mirror of
https://github.com/alibaba/higress.git
synced 2026-04-21 20:17:29 +08:00
Move codes to pkg (#46)
This commit is contained in:
Yang
GitHub
241
pkg/ingress/kube/annotations/ip_access_control_test.go
Normal file
241
pkg/ingress/kube/annotations/ip_access_control_test.go
Normal file
@@ -0,0 +1,241 @@
|
||||
// Copyright (c) 2022 Alibaba Group Holding Ltd.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
package annotations
|
||||
|
||||
import (
|
||||
"reflect"
|
||||
"testing"
|
||||
|
||||
networking "istio.io/api/networking/v1alpha3"
|
||||
)
|
||||
|
||||
func TestIPAccessControlParse(t *testing.T) {
|
||||
parser := ipAccessControl{}
|
||||
|
||||
testCases := []struct {
|
||||
input map[string]string
|
||||
expect *IPAccessControlConfig
|
||||
}{
|
||||
{},
|
||||
{
|
||||
input: map[string]string{
|
||||
DefaultAnnotationsPrefix + "/" + whitelist: "1.1.1.1",
|
||||
MSEAnnotationsPrefix + "/" + blacklist: "2.2.2.2",
|
||||
},
|
||||
expect: &IPAccessControlConfig{
|
||||
Route: &IPAccessControl{
|
||||
isWhite: true,
|
||||
remoteIp: []string{"1.1.1.1"},
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
input: map[string]string{
|
||||
MSEAnnotationsPrefix + "/" + blacklist: "2.2.2.2",
|
||||
},
|
||||
expect: &IPAccessControlConfig{
|
||||
Route: &IPAccessControl{
|
||||
isWhite: false,
|
||||
remoteIp: []string{"2.2.2.2"},
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
input: map[string]string{
|
||||
MSEAnnotationsPrefix + "/" + domainWhitelist: "1.1.1.1",
|
||||
},
|
||||
expect: &IPAccessControlConfig{
|
||||
Domain: &IPAccessControl{
|
||||
isWhite: true,
|
||||
remoteIp: []string{"1.1.1.1"},
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
input: map[string]string{
|
||||
MSEAnnotationsPrefix + "/" + whitelist: "1.1.1.1, 3.3.3.3",
|
||||
MSEAnnotationsPrefix + "/" + domainBlacklist: "2.2.2.2",
|
||||
},
|
||||
expect: &IPAccessControlConfig{
|
||||
Route: &IPAccessControl{
|
||||
isWhite: true,
|
||||
remoteIp: []string{"1.1.1.1", "3.3.3.3"},
|
||||
},
|
||||
Domain: &IPAccessControl{
|
||||
isWhite: false,
|
||||
remoteIp: []string{"2.2.2.2"},
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
for _, testCase := range testCases {
|
||||
t.Run("", func(t *testing.T) {
|
||||
config := &Ingress{}
|
||||
_ = parser.Parse(testCase.input, config, nil)
|
||||
if !reflect.DeepEqual(testCase.expect, config.IPAccessControl) {
|
||||
t.Fatalf("Should be equal")
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestIpAccessControl_ApplyVirtualServiceHandler(t *testing.T) {
|
||||
parser := ipAccessControl{}
|
||||
|
||||
testCases := []struct {
|
||||
config *Ingress
|
||||
input *networking.VirtualService
|
||||
expect *networking.HTTPFilter
|
||||
}{
|
||||
{
|
||||
config: &Ingress{},
|
||||
input: &networking.VirtualService{},
|
||||
expect: nil,
|
||||
},
|
||||
{
|
||||
config: &Ingress{
|
||||
IPAccessControl: &IPAccessControlConfig{
|
||||
Domain: &IPAccessControl{
|
||||
isWhite: true,
|
||||
remoteIp: []string{"1.1.1.1"},
|
||||
},
|
||||
},
|
||||
},
|
||||
input: &networking.VirtualService{},
|
||||
expect: &networking.HTTPFilter{
|
||||
Name: "ip-access-control",
|
||||
Disable: false,
|
||||
Filter: &networking.HTTPFilter_IpAccessControl{
|
||||
IpAccessControl: &networking.IPAccessControl{
|
||||
RemoteIpBlocks: []string{"1.1.1.1"},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
config: &Ingress{
|
||||
IPAccessControl: &IPAccessControlConfig{
|
||||
Domain: &IPAccessControl{
|
||||
isWhite: false,
|
||||
remoteIp: []string{"2.2.2.2"},
|
||||
},
|
||||
},
|
||||
},
|
||||
input: &networking.VirtualService{},
|
||||
expect: &networking.HTTPFilter{
|
||||
Name: "ip-access-control",
|
||||
Disable: false,
|
||||
Filter: &networking.HTTPFilter_IpAccessControl{
|
||||
IpAccessControl: &networking.IPAccessControl{
|
||||
NotRemoteIpBlocks: []string{"2.2.2.2"},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
for _, testCase := range testCases {
|
||||
t.Run("", func(t *testing.T) {
|
||||
parser.ApplyVirtualServiceHandler(testCase.input, testCase.config)
|
||||
if testCase.config.IPAccessControl == nil {
|
||||
if len(testCase.input.HostHTTPFilters) != 0 {
|
||||
t.Fatalf("Should be empty")
|
||||
}
|
||||
} else {
|
||||
if len(testCase.input.HostHTTPFilters) == 0 {
|
||||
t.Fatalf("Should be not empty")
|
||||
}
|
||||
if !reflect.DeepEqual(testCase.expect, testCase.input.HostHTTPFilters[0]) {
|
||||
t.Fatalf("Should be equal")
|
||||
}
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestIpAccessControl_ApplyRoute(t *testing.T) {
|
||||
parser := ipAccessControl{}
|
||||
|
||||
testCases := []struct {
|
||||
config *Ingress
|
||||
input *networking.HTTPRoute
|
||||
expect *networking.HTTPFilter
|
||||
}{
|
||||
{
|
||||
config: &Ingress{},
|
||||
input: &networking.HTTPRoute{},
|
||||
expect: nil,
|
||||
},
|
||||
{
|
||||
config: &Ingress{
|
||||
IPAccessControl: &IPAccessControlConfig{
|
||||
Route: &IPAccessControl{
|
||||
isWhite: true,
|
||||
remoteIp: []string{"1.1.1.1"},
|
||||
},
|
||||
},
|
||||
},
|
||||
input: &networking.HTTPRoute{},
|
||||
expect: &networking.HTTPFilter{
|
||||
Name: "ip-access-control",
|
||||
Disable: false,
|
||||
Filter: &networking.HTTPFilter_IpAccessControl{
|
||||
IpAccessControl: &networking.IPAccessControl{
|
||||
RemoteIpBlocks: []string{"1.1.1.1"},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
config: &Ingress{
|
||||
IPAccessControl: &IPAccessControlConfig{
|
||||
Route: &IPAccessControl{
|
||||
isWhite: false,
|
||||
remoteIp: []string{"2.2.2.2"},
|
||||
},
|
||||
},
|
||||
},
|
||||
input: &networking.HTTPRoute{},
|
||||
expect: &networking.HTTPFilter{
|
||||
Name: "ip-access-control",
|
||||
Disable: false,
|
||||
Filter: &networking.HTTPFilter_IpAccessControl{
|
||||
IpAccessControl: &networking.IPAccessControl{
|
||||
NotRemoteIpBlocks: []string{"2.2.2.2"},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
for _, testCase := range testCases {
|
||||
t.Run("", func(t *testing.T) {
|
||||
parser.ApplyRoute(testCase.input, testCase.config)
|
||||
if testCase.config.IPAccessControl == nil {
|
||||
if len(testCase.input.RouteHTTPFilters) != 0 {
|
||||
t.Fatalf("Should be empty")
|
||||
}
|
||||
} else {
|
||||
if len(testCase.input.RouteHTTPFilters) == 0 {
|
||||
t.Fatalf("Should be not empty")
|
||||
}
|
||||
if !reflect.DeepEqual(testCase.expect, testCase.input.RouteHTTPFilters[0]) {
|
||||
t.Fatalf("Should be equal")
|
||||
}
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user