run integration tests

apicast/.gitignore

@@ -0,0 +1,2 @@
+lua_modules
+t/servroot

apicast/.s2iignore

@@ -1 +1,3 @@
 .idea
+*.swp
+lua_modules

apicast/Makefile

@@ -1,6 +1,6 @@
 .DEFAULT_GOAL := help
 
-APICAST_VERSION ?= policy-chain
+APICAST_VERSION ?= v3.2.0-alpha2
 RUNTIME_IMAGE ?= quay.io/3scale/apicast:$(APICAST_VERSION)
 BUILDER_IMAGE ?= $(RUNTIME_IMAGE)-builder
 IMAGE_TAG ?= $(APICAST_VERSION)
@@ -11,7 +11,7 @@ REMOTE_IMAGE_NAME ?= $(IMAGE_NAME):$(IMAGE_TAG)
 LOG_LEVEL ?= notice
 
 build: ## Build the image
-	s2i build .  $(BUILDER_IMAGE) $(LOCAL_IMAGE_NAME) --environment-file=.env --runtime-image=$(RUNTIME_IMAGE)
+	s2i build .  $(BUILDER_IMAGE) $(LOCAL_IMAGE_NAME) --environment-file=.env --runtime-image=$(RUNTIME_IMAGE) --loglevel=5
 
 test: ## Run tests (try to start the image)
 	docker run -it --rm $(LOCAL_IMAGE_NAME) bin/apicast -d

apicast/Roverfile

@@ -1,5 +1,10 @@
 luarocks {
 	group 'production' {
 		module { 'lua-resty-iputils' },
+	},
+
+	group { 'development', 'test' } {
+		module { 'apicast' },
+		module { 'lua-resty-repl' },
 	}
 }

apicast/Roverfile.lock

@@ -1 +1,14 @@
+apicast scm-1|b28109bd80571cb04c4364b99281db8a27ac5374
+argparse 0.5.0-1|
+inspect 3.1.1-0|
+liquid scm-1|811a73e38fdd9fdea116be4baf310ca326b96c77
+lua-resty-env 0.4.0-1|
+lua-resty-execvp 0.1.0-1|
+lua-resty-http 0.12-0|
 lua-resty-iputils 0.3.0-1|
+lua-resty-jwt 0.1.11-0|
+lua-resty-repl 0.0.6-0|3878f41b7e8f97b1c96919db19dbee9496569dda
+lua-resty-url 0.2.0-1|
+luafilesystem 1.7.0-2|
+penlight 1.5.4-1|
+router 2.1-0|

apicast/cpanfile

@@ -0,0 +1 @@
+requires 'Test::APIcast', '0.03';

apicast/src/cloud_hosted/balancer_blacklist.lua

@@ -2,7 +2,7 @@ local iputils = require("resty.iputils")
 local default_balancer = require('resty.balancer.round_robin').call
 local resty_balancer = require('resty.balancer')
 
-local _M = { _VERSION = '0.0', _NAME = 'IP Blacklist' }
+local _M = require('apicast.policy').new('IP Blacklist', '0.1')
 local mt = { __index = _M }
 
 local ipv4 = {
@@ -25,7 +25,6 @@ for _,cidrs in pairs(ipv4) do
   end
 end
 
-
 function _M.new()
   return setmetatable({}, mt)
 end

apicast/src/cloud_hosted/rate_limit.lua

@@ -1,36 +1,60 @@
-local setmetatable = setmetatable
-
 local limit_req = require "resty.limit.req"
 
-local _M = { _VERSION = '0.0', _NAME = 'Rate Limit' }
-local mt = { __index = _M }
+local _M = require('apicast.policy').new('Rate Limit', '0.1')
+
+local new = _M.new
 
-function _M.new(limit, burst)
-  local limiter, err = limit_req.new("rate_limit_req_store", limit, burst)
+local function new_limiter(limit, burst)
+  local limiter, err = limit_req.new("rate_limit_req_store", limit, burst or 0)
 
   if limiter then
-    ngx.log(ngx.NOTICE, 'rate limit: ', limit, '/s', ' burst: ', burst, '/s')
+    ngx.log(ngx.NOTICE, 'rate limit: ', limit, '/s', ' burst: ', burst or limit, '/s')
   elseif not arg then  -- arg is a table when executed from the CLI
     ngx.log(ngx.ERR, 'error loading rate limiter: ', err)
   end
 
-  return setmetatable({
-    limiter = limiter
-  }, mt)
+  return limiter
+end
+
+local empty = {}
+
+function _M.new(configuration)
+  local policy = new(configuration)
+  local config = configuration or empty
+
+  local limit = config.limit
+  local burst = config.burst
+
+  policy.status = config.status
+
+  if limit then
+    policy.limiter = new_limiter(limit, burst)
+    assert(policy.limiter, 'missing limiter')
+  else
+    ngx.log(ngx.NOTICE, 'rate limit not set')
+  end
+
+  return policy
+end
+
+function _M:content()
+  ngx.log(ngx.STDERR, 'this is content phase')
 end
 
-function _M:call(host)
+function _M:access(context)
   local limiter = self.limiter
 
   if not limiter then return nil, 'missing limiter' end
 
-  local key = host or ngx.var.host
+  local key = context.host or ngx.var.host
+  local status = self.status or 503
 
   local delay, err = limiter:incoming(key, true)
 
   if not delay then
+    ngx.log(ngx.WARN, err, ' request over limit, key: ', key)
     if err == "rejected" then
-      return ngx.exit(503)
+      return ngx.exit(status)
     end
     ngx.log(ngx.ERR, "failed to limit req: ", err)
     return ngx.exit(500)

apicast/src/cloud_hosted/upstream.lua

@@ -0,0 +1,37 @@
+local resty_resolver = require('resty.resolver')
+local resty_url = require('resty.url')
+local format = string.format
+
+local _M = require('apicast.policy').new('Upstream', '0.1')
+
+local new = _M.new
+
+local empty = {}
+function _M.new(configuration)
+  local policy = new(configuration)
+  local config = configuration or empty
+
+  local url = resty_url.parse(config.url) or empty
+  local host = config.host or url.host
+
+  policy.host = host
+  policy.url = url
+
+  return policy
+end
+
+function _M:content()
+  local url = self.url
+  local host = self.host
+
+  ngx.ctx.upstream = resty_resolver:instance():get_servers(url.host, { port = url.port })
+  ngx.var.proxy_pass = format('%s://upstream%s', url.scheme, url.path or '')
+  ngx.req.set_header('Host', host or ngx.var.host)
+
+  if not ngx.headers_sent then
+    ngx.exec("@upstream")
+  end
+end
+
+
+return _M

apicast/t/blacklist.t

@@ -0,0 +1,68 @@
+BEGIN {
+    $ENV{TEST_NGINX_APICAST_BINARY} ||= 'rover exec apicast';
+}
+
+use strict;
+use warnings FATAL => 'all';
+use Test::APIcast::Blackbox 'no_plan';
+
+repeat_each(1);
+run_tests();
+
+__DATA__
+
+=== TEST 1: balancer blacklist
+The module does not crash without configuration.
+--- configuration
+{
+  "services": [
+    {
+      "proxy": {
+        "policy_chain": [
+          { "name": "cloud_hosted.balancer_blacklist" },
+          { "name": "apicast.policy.echo", "configuration": { } }
+        ]
+      }
+    }
+  ]
+}
+--- request
+GET /t
+--- response_body
+GET /t HTTP/1.1
+--- error_code: 200
+--- no_error_log
+[error]
+
+
+
+=== TEST 2: balancer upstream blacklist
+Going to prevent connecting to local upstream.
+--- ONLY
+--- configuration
+{
+  "services": [
+    {
+      "proxy": {
+        "policy_chain": [
+          { "name": "cloud_hosted.balancer_blacklist" },
+          { "name": "cloud_hosted.upstream",
+            "configuration": {
+              "url": "http://test:$TEST_NGINX_SERVER_PORT", "host": "test"
+            }
+          }
+        ]
+      }
+    }
+  ]
+}
+--- upstream
+location /t {
+  content_by_lua_block { ngx.say('ok') }
+}
+--- request
+GET /t
+--- error_code: 503
+--- error_log
+failed to set current backend peer: blacklisted while connecting to upstream
+

apicast/t/rate_limit.t

@@ -0,0 +1,111 @@
+BEGIN {
+    $ENV{TEST_NGINX_APICAST_BINARY} ||= 'rover exec apicast';
+}
+
+use strict;
+use warnings FATAL => 'all';
+use Test::APIcast::Blackbox 'no_plan';
+
+repeat_each(1);
+run_tests();
+
+__DATA__
+
+=== TEST 1: rate limit without limit
+The module does not crash without configuration.
+--- configuration
+{
+  "services": [
+    {
+      "proxy": {
+        "policy_chain": [
+          { "name": "cloud_hosted.rate_limit" },
+          { "name": "apicast.policy.echo", "configuration": { } }
+        ]
+      }
+    }
+  ]
+}
+--- request
+GET /t
+--- response_body
+GET /t HTTP/1.1
+--- error_code: 200
+--- no_error_log
+[error]
+
+
+
+=== TEST 2: rate limit with limit
+The module does rate limiting.
+--- configuration
+{
+  "services": [
+    {
+      "proxy": {
+        "policy_chain": [
+          { "name": "cloud_hosted.rate_limit", "configuration": { "limit": 1 } },
+          { "name": "apicast.policy.echo", "configuration": { } }
+        ]
+      }
+    }
+  ]
+}
+--- request eval
+["GET /t", "GET /t"]
+--- error_code eval
+[200, 503]
+--- grep_error_log
+rejected request over limit, key: localhost
+--- grep_error_log_out eval
+["", "rejected request over limit, key: localhost"]
+
+
+
+=== TEST 3: rate limit with limit and burst
+Delays the request.
+--- configuration
+{
+  "services": [
+    {
+      "proxy": {
+        "policy_chain": [
+          { "name": "cloud_hosted.rate_limit", "configuration": { "limit": 1, "burst": 1 } },
+          { "name": "apicast.policy.echo", "configuration": { } }
+        ]
+      }
+    }
+  ]
+}
+--- request eval
+["GET /t", "GET /t"]
+--- response_body eval
+["GET /t HTTP/1.1\n", "GET /t HTTP/1.1\n" ]
+--- error_code eval
+[200, 200]
+--- grep_error_log
+delaying request: localhost for 1s, excess: 1
+--- grep_error_log_out eval
+["", "delaying request: localhost for 1s, excess: 1"]
+
+
+
+=== TEST 4: rate limit with custom status
+Sends the custom status code.
+--- configuration
+{
+  "services": [
+    {
+      "proxy": {
+        "policy_chain": [
+          { "name": "cloud_hosted.rate_limit", "configuration": { "limit": 1, "status": 429 } },
+          { "name": "apicast.policy.echo", "configuration": { } }
+        ]
+      }
+    }
+  ]
+}
+--- request eval
+["GET /t", "GET /t"]
+--- error_code eval
+[200, 429]