mirror of
https://github.com/hanzoai/ingress.git
synced 2026-10-26 02:47:15 +00:00
zeekay
efee4c9fb1
OWASP Coraza with the Core Rule Set v4 embedded, declared as `waf` on every provider: file, labels and the Middleware CR. Rules load Core Rule Set, then files, then inline directives. The engine state is written after every rule. The Core Rule Set's own recommended configuration opens with SecRuleEngine DetectionOnly, so a state written first is overridden by the rules it governs and the firewall loads all of CRS and refuses nothing; detectionOnly on the middleware is the one place the mode is decided. geoBlock rode along: it was declared in dynamic config only, absent from MiddlewareSpec, both deep copies and the CRD schema, so a Middleware CR carrying it produced a middleware without it. The +groupName marker now matches the registered group, which is what makes controller-gen's output land where code-gen.sh reads it; the stale traefik.io_*.yaml dumps go. CI asks for the arm64 runner git.hanzo.ai actually has and builds both platforms.
45 lines
1.4 KiB
Go
45 lines
1.4 KiB
Go
package dynamic
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
// A field the generated deep copy does not carry is dropped in silence on the
|
|
// Kubernetes path, so the middleware reads as configured and does nothing.
|
|
// geoBlock was in that state: declared, buildable, and absent from every
|
|
// Middleware the CRD provider produced.
|
|
func TestEveryMiddlewareFieldSurvivesADeepCopy(t *testing.T) {
|
|
in := &Middleware{
|
|
GeoBlock: &GeoBlock{
|
|
BlockCountries: []string{"KP", "IR"},
|
|
HeaderName: "X-Geo-Country",
|
|
RejectStatusCode: 451,
|
|
},
|
|
WAF: &WAF{
|
|
CoreRuleSet: true,
|
|
DirectivesFiles: []string{"/etc/waf/local.conf"},
|
|
Directives: `SecRule REQUEST_URI "@contains /admin" "id:1,phase:1,deny"`,
|
|
},
|
|
}
|
|
|
|
out := in.DeepCopy()
|
|
|
|
require.NotNil(t, out.GeoBlock, "geoBlock must survive the copy")
|
|
assert.Equal(t, []string{"KP", "IR"}, out.GeoBlock.BlockCountries)
|
|
assert.Equal(t, 451, out.GeoBlock.RejectStatusCode)
|
|
|
|
require.NotNil(t, out.WAF, "waf must survive the copy")
|
|
assert.True(t, out.WAF.CoreRuleSet)
|
|
assert.Equal(t, []string{"/etc/waf/local.conf"}, out.WAF.DirectivesFiles)
|
|
assert.Equal(t, in.WAF.Directives, out.WAF.Directives)
|
|
|
|
// The slices are copies, not shared backing arrays.
|
|
out.GeoBlock.BlockCountries[0] = "US"
|
|
out.WAF.DirectivesFiles[0] = "/other"
|
|
assert.Equal(t, "KP", in.GeoBlock.BlockCountries[0])
|
|
assert.Equal(t, "/etc/waf/local.conf", in.WAF.DirectivesFiles[0])
|
|
}
|