Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: implement Lua EnvoyExtensionPolicy
Signed-off-by: Rudrakh Panigrahi <[email protected]>
- Loading branch information
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,60 @@ | ||
| // Copyright Envoy Gateway Authors | ||
| // SPDX-License-Identifier: Apache-2.0 | ||
| // The full text of the Apache license is available in the LICENSE file at | ||
| // the root of the repo. | ||
|
|
||
| package luavalidator | ||
|
|
||
| import ( | ||
| _ "embed" | ||
| "fmt" | ||
| "strings" | ||
|
|
||
| lua "github.com/yuin/gopher-lua" | ||
| ) | ||
|
|
||
| // mockData contains mocks of Envoy supported APIs for Lua filters. | ||
| // Refer: https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/lua_filter#stream-handle-api | ||
| // | ||
| //go:embed mocks.lua | ||
| var mockData []byte | ||
|
|
||
| // LuaValidator validates user provided Lua for compatibility with Envoy supported Lua HTTP filter | ||
| type LuaValidator struct { | ||
| body string | ||
| } | ||
|
|
||
| // NewLuaValidator returns a LuaValidator for user provided Lua body | ||
| func NewLuaValidator(body string) *LuaValidator { | ||
| return &LuaValidator{ | ||
| body: body, | ||
| } | ||
| } | ||
|
|
||
| // Validate runs all validations for the LuaValidator | ||
| func (l *LuaValidator) Validate() error { | ||
| if !strings.Contains(l.body, "envoy_on_request") && !strings.Contains(l.body, "envoy_on_response") { | ||
| return fmt.Errorf("expected one of envoy_on_request() or envoy_on_response() to be defined") | ||
| } | ||
| if strings.Contains(l.body, "envoy_on_request") { | ||
| if err := l.runLua(string(mockData) + "\n" + l.body + "\nenvoy_on_request(StreamHandle)"); err != nil { | ||
| return fmt.Errorf("failed to mock run envoy_on_request: %w", err) | ||
| } | ||
| } | ||
| if strings.Contains(l.body, "envoy_on_response") { | ||
| if err := l.runLua(string(mockData) + "\n" + l.body + "\nenvoy_on_response(StreamHandle)"); err != nil { | ||
| return fmt.Errorf("failed to mock run envoy_on_response: %w", err) | ||
| } | ||
| } | ||
| return nil | ||
| } | ||
|
|
||
| // runLua interprets and runs the provided Lua body in runtime | ||
| func (l *LuaValidator) runLua(body string) error { | ||
| L := lua.NewState() | ||
| defer L.Close() | ||
| if err := L.DoString(body); err != nil { | ||
| return err | ||
| } | ||
| return nil | ||
| } | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,146 @@ | ||
| // Copyright Envoy Gateway Authors | ||
| // SPDX-License-Identifier: Apache-2.0 | ||
| // The full text of the Apache license is available in the LICENSE file at | ||
| // the root of the repo. | ||
|
|
||
| package luavalidator | ||
|
|
||
| import ( | ||
| "strings" | ||
| "testing" | ||
| ) | ||
|
|
||
| func Test_Validate(t *testing.T) { | ||
| type args struct { | ||
| name string | ||
| body string | ||
| expectedErrSubstring string | ||
| } | ||
| tests := []args{ | ||
| { | ||
| name: "empty body", | ||
| body: "", | ||
| expectedErrSubstring: "expected one of envoy_on_request() or envoy_on_response() to be defined", | ||
| }, | ||
| { | ||
| name: "logInfo: envoy_on_response", | ||
| body: `function envoy_on_response(response_handle) | ||
| response_handle:logInfo("Goodbye.") | ||
| end`, | ||
| expectedErrSubstring: "", | ||
| }, | ||
| { | ||
| name: "logInfo: envoy_on_request", | ||
| body: `function envoy_on_request(request_handle) | ||
| request_handle:logInfo("Goodbye.") | ||
| end`, | ||
| expectedErrSubstring: "", | ||
| }, | ||
| { | ||
| name: "stream:headers:Get", | ||
| body: `function envoy_on_request(request_handle) | ||
| request_handle:headers():get("foo") | ||
| end`, | ||
| expectedErrSubstring: "", | ||
| }, | ||
| { | ||
| name: "stream:connection:ssl:expirationPeerCertificate", | ||
| body: `function envoy_on_request(request_handle) | ||
| request_handle:connection():ssl():expirationPeerCertificate() | ||
| end`, | ||
| expectedErrSubstring: "", | ||
| }, | ||
| { | ||
| name: "stream:metadata:pairs", | ||
| body: `function envoy_on_request(request_handle) | ||
| for key, value in pairs(request_handle:metadata()) do | ||
| print(key, value) | ||
| end | ||
| end`, | ||
| expectedErrSubstring: "", | ||
| }, | ||
| { | ||
| name: "stream:httpCall", | ||
| body: `function envoy_on_request(request_handle) | ||
| -- Make an HTTP call. | ||
| local headers, body = request_handle:httpCall( | ||
| "lua_cluster", | ||
| { | ||
| [":method"] = "POST", | ||
| [":path"] = "/", | ||
| [":authority"] = "lua_cluster", | ||
| ["set-cookie"] = { "lang=lua; Path=/", "type=binding; Path=/" } | ||
| }, | ||
| "hello world", | ||
| 5000) | ||
| -- Response directly and set a header from the HTTP call. No further filter iteration | ||
| -- occurs. | ||
| request_handle:respond( | ||
| {[":status"] = "403", | ||
| ["upstream_foo"] = headers["foo"]}, | ||
| "nope") | ||
| end`, | ||
| expectedErrSubstring: "", | ||
| }, | ||
| { | ||
| name: "stream:httpPostCall unsupported api", | ||
| body: `function envoy_on_request(request_handle) | ||
| -- Make an HTTP call. | ||
| local headers, body = request_handle:httpPostCall( | ||
| "lua_cluster", | ||
| { | ||
| [":method"] = "POST", | ||
| [":path"] = "/", | ||
| [":authority"] = "lua_cluster", | ||
| ["set-cookie"] = { "lang=lua; Path=/", "type=binding; Path=/" } | ||
| }, | ||
| "hello world", | ||
| 5000) | ||
| -- Response directly and set a header from the HTTP call. No further filter iteration | ||
| -- occurs. | ||
| request_handle:respond( | ||
| {[":status"] = "403", | ||
| ["upstream_foo"] = headers["foo"]}, | ||
| "nope") | ||
| end`, | ||
| expectedErrSubstring: "attempt to call a non-function object", | ||
| }, | ||
| { | ||
| name: "stream:bodyChunks", | ||
| body: `function envoy_on_response(response_handle) | ||
| -- Sets the content-type. | ||
| response_handle:headers():replace("content-type", "text/html") | ||
| local last | ||
| for chunk in response_handle:bodyChunks() do | ||
| -- Clears each received chunk. | ||
| chunk:setBytes("") | ||
| last = chunk | ||
| end | ||
| last:setBytes("<html><b>Not Found<b></html>") | ||
| end`, | ||
| expectedErrSubstring: "", | ||
| }, | ||
| { | ||
| name: "unsupported api", | ||
| body: `function envoy_on_request(request_handle) | ||
| request_handle:unknownApi() | ||
| end`, | ||
| expectedErrSubstring: "attempt to call a non-function object", | ||
| }, | ||
| } | ||
| for _, tt := range tests { | ||
| t.Run(tt.name, func(t *testing.T) { | ||
| l := NewLuaValidator(tt.body) | ||
| if err := l.Validate(); err != nil && tt.expectedErrSubstring == "" { | ||
| t.Errorf("Unexpected error: %v", err) | ||
| } else if err != nil && !strings.Contains(err.Error(), tt.expectedErrSubstring) { | ||
| t.Errorf("Expected substring in error: %v, got error: %v", tt.expectedErrSubstring, err) | ||
| } else if err == nil && tt.expectedErrSubstring != "" { | ||
| t.Errorf("Expected error with substring: %v", tt.expectedErrSubstring) | ||
| } | ||
| }) | ||
| } | ||
| } |
Oops, something went wrong.