DevFW-CICD/ingress-nginx-helm
6
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

extra waf rules per ingress (#2315)

Browse source 
* extra waf rules per ingress

* document annotation nginx.ingress.kubernetes.io/lua-resty-waf-extra-rules

* regenerate internal/file/bindata.go
This commit is contained in:
Elvin Efendi 2018-04-09 06:14:30 -04:00 • committed by Manuel Alejandro de Brito Fontes
parent 16faf309ca
commit bad8295a42
5 changed files with 67 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

38
test/e2e/annotations/luarestywaf.go
View file

@ -68,8 +68,44 @@ var _ = framework.IngressNginxDescribe("Annotations - lua-resty-waf", func() {
Expect(len(errs)).Should(Equal(0))
Expect(resp.StatusCode).Should(Equal(http.StatusOK))
})
})
It("should apply configured extra rules", func() {
host := "foo"
createIngress(f, host, map[string]string{
"nginx.ingress.kubernetes.io/lua-resty-waf": "true",
"nginx.ingress.kubernetes.io/lua-resty-waf-extra-rules": `[=[
{ "access": [
{ "actions": { "disrupt" : "DENY" },
"id": 10001,
"msg": "my custom rule",
"operator": "STR_CONTAINS",
"pattern": "foo",
"vars": [ { "parse": [ "values", 1 ], "type": "REQUEST_ARGS" } ] }
],
"body_filter": [],
"header_filter":[]
}
]=]`,
})
url := fmt.Sprintf("%s?msg=my-message", f.NginxHTTPURL)
resp, _, errs := gorequest.New().
Get(url).
Set("Host", host).
End()
Expect(len(errs)).Should(Equal(0))
Expect(resp.StatusCode).Should(Equal(http.StatusOK))
url = fmt.Sprintf("%s?msg=my-foo-message", f.NginxHTTPURL)
resp, _, errs = gorequest.New().
Get(url).
Set("Host", host).
End()
Expect(len(errs)).Should(Equal(0))
Expect(resp.StatusCode).Should(Equal(http.StatusForbidden))
})
})
Context("when lua-resty-waf is not enabled", func() {
It("should return 200 even for a malicious request", func() {
host := "foo"