DevFW-CICD/ingress-nginx-helm
6
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

CHERRY-PICK of #7665 - Remove snippet (#7666)

Browse source 
* Add option to force enabling snippet directives (#7665)

Signed-off-by: Ricardo Pchevuzinske Katz <ricardo.katz@gmail.com>

* Add missing key when cherry-picking
This commit is contained in:
Ricardo Katz 2021-09-19 21:52:08 -03:00 • committed by GitHub
parent f44bbe9b03
commit 64e2bed508
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
12 changed files with 459 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

42
test/e2e/annotations/modsecurity.go
View file

@ -282,7 +282,7 @@ var _ = framework.DescribeAnnotation("modsecurity owasp", func() {
f.WaitForNginxServer(host,
func(server string) bool {
return true
return strings.Contains(server, "SecRequestBodyAccess On")
})
f.HTTPTestClient().
@ -292,4 +292,44 @@ var _ = framework.DescribeAnnotation("modsecurity owasp", func() {
Expect().
Status(http.StatusForbidden)
})
ginkgo.It("should enable modsecurity through the config map but ignore snippet as disabled by admin", func() {
host := "modsecurity.foo.com"
nameSpace := f.Namespace
snippet := `SecRequestBodyAccess On
SecAuditEngine RelevantOnly
SecAuditLogParts ABIJDEFHZ
SecAuditLog /dev/stdout
SecAuditLogType Serial
SecRule REQUEST_HEADERS:User-Agent \"block-ua\" \"log,deny,id:107,status:403,msg:\'UA blocked\'\"`
annotations := map[string]string{
"nginx.ingress.kubernetes.io/modsecurity-snippet": snippet,
}
ing := framework.NewSingleIngress(host, "/", host, nameSpace, framework.EchoService, 80, annotations)
f.EnsureIngress(ing)
expectedComment := "SecRuleEngine On"
f.SetNginxConfigMapData(map[string]string{
"enable-modsecurity": "true",
"enable-owasp-modsecurity-crs": "true",
"enable-snippet-directives": "false",
"modsecurity-snippet": expectedComment,
})
f.WaitForNginxServer(host,
func(server string) bool {
return !strings.Contains(server, "block-ua")
})
f.HTTPTestClient().
GET("/").
WithHeader("Host", host).
WithHeader("User-Agent", "block-ua").
Expect().
Status(http.StatusOK)
})
})

51
test/e2e/annotations/serversnippet.go
View file

@ -17,6 +17,7 @@ limitations under the License.
package annotations
import (
"net/http"
"strings"
"github.com/onsi/ginkgo"
@ -35,8 +36,8 @@ var _ = framework.DescribeAnnotation("server-snippet", func() {
host := "serversnippet.foo.com"
annotations := map[string]string{
"nginx.ingress.kubernetes.io/server-snippet": `
more_set_headers "Content-Length: $content_length";
more_set_headers "Content-Type: $content_type";`,
more_set_headers "Foo: Bar";
more_set_headers "Xpto: Lalala";`,
}
ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations)
@ -44,8 +45,50 @@ var _ = framework.DescribeAnnotation("server-snippet", func() {
f.WaitForNginxServer(host,
func(server string) bool {
return strings.Contains(server, `more_set_headers "Content-Length: $content_length`) &&
strings.Contains(server, `more_set_headers "Content-Type: $content_type";`)
return strings.Contains(server, `more_set_headers "Foo: Bar`) &&
strings.Contains(server, `more_set_headers "Xpto: Lalala";`)
})
f.HTTPTestClient().
GET("/").
WithHeader("Host", host).
Expect().
Status(http.StatusOK).Headers().
ValueEqual("Foo", []string{"Bar"}).
ValueEqual("Xpto", []string{"Lalala"})
})
ginkgo.It(`drops server snippet if disabled by the administrator`, func() {
host := "noserversnippet.foo.com"
annotations := map[string]string{
"nginx.ingress.kubernetes.io/server-snippet": `
more_set_headers "Foo: Bar";
more_set_headers "Xpto: Lalala";`,
}
ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations)
f.UpdateNginxConfigMapData("enable-snippet-directives", "false")
defer func() {
// Return to the original value
f.UpdateNginxConfigMapData("enable-snippet-directives", "true")
}()
// Sleep a while just to guarantee that the configmap is applied
framework.Sleep()
f.EnsureIngress(ing)
f.WaitForNginxServer(host,
func(server string) bool {
return !strings.Contains(server, `more_set_headers "Foo: Bar`) &&
!strings.Contains(server, `more_set_headers "Xpto: Lalala";`)
})
f.HTTPTestClient().
GET("/").
WithHeader("Host", host).
Expect().
Status(http.StatusOK).Headers().
NotContainsKey("Foo").
NotContainsKey("Xpto")
})
})

44
test/e2e/annotations/snippet.go
View file

@ -17,6 +17,7 @@ limitations under the License.
package annotations
import (
"net/http"
"strings"
"github.com/onsi/ginkgo"
@ -31,11 +32,11 @@ var _ = framework.DescribeAnnotation("configuration-snippet", func() {
f.NewEchoDeployment()
})
ginkgo.It(`set snippet "more_set_headers "Request-Id: $req_id";" in all locations"`, func() {
ginkgo.It(`set snippet "more_set_headers "Foo1: Bar1";" in all locations"`, func() {
host := "configurationsnippet.foo.com"
annotations := map[string]string{
"nginx.ingress.kubernetes.io/configuration-snippet": `
more_set_headers "Request-Id: $req_id";`,
more_set_headers "Foo1: Bar1";`,
}
ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations)
@ -43,7 +44,44 @@ var _ = framework.DescribeAnnotation("configuration-snippet", func() {
f.WaitForNginxServer(host,
func(server string) bool {
return strings.Contains(server, `more_set_headers "Request-Id: $req_id";`)
return strings.Contains(server, `more_set_headers "Foo1: Bar1";`)
})
f.HTTPTestClient().
GET("/").
WithHeader("Host", host).
Expect().
Status(http.StatusOK).Headers().
ValueEqual("Foo1", []string{"Bar1"})
})
ginkgo.It(`drops snippet "more_set_headers "Foo1: Bar1";" in all locations if disabled by admin"`, func() {
host := "noconfigurationsnippet.foo.com"
annotations := map[string]string{
"nginx.ingress.kubernetes.io/configuration-snippet": `
more_set_headers "Foo1: Bar1";`,
}
ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations)
f.UpdateNginxConfigMapData("enable-snippet-directives", "false")
defer func() {
// Return to the original value
f.UpdateNginxConfigMapData("enable-snippet-directives", "true")
}()
// Sleep a while just to guarantee that the configmap is applied
framework.Sleep()
f.EnsureIngress(ing)
f.WaitForNginxServer(host,
func(server string) bool {
return !strings.Contains(server, `more_set_headers "Foo1: Bar1";`)
})
f.HTTPTestClient().
GET("/").
WithHeader("Host", host).
Expect().
Status(http.StatusOK).Headers().
NotContainsKey("Foo1")
})
})