

  306. 	uri := "/about-lonelycoder/"
    307. 

  307. 	method := "GET"
    308. 

  308. 

  309. 	recorder := httptest.NewRecorder()
    310. 

  310. 	param := make(url.Values)
    311. 

  311. 	req, err := http.NewRequest(method, uri+param.Encode(), nil)
    312. 

  312. 	req.RemoteAddr = "10.0.0.1"
    313. 

  313. 	req.Header.Add("X-Forwarded-For", "127.0.0.1")
    314. 

  314. 	req.Header.Add("authorization", "gfgg1234")
    315. 

  315. 

  316. 	if err != nil {
    317. 

  317. 		t.Fatal(err)
    318. 

  318. 	}
    319. 

  319. 

  320. 	chain := getChain(*spec)
    321. 

  321. 	chain.ServeHTTP(recorder, req)
    322. 

  322. 

  323. 	if recorder.Code != 200 {
    324. 

  324. 		t.Error("Invalid response code, should be 200:  \n", recorder.Code, recorder.Body, req.RemoteAddr)
    325. 

  325. 	}
    326. 

  326. }
    327. 

  327. 

  328. func TestIpMiddlewareIPMissing(t *testing.T) {
    329. 

  329. 	spec := MakeIPSampleAPI(ipMiddlewareTestDefinitionMissing)
    330. 

  330. 	redisStore := RedisStorageManager{KeyPrefix: "apikey-"}
    331. 

  331. 	healthStore := &RedisStorageManager{KeyPrefix: "apihealth."}
    332. 

  332. 	orgStore := &RedisStorageManager{KeyPrefix: "orgKey."}
    333. 

  333. 	spec.Init(&redisStore, &redisStore, healthStore, orgStore)
    334. 

  334. 	thisSession := createNonThrottledSession()
    335. 

  335. 	spec.SessionManager.UpdateSession("1234rtyrty", thisSession, 60)
    336. 

  336. 	uri := "/about-lonelycoder/"
    337. 

  337. 	method := "GET"
    338. 

  338. 

  339. 	recorder := httptest.NewRecorder()
    340. 

  340. 	param := make(url.Values)
    341. 

  341. 	req, err := http.NewRequest(method, uri+param.Encode(), nil)
    342. 

  342. 	req.Header.Add("authorization", "1234rtyrty")
    343. 

  343. 

  344. 	if err != nil {
    345. 

  345. 		t.Fatal(err)
    346. 

  346. 	}
    347. 

  347. 

  348. 	chain := getChain(*spec)
    349. 

  349. 	chain.ServeHTTP(recorder, req)
    350. 

  350. 

  351. 	if recorder.Code != 200 {
    352. 

  352. 		t.Error("Invalid response code, should be 200:  \n", recorder.Code, recorder.Body)
    353. 

  353. 	}
    354. 

  354. }
    355. 

  355. 

  356. func TestIpMiddlewareIPDisabled(t *testing.T) {
    357. 

  357. 	spec := MakeIPSampleAPI(ipMiddlewareTestDefinitionDisabled)
    358. 

  358. 	redisStore := RedisStorageManager{KeyPrefix: "apikey-"}
    359. 

  359. 	healthStore := &RedisStorageManager{KeyPrefix: "apihealth."}
    360. 

  360. 	orgStore := &RedisStorageManager{KeyPrefix: "orgKey."}
    361. 

  361. 	spec.Init(&redisStore, &redisStore, healthStore, orgStore)
    362. 

  362. 	thisSession := createNonThrottledSession()
    363. 

  363. 	spec.SessionManager.UpdateSession("1234iuouio", thisSession, 60)
    364. 

  364. 	uri := "/about-lonelycoder/"
    365. 

  365. 	method := "GET"
    366. 

  366. 

  367. 	recorder := httptest.NewRecorder()
    368. 

  368. 	param := make(url.Values)
    369. 

  369. 	req, err := http.NewRequest(method, uri+param.Encode(), nil)
    370. 

  370. 	req.Header.Add("authorization", "1234iuouio")
    371. 

  371. 

  372. 	if err != nil {
    373. 

  373. 		t.Fatal(err)
    374. 

  374. 	}
    375. 

  375. 

  376. 	chain := getChain(*spec)
    377. 

  377. 	chain.ServeHTTP(recorder, req)
    378. 

  378. 

  379. 	if recorder.Code != 200 {
    380. 

  380. 		t.Error("Invalid response code, should be 200:  \n", recorder.Code, recorder.Body)
    381. 

  381. 	}
    382. 

  382. }
    383.