| # |
| # Licensed to the Apache Software Foundation (ASF) under one or more |
| # contributor license agreements. See the NOTICE file distributed with |
| # this work for additional information regarding copyright ownership. |
| # The ASF licenses this file to You under the Apache License, Version 2.0 |
| # (the "License"); you may not use this file except in compliance with |
| # the License. You may obtain a copy of the License at |
| # |
| # http://www.apache.org/licenses/LICENSE-2.0 |
| # |
| # Unless required by applicable law or agreed to in writing, software |
| # distributed under the License is distributed on an "AS IS" BASIS, |
| # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| # See the License for the specific language governing permissions and |
| # limitations under the License. |
| # |
| use t::APISIX 'no_plan'; |
| |
| repeat_each(1); |
| no_long_string(); |
| no_root_location(); |
| no_shuffle(); |
| |
| add_block_preprocessor(sub { |
| my ($block) = @_; |
| |
| my $inside_lua_block = $block->inside_lua_block // ""; |
| chomp($inside_lua_block); |
| my $http_config = $block->http_config // <<_EOC_; |
| |
| server { |
| listen 8765; |
| |
| location /httptrigger { |
| content_by_lua_block { |
| ngx.req.read_body() |
| local msg = "aws lambda invoked" |
| ngx.header['Content-Length'] = #msg + 1 |
| ngx.header['Connection'] = "Keep-Alive" |
| ngx.say(msg) |
| } |
| } |
| |
| location /generic { |
| content_by_lua_block { |
| $inside_lua_block |
| } |
| } |
| } |
| _EOC_ |
| |
| $block->set_value("http_config", $http_config); |
| |
| if (!$block->request) { |
| $block->set_value("request", "GET /t"); |
| } |
| if (!$block->no_error_log && !$block->error_log) { |
| $block->set_value("no_error_log", "[error]\n[alert]"); |
| } |
| }); |
| |
| run_tests; |
| |
| __DATA__ |
| |
| === TEST 1: checking iam schema |
| --- config |
| location /t { |
| content_by_lua_block { |
| local plugin = require("apisix.plugins.aws-lambda") |
| local ok, err = plugin.check_schema({ |
| function_uri = "https://api.amazonaws.com", |
| authorization = { |
| iam = { |
| accesskey = "key1", |
| secretkey = "key2" |
| } |
| } |
| }) |
| if not ok then |
| ngx.say(err) |
| else |
| ngx.say("done") |
| end |
| } |
| } |
| --- response_body |
| done |
| |
| |
| |
| === TEST 2: missing fields in iam schema |
| --- config |
| location /t { |
| content_by_lua_block { |
| local plugin = require("apisix.plugins.aws-lambda") |
| local ok, err = plugin.check_schema({ |
| function_uri = "https://api.amazonaws.com", |
| authorization = { |
| iam = { |
| secretkey = "key2" |
| } |
| } |
| }) |
| if not ok then |
| ngx.say(err) |
| else |
| ngx.say("done") |
| end |
| } |
| } |
| --- response_body |
| property "authorization" validation failed: property "iam" validation failed: property "accesskey" is required |
| |
| |
| |
| === TEST 3: create route with aws plugin enabled |
| --- config |
| location /t { |
| content_by_lua_block { |
| local t = require("lib.test_admin").test |
| |
| local code, body = t('/apisix/admin/routes/1', |
| ngx.HTTP_PUT, |
| [[{ |
| "plugins": { |
| "aws-lambda": { |
| "function_uri": "http://localhost:8765/httptrigger", |
| "authorization": { |
| "apikey" : "testkey" |
| } |
| } |
| }, |
| "uri": "/aws" |
| }]] |
| ) |
| |
| if code >= 300 then |
| ngx.status = code |
| ngx.say("fail") |
| return |
| end |
| |
| ngx.say(body) |
| } |
| } |
| --- response_body |
| passed |
| |
| |
| |
| === TEST 4: test plugin endpoint |
| --- config |
| location /t { |
| content_by_lua_block { |
| local t = require("lib.test_admin").test |
| local core = require("apisix.core") |
| |
| local code, _, body, headers = t("/aws", "GET") |
| if code >= 300 then |
| ngx.status = code |
| ngx.say(body) |
| return |
| end |
| |
| -- headers proxied 2 times -- one by plugin, another by this test case |
| core.response.set_header(headers) |
| ngx.print(body) |
| } |
| } |
| --- response_body |
| aws lambda invoked |
| --- response_headers |
| Content-Length: 19 |
| |
| |
| |
| === TEST 5: check authz header - apikey |
| --- config |
| location /t { |
| content_by_lua_block { |
| local t = require("lib.test_admin").test |
| -- passing an apikey |
| local code, body = t('/apisix/admin/routes/1', |
| ngx.HTTP_PUT, |
| [[{ |
| "plugins": { |
| "aws-lambda": { |
| "function_uri": "http://localhost:8765/generic", |
| "authorization": { |
| "apikey": "test_key" |
| } |
| } |
| }, |
| "uri": "/aws" |
| }]] |
| ) |
| if code >= 300 then |
| ngx.status = code |
| ngx.say("fail") |
| return |
| end |
| |
| ngx.say(body) |
| |
| local code, _, body = t("/aws", "GET") |
| if code >= 300 then |
| ngx.status = code |
| ngx.say(body) |
| return |
| end |
| ngx.print(body) |
| } |
| } |
| --- inside_lua_block |
| local headers = ngx.req.get_headers() or {} |
| ngx.say("Authz-Header - " .. headers["x-api-key"] or "") |
| |
| --- response_body |
| passed |
| Authz-Header - test_key |
| |
| |
| |
| === TEST 6: check authz header - IAM v4 signing |
| --- config |
| location /t { |
| content_by_lua_block { |
| local t = require("lib.test_admin").test |
| |
| -- passing the iam access and secret keys |
| local code, body = t('/apisix/admin/routes/1', |
| ngx.HTTP_PUT, |
| [[{ |
| "plugins": { |
| "aws-lambda": { |
| "function_uri": "http://localhost:8765/generic", |
| "authorization": { |
| "iam": { |
| "accesskey": "KEY1", |
| "secretkey": "KeySecret" |
| } |
| } |
| } |
| }, |
| "uri": "/aws" |
| }]] |
| ) |
| if code >= 300 then |
| ngx.status = code |
| ngx.say("fail") |
| return |
| end |
| |
| ngx.say(body) |
| |
| local code, _, body, headers = t("/aws", "GET") |
| if code >= 300 then |
| ngx.status = code |
| ngx.say(body) |
| return |
| end |
| |
| ngx.print(body) |
| } |
| } |
| --- inside_lua_block |
| local headers = ngx.req.get_headers() or {} |
| ngx.say("Authz-Header - " .. headers["Authorization"] or "") |
| ngx.say("AMZ-Date - " .. headers["X-Amz-Date"] or "") |
| ngx.print("invoked") |
| |
| --- response_body eval |
| qr/passed |
| Authz-Header - AWS4-HMAC-SHA256 [ -~]* |
| AMZ-Date - [\d]+T[\d]+Z |
| invoked/ |
| |
| |
| |
| === TEST 7: cleanup route before encryption test |
| --- config |
| location /t { |
| content_by_lua_block { |
| local t = require("lib.test_admin").test |
| local code = t('/apisix/admin/routes/1', ngx.HTTP_DELETE) |
| ngx.say(code) |
| } |
| } |
| --- response_body |
| 200 |
| |
| |
| |
| === TEST 8: iam credentials (accesskey, secretkey) and apikey are encrypted at rest |
| --- yaml_config |
| apisix: |
| data_encryption: |
| enable: true |
| keyring: |
| - edd1c9f0985e76a2 |
| --- config |
| location /t { |
| content_by_lua_block { |
| local t = require("lib.test_admin").test |
| local json = require("toolkit.json") |
| |
| -- create route with both IAM credentials and apikey |
| local code, body = t('/apisix/admin/routes/1', |
| ngx.HTTP_PUT, |
| [[{ |
| "plugins": { |
| "aws-lambda": { |
| "function_uri": "http://localhost:8765/generic", |
| "authorization": { |
| "apikey": "test-api-key", |
| "iam": { |
| "accesskey": "test-access-key", |
| "secretkey": "test-secret-key" |
| } |
| } |
| } |
| }, |
| "uri": "/aws" |
| }]] |
| ) |
| if code >= 300 then |
| ngx.status = code |
| ngx.say(body) |
| return |
| end |
| |
| -- admin API returns plaintext (framework decrypts on read) |
| local code, _, res = t('/apisix/admin/routes/1', ngx.HTTP_GET) |
| res = json.decode(res) |
| ngx.say(res.value.plugins["aws-lambda"].authorization.iam.secretkey) |
| ngx.say(res.value.plugins["aws-lambda"].authorization.iam.accesskey) |
| ngx.say(res.value.plugins["aws-lambda"].authorization.apikey) |
| |
| -- etcd stores ciphertext: assert value is a non-empty string != plaintext |
| local etcd = require("apisix.core.etcd") |
| local etcd_res = assert(etcd.get('/routes/1')) |
| local plugin_conf = etcd_res.body.node.value.plugins["aws-lambda"] |
| local stored_secret = plugin_conf.authorization.iam.secretkey |
| local stored_access = plugin_conf.authorization.iam.accesskey |
| local stored_apikey = plugin_conf.authorization.apikey |
| |
| if type(stored_secret) == "string" and #stored_secret > 0 |
| and stored_secret ~= "test-secret-key" then |
| ngx.say("secretkey encrypted: ok") |
| else |
| ngx.say("secretkey encrypted: FAIL") |
| end |
| if type(stored_access) == "string" and #stored_access > 0 |
| and stored_access ~= "test-access-key" then |
| ngx.say("accesskey encrypted: ok") |
| else |
| ngx.say("accesskey encrypted: FAIL") |
| end |
| if type(stored_apikey) == "string" and #stored_apikey > 0 |
| and stored_apikey ~= "test-api-key" then |
| ngx.say("apikey encrypted: ok") |
| else |
| ngx.say("apikey encrypted: FAIL") |
| end |
| } |
| } |
| --- response_body |
| test-secret-key |
| test-access-key |
| test-api-key |
| secretkey encrypted: ok |
| accesskey encrypted: ok |
| apikey encrypted: ok |
| |
| |
| |
| === TEST 9: IAM v4 signing with encoded, multi-value and valueless query params |
| --- config |
| location /t { |
| content_by_lua_block { |
| local t = require("lib.test_admin").test |
| |
| local code, body = t('/apisix/admin/routes/1', |
| ngx.HTTP_PUT, |
| [[{ |
| "plugins": { |
| "aws-lambda": { |
| "function_uri": "http://localhost:8765/generic", |
| "authorization": { |
| "iam": { |
| "accesskey": "KEY1", |
| "secretkey": "KeySecret" |
| } |
| } |
| } |
| }, |
| "uri": "/aws" |
| }]] |
| ) |
| if code >= 300 then |
| ngx.status = code |
| ngx.say("fail") |
| return |
| end |
| |
| ngx.say(body) |
| |
| -- unsorted query string with a percent-encoded key and value, |
| -- a value that needs encoding, repeated args and a valueless arg |
| local code, _, body = t( |
| "/aws?with%20space=a%2Fb%20c&multi=m2&multi=m1&flag&a=*&a-=x", |
| "GET") |
| if code >= 300 then |
| ngx.status = code |
| end |
| ngx.print(body) |
| } |
| } |
| --- inside_lua_block |
| -- emulate the AWS server side SigV4 validation: rebuild the canonical |
| -- request from the request actually received and recompute the signature |
| local hmac = require("resty.hmac") |
| local resty_sha256 = require("resty.sha256") |
| local hex_encode = require("resty.string").to_hex |
| |
| local function hmac256(key, msg) |
| return hmac:new(key, hmac.ALGOS.SHA256):final(msg) |
| end |
| |
| local function sha256(msg) |
| local hash = resty_sha256:new() |
| hash:update(msg) |
| return hex_encode(hash:final()) |
| end |
| |
| local function uri_encode(s) |
| return (s:gsub("[^A-Za-z0-9%-_.~]", function(c) |
| return string.format("%%%02X", string.byte(c)) |
| end)) |
| end |
| |
| ngx.say("query: ", ngx.var.args) |
| |
| local headers = ngx.req.get_headers() |
| local credential, signed_headers, signature = headers["authorization"]:match( |
| "^AWS4%-HMAC%-SHA256 Credential=([^,]+), SignedHeaders=([^,]+), Signature=(%x+)$") |
| local datestamp, region, service = credential:match( |
| "/(%d+)/([^/]+)/([^/]+)/aws4_request$") |
| |
| -- canonical query string: decode every pair received on the wire, |
| -- then URI-encode and sort the pairs again |
| local query_pairs = {} |
| for pair in (ngx.var.args or ""):gmatch("[^&]+") do |
| local eq = pair:find("=", 1, true) |
| local k, v |
| if eq then |
| k, v = pair:sub(1, eq - 1), pair:sub(eq + 1) |
| else |
| k, v = pair, "" |
| end |
| table.insert(query_pairs, |
| {uri_encode(ngx.unescape_uri(k)), uri_encode(ngx.unescape_uri(v))}) |
| end |
| table.sort(query_pairs, function(a, b) |
| if a[1] ~= b[1] then |
| return a[1] < b[1] |
| end |
| return a[2] < b[2] |
| end) |
| local canonical_qs = {} |
| for i, p in ipairs(query_pairs) do |
| canonical_qs[i] = p[1] .. "=" .. p[2] |
| end |
| |
| local canonical_headers = {} |
| local i = 0 |
| for name in signed_headers:gmatch("[^;]+") do |
| i = i + 1 |
| local value = headers[name]:gsub("^%s+", ""):gsub("%s+$", "") |
| canonical_headers[i] = name .. ":" .. value .. "\n" |
| end |
| |
| ngx.req.read_body() |
| local canonical_request = ngx.req.get_method() .. "\n" |
| .. ngx.var.request_uri:match("^([^?]*)") .. "\n" |
| .. table.concat(canonical_qs, "&") .. "\n" |
| .. table.concat(canonical_headers) .. "\n" |
| .. signed_headers .. "\n" |
| .. sha256(ngx.req.get_body_data() or "") |
| |
| local string_to_sign = "AWS4-HMAC-SHA256\n" |
| .. headers["x-amz-date"] .. "\n" |
| .. datestamp .. "/" .. region .. "/" .. service .. "/aws4_request\n" |
| .. sha256(canonical_request) |
| |
| local sign_key = hmac256("AWS4" .. "KeySecret", datestamp) |
| sign_key = hmac256(sign_key, region) |
| sign_key = hmac256(sign_key, service) |
| sign_key = hmac256(sign_key, "aws4_request") |
| local expected = hex_encode(hmac256(sign_key, string_to_sign)) |
| |
| if expected == signature then |
| ngx.say("signature: ok") |
| else |
| ngx.say("signature mismatch: got ", signature, ", want ", expected) |
| end |
| |
| --- response_body |
| passed |
| query: a=%2A&a-=x&flag=&multi=m1&multi=m2&with%20space=a%2Fb%20c |
| signature: ok |
