jiazhizhong/higress
1
0
Fork 0
mirror of https://github.com/alibaba/higress.git synced 2026-06-08 20:27:31 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(wasm-go): add wasm go plugin unit test and ci workflow (#2809)

Browse Source
This commit is contained in:
Jingze
2025-08-28 20:02:03 +08:00
committed by GitHub
parent 3e0a5f02a7
commit a00b810be5
138 changed files with 27695 additions and 313 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
plugins/wasm-go/extensions/ip-restriction/go.mod
View File

@@ -5,16 +5,22 @@ go 1.24.1
toolchain go1.24.4
require (
github.com/higress-group/proxy-wasm-go-sdk v0.0.0-20250611100342-5654e89a7a80
github.com/higress-group/wasm-go v1.0.0
github.com/asergeyev/nradix v0.0.0-20170505151046-3872ab85bb56
github.com/higress-group/proxy-wasm-go-sdk v0.0.0-20250822030947-8345453fddd0
github.com/higress-group/wasm-go v1.0.2-0.20250821081215-b573359becf8
github.com/stretchr/testify v1.9.0
github.com/tidwall/gjson v1.18.0
github.com/zmap/go-iptree v0.0.0-20210731043055-d4e632617837
)
require (
github.com/asergeyev/nradix v0.0.0-20170505151046-3872ab85bb56 // indirect
github.com/davecgh/go-spew v1.1.1 // indirect
github.com/google/uuid v1.6.0 // indirect
github.com/pmezard/go-difflib v1.0.0 // indirect
github.com/tetratelabs/wazero v1.7.2 // indirect
github.com/tidwall/match v1.1.1 // indirect
github.com/tidwall/pretty v1.2.1 // indirect
github.com/tidwall/resp v0.1.1 // indirect
github.com/tidwall/sjson v1.2.5 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
)

15
plugins/wasm-go/extensions/ip-restriction/go.sum
View File

@@ -4,14 +4,17 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
github.com/higress-group/proxy-wasm-go-sdk v0.0.0-20250611100342-5654e89a7a80 h1:xqmtTZI0JQ2O+Lg9/CE6c+Tw9KD6FnvWw8EpLVuuvfg=
github.com/higress-group/proxy-wasm-go-sdk v0.0.0-20250611100342-5654e89a7a80/go.mod h1:tRI2LfMudSkKHhyv1uex3BWzcice2s/l8Ah8axporfA=
github.com/higress-group/wasm-go v1.0.0 h1:4Ik5n3FsJ5+r13KLQl2ky+8NuAE8dfWQwoKxXYD2KAw=
github.com/higress-group/wasm-go v1.0.0/go.mod h1:ODBV27sjmhIW8Cqv3R74EUcTnbdkE69bmXBQFuRkY1M=
github.com/higress-group/proxy-wasm-go-sdk v0.0.0-20250822030947-8345453fddd0 h1:YGdj8KBzVjabU3STUfwMZghB+VlX6YLfJtLbrsWaOD0=
github.com/higress-group/proxy-wasm-go-sdk v0.0.0-20250822030947-8345453fddd0/go.mod h1:tRI2LfMudSkKHhyv1uex3BWzcice2s/l8Ah8axporfA=
github.com/higress-group/wasm-go v1.0.2-0.20250821081215-b573359becf8 h1:rs+AH1wfZy4swzuAyiRXT7xPUm8gycXt9Gwy0tqOq0o=
github.com/higress-group/wasm-go v1.0.2-0.20250821081215-b573359becf8/go.mod h1:9k7L730huS/q4V5iH9WLDgf5ZUHEtfhM/uXcegKDG/M=
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
github.com/tetratelabs/wazero v1.7.2 h1:1+z5nXJNwMLPAWaTePFi49SSTL0IMx/i3Fg8Yc25GDc=
github.com/tetratelabs/wazero v1.7.2/go.mod h1:ytl6Zuh20R/eROuyDaGPkp82O9C/DJfXAwJfQ3X6/7Y=
github.com/tidwall/gjson v1.14.2/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
github.com/tidwall/gjson v1.18.0 h1:FIDeeyB800efLX89e5a8Y0BNH+LOngJyGrIWxG2FKQY=
github.com/tidwall/gjson v1.18.0/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
@@ -21,7 +24,11 @@ github.com/tidwall/pretty v1.2.1 h1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4=
github.com/tidwall/pretty v1.2.1/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
github.com/tidwall/resp v0.1.1 h1:Ly20wkhqKTmDUPlyM1S7pWo5kk0tDu8OoC/vFArXmwE=
github.com/tidwall/resp v0.1.1/go.mod h1:3/FrruOBAxPTPtundW0VXgmsQ4ZBA0Aw714lVYgwFa0=
github.com/tidwall/sjson v1.2.5 h1:kLy8mja+1c9jlljvWTlSazM7cKDRfJuR/bOJhcY5NcY=
github.com/tidwall/sjson v1.2.5/go.mod h1:Fvgq9kS/6ociJEDnK0Fk1cpYF4FIW6ZF7LAe+6jwd28=
github.com/zmap/go-iptree v0.0.0-20210731043055-d4e632617837 h1:DjHnADS2r2zynZ3WkCFAQ+PNYngMSNceRROi0pO6c3M=
github.com/zmap/go-iptree v0.0.0-20210731043055-d4e632617837/go.mod h1:9vp0bxqozzQwcjBwenEXfKVq8+mYbwHkQ1NF9Ap0DMw=
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

372
plugins/wasm-go/extensions/ip-restriction/main_test.go Normal file
View File

@@ -0,0 +1,372 @@
// Copyright (c) 2022 Alibaba Group Holding Ltd.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
package main
import (
"encoding/json"
"testing"
"github.com/higress-group/proxy-wasm-go-sdk/proxywasm/types"
"github.com/higress-group/wasm-go/pkg/test"
"github.com/stretchr/testify/require"
)
// 测试配置：白名单模式
var allowConfig = func() json.RawMessage {
data, _ := json.Marshal(map[string]interface{}{
"ip_source_type": "origin-source",
"allow": []string{"192.168.1.0/24", "10.0.0.1"},
"status": 403,
"message": "Access denied",
})
return data
}()
// 测试配置：黑名单模式
var denyConfig = func() json.RawMessage {
data, _ := json.Marshal(map[string]interface{}{
"ip_source_type": "header",
"ip_header_name": "X-Real-IP",
"deny": []string{"192.168.2.0/24", "10.0.0.2"},
"status": 429,
"message": "IP blocked",
})
return data
}()
// 测试配置：使用默认值
var defaultConfig = func() json.RawMessage {
data, _ := json.Marshal(map[string]interface{}{
"allow": []string{"127.0.0.1"},
})
return data
}()
// 测试配置：无效配置（同时设置 allow 和 deny）
var invalidConfig = func() json.RawMessage {
data, _ := json.Marshal(map[string]interface{}{
"allow": []string{"127.0.0.1"},
"deny": []string{"192.168.1.1"},
})
return data
}()
// 测试配置：空配置（没有 allow 和 deny）
var emptyConfig = func() json.RawMessage {
data, _ := json.Marshal(map[string]interface{}{
"ip_source_type": "origin-source",
})
return data
}()
func TestParseConfig(t *testing.T) {
test.RunGoTest(t, func(t *testing.T) {
// 测试白名单配置
t.Run("allow list config", func(t *testing.T) {
host, status := test.NewTestHost(allowConfig)
defer host.Reset()
require.Equal(t, types.OnPluginStartStatusOK, status)
config, err := host.GetMatchConfig()
require.NoError(t, err)
require.NotNil(t, config)
restrictionConfig := config.(*RestrictionConfig)
require.Equal(t, "origin-source", restrictionConfig.IPSourceType)
require.Equal(t, "X-Forwarded-For", restrictionConfig.IPHeaderName) // 默认值
require.NotNil(t, restrictionConfig.Allow)
require.Nil(t, restrictionConfig.Deny)
require.Equal(t, uint32(403), restrictionConfig.Status)
require.Equal(t, "Access denied", restrictionConfig.Message)
})
// 测试黑名单配置
t.Run("deny list config", func(t *testing.T) {
host, status := test.NewTestHost(denyConfig)
defer host.Reset()
require.Equal(t, types.OnPluginStartStatusOK, status)
config, err := host.GetMatchConfig()
require.NoError(t, err)
require.NotNil(t, config)
restrictionConfig := config.(*RestrictionConfig)
require.Equal(t, "header", restrictionConfig.IPSourceType)
require.Equal(t, "X-Real-IP", restrictionConfig.IPHeaderName)
require.Nil(t, restrictionConfig.Allow)
require.NotNil(t, restrictionConfig.Deny)
require.Equal(t, uint32(429), restrictionConfig.Status)
require.Equal(t, "IP blocked", restrictionConfig.Message)
})
// 测试默认配置
t.Run("default config", func(t *testing.T) {
host, status := test.NewTestHost(defaultConfig)
defer host.Reset()
require.Equal(t, types.OnPluginStartStatusOK, status)
config, err := host.GetMatchConfig()
require.NoError(t, err)
require.NotNil(t, config)
restrictionConfig := config.(*RestrictionConfig)
require.Equal(t, "origin-source", restrictionConfig.IPSourceType) // 默认值
require.Equal(t, "X-Forwarded-For", restrictionConfig.IPHeaderName) // 默认值
require.NotNil(t, restrictionConfig.Allow)
require.Nil(t, restrictionConfig.Deny)
require.Equal(t, uint32(403), restrictionConfig.Status) // 默认值
require.Equal(t, "Your IP address is blocked.", restrictionConfig.Message) // 默认值
})
// 测试无效配置（同时设置 allow 和 deny）
t.Run("invalid config - both allow and deny", func(t *testing.T) {
host, status := test.NewTestHost(invalidConfig)
defer host.Reset()
require.Equal(t, types.OnPluginStartStatusFailed, status)
})
// 测试空配置（没有 allow 和 deny）
t.Run("empty config - no allow or deny", func(t *testing.T) {
host, status := test.NewTestHost(emptyConfig)
defer host.Reset()
require.Equal(t, types.OnPluginStartStatusFailed, status)
})
})
}
func TestOnHttpRequestHeaders(t *testing.T) {
test.RunTest(t, func(t *testing.T) {
// 测试白名单模式 - IP 在白名单中（应该通过）
t.Run("allow list - IP allowed", func(t *testing.T) {
host, status := test.NewTestHost(allowConfig)
defer host.Reset()
require.Equal(t, types.OnPluginStartStatusOK, status)
// 设置源 IP 地址（在白名单中）
host.SetProperty([]string{"source", "address"}, []byte("192.168.1.100:8080"))
action := host.CallOnHttpRequestHeaders([][2]string{
{":authority", "example.com"},
{":path", "/test"},
{":method", "GET"},
})
require.Equal(t, types.ActionContinue, action)
require.Equal(t, types.ActionContinue, host.GetHttpStreamAction())
localResponse := host.GetLocalResponse()
require.Nil(t, localResponse, "IP in allow list should pass through")
host.CompleteHttp()
})
// 测试白名单模式 - IP 不在白名单中（应该被阻止）
t.Run("allow list - IP not allowed", func(t *testing.T) {
host, status := test.NewTestHost(allowConfig)
defer host.Reset()
require.Equal(t, types.OnPluginStartStatusOK, status)
// 设置源 IP 地址（不在白名单中）
host.SetProperty([]string{"source", "address"}, []byte("192.168.2.100:8080"))
action := host.CallOnHttpRequestHeaders([][2]string{
{":authority", "example.com"},
{":path", "/test"},
{":method", "GET"},
})
require.Equal(t, types.ActionContinue, action)
require.Equal(t, types.ActionContinue, host.GetHttpStreamAction())
localResponse := host.GetLocalResponse()
require.NotNil(t, localResponse)
require.Equal(t, uint32(403), localResponse.StatusCode)
// 验证 JSON 响应格式
var responseData map[string]string
err := json.Unmarshal(localResponse.Data, &responseData)
require.NoError(t, err)
require.Equal(t, "Access denied", responseData["message"])
host.CompleteHttp()
})
// 测试黑名单模式 - IP 在黑名单中（应该被阻止）
t.Run("deny list - IP denied", func(t *testing.T) {
host, status := test.NewTestHost(denyConfig)
defer host.Reset()
require.Equal(t, types.OnPluginStartStatusOK, status)
action := host.CallOnHttpRequestHeaders([][2]string{
{":authority", "example.com"},
{":path", "/test"},
{":method", "GET"},
{"X-Real-IP", "192.168.2.100"}, // IP 在黑名单中
})
require.Equal(t, types.ActionContinue, action)
require.Equal(t, types.ActionContinue, host.GetHttpStreamAction())
localResponse := host.GetLocalResponse()
require.NotNil(t, localResponse)
require.Equal(t, uint32(429), localResponse.StatusCode)
// 验证 JSON 响应格式
var responseData map[string]string
err := json.Unmarshal(localResponse.Data, &responseData)
require.NoError(t, err)
require.Equal(t, "IP blocked", responseData["message"])
host.CompleteHttp()
})
// 测试黑名单模式 - IP 不在黑名单中（应该通过）
t.Run("deny list - IP not denied", func(t *testing.T) {
host, status := test.NewTestHost(denyConfig)
defer host.Reset()
require.Equal(t, types.OnPluginStartStatusOK, status)
action := host.CallOnHttpRequestHeaders([][2]string{
{":authority", "example.com"},
{":path", "/test"},
{":method", "GET"},
{"X-Real-IP", "192.168.3.100"}, // IP 不在黑名单中
})
require.Equal(t, types.ActionContinue, action)
require.Equal(t, types.ActionContinue, host.GetHttpStreamAction())
localResponse := host.GetLocalResponse()
require.Nil(t, localResponse, "IP not in deny list should pass through")
host.CompleteHttp()
})
// 测试从请求头获取 IP - 多个 IP 的情况
t.Run("header source - multiple IPs", func(t *testing.T) {
host, status := test.NewTestHost(denyConfig)
defer host.Reset()
require.Equal(t, types.OnPluginStartStatusOK, status)
action := host.CallOnHttpRequestHeaders([][2]string{
{":authority", "example.com"},
{":path", "/test"},
{":method", "GET"},
{"X-Real-IP", "192.168.3.100, 10.0.0.1, 172.16.0.1"}, // 多个 IP，取第一个
})
require.Equal(t, types.ActionContinue, action)
require.Equal(t, types.ActionContinue, host.GetHttpStreamAction())
localResponse := host.GetLocalResponse()
require.Nil(t, localResponse, "First IP not in deny list should pass through")
host.CompleteHttp()
})
// 测试无效 IP 地址
t.Run("invalid IP address", func(t *testing.T) {
host, status := test.NewTestHost(allowConfig)
defer host.Reset()
require.Equal(t, types.OnPluginStartStatusOK, status)
// 设置无效的源 IP 地址
host.SetProperty([]string{"source", "address"}, []byte("invalid-ip:8080"))
action := host.CallOnHttpRequestHeaders([][2]string{
{":authority", "example.com"},
{":path", "/test"},
{":method", "GET"},
})
require.Equal(t, types.ActionContinue, action)
require.Equal(t, types.ActionContinue, host.GetHttpStreamAction())
localResponse := host.GetLocalResponse()
require.NotNil(t, localResponse)
require.Equal(t, uint32(403), localResponse.StatusCode)
host.CompleteHttp()
})
// 测试 IPv6 地址
t.Run("IPv6 address", func(t *testing.T) {
host, status := test.NewTestHost(allowConfig)
defer host.Reset()
require.Equal(t, types.OnPluginStartStatusOK, status)
// 设置 IPv6 源地址
host.SetProperty([]string{"source", "address"}, []byte("[2001:db8::1]:8080"))
action := host.CallOnHttpRequestHeaders([][2]string{
{":authority", "example.com"},
{":path", "/test"},
{":method", "GET"},
})
require.Equal(t, types.ActionContinue, action)
require.Equal(t, types.ActionContinue, host.GetHttpStreamAction())
localResponse := host.GetLocalResponse()
require.NotNil(t, localResponse) // IPv6 不在白名单中，应该被阻止
require.Equal(t, uint32(403), localResponse.StatusCode)
host.CompleteHttp()
})
})
}
func TestParseIP(t *testing.T) {
// 测试 parseIP 函数
t.Run("IPv4 address", func(t *testing.T) {
result := parseIP("192.168.1.100:8080", false)
require.Equal(t, "192.168.1.100", result)
})
t.Run("IPv4 address without port", func(t *testing.T) {
result := parseIP("192.168.1.100", false)
require.Equal(t, "192.168.1.100", result)
})
t.Run("IPv6 address with port", func(t *testing.T) {
result := parseIP("[2001:db8::1]:8080", false)
require.Equal(t, "2001:db8::1", result)
})
t.Run("IPv6 address without port", func(t *testing.T) {
result := parseIP("[2001:db8::1]", false)
require.Equal(t, "2001:db8::1", result)
})
t.Run("IP from header - multiple IPs", func(t *testing.T) {
result := parseIP("192.168.1.100, 10.0.0.1, 172.16.0.1", true)
require.Equal(t, "192.168.1.100", result)
})
t.Run("IP from header - single IP", func(t *testing.T) {
result := parseIP("192.168.1.100", true)
require.Equal(t, "192.168.1.100", result)
})
t.Run("IP with spaces", func(t *testing.T) {
result := parseIP(" 192.168.1.100 ", false)
require.Equal(t, "192.168.1.100", result)
})
t.Run("empty IP", func(t *testing.T) {
result := parseIP("", false)
require.Equal(t, "", result)
})
}