t/lib/server.lua (626 lines of code) (raw):

-- -- Licensed to the Apache Software Foundation (ASF) under one or more -- contributor license agreements. See the NOTICE file distributed with -- this work for additional information regarding copyright ownership. -- The ASF licenses this file to You under the Apache License, Version 2.0 -- (the "License"); you may not use this file except in compliance with -- the License. You may obtain a copy of the License at -- -- http://www.apache.org/licenses/LICENSE-2.0 -- -- Unless required by applicable law or agreed to in writing, software -- distributed under the License is distributed on an "AS IS" BASIS, -- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -- See the License for the specific language governing permissions and -- limitations under the License. -- local json_decode = require("toolkit.json").decode local json_encode = require("toolkit.json").encode local rsa_public_key = [[ -----BEGIN PUBLIC KEY----- MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw86xcJwNxL2MkWnjIGiw 94QY78Sq89dLqMdV/Ku2GIX9lYkbS0VDGtmxDGJLBOYW4cKTX+pigJyzglLgE+nD z3VJf2oCqSV74gTyEdi7sw9e1rCyR6dR8VA7LEpIHwmhnDhhjXy1IYSKRdiVHLS5 sYmaAGckpUo3MLqUrgydGj5tFzvK/R/ELuZBdlZM+XuWxYry05r860E3uL+VdVCO oU4RJQknlJnTRd7ht8KKcZb6uM14C057i26zX/xnOJpaVflA4EyEo99hKQAdr8Sh G70MOLYvGCZxl1o8S3q4X67MxcPlfJaXnbog2AOOGRaFar88XiLFWTbXMCLuz7xD zQIDAQAB -----END PUBLIC KEY-----]] local rsa_private_key = [[ -----BEGIN PRIVATE KEY----- MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDDzrFwnA3EvYyR aeMgaLD3hBjvxKrz10uox1X8q7YYhf2ViRtLRUMa2bEMYksE5hbhwpNf6mKAnLOC UuAT6cPPdUl/agKpJXviBPIR2LuzD17WsLJHp1HxUDssSkgfCaGcOGGNfLUhhIpF 2JUctLmxiZoAZySlSjcwupSuDJ0aPm0XO8r9H8Qu5kF2Vkz5e5bFivLTmvzrQTe4 v5V1UI6hThElCSeUmdNF3uG3wopxlvq4zXgLTnuLbrNf/Gc4mlpV+UDgTISj32Ep AB2vxKEbvQw4ti8YJnGXWjxLerhfrszFw+V8lpeduiDYA44ZFoVqvzxeIsVZNtcw Iu7PvEPNAgMBAAECggEAVpyN9m7A1F631/aLheFpLgMbeKt4puV7zQtnaJ2XrZ9P PR7pmNDpTu4uF3k/D8qrIm+L+uhVa+hkquf3wDct6w1JVnfQ93riImbnoKdK13ic DcEZCwLjByfjFMNCxZ/gAZca55fbExlqhFy6EHmMjhB8s2LsXcTHRuGxNI/Vyi49 sxECibe0U53aqdJbVWrphIS67cpwl4TUkN6mrHsNuDYNJ9dgkpapoqp4FTFQsBqC afOK5qgJ68dWZ47FBUng+AZjdCncqAIuJxxItGVQP6YPsFs+OXcivIVHJr363TpC l85FfdvqWV5OGBbwSKhNwiTNUVvfSQVmtURGWG/HbQKBgQD4gZ1z9+Lx19kT9WTz lw93lxso++uhAPDTKviyWSRoEe5aN3LCd4My+/Aj+sk4ON/s2BV3ska5Im93j+vC rCv3uPn1n2jUhWuJ3bDqipeTW4n/CQA2m/8vd26TMk22yOkkqw2MIA8sjJ//SD7g tdG7up6DgGMP4hgbO89uGU7DAwKBgQDJtkKd0grh3u52Foeh9YaiAgYRwc65IE16 UyD1OJxIuX/dYQDLlo5KyyngFa1ZhWIs7qC7r3xXH+10kfJY+Q+5YMjmZjlL8SR1 Ujqd02R9F2//6OeswyReachJZbZdtiEw3lPa4jVFYfhSe0M2ZPxMwvoXb25eyCNI 1lYjSKq87wKBgHnLTNghjeDp4UKe6rNYPgRm0rDrhziJtX5JeUov1mALKb6dnmkh GfRK9g8sQqKDfXwfC6Z2gaMK9YaryujGaWYoCpoPXtmJ6oLPXH4XHuLh4mhUiP46 xn8FEfSimuQS4/FMxH8A128GHQSI7AhGFFzlwfrBWcvXC+mNDsTvMmLxAoGARc+4 upppfccETQZ7JsitMgD1TMwA2f2eEwoWTAitvlXFNT9PYSbYVHaAJbga6PLLCbYF FzAjHpxEOKYSdEyu7n/ayDL0/Z2V+qzc8KarDsg/0RgwppBbU/nUgeKb/U79qcYo y4ai3UKNCS70Ei1dTMvmdpnwXwlxfNIBufB6dy0CgYBMYq9Lc31GkC6PcGEEbx6W vjImOadWZbuOVnvEQjb5XCdcOsWsMcg96PtoeuyyHmhnEF1GsMzcIdQv/PHrvYpK Yp8D0aqsLEgwGrJQER26FPpKmyIwvcL+nm6q5W31PnU9AOC/WEkB6Zs58hsMzD2S kEJQcmfVew5mFXyxuEn3zA== -----END PRIVATE KEY-----]] local _M = {} local function inject_headers() local hdrs = ngx.req.get_headers() for k, v in pairs(hdrs) do if k:sub(1, 5) == "resp-" then ngx.header[k:sub(6)] = v end end end function _M.hello() ngx.req.read_body() local s = "hello world" ngx.header['Content-Length'] = #s + 1 ngx.say(s) end function _M.hello_chunked() ngx.print("hell") ngx.flush(true) ngx.print("o w") ngx.flush(true) ngx.say("orld") end function _M.hello1() ngx.say("hello1 world") end -- Fake endpoint, needed for testing authz-keycloak plugin. function _M.course_foo() ngx.say("course foo") end function _M.server_port() ngx.print(ngx.var.server_port) end _M.server_port_route2 = _M.server_port _M.server_port_hello = _M.server_port _M.server_port_aa = _M.server_port function _M.limit_conn() ngx.sleep(0.3) ngx.say("hello world") end function _M.plugin_proxy_rewrite() ngx.say("uri: ", ngx.var.uri) ngx.say("host: ", ngx.var.host) ngx.say("scheme: ", ngx.var.scheme) ngx.log(ngx.WARN, "plugin_proxy_rewrite get method: ", ngx.req.get_method()) end function _M.plugin_proxy_rewrite_args() ngx.say("uri: ", ngx.var.uri) local args = ngx.req.get_uri_args() local keys = {} for k, _ in pairs(args) do table.insert(keys, k) end table.sort(keys) for _, key in ipairs(keys) do if type(args[key]) == "table" then ngx.say(key, ": ", table.concat(args[key], ',')) else ngx.say(key, ": ", args[key]) end end end function _M.specific_status() local status = ngx.var.http_x_test_upstream_status if status ~= nil then ngx.status = status ngx.say("upstream status: ", status) end end function _M.status() ngx.log(ngx.WARN, "client request host: ", ngx.var.http_host) ngx.say("ok") end function _M.ewma() if ngx.var.server_port == "1981" or ngx.var.server_port == "1982" then ngx.sleep(0.2) else ngx.sleep(0.1) end ngx.print(ngx.var.server_port) end local builtin_hdr_ignore_list = { ["x-forwarded-for"] = true, ["x-forwarded-proto"] = true, ["x-forwarded-host"] = true, ["x-forwarded-port"] = true, } function _M.uri() ngx.say("uri: ", ngx.var.uri) local headers = ngx.req.get_headers() local keys = {} for k in pairs(headers) do if not builtin_hdr_ignore_list[k] then table.insert(keys, k) end end table.sort(keys) for _, key in ipairs(keys) do ngx.say(key, ": ", headers[key]) end end _M.uri_plugin_proxy_rewrite = _M.uri _M.uri_plugin_proxy_rewrite_args = _M.uri function _M.old_uri() ngx.say("uri: ", ngx.var.uri) local headers = ngx.req.get_headers() local keys = {} for k in pairs(headers) do table.insert(keys, k) end table.sort(keys) for _, key in ipairs(keys) do ngx.say(key, ": ", headers[key]) end end function _M.opentracing() ngx.say("opentracing") end function _M.with_header() --split into multiple chunk ngx.say("hello") ngx.say("world") ngx.say("!") end function _M.mock_zipkin() ngx.req.read_body() local data = ngx.req.get_body_data() ngx.log(ngx.NOTICE, data) local spans = json_decode(data) local ver = ngx.req.get_uri_args()['span_version'] if ver == "1" then if #spans ~= 5 then ngx.log(ngx.ERR, "wrong number of spans: ", #spans) ngx.exit(400) end else if #spans ~= 3 then -- request/proxy/response ngx.log(ngx.ERR, "wrong number of spans: ", #spans) ngx.exit(400) end end for _, span in pairs(spans) do local prefix = string.sub(span.name, 1, 6) if prefix ~= 'apisix' then ngx.log(ngx.ERR, "wrong prefix of name", prefix) ngx.exit(400) end if not span.traceId then ngx.log(ngx.ERR, "missing trace id") ngx.exit(400) end if not span.localEndpoint then ngx.log(ngx.ERR, "missing local endpoint") ngx.exit(400) end if span.localEndpoint.serviceName ~= 'APISIX' and span.localEndpoint.serviceName ~= 'apisix' then ngx.log(ngx.ERR, "wrong serviceName: ", span.localEndpoint.serviceName) ngx.exit(400) end if span.localEndpoint.port ~= 1984 then ngx.log(ngx.ERR, "wrong port: ", span.localEndpoint.port) ngx.exit(400) end local server_addr = ngx.req.get_uri_args()['server_addr'] if server_addr then if span.localEndpoint.ipv4 ~= server_addr then ngx.log(ngx.ERR, "server_addr mismatched") ngx.exit(400) end end end end function _M.wolf_rbac_login_rest() ngx.req.read_body() local data = ngx.req.get_body_data() local args = json_decode(data) if not args.username then ngx.say(json_encode({ok=false, reason="ERR_USERNAME_MISSING"})) ngx.exit(0) end if not args.password then ngx.say(json_encode({ok=false, reason="ERR_PASSWORD_MISSING"})) ngx.exit(0) end if args.username ~= "admin" then ngx.say(json_encode({ok=false, reason="ERR_USER_NOT_FOUND"})) ngx.exit(0) end if args.password ~= "123456" then ngx.say(json_encode({ok=false, reason="ERR_PASSWORD_ERROR"})) ngx.exit(0) end ngx.say(json_encode({ok=true, data={token="wolf-rbac-token", userInfo={nickname="administrator",username="admin", id="100"}}})) end function _M.wolf_rbac_access_check() local headers = ngx.req.get_headers() local token = headers['x-rbac-token'] if token ~= 'wolf-rbac-token' then ngx.say(json_encode({ok=false, reason="ERR_TOKEN_INVALID"})) ngx.exit(0) end local args = ngx.req.get_uri_args() local resName = args.resName if resName == '/hello' or resName == '/wolf/rbac/custom/headers' then ngx.say(json_encode({ok=true, data={ userInfo={nickname="administrator", username="admin", id="100"} }})) elseif resName == '/hello/500' then ngx.status = 500 ngx.say(json_encode({ok=false, reason="ERR_SERVER_ERROR"})) elseif resName == '/hello/401' then ngx.status = 401 ngx.say(json_encode({ok=false, reason="ERR_TOKEN_INVALID"})) else ngx.status = 403 ngx.say(json_encode({ok=false, reason="ERR_ACCESS_DENIED"})) end end function _M.wolf_rbac_user_info() local headers = ngx.req.get_headers() local token = headers['x-rbac-token'] if token ~= 'wolf-rbac-token' then ngx.say(json_encode({ok=false, reason="ERR_TOKEN_INVALID"})) ngx.exit(0) end ngx.say(json_encode({ok=true, data={ userInfo={nickname="administrator", username="admin", id="100"} }})) end function _M.wolf_rbac_change_pwd() ngx.req.read_body() local data = ngx.req.get_body_data() local args = json_decode(data) if args.oldPassword ~= "123456" then ngx.say(json_encode({ok=false, reason="ERR_OLD_PASSWORD_INCORRECT"})) ngx.exit(0) end ngx.say(json_encode({ok=true, data={ }})) end function _M.wolf_rbac_custom_headers() local headers = ngx.req.get_headers() ngx.say('id:' .. headers['X-UserId'] .. ',username:' .. headers['X-Username'] .. ',nickname:' .. headers['X-Nickname']) end function _M.websocket_handshake() local websocket = require "resty.websocket.server" local wb, err = websocket:new() if not wb then ngx.log(ngx.ERR, "failed to new websocket: ", err) return ngx.exit(400) end local bytes, err = wb:send_text("hello") if not bytes then ngx.log(ngx.ERR, "failed to send text: ", err) return ngx.exit(444) end end _M.websocket_handshake_route = _M.websocket_handshake function _M.api_breaker() ngx.exit(tonumber(ngx.var.arg_code)) end function _M.mysleep() ngx.sleep(tonumber(ngx.var.arg_seconds)) if ngx.var.arg_abort then ngx.exit(ngx.ERROR) else ngx.say(ngx.var.arg_seconds) end end local function print_uri() ngx.say(ngx.var.uri) end for i = 1, 100 do _M["print_uri_" .. i] = print_uri end function _M.print_uri_detailed() ngx.say("ngx.var.uri: ", ngx.var.uri) ngx.say("ngx.var.request_uri: ", ngx.var.request_uri) end function _M.headers() local args = ngx.req.get_uri_args() for name, val in pairs(args) do ngx.header[name] = nil ngx.header[name] = val end ngx.say("/headers") end function _M.echo() ngx.req.read_body() local hdrs = ngx.req.get_headers() for k, v in pairs(hdrs) do ngx.header[k] = v end ngx.print(ngx.req.get_body_data() or "") end function _M.log() ngx.req.read_body() local body = ngx.req.get_body_data() local ct = ngx.var.content_type if ct ~= "text/plain" then body = json_decode(body) body = json_encode(body) end ngx.log(ngx.WARN, "request log: ", body or "nil") end function _M.server_error() error("500 Internal Server Error") end function _M.log_request() ngx.log(ngx.WARN, "uri: ", ngx.var.uri) local headers = ngx.req.get_headers() local keys = {} for k in pairs(headers) do table.insert(keys, k) end table.sort(keys) for _, key in ipairs(keys) do ngx.log(ngx.WARN, key, ": ", headers[key]) end end function _M.v3_auth_authenticate() ngx.log(ngx.WARN, "etcd auth failed!") end function _M._well_known_openid_configuration() local t = require("lib.test_admin") local openid_data = t.read_file("t/plugin/openid-connect/configuration.json") ngx.say(openid_data) end function _M.google_logging_token() local args = ngx.req.get_uri_args() local args_token_type = args.token_type or "Bearer" ngx.req.read_body() local data = ngx.decode_args(ngx.req.get_body_data()) local jwt = require("resty.jwt") local access_scopes = "https://apisix.apache.org/logs:admin" local verify = jwt:verify(rsa_public_key, data["assertion"]) if not verify.verified then ngx.status = 401 ngx.say(json_encode({ error = "identity authentication failed" })) return end local scopes_valid = type(verify.payload.scope) == "string" and verify.payload.scope:find(access_scopes) if not scopes_valid then ngx.status = 403 ngx.say(json_encode({ error = "no access to this scopes" })) return end local expire_time = (verify.payload.exp or ngx.time()) - ngx.time() if expire_time <= 0 then expire_time = 0 end local jwt_token = jwt:sign(rsa_private_key, { header = { typ = "JWT", alg = "RS256" }, payload = { exp = verify.payload.exp, scope = access_scopes } }) ngx.say(json_encode({ access_token = jwt_token, expires_in = expire_time, token_type = args_token_type })) end function _M.google_logging_entries() local args = ngx.req.get_uri_args() local args_token_type = args.token_type or "Bearer" ngx.req.read_body() local data = ngx.req.get_body_data() local jwt = require("resty.jwt") local access_scopes = "https://apisix.apache.org/logs:admin" local headers = ngx.req.get_headers() local token = headers["Authorization"] if not token then ngx.status = 401 ngx.say(json_encode({ error = "authentication header not exists" })) return end token = string.sub(token, #args_token_type + 2) local verify = jwt:verify(rsa_public_key, token) if not verify.verified then ngx.status = 401 ngx.say(json_encode({ error = "identity authentication failed" })) return end local scopes_valid = type(verify.payload.scope) == "string" and verify.payload.scope:find(access_scopes) if not scopes_valid then ngx.status = 403 ngx.say(json_encode({ error = "no access to this scopes" })) return end local expire_time = (verify.payload.exp or ngx.time()) - ngx.time() if expire_time <= 0 then ngx.status = 403 ngx.say(json_encode({ error = "token has expired" })) return end ngx.say(data) end function _M.google_secret_token() local args = ngx.req.get_uri_args() local args_token_type = args.token_type or "Bearer" ngx.req.read_body() local data = ngx.decode_args(ngx.req.get_body_data()) local jwt = require("resty.jwt") local access_scopes = "https://www.googleapis.com/auth/cloud" local verify = jwt:verify(rsa_public_key, data["assertion"]) if not verify.verified then ngx.status = 401 ngx.say(json_encode({ error = "identity authentication failed" })) return end local scopes_valid = type(verify.payload.scope) == "string" and verify.payload.scope:find(access_scopes) if not scopes_valid then ngx.status = 403 ngx.say(json_encode({ error = "no access to this scope" })) return end local expire_time = (verify.payload.exp or ngx.time()) - ngx.time() if expire_time <= 0 then expire_time = 0 end local jwt_token = jwt:sign(rsa_private_key, { header = { typ = "JWT", alg = "RS256" }, payload = { exp = verify.payload.exp, scope = access_scopes } }) ngx.say(json_encode({ access_token = jwt_token, expires_in = expire_time, token_type = args_token_type })) end function _M.google_secret_apisix_jack() local args = ngx.req.get_uri_args() local args_token_type = args.token_type or "Bearer" local jwt = require("resty.jwt") local access_scopes = "https://www.googleapis.com/auth/cloud" local headers = ngx.req.get_headers() local token = headers["Authorization"] if not token then ngx.status = 401 ngx.say(json_encode({ error = "authentication header not exists" })) return end token = string.sub(token, #args_token_type + 2) local verify = jwt:verify(rsa_public_key, token) if not verify.verified then ngx.status = 401 ngx.say(json_encode({ error = "identity authentication failed" })) return end local scopes_valid = type(verify.payload.scope) == "string" and verify.payload.scope:find(access_scopes) if not scopes_valid then ngx.status = 403 ngx.say(json_encode({ error = "no access to this scope" })) return end local expire_time = (verify.payload.exp or ngx.time()) - ngx.time() if expire_time <= 0 then ngx.status = 403 ngx.say(json_encode({ error = "token has expired" })) return end local response = { name = "projects/647037004838/secrets/apisix/versions/1", payload = { data = "eyJrZXkiOiJ2YWx1ZSJ9", dataCrc32c = "2296192492" } } ngx.status = 200 ngx.say(json_encode(response)) end function _M.google_secret_apisix_error_jack() local args = ngx.req.get_uri_args() local args_token_type = args.token_type or "Bearer" local jwt = require("resty.jwt") local access_scopes = "https://www.googleapis.com/auth/root/cloud" local headers = ngx.req.get_headers() local token = headers["Authorization"] if not token then ngx.status = 401 ngx.say(json_encode({ error = "authentication header not exists" })) return end token = string.sub(token, #args_token_type + 2) local verify = jwt:verify(rsa_public_key, token) if not verify.verified then ngx.status = 401 ngx.say(json_encode({ error = "identity authentication failed" })) return end local scopes_valid = type(verify.payload.scope) == "string" and verify.payload.scope:find(access_scopes) if not scopes_valid then ngx.status = 403 ngx.say(json_encode({ error = "no access to this scope" })) return end local expire_time = (verify.payload.exp or ngx.time()) - ngx.time() if expire_time <= 0 then ngx.status = 403 ngx.say(json_encode({ error = "token has expired" })) return end local response = { name = "projects/647037004838/secrets/apisix_error/versions/1", payload = { data = "eyJrZXkiOiJ2YWx1ZSJ9", dataCrc32c = "2296192492" } } ngx.status = 200 ngx.say(json_encode(response)) end function _M.google_secret_apisix_mysql() local args = ngx.req.get_uri_args() local args_token_type = args.token_type or "Bearer" local jwt = require("resty.jwt") local access_scopes = "https://www.googleapis.com/auth/cloud" local headers = ngx.req.get_headers() local token = headers["Authorization"] if not token then ngx.status = 401 ngx.say(json_encode({ error = "authentication header not exists" })) return end token = string.sub(token, #args_token_type + 2) local verify = jwt:verify(rsa_public_key, token) if not verify.verified then ngx.status = 401 ngx.say(json_encode({ error = "identity authentication failed" })) return end local scopes_valid = type(verify.payload.scope) == "string" and verify.payload.scope:find(access_scopes) if not scopes_valid then ngx.status = 403 ngx.say(json_encode({ error = "no access to this scope" })) return end local expire_time = (verify.payload.exp or ngx.time()) - ngx.time() if expire_time <= 0 then ngx.status = 403 ngx.say(json_encode({ error = "token has expired" })) return end local response = { name = "projects/647037004838/secrets/apisix/versions/1", payload = { data = "c2VjcmV0", dataCrc32c = "0xB03C4D4D" } } ngx.status = 200 ngx.say(json_encode(response)) end function _M.plugin_proxy_rewrite_resp_header() ngx.req.read_body() local s = "plugin_proxy_rewrite_resp_header" ngx.header['Content-Length'] = #s + 1 ngx.say(s) end -- Please add your fake upstream above function _M.go() local action = string.sub(ngx.var.uri, 2) action = string.gsub(action, "[/\\.-]", "_") if not action or not _M[action] then ngx.log(ngx.WARN, "undefined path in test server, uri: ", ngx.var.request_uri) return ngx.exit(404) end inject_headers() return _M[action]() end function _M.clickhouse_logger_server() ngx.req.read_body() local data = ngx.req.get_body_data() local headers = ngx.req.get_headers() ngx.log(ngx.WARN, "clickhouse body: ", data) for k, v in pairs(headers) do ngx.log(ngx.WARN, "clickhouse headers: " .. k .. ":" .. v) end ngx.say("ok") end function _M.mock_compressed_upstream_response() local s = "compressed_response" ngx.header['Content-Encoding'] = 'gzip' ngx.say(s) end return _M