mirror of
https://github.com/alibaba/higress.git
synced 2026-05-08 04:17:27 +08:00
feat: add replay protection plugin (#1672)
Co-authored-by: hanxiantao <601803023@qq.com>
This commit is contained in:
yunmaoQu
GitHub
139
test/e2e/conformance/tests/go-wasm-replay-protection.go
Normal file
139
test/e2e/conformance/tests/go-wasm-replay-protection.go
Normal file
@@ -0,0 +1,139 @@
|
||||
// Copyright (c) 2025 Alibaba Group Holding Ltd.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
package tests
|
||||
|
||||
import (
|
||||
"crypto/rand"
|
||||
"encoding/base64"
|
||||
"testing"
|
||||
|
||||
"github.com/alibaba/higress/test/e2e/conformance/utils/http"
|
||||
"github.com/alibaba/higress/test/e2e/conformance/utils/suite"
|
||||
)
|
||||
|
||||
func init() {
|
||||
Register(WasmPluginsReplayProtection)
|
||||
}
|
||||
|
||||
func generateBase64Nonce(length int) string {
|
||||
bytes := make([]byte, length)
|
||||
rand.Read(bytes)
|
||||
return base64.StdEncoding.EncodeToString(bytes)
|
||||
}
|
||||
|
||||
var WasmPluginsReplayProtection = suite.ConformanceTest{
|
||||
ShortName: "WasmPluginsReplayProtection",
|
||||
Description: "The replay protection wasm plugin prevents replay attacks by validating request nonce.",
|
||||
Manifests: []string{"tests/go-wasm-replay-protection.yaml"},
|
||||
Features: []suite.SupportedFeature{suite.WASMGoConformanceFeature},
|
||||
Test: func(t *testing.T, suite *suite.ConformanceTestSuite) {
|
||||
replayNonce := generateBase64Nonce(32)
|
||||
testcases := []http.Assertion{
|
||||
{
|
||||
Meta: http.AssertionMeta{
|
||||
TestCaseName: "Missing nonce header",
|
||||
CompareTarget: http.CompareTargetResponse,
|
||||
},
|
||||
Request: http.AssertionRequest{
|
||||
ActualRequest: http.Request{
|
||||
Host: "foo.com",
|
||||
Path: "/",
|
||||
Method: "GET",
|
||||
},
|
||||
},
|
||||
Response: http.AssertionResponse{
|
||||
ExpectedResponse: http.Response{
|
||||
StatusCode: 400,
|
||||
ContentType: http.ContentTypeTextPlain,
|
||||
Body: []byte(`Missing Required Header`),
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
Meta: http.AssertionMeta{
|
||||
TestCaseName: "Invalid nonce not base64 encoded",
|
||||
CompareTarget: http.CompareTargetResponse,
|
||||
},
|
||||
Request: http.AssertionRequest{
|
||||
ActualRequest: http.Request{
|
||||
Host: "foo.com",
|
||||
Path: "/",
|
||||
Method: "GET",
|
||||
Headers: map[string]string{
|
||||
"X-Higress-Nonce": "invalid nonce",
|
||||
},
|
||||
},
|
||||
},
|
||||
Response: http.AssertionResponse{
|
||||
ExpectedResponse: http.Response{
|
||||
StatusCode: 400,
|
||||
ContentType: http.ContentTypeTextPlain,
|
||||
Body: []byte(`Invalid Nonce`),
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
Meta: http.AssertionMeta{
|
||||
TestCaseName: "First request with unique nonce returns 200",
|
||||
CompareTarget: http.CompareTargetResponse,
|
||||
},
|
||||
Request: http.AssertionRequest{
|
||||
ActualRequest: http.Request{
|
||||
Host: "foo.com",
|
||||
Path: "/",
|
||||
Method: "GET",
|
||||
Headers: map[string]string{
|
||||
"X-Higress-Nonce": replayNonce,
|
||||
},
|
||||
},
|
||||
},
|
||||
Response: http.AssertionResponse{
|
||||
ExpectedResponse: http.Response{
|
||||
StatusCode: 200,
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
Meta: http.AssertionMeta{
|
||||
TestCaseName: "Second request with repeated nonce returns 429",
|
||||
CompareTarget: http.CompareTargetResponse,
|
||||
},
|
||||
Request: http.AssertionRequest{
|
||||
ActualRequest: http.Request{
|
||||
Host: "foo.com",
|
||||
Path: "/",
|
||||
Method: "GET",
|
||||
Headers: map[string]string{
|
||||
"X-Higress-Nonce": replayNonce,
|
||||
},
|
||||
},
|
||||
},
|
||||
Response: http.AssertionResponse{
|
||||
ExpectedResponse: http.Response{
|
||||
StatusCode: 429,
|
||||
ContentType: http.ContentTypeTextPlain,
|
||||
Body: []byte(`Replay Attack Detected`),
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
t.Run("WasmPlugins replay-protection", func(t *testing.T) {
|
||||
for _, testcase := range testcases {
|
||||
http.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, suite.GatewayAddress, testcase)
|
||||
}
|
||||
})
|
||||
},
|
||||
}
|
||||
88
test/e2e/conformance/tests/go-wasm-replay-protection.yaml
Normal file
88
test/e2e/conformance/tests/go-wasm-replay-protection.yaml
Normal file
@@ -0,0 +1,88 @@
|
||||
# Copyright (c) 2025 Alibaba Group Holding Ltd.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
# Deploy Redis service
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: redis
|
||||
namespace: higress-conformance-infra
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: redis
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: redis
|
||||
spec:
|
||||
containers:
|
||||
- name: redis
|
||||
image: redis:6.2
|
||||
ports:
|
||||
- containerPort: 6379
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: redis
|
||||
namespace: higress-conformance-infra
|
||||
spec:
|
||||
ports:
|
||||
- port: 6379
|
||||
targetPort: 6379
|
||||
selector:
|
||||
app: redis
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: replay-protection
|
||||
namespace: higress-conformance-infra
|
||||
spec:
|
||||
ingressClassName: higress
|
||||
rules:
|
||||
- host: "foo.com"
|
||||
http:
|
||||
paths:
|
||||
- pathType: Prefix
|
||||
path: "/"
|
||||
backend:
|
||||
service:
|
||||
name: infra-backend-v1
|
||||
port:
|
||||
number: 8080
|
||||
---
|
||||
# Configure WasmPlugin
|
||||
apiVersion: extensions.higress.io/v1alpha1
|
||||
kind: WasmPlugin
|
||||
metadata:
|
||||
name: replay-protection
|
||||
namespace: higress-system
|
||||
spec:
|
||||
defaultConfig:
|
||||
force_nonce: true
|
||||
nonce_ttl: 86400
|
||||
nonce_header: "X-Higress-Nonce"
|
||||
nonce_min_length: 8
|
||||
nonce_max_length: 128
|
||||
validate_base64: true
|
||||
reject_code: 429
|
||||
redis:
|
||||
service_name: "redis.higress-conformance-infra.svc.cluster.local"
|
||||
service_port: 6379
|
||||
timeout: 1000
|
||||
key_prefix: "replay-protection"
|
||||
url: file:///opt/plugins/wasm-go/extensions/replay-protection/plugin.wasm
|
||||
Reference in New Issue
Block a user