Add plugins (#27)

plugins/wasm-cpp/extensions/key_auth/BUILD

@@ -0,0 +1,58 @@
+load("@proxy_wasm_cpp_sdk//bazel/wasm:wasm.bzl", "wasm_cc_binary")
+load("//bazel:wasm.bzl", "declare_wasm_image_targets")
+
+wasm_cc_binary(
+    name = "key_auth.wasm",
+    srcs = [
+        "plugin.cc",
+        "plugin.h",
+        "//common:base64.h",
+    ],
+    deps = [
+        "@com_google_absl//absl/strings",
+        "@com_google_absl//absl/time",
+        "//common:json_util",
+        "@proxy_wasm_cpp_sdk//:proxy_wasm_intrinsics",
+        "//common:http_util",
+        "//common:rule_util",
+    ],
+)
+
+cc_library(
+    name = "key_auth_lib",
+    srcs = [
+        "plugin.cc",
+        "//common:base64.h",
+    ],
+    hdrs = [
+        "plugin.h",
+    ],
+    copts = ["-DNULL_PLUGIN"],
+    deps = [
+        "@com_google_absl//absl/strings",
+        "@com_google_absl//absl/time",
+        "//common:json_util",
+        "@proxy_wasm_cpp_host//:lib",
+        "//common:http_util",
+        "//common:rule_util",
+    ],
+)
+
+cc_test(
+    name = "key_auth_test",
+    srcs = [
+        "plugin_test.cc",
+    ],
+    copts = ["-DNULL_PLUGIN"],
+    deps = [
+        ":key_auth_lib",
+        "@com_google_googletest//:gtest",
+        "@com_google_googletest//:gtest_main",
+        "@proxy_wasm_cpp_host//:lib",
+    ],
+)
+
+declare_wasm_image_targets(
+    name = "key_auth",
+    wasm_file = ":key_auth.wasm",
+)

plugins/wasm-cpp/extensions/key_auth/plugin.cc

@@ -0,0 +1,279 @@
+// Copyright (c) 2022 Alibaba Group Holding Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "extensions/key_auth/plugin.h"
+
+#include <array>
+
+#include "absl/strings/str_cat.h"
+#include "absl/strings/str_split.h"
+#include "common/http_util.h"
+#include "common/json_util.h"
+
+using ::nlohmann::json;
+using ::Wasm::Common::JsonArrayIterate;
+using ::Wasm::Common::JsonGetField;
+using ::Wasm::Common::JsonObjectIterate;
+using ::Wasm::Common::JsonValueAs;
+
+#ifdef NULL_PLUGIN
+
+namespace proxy_wasm {
+namespace null_plugin {
+namespace key_auth {
+
+PROXY_WASM_NULL_PLUGIN_REGISTRY
+
+#endif
+
+static RegisterContextFactory register_KeyAuth(CONTEXT_FACTORY(PluginContext),
+                                               ROOT_FACTORY(PluginRootContext));
+
+namespace {
+
+void deniedNoKeyAuthData(const std::string& realm) {
+  sendLocalResponse(401, "No API key found in request", "",
+                    {{"WWW-Authenticate", absl::StrCat("Key realm=", realm)}});
+}
+
+void deniedInvalidCredentials(const std::string& realm) {
+  sendLocalResponse(401, "Request denied by Key Auth check. Invalid API key",
+                    "",
+                    {{"WWW-Authenticate", absl::StrCat("Key realm=", realm)}});
+}
+
+void deniedUnauthorizedConsumer(const std::string& realm) {
+  sendLocalResponse(
+      403, "Request denied by Key Auth check. Unauthorized consumer", "",
+      {{"WWW-Authenticate", absl::StrCat("Basic realm=", realm)}});
+}
+
+}  // namespace
+
+bool PluginRootContext::parsePluginConfig(const json& configuration,
+                                          KeyAuthConfigRule& rule) {
+  if ((configuration.find("consumers") != configuration.end()) &&
+      (configuration.find("credentials") != configuration.end())) {
+    LOG_WARN(
+        "The consumers field and the credentials field cannot appear at the "
+        "same level");
+    return false;
+  }
+  if (!JsonArrayIterate(
+          configuration, "credentials", [&](const json& credentials) -> bool {
+            auto credential = JsonValueAs<std::string>(credentials);
+            if (credential.second != Wasm::Common::JsonParserResultDetail::OK) {
+              return false;
+            }
+            rule.credentials.insert(credential.first.value());
+            return true;
+          })) {
+    LOG_WARN("failed to parse configuration for credentials.");
+    return false;
+  }
+  if (!JsonArrayIterate(
+          configuration, "consumers", [&](const json& consumer) -> bool {
+            auto item = consumer.find("name");
+            if (item == consumer.end()) {
+              LOG_WARN("can't find 'name' field in consumer.");
+              return false;
+            }
+            auto name = JsonValueAs<std::string>(item.value());
+            if (name.second != Wasm::Common::JsonParserResultDetail::OK ||
+                !name.first) {
+              return false;
+            }
+            item = consumer.find("credential");
+            if (item == consumer.end()) {
+              LOG_WARN("can't find 'credential' field in consumer.");
+              return false;
+            }
+            auto credential = JsonValueAs<std::string>(item.value());
+            if (credential.second != Wasm::Common::JsonParserResultDetail::OK ||
+                !credential.first) {
+              return false;
+            }
+            if (rule.credential_to_name.find(credential.first.value()) !=
+                rule.credential_to_name.end()) {
+              LOG_WARN(absl::StrCat("duplicate consumer credential: ",
+                                    credential.first.value()));
+              return false;
+            }
+            rule.credentials.insert(credential.first.value());
+            rule.credential_to_name.emplace(
+                std::make_pair(credential.first.value(), name.first.value()));
+            return true;
+          })) {
+    LOG_WARN("failed to parse configuration for credentials.");
+    return false;
+  }
+  if (rule.credentials.empty()) {
+    LOG_INFO("at least one credential has to be configured for a rule.");
+    return false;
+  }
+  if (!JsonArrayIterate(configuration, "keys", [&](const json& item) -> bool {
+        auto key = JsonValueAs<std::string>(item);
+        if (key.second != Wasm::Common::JsonParserResultDetail::OK) {
+          return false;
+        }
+        rule.keys.push_back(key.first.value());
+        return true;
+      })) {
+    LOG_WARN("failed to parse configuration for keys.");
+    return false;
+  }
+  if (rule.keys.empty()) {
+    LOG_WARN("at least one key has to be configured for a rule.");
+    return false;
+  }
+  auto it = configuration.find("realm");
+  if (it != configuration.end()) {
+    auto realm_string = JsonValueAs<std::string>(it.value());
+    if (realm_string.second != Wasm::Common::JsonParserResultDetail::OK) {
+      return false;
+    }
+    rule.realm = realm_string.first.value();
+  }
+  it = configuration.find("in_query");
+  if (it != configuration.end()) {
+    auto in_query = JsonValueAs<bool>(it.value());
+    if (in_query.second != Wasm::Common::JsonParserResultDetail::OK ||
+        !in_query.first) {
+      LOG_WARN("failed to parse 'in_query' field in filter configuration.");
+      return false;
+    }
+    rule.in_query = in_query.first.value();
+  }
+  it = configuration.find("in_header");
+  if (it != configuration.end()) {
+    auto in_header = JsonValueAs<bool>(it.value());
+    if (in_header.second != Wasm::Common::JsonParserResultDetail::OK ||
+        !in_header.first) {
+      LOG_WARN("failed to parse 'in_header' field in filter configuration.");
+      return false;
+    }
+    rule.in_header = in_header.first.value();
+  }
+  if (!rule.in_query && !rule.in_header) {
+    LOG_WARN("at least one of 'in_query' and 'in_header' must set to true");
+    return false;
+  }
+  return true;
+}
+
+bool PluginRootContext::checkPlugin(
+    const KeyAuthConfigRule& rule,
+    const std::optional<std::unordered_set<std::string>>& allow_set) {
+  auto credential = extractCredential(rule);
+  if (credential.empty()) {
+    LOG_DEBUG("empty credential");
+    deniedNoKeyAuthData(rule.realm);
+    return false;
+  }
+  auto auth_credential_iter = rule.credentials.find(std::string(credential));
+  // Check if the credential is part of the credentials
+  // set from our container to grant or deny access.
+  if (auth_credential_iter == rule.credentials.end()) {
+    LOG_DEBUG(absl::StrCat("api key not found: ", credential));
+    deniedInvalidCredentials(rule.realm);
+    return false;
+  }
+  // Check if this credential has a consumer name. If so, check if this
+  // consumer is allowed to access. If allow_set is empty, allow all consumers.
+  auto credential_to_name_iter =
+      rule.credential_to_name.find(std::string(std::string(credential)));
+  if (credential_to_name_iter != rule.credential_to_name.end()) {
+    if (allow_set && !allow_set.value().empty()) {
+      if (allow_set.value().find(credential_to_name_iter->second) ==
+          allow_set.value().end()) {
+        deniedUnauthorizedConsumer(rule.realm);
+        LOG_DEBUG(credential_to_name_iter->second);
+        return false;
+      }
+    }
+    addRequestHeader("X-Mse-Consumer", credential_to_name_iter->second);
+  }
+  return true;
+}
+
+bool PluginRootContext::onConfigure(size_t size) {
+  // Parse configuration JSON string.
+  if (size > 0 && !configure(size)) {
+    LOG_WARN("configuration has errors initialization will not continue.");
+    setInvalidConfig();
+    return true;
+  }
+  return true;
+}
+
+bool PluginRootContext::configure(size_t configuration_size) {
+  auto configuration_data = getBufferBytes(WasmBufferType::PluginConfiguration,
+                                           0, configuration_size);
+  // Parse configuration JSON string.
+  auto result = ::Wasm::Common::JsonParse(configuration_data->view());
+  if (!result) {
+    LOG_WARN(absl::StrCat("cannot parse plugin configuration JSON string: ",
+                          configuration_data->view()));
+    return false;
+  }
+  if (!parseAuthRuleConfig(result.value())) {
+    LOG_WARN(absl::StrCat("cannot parse plugin configuration JSON string: ",
+                          configuration_data->view()));
+    return false;
+  }
+  return true;
+}
+
+std::string PluginRootContext::extractCredential(
+    const KeyAuthConfigRule& rule) {
+  auto request_path_header = getRequestHeader(":path");
+  auto path = request_path_header->view();
+  LOG_DEBUG(std::string(path));
+  if (rule.in_query) {
+    auto params = Wasm::Common::Http::parseAndDecodeQueryString(path);
+    for (const auto& key : rule.keys) {
+      auto it = params.find(key);
+      if (it != params.end()) {
+        return it->second;
+      }
+    }
+  }
+  if (rule.in_header) {
+    for (const auto& key : rule.keys) {
+      auto header = getRequestHeader(key);
+      if (header->size() != 0) {
+        return header->toString();
+      }
+    }
+  }
+  return "";
+}
+
+FilterHeadersStatus PluginContext::onRequestHeaders(uint32_t, bool) {
+  auto* rootCtx = rootContext();
+  return rootCtx->checkAuthRule(
+             [rootCtx](const auto& config, const auto& allow_set) {
+               return rootCtx->checkPlugin(config, allow_set);
+             })
+             ? FilterHeadersStatus::Continue
+             : FilterHeadersStatus::StopIteration;
+}
+
+#ifdef NULL_PLUGIN
+
+}  // namespace key_auth
+}  // namespace null_plugin
+}  // namespace proxy_wasm
+
+#endif

plugins/wasm-cpp/extensions/key_auth/plugin.h

@@ -0,0 +1,85 @@
+/*
+ * Copyright (c) 2022 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <assert.h>
+
+#include <string>
+#include <unordered_set>
+
+#include "common/route_rule_matcher.h"
+#define ASSERT(_X) assert(_X)
+
+#ifndef NULL_PLUGIN
+
+#include "proxy_wasm_intrinsics.h"
+
+#else
+
+#include "include/proxy-wasm/null_plugin.h"
+
+namespace proxy_wasm {
+namespace null_plugin {
+namespace key_auth {
+
+#endif
+
+struct KeyAuthConfigRule {
+  std::unordered_set<std::string> credentials;
+  std::unordered_map<std::string, std::string> credential_to_name;
+  std::string realm = "MSE Gateway";
+  std::vector<std::string> keys;
+  bool in_query = true;
+  bool in_header = true;
+};
+
+// PluginRootContext is the root context for all streams processed by the
+// thread. It has the same lifetime as the worker thread and acts as target for
+// interactions that outlives individual stream, e.g. timer, async calls.
+class PluginRootContext : public RootContext,
+                          public RouteRuleMatcher<KeyAuthConfigRule> {
+ public:
+  PluginRootContext(uint32_t id, std::string_view root_id)
+      : RootContext(id, root_id) {}
+  ~PluginRootContext() {}
+  bool onConfigure(size_t) override;
+  bool checkPlugin(const KeyAuthConfigRule&,
+                   const std::optional<std::unordered_set<std::string>>&);
+  bool configure(size_t);
+
+ private:
+  bool parsePluginConfig(const json&, KeyAuthConfigRule&) override;
+  std::string extractCredential(const KeyAuthConfigRule&);
+};
+
+// Per-stream context.
+class PluginContext : public Context {
+ public:
+  explicit PluginContext(uint32_t id, RootContext* root) : Context(id, root) {}
+  FilterHeadersStatus onRequestHeaders(uint32_t, bool) override;
+
+ private:
+  inline PluginRootContext* rootContext() {
+    return dynamic_cast<PluginRootContext*>(this->root());
+  }
+};
+
+#ifdef NULL_PLUGIN
+
+}  // namespace key_auth
+}  // namespace null_plugin
+}  // namespace proxy_wasm
+
+#endif

plugins/wasm-cpp/extensions/key_auth/plugin_test.cc

@@ -0,0 +1,245 @@
+// Copyright (c) 2022 Alibaba Group Holding Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "extensions/key_auth/plugin.h"
+
+#include "common/base64.h"
+#include "gmock/gmock.h"
+#include "gtest/gtest.h"
+#include "include/proxy-wasm/context.h"
+#include "include/proxy-wasm/null.h"
+
+namespace proxy_wasm {
+namespace null_plugin {
+namespace key_auth {
+
+NullPluginRegistry* context_registry_;
+RegisterNullVmPluginFactory register_key_auth_plugin("key_auth", []() {
+  return std::make_unique<NullPlugin>(key_auth::context_registry_);
+});
+
+class MockContext : public proxy_wasm::ContextBase {
+ public:
+  MockContext(WasmBase* wasm) : ContextBase(wasm) {}
+
+  MOCK_METHOD(BufferInterface*, getBuffer, (WasmBufferType));
+  MOCK_METHOD(WasmResult, log, (uint32_t, std::string_view));
+  MOCK_METHOD(WasmResult, getHeaderMapValue,
+              (WasmHeaderMapType /* type */, std::string_view /* key */,
+               std::string_view* /*result */));
+  MOCK_METHOD(WasmResult, addHeaderMapValue,
+              (WasmHeaderMapType /* type */, std::string_view /* key */,
+               std::string_view /* value */));
+  MOCK_METHOD(WasmResult, sendLocalResponse,
+              (uint32_t /* response_code */, std::string_view /* body */,
+               Pairs /* additional_headers */, uint32_t /* grpc_status */,
+               std::string_view /* details */));
+  MOCK_METHOD(WasmResult, getProperty, (std::string_view, std::string*));
+};
+
+class KeyAuthTest : public ::testing::Test {
+ protected:
+  KeyAuthTest() {
+    // Initialize test VM
+    test_vm_ = createNullVm();
+    wasm_base_ = std::make_unique<WasmBase>(
+        std::move(test_vm_), "test-vm", "", "",
+        std::unordered_map<std::string, std::string>{},
+        AllowedCapabilitiesMap{});
+    wasm_base_->load("key_auth");
+    wasm_base_->initialize();
+
+    // Initialize host side context
+    mock_context_ = std::make_unique<MockContext>(wasm_base_.get());
+    current_context_ = mock_context_.get();
+
+    ON_CALL(*mock_context_, log(testing::_, testing::_))
+        .WillByDefault([](uint32_t, std::string_view m) {
+          std::cerr << m << "\n";
+          return WasmResult::Ok;
+        });
+
+    ON_CALL(*mock_context_, getHeaderMapValue(WasmHeaderMapType::RequestHeaders,
+                                              testing::_, testing::_))
+        .WillByDefault([&](WasmHeaderMapType, std::string_view header,
+                           std::string_view* result) {
+          if (header == ":authority") {
+            *result = authority_;
+          }
+          if (header == ":path") {
+            *result = path_;
+          }
+          if (header == "x-api-key") {
+            *result = key_header_;
+          }
+          return WasmResult::Ok;
+        });
+    ON_CALL(*mock_context_, addHeaderMapValue(WasmHeaderMapType::RequestHeaders,
+                                              testing::_, testing::_))
+        .WillByDefault([&](WasmHeaderMapType, std::string_view key,
+                           std::string_view value) { return WasmResult::Ok; });
+
+    ON_CALL(*mock_context_, getProperty(testing::_, testing::_))
+        .WillByDefault([&](std::string_view path, std::string* result) {
+          *result = route_name_;
+          return WasmResult::Ok;
+        });
+
+    // Initialize Wasm sandbox context
+    root_context_ = std::make_unique<PluginRootContext>(0, "");
+    context_ = std::make_unique<PluginContext>(1, root_context_.get());
+  }
+  ~KeyAuthTest() override {}
+
+  std::unique_ptr<WasmBase> wasm_base_;
+  std::unique_ptr<WasmVm> test_vm_;
+  std::unique_ptr<MockContext> mock_context_;
+
+  std::unique_ptr<PluginRootContext> root_context_;
+  std::unique_ptr<PluginContext> context_;
+
+  std::string path_;
+  std::string authority_;
+  std::string route_name_;
+  std::string key_header_;
+};
+
+TEST_F(KeyAuthTest, InQuery) {
+  std::string configuration = R"(
+{
+  "_rules_": [
+    {
+      "_match_route_": ["test"],
+      "credentials":["abc"],
+      "keys": ["apiKey", "x-api-key"]
+    }
+  ]  
+})";
+  BufferBase buffer;
+  buffer.set(configuration);
+  EXPECT_CALL(*mock_context_, getBuffer(WasmBufferType::PluginConfiguration))
+      .WillOnce([&buffer](WasmBufferType) { return &buffer; });
+  EXPECT_TRUE(root_context_->configure(configuration.size()));
+
+  route_name_ = "test";
+  path_ = "/test?hello=123&apiKey=abc";
+  EXPECT_EQ(context_->onRequestHeaders(0, false),
+            FilterHeadersStatus::Continue);
+
+  path_ = "/test?hello=123";
+  EXPECT_EQ(context_->onRequestHeaders(0, false),
+            FilterHeadersStatus::StopIteration);
+
+  path_ = "/test?hello=123&apiKey=123";
+  EXPECT_EQ(context_->onRequestHeaders(0, false),
+            FilterHeadersStatus::StopIteration);
+}
+
+TEST_F(KeyAuthTest, InQueryWithConsumer) {
+  std::string configuration = R"(
+{
+  "consumers" : [ {"credential" : "abc", "name" : "consumer1"} ],
+  "keys" : [ "apiKey", "x-api-key" ],
+  "_rules_" : [ {"_match_route_" : ["test"], "allow" : ["consumer1"]} ]
+})";
+  BufferBase buffer;
+  buffer.set(configuration);
+  EXPECT_CALL(*mock_context_, getBuffer(WasmBufferType::PluginConfiguration))
+      .WillOnce([&buffer](WasmBufferType) { return &buffer; });
+  EXPECT_TRUE(root_context_->configure(configuration.size()));
+
+  route_name_ = "test";
+  path_ = "/test?hello=1&apiKey=abc";
+  EXPECT_EQ(context_->onRequestHeaders(0, false),
+            FilterHeadersStatus::Continue);
+
+  path_ = "/test?hello=123";
+  EXPECT_EQ(context_->onRequestHeaders(0, false),
+            FilterHeadersStatus::StopIteration);
+
+  path_ = "/test?hello=123&apiKey=123";
+  EXPECT_EQ(context_->onRequestHeaders(0, false),
+            FilterHeadersStatus::StopIteration);
+}
+
+TEST_F(KeyAuthTest, InHeader) {
+  std::string configuration = R"(
+{
+  "credentials":["abc", "xyz"],
+  "keys": ["x-api-key"]
+})";
+  BufferBase buffer;
+  buffer.set(configuration);
+  EXPECT_CALL(*mock_context_, getBuffer(WasmBufferType::PluginConfiguration))
+      .WillOnce([&buffer](WasmBufferType) { return &buffer; });
+  EXPECT_TRUE(root_context_->configure(configuration.size()));
+
+  path_ = "/test?hello=123";
+  key_header_ = "abc";
+  EXPECT_EQ(context_->onRequestHeaders(0, false),
+            FilterHeadersStatus::Continue);
+
+  path_ = "/test?hello=123";
+  key_header_ = "xyz";
+  EXPECT_EQ(context_->onRequestHeaders(0, false),
+            FilterHeadersStatus::Continue);
+
+  path_ = "/test?hello=123";
+  key_header_ = "";
+  EXPECT_EQ(context_->onRequestHeaders(0, false),
+            FilterHeadersStatus::StopIteration);
+
+  path_ = "/test?hello=123";
+  key_header_ = "123";
+  EXPECT_EQ(context_->onRequestHeaders(0, false),
+            FilterHeadersStatus::StopIteration);
+}
+
+TEST_F(KeyAuthTest, InHeaderWithConsumer) {
+  std::string configuration = R"(
+{
+  "consumers" : [ {"credential" : "abc", "name" : "consumer1"},
+                  {"credential" : "xyz", "name" : "consumer1"} ],
+  "keys": ["x-api-key"]
+})";
+  BufferBase buffer;
+  buffer.set(configuration);
+  EXPECT_CALL(*mock_context_, getBuffer(WasmBufferType::PluginConfiguration))
+      .WillOnce([&buffer](WasmBufferType) { return &buffer; });
+  EXPECT_TRUE(root_context_->configure(configuration.size()));
+
+  path_ = "/test?hello=123";
+  key_header_ = "abc";
+  EXPECT_EQ(context_->onRequestHeaders(0, false),
+            FilterHeadersStatus::Continue);
+
+  path_ = "/test?hello=123";
+  key_header_ = "xyz";
+  EXPECT_EQ(context_->onRequestHeaders(0, false),
+            FilterHeadersStatus::Continue);
+
+  path_ = "/test?hello=123";
+  key_header_ = "";
+  EXPECT_EQ(context_->onRequestHeaders(0, false),
+            FilterHeadersStatus::StopIteration);
+
+  path_ = "/test?hello=123";
+  key_header_ = "123";
+  EXPECT_EQ(context_->onRequestHeaders(0, false),
+            FilterHeadersStatus::StopIteration);
+}
+
+}  // namespace key_auth
+}  // namespace null_plugin
+}  // namespace proxy_wasm