local kong_meta = require "kong.meta" local conf_loader = require "kong.conf_loader" local log = require "kong.cmd.utils.log" local helpers = require "spec.helpers" local tablex = require "pl.tablex" local pl_path = require "pl.path" local ffi = require "ffi" local C = ffi.C ffi.cdef([[ struct group *getgrnam(const char *name); struct passwd *getpwnam(const char *name); ]]) local KONG_VERSION = string.format("%d.%d", kong_meta._VERSION_TABLE.major, kong_meta._VERSION_TABLE.minor) local function kong_user_group_exists() if C.getpwnam("kong") == nil or C.getgrnam("kong") == nil then return false else return true end end local function search_directive(tbl, directive_name, directive_value) for _, directive in pairs(tbl) do if directive.name == directive_name and directive.value == directive_value then return true end end return false end local DATABASE = os.getenv("KONG_DATABASE") or "postgres" describe("Configuration loader", function() it("loads the defaults", function() local conf = assert(conf_loader()) assert.is_string(conf.lua_package_path) if kong_user_group_exists() == true then assert.equal("kong kong", conf.nginx_main_user) else assert.is_nil(conf.nginx_main_user) end assert.equal("auto", conf.nginx_main_worker_processes) assert.equal("eventual", conf.worker_consistency) assert.same({"127.0.0.1:8001 reuseport backlog=16384", "127.0.0.1:8444 http2 ssl reuseport backlog=16384"}, conf.admin_listen) assert.same({"0.0.0.0:8000 reuseport backlog=16384", "0.0.0.0:8443 http2 ssl reuseport backlog=16384"}, conf.proxy_listen) assert.same({"0.0.0.0:8002", "0.0.0.0:8445 ssl"}, conf.admin_gui_listen) assert.equal("/", conf.admin_gui_path) assert.equal(false, conf.admin_gui_csp_header) assert.equal("logs/admin_gui_access.log", conf.admin_gui_access_log) assert.equal("logs/admin_gui_error.log", conf.admin_gui_error_log) assert.same({}, conf.ssl_cert) -- check placeholder value assert.same({}, conf.ssl_cert_key) assert.same({}, conf.admin_ssl_cert) assert.same({}, conf.admin_ssl_cert_key) assert.same({}, conf.admin_gui_ssl_cert) assert.same({}, conf.admin_gui_ssl_cert_key) assert.same({}, conf.status_ssl_cert) assert.same({}, conf.status_ssl_cert_key) assert.same(nil, conf.privileged_agent) assert.same(true, conf.dedicated_config_processing) assert.same(false, conf.allow_debug_header) assert.same(KONG_VERSION, conf.lmdb_validation_tag) assert.is_nil(getmetatable(conf)) end) it("loads a given file, with higher precedence", function() local conf = assert(conf_loader(helpers.test_conf_path)) -- defaults assert.equal("on", conf.nginx_main_daemon) -- overrides assert.same({"off"}, conf.admin_gui_listen) if kong_user_group_exists() == true then assert.equal("kong kong", conf.nginx_main_user) else assert.is_nil(conf.nginx_main_user) end assert.equal("1", conf.nginx_main_worker_processes) assert.same({"127.0.0.1:9001"}, conf.admin_listen) assert.same({"0.0.0.0:9000", "0.0.0.0:9443 http2 ssl", "0.0.0.0:9002 http2"}, conf.proxy_listen) assert.same(KONG_VERSION, conf.lmdb_validation_tag) assert.is_nil(getmetatable(conf)) end) it("preserves default properties if not in given file", function() local conf = assert(conf_loader(helpers.test_conf_path)) assert.is_string(conf.lua_package_path) -- still there end) it("accepts custom params, with highest precedence", function() local conf = assert(conf_loader(helpers.test_conf_path, { admin_listen = "127.0.0.1:9001", nginx_main_worker_processes = "auto" })) -- defaults assert.equal("on", conf.nginx_main_daemon) -- overrides if kong_user_group_exists() == true then assert.equal("kong kong", conf.nginx_main_user) else assert.is_nil(conf.nginx_main_user) end assert.equal("auto", conf.nginx_main_worker_processes) assert.same({"127.0.0.1:9001"}, conf.admin_listen) assert.same({"0.0.0.0:9000", "0.0.0.0:9443 http2 ssl", "0.0.0.0:9002 http2"}, conf.proxy_listen) assert.is_nil(getmetatable(conf)) end) it("strips extraneous properties (not in defaults)", function() local conf = assert(conf_loader(nil, { stub_property = "leave me alone" })) assert.is_nil(conf.stub_property) end) it("returns a plugins table", function() local constants = require "kong.constants" local conf = assert(conf_loader()) assert.same(constants.BUNDLED_PLUGINS, conf.loaded_plugins) end) it("loads custom plugins", function() local conf = assert(conf_loader(nil, { plugins = "hello-world,my-plugin" })) assert.True(conf.loaded_plugins["hello-world"]) assert.True(conf.loaded_plugins["my-plugin"]) end) it("merges plugins and custom plugins", function() local conf = assert(conf_loader(nil, { plugins = "foo, bar", })) assert.is_not_nil(conf.loaded_plugins) assert.same(2, tablex.size(conf.loaded_plugins)) assert.True(conf.loaded_plugins["foo"]) assert.True(conf.loaded_plugins["bar"]) end) it("no longer applies # transformations when loading from .kong_env (issue #5761)", function() local conf = assert(conf_loader(nil, { pg_password = "!abCDefGHijKL4\\#1MN2OP3", }, { from_kong_env = true, })) assert.same("!abCDefGHijKL4\\#1MN2OP3", conf.pg_password) end) it("loads custom plugins surrounded by spaces", function() local conf = assert(conf_loader(nil, { plugins = " hello-world , another-one " })) assert.True(conf.loaded_plugins["hello-world"]) assert.True(conf.loaded_plugins["another-one"]) end) it("extracts flags, ports and listen ips from proxy_listen/admin_listen/admin_gui_listen", function() local conf = assert(conf_loader()) assert.equal("127.0.0.1", conf.admin_listeners[1].ip) assert.equal(8001, conf.admin_listeners[1].port) assert.equal(false, conf.admin_listeners[1].ssl) assert.equal(false, conf.admin_listeners[1].http2) assert.equal("127.0.0.1:8001 reuseport backlog=16384", conf.admin_listeners[1].listener) assert.equal("127.0.0.1", conf.admin_listeners[2].ip) assert.equal(8444, conf.admin_listeners[2].port) assert.equal(true, conf.admin_listeners[2].ssl) assert.equal(true, conf.admin_listeners[2].http2) assert.equal("127.0.0.1:8444 ssl reuseport backlog=16384", conf.admin_listeners[2].listener) assert.equal("0.0.0.0", conf.admin_gui_listeners[1].ip) assert.equal(8002, conf.admin_gui_listeners[1].port) assert.equal(false, conf.admin_gui_listeners[1].ssl) assert.equal(false, conf.admin_gui_listeners[1].http2) assert.equal("0.0.0.0:8002", conf.admin_gui_listeners[1].listener) assert.equal("0.0.0.0", conf.admin_gui_listeners[2].ip) assert.equal(8445, conf.admin_gui_listeners[2].port) assert.equal(true, conf.admin_gui_listeners[2].ssl) assert.equal(false, conf.admin_gui_listeners[2].http2) assert.equal("0.0.0.0:8445 ssl", conf.admin_gui_listeners[2].listener) assert.equal("0.0.0.0", conf.proxy_listeners[1].ip) assert.equal(8000, conf.proxy_listeners[1].port) assert.equal(false, conf.proxy_listeners[1].ssl) assert.equal(false, conf.proxy_listeners[1].http2) assert.equal("0.0.0.0:8000 reuseport backlog=16384", conf.proxy_listeners[1].listener) assert.equal("0.0.0.0", conf.proxy_listeners[2].ip) assert.equal(8443, conf.proxy_listeners[2].port) assert.equal(true, conf.proxy_listeners[2].ssl) assert.equal(true, conf.proxy_listeners[2].http2) assert.equal("0.0.0.0:8443 ssl reuseport backlog=16384", conf.proxy_listeners[2].listener) end) it("parses IPv6 from proxy_listen/admin_listen/admin_gui_listen", function() local conf = assert(conf_loader(nil, { proxy_listen = "[::]:8000, [::]:8443 ssl", admin_listen = "[::1]:8001, [::1]:8444 ssl", admin_gui_listen = "[::1]:8002, [::1]:8445 ssl", })) assert.equal("[0000:0000:0000:0000:0000:0000:0000:0001]", conf.admin_listeners[1].ip) assert.equal(8001, conf.admin_listeners[1].port) assert.equal(false, conf.admin_listeners[1].ssl) assert.equal(false, conf.admin_listeners[1].http2) assert.equal("[0000:0000:0000:0000:0000:0000:0000:0001]:8001", conf.admin_listeners[1].listener) assert.equal("[0000:0000:0000:0000:0000:0000:0000:0001]", conf.admin_listeners[2].ip) assert.equal(8444, conf.admin_listeners[2].port) assert.equal(true, conf.admin_listeners[2].ssl) assert.equal(false, conf.admin_listeners[2].http2) assert.equal("[0000:0000:0000:0000:0000:0000:0000:0001]:8444 ssl", conf.admin_listeners[2].listener) assert.equal("[0000:0000:0000:0000:0000:0000:0000:0001]", conf.admin_gui_listeners[1].ip) assert.equal(8002, conf.admin_gui_listeners[1].port) assert.equal(false, conf.admin_gui_listeners[1].ssl) assert.equal(false, conf.admin_gui_listeners[1].http2) assert.equal("[0000:0000:0000:0000:0000:0000:0000:0001]:8002", conf.admin_gui_listeners[1].listener) assert.equal("[0000:0000:0000:0000:0000:0000:0000:0001]", conf.admin_gui_listeners[2].ip) assert.equal(8445, conf.admin_gui_listeners[2].port) assert.equal(true, conf.admin_gui_listeners[2].ssl) assert.equal(false, conf.admin_gui_listeners[2].http2) assert.equal("[0000:0000:0000:0000:0000:0000:0000:0001]:8445 ssl", conf.admin_gui_listeners[2].listener) assert.equal("[0000:0000:0000:0000:0000:0000:0000:0000]", conf.proxy_listeners[1].ip) assert.equal(8000, conf.proxy_listeners[1].port) assert.equal(false, conf.proxy_listeners[1].ssl) assert.equal(false, conf.proxy_listeners[1].http2) assert.equal("[0000:0000:0000:0000:0000:0000:0000:0000]:8000", conf.proxy_listeners[1].listener) assert.equal("[0000:0000:0000:0000:0000:0000:0000:0000]", conf.proxy_listeners[2].ip) assert.equal(8443, conf.proxy_listeners[2].port) assert.equal(true, conf.proxy_listeners[2].ssl) assert.equal(false, conf.proxy_listeners[2].http2) assert.equal("[0000:0000:0000:0000:0000:0000:0000:0000]:8443 ssl", conf.proxy_listeners[2].listener) end) it("extracts ssl flags properly when hostnames contain them", function() local conf conf = assert(conf_loader(nil, { proxy_listen = "ssl.myname.test:8000", admin_listen = "ssl.myname.test:8001", admin_gui_listen = "ssl.myname.test:8002", })) assert.equal("ssl.myname.test", conf.proxy_listeners[1].ip) assert.equal(false, conf.proxy_listeners[1].ssl) assert.equal("ssl.myname.test", conf.admin_listeners[1].ip) assert.equal(false, conf.admin_listeners[1].ssl) assert.equal("ssl.myname.test", conf.admin_gui_listeners[1].ip) assert.equal(false, conf.admin_gui_listeners[1].ssl) conf = assert(conf_loader(nil, { proxy_listen = "ssl_myname.test:8000 ssl", admin_listen = "ssl_myname.test:8001 ssl", admin_gui_listen = "ssl_myname.test:8002 ssl", })) assert.equal("ssl_myname.test", conf.proxy_listeners[1].ip) assert.equal(true, conf.proxy_listeners[1].ssl) assert.equal("ssl_myname.test", conf.admin_listeners[1].ip) assert.equal(true, conf.admin_listeners[1].ssl) assert.equal("ssl_myname.test", conf.admin_gui_listeners[1].ip) assert.equal(true, conf.admin_gui_listeners[1].ssl) end) it("extracts 'off' from proxy_listen/admin_listen/admin_gui_listen", function() local conf conf = assert(conf_loader(nil, { proxy_listen = "off", admin_listen = "off", admin_gui_listen = "off", })) assert.same({}, conf.proxy_listeners) assert.same({}, conf.admin_listeners) assert.same({}, conf.admin_gui_listeners) -- off with multiple entries conf = assert(conf_loader(nil, { proxy_listen = "off, 0.0.0.0:9000", admin_listen = "off, 127.0.0.1:9001", admin_gui_listen = "off, 127.0.0.1:9002", })) assert.same({}, conf.proxy_listeners) assert.same({}, conf.admin_listeners) assert.same({}, conf.admin_gui_listeners) -- not off with names containing 'off' conf = assert(conf_loader(nil, { proxy_listen = "offshore.test:9000", admin_listen = "offshore.test:9001", admin_gui_listen = "offshore.test:9002", })) assert.same("offshore.test", conf.proxy_listeners[1].ip) assert.same("offshore.test", conf.admin_listeners[1].ip) assert.same("offshore.test", conf.admin_gui_listeners[1].ip) end) it("attaches prefix paths", function() local conf = assert(conf_loader()) assert.equal("/usr/local/kong/pids/nginx.pid", conf.nginx_pid) assert.equal("/usr/local/kong/logs/error.log", conf.nginx_err_logs) assert.equal("/usr/local/kong/logs/access.log", conf.nginx_acc_logs) assert.equal("/usr/local/kong/logs/admin_access.log", conf.admin_acc_logs) assert.equal("/usr/local/kong/nginx.conf", conf.nginx_conf) assert.equal("/usr/local/kong/nginx-kong.conf", conf.nginx_kong_conf) assert.equal("/usr/local/kong/.kong_env", conf.kong_env) -- ssl default paths assert.equal("/usr/local/kong/ssl/kong-default.crt", conf.ssl_cert_default) assert.equal("/usr/local/kong/ssl/kong-default.key", conf.ssl_cert_key_default) assert.equal("/usr/local/kong/ssl/admin-kong-default.crt", conf.admin_ssl_cert_default) assert.equal("/usr/local/kong/ssl/admin-kong-default.key", conf.admin_ssl_cert_key_default) assert.equal("/usr/local/kong/ssl/admin-gui-kong-default.crt", conf.admin_gui_ssl_cert_default) assert.equal("/usr/local/kong/ssl/admin-gui-kong-default.key", conf.admin_gui_ssl_cert_key_default) assert.equal("/usr/local/kong/ssl/status-kong-default.crt", conf.status_ssl_cert_default) assert.equal("/usr/local/kong/ssl/status-kong-default.key", conf.status_ssl_cert_key_default) end) it("should populate correct admin_gui_origin", function() local conf, _, errors = conf_loader(nil, {}) assert.is_nil(errors) assert.is_not_nil(conf) assert.is_nil(conf.admin_gui_origin) conf, _, errors = conf_loader(nil, { admin_gui_url = "http://localhost:8002", }) assert.is_nil(errors) assert.is_not_nil(conf) assert.is_not_nil(conf.admin_gui_origin) assert.same({ "http://localhost:8002" }, conf.admin_gui_origin) conf, _, errors = conf_loader(nil, { admin_gui_url = "https://localhost:8002", }) assert.is_nil(errors) assert.is_not_nil(conf) assert.is_not_nil(conf.admin_gui_origin) assert.same({ "https://localhost:8002" }, conf.admin_gui_origin) conf, _, errors = conf_loader(nil, { admin_gui_url = "http://localhost:8002/manager", }) assert.is_nil(errors) assert.is_not_nil(conf) assert.is_not_nil(conf.admin_gui_origin) assert.same({ "http://localhost:8002" }, conf.admin_gui_origin) conf, _, errors = conf_loader(nil, { admin_gui_url = "http://localhost:8002/manager, https://localhost:8445/manager", }) assert.is_nil(errors) assert.is_not_nil(conf) assert.is_not_nil(conf.admin_gui_origin) assert.is_table(conf.admin_gui_origin) assert.same({ "http://localhost:8002", "https://localhost:8445" }, conf.admin_gui_origin) end) it("strips comments ending settings", function() local _os_getenv = os.getenv finally(function() os.getenv = _os_getenv -- luacheck: ignore end) os.getenv = function() end -- luacheck: ignore local conf = assert(conf_loader("spec/fixtures/to-strip.conf")) assert.equal(DATABASE, conf.database) assert.equal("debug", conf.log_level) end) it("overcomes penlight's list_delim option", function() local conf = assert(conf_loader("spec/fixtures/to-strip.conf")) assert.False(conf.pg_ssl) assert.True(conf.loaded_plugins.foobar) assert.True(conf.loaded_plugins["hello-world"]) end) it("correctly parses values containing an octothorpe", function() local conf = assert(conf_loader("spec/fixtures/to-strip.conf")) assert.equal("test#123", conf.pg_password) end) it("escapes unescaped octothorpes in environment variables", function() finally(function() helpers.unsetenv("KONG_PG_PASSWORD") end) helpers.setenv("KONG_PG_PASSWORD", "test#123") local conf = assert(conf_loader()) assert.equal("test#123", conf.pg_password) helpers.setenv("KONG_PG_PASSWORD", "test#12#3") local conf = assert(conf_loader()) assert.equal("test#12#3", conf.pg_password) helpers.setenv("KONG_PG_PASSWORD", "test##12##3#") local conf = assert(conf_loader()) assert.equal("test##12##3#", conf.pg_password) end) it("escapes unescaped octothorpes in custom_conf overrides", function() local conf = assert(conf_loader(nil, { pg_password = "test#123", })) assert.equal("test#123", conf.pg_password) local conf = assert(conf_loader(nil, { pg_password = "test#12#3", })) assert.equal("test#12#3", conf.pg_password) local conf = assert(conf_loader(nil, { pg_password = "test##12##3#", })) assert.equal("test##12##3#", conf.pg_password) end) it("does not modify existing octothorpes in environment variables", function() finally(function() helpers.unsetenv("KONG_PG_PASSWORD") end) helpers.setenv("KONG_PG_PASSWORD", [[test#123]]) local conf = assert(conf_loader()) assert.equal("test#123", conf.pg_password) helpers.setenv("KONG_PG_PASSWORD", [[test##12##3#]]) local conf = assert(conf_loader()) assert.equal("test##12##3#", conf.pg_password) end) it("does not modify existing octothorpes in custom_conf overrides", function() local conf = assert(conf_loader(nil, { pg_password = [[test#123]], })) assert.equal("test#123", conf.pg_password) local conf = assert(conf_loader(nil, { pg_password = [[test##12##3#]], })) assert.equal("test##12##3#", conf.pg_password) end) describe("dynamic directives", function() it("loads flexible prefix based configs from a file", function() local conf = assert(conf_loader("spec/fixtures/nginx-directives.conf", { plugins = "off", })) assert.True(search_directive(conf.nginx_http_directives, "variables_hash_bucket_size", "128")) assert.True(search_directive(conf.nginx_stream_directives, "variables_hash_bucket_size", "128")) assert.True(search_directive(conf.nginx_http_directives, "lua_shared_dict", "custom_cache 5m")) assert.True(search_directive(conf.nginx_stream_directives, "lua_shared_dict", "custom_cache 5m")) assert.True(search_directive(conf.nginx_proxy_directives, "proxy_bind", "127.0.0.1")) assert.True(search_directive(conf.nginx_sproxy_directives, "proxy_bind", "127.0.0.1")) assert.True(search_directive(conf.nginx_admin_directives, "server_tokens", "off")) end) it("quotes numeric flexible prefix based configs", function() local conf, err = conf_loader(nil, { ["nginx_http_max_pending_timers"] = 4096, }) assert.is_nil(err) assert.True(search_directive(conf.nginx_http_directives, "max_pending_timers", "4096")) end) it("accepts flexible config values with precedence", function() local conf = assert(conf_loader("spec/fixtures/nginx-directives.conf", { ["nginx_http_variables_hash_bucket_size"] = "256", ["nginx_stream_variables_hash_bucket_size"] = "256", ["nginx_http_lua_shared_dict"] = "custom_cache 2m", ["nginx_stream_lua_shared_dict"] = "custom_cache 2m", ["nginx_proxy_proxy_bind"] = "127.0.0.2", ["nginx_sproxy_proxy_bind"] = "127.0.0.2", ["nginx_admin_server_tokens"] = "build", plugins = "off", })) assert.True(search_directive(conf.nginx_http_directives, "variables_hash_bucket_size", "256")) assert.True(search_directive(conf.nginx_stream_directives, "variables_hash_bucket_size", "256")) assert.True(search_directive(conf.nginx_http_directives, "lua_shared_dict", "custom_cache 2m")) assert.True(search_directive(conf.nginx_stream_directives, "lua_shared_dict", "custom_cache 2m")) assert.True(search_directive(conf.nginx_proxy_directives, "proxy_bind", "127.0.0.2")) assert.True(search_directive(conf.nginx_sproxy_directives, "proxy_bind", "127.0.0.2")) assert.True(search_directive(conf.nginx_admin_directives, "server_tokens", "build")) assert.True(search_directive(conf.nginx_status_directives, "client_body_buffer_size", "8k")) end) end) describe("prometheus_metrics shm", function() it("is injected if not provided via nginx_http_* directives", function() local conf = assert(conf_loader()) assert.True(search_directive(conf.nginx_http_directives, "lua_shared_dict", "prometheus_metrics 5m")) end) it("size is not modified if provided via nginx_http_* directives", function() local conf = assert(conf_loader(nil, { plugins = "bundled", nginx_http_lua_shared_dict = "prometheus_metrics 2m", })) assert.True(search_directive(conf.nginx_http_directives, "lua_shared_dict", "prometheus_metrics 2m")) end) it("is injected in addition to any shm provided via nginx_http_* directive", function() local conf = assert(conf_loader(nil, { plugins = "bundled", nginx_http_lua_shared_dict = "custom_cache 2m", })) assert.True(search_directive(conf.nginx_http_directives, "lua_shared_dict", "custom_cache 2m")) assert.True(search_directive(conf.nginx_http_directives, "lua_shared_dict", "prometheus_metrics 5m")) end) it("is not injected if prometheus plugin is disabled", function() local conf = assert(conf_loader(nil, { plugins = "off", })) assert.is_nil(conf.nginx_http_directives["lua_shared_dict"]) end) end) describe("nginx_main_user", function() it("is 'kong kong' by default if the kong user/group exist", function() local conf = assert(conf_loader(helpers.test_conf_path)) if kong_user_group_exists() == true then assert.equal("kong kong", conf.nginx_main_user) else assert.is_nil(conf.nginx_main_user) end end) it("is nil when 'nobody'", function() local conf = assert(conf_loader(helpers.test_conf_path, { nginx_main_user = "nobody" })) assert.is_nil(conf.nginx_main_user) end) it("is nil when 'nobody nobody'", function() local conf = assert(conf_loader(helpers.test_conf_path, { nginx_main_user = "nobody nobody" })) assert.is_nil(conf.nginx_main_user) end) it("is 'www_data www_data' when 'www_data www_data'", function() local conf = assert(conf_loader(helpers.test_conf_path, { nginx_main_user = "www_data www_data" })) assert.equal("www_data www_data", conf.nginx_main_user) end) end) describe("nginx_user", function() it("is 'kong kong' by default if the kong user/group exist", function() local conf = assert(conf_loader(helpers.test_conf_path)) if kong_user_group_exists() == true then assert.equal("kong kong", conf.nginx_user) else assert.is_nil(conf.nginx_user) end end) it("is nil when 'nobody'", function() local conf = assert(conf_loader(helpers.test_conf_path, { nginx_user = "nobody" })) assert.is_nil(conf.nginx_user) end) it("is nil when 'nobody nobody'", function() local conf = assert(conf_loader(helpers.test_conf_path, { nginx_user = "nobody nobody" })) assert.is_nil(conf.nginx_user) end) it("is 'www_data www_data' when 'www_data www_data'", function() local conf = assert(conf_loader(helpers.test_conf_path, { nginx_user = "www_data www_data" })) assert.equal("www_data www_data", conf.nginx_user) end) end) describe("port_maps and host_ports", function() it("are empty tables when not specified", function() local conf = assert(conf_loader(helpers.test_conf_path, {})) assert.same({}, conf.port_maps) assert.same({}, conf.host_ports) end) it("are tables when specified", function() local conf = assert(conf_loader(helpers.test_conf_path, { port_maps = "80:8000,443:8443", })) assert.same({ "80:8000", "443:8443", }, conf.port_maps) assert.same({ [8000] = 80, ["8000"] = 80, [8443] = 443, ["8443"] = 443, }, conf.host_ports) end) it("gives an error with invalid value", function() local _, err = conf_loader(helpers.test_conf_path, { port_maps = "src:dst", }) assert.equal("invalid port mapping (`port_maps`): src:dst", err) end) it("errors with a helpful error message if cassandra is used", function() local _, err = conf_loader(nil, { database = "cassandra" }) assert.equal("Cassandra as a datastore for Kong is not supported in" .. " versions 3.4 and above. Please use Postgres.", err) end) end) describe("inferences", function() it("infer booleans (on/off/true/false strings)", function() local conf = assert(conf_loader()) assert.equal("on", conf.nginx_main_daemon) assert.equal(256, conf.lua_socket_pool_size) assert.True(conf.anonymous_reports) assert.False(conf.pg_ssl) assert.False(conf.pg_ssl_verify) conf = assert(conf_loader(nil, { pg_ssl = true })) assert.True(conf.pg_ssl) conf = assert(conf_loader(nil, { pg_ssl = "on" })) assert.True(conf.pg_ssl) conf = assert(conf_loader(nil, { pg_ssl = "true" })) assert.True(conf.pg_ssl) end) it("infer arrays (comma-separated strings)", function() local conf = assert(conf_loader()) assert.same({"bundled"}, conf.plugins) assert.same({"LAST", "SRV", "A", "CNAME"}, conf.dns_order) assert.same({"A", "SRV"}, conf.resolver_family) assert.is_nil(getmetatable(conf.plugins)) assert.is_nil(getmetatable(conf.dns_order)) assert.is_nil(getmetatable(conf.resolver_family)) end) it("trims array values", function() local conf = assert(conf_loader("spec/fixtures/to-strip.conf")) assert.same({"foobar", "hello-world", "bundled"}, conf.plugins) end) it("infer ngx_boolean", function() local conf = assert(conf_loader(nil, { nginx_main_daemon = true })) assert.equal("on", conf.nginx_main_daemon) conf = assert(conf_loader(nil, { nginx_main_daemon = false })) assert.equal("off", conf.nginx_main_daemon) conf = assert(conf_loader(nil, { nginx_main_daemon = "off" })) assert.equal("off", conf.nginx_main_daemon) end) end) describe("validations", function() it("enforces properties types", function() local conf, err = conf_loader(nil, { lua_package_path = 123 }) assert.equal("lua_package_path is not a string: '123'", err) assert.is_nil(conf) end) it("enforces enums", function() local conf, err = conf_loader(nil, { database = "mysql" }) assert.equal("database has an invalid value: 'mysql' (postgres, cassandra, off)", err) assert.is_nil(conf) local conf, err = conf_loader(nil, { worker_consistency = "magical" }) assert.equal("worker_consistency has an invalid value: 'magical' (strict, eventual)", err) assert.is_nil(conf) end) it("enforces listen addresses format", function() local conf, err = conf_loader(nil, { admin_listen = "127.0.0.1" }) assert.is_nil(conf) assert.equal("admin_listen must be of form: [off] | : [ssl] [http2] [proxy_protocol] [deferred] [bind] [reuseport] [backlog=%d+] [ipv6only=on] [ipv6only=off] [so_keepalive=on] [so_keepalive=off] [so_keepalive=%w*:%w*:%d*], [... next entry ...]", err) conf, err = conf_loader(nil, { proxy_listen = "127.0.0.1" }) assert.is_nil(conf) assert.equal("proxy_listen must be of form: [off] | : [ssl] [http2] [proxy_protocol] [deferred] [bind] [reuseport] [backlog=%d+] [ipv6only=on] [ipv6only=off] [so_keepalive=on] [so_keepalive=off] [so_keepalive=%w*:%w*:%d*], [... next entry ...]", err) conf, err = conf_loader(nil, { admin_gui_listen = "127.0.0.1" }) assert.is_nil(conf) assert.equal("admin_gui_listen must be of form: [off] | : [ssl] [http2] [proxy_protocol] [deferred] [bind] [reuseport] [backlog=%d+] [ipv6only=on] [ipv6only=off] [so_keepalive=on] [so_keepalive=off] [so_keepalive=%w*:%w*:%d*], [... next entry ...]", err) end) it("rejects empty string in listen addresses", function() local conf, err = conf_loader(nil, { admin_listen = "" }) assert.is_nil(conf) assert.equal("admin_listen must be of form: [off] | : [ssl] [http2] [proxy_protocol] [deferred] [bind] [reuseport] [backlog=%d+] [ipv6only=on] [ipv6only=off] [so_keepalive=on] [so_keepalive=off] [so_keepalive=%w*:%w*:%d*], [... next entry ...]", err) conf, err = conf_loader(nil, { proxy_listen = "" }) assert.is_nil(conf) assert.equal("proxy_listen must be of form: [off] | : [ssl] [http2] [proxy_protocol] [deferred] [bind] [reuseport] [backlog=%d+] [ipv6only=on] [ipv6only=off] [so_keepalive=on] [so_keepalive=off] [so_keepalive=%w*:%w*:%d*], [... next entry ...]", err) conf, err = conf_loader(nil, { admin_gui_listen = "" }) assert.is_nil(conf) assert.equal("admin_gui_listen must be of form: [off] | : [ssl] [http2] [proxy_protocol] [deferred] [bind] [reuseport] [backlog=%d+] [ipv6only=on] [ipv6only=off] [so_keepalive=on] [so_keepalive=off] [so_keepalive=%w*:%w*:%d*], [... next entry ...]", err) end) it("enforces admin_gui_path values", function() local conf, _, errors = conf_loader(nil, { admin_gui_path = "without-leading-slash" }) assert.equal(1, #errors) assert.is_nil(conf) conf, _, errors = conf_loader(nil, { admin_gui_path = "/with-trailing-slash/" }) assert.equal(1, #errors) assert.is_nil(conf) conf, _, errors = conf_loader(nil, { admin_gui_path = "/with!invalid$characters" }) assert.equal(1, #errors) assert.is_nil(conf) conf, _, errors = conf_loader(nil, { admin_gui_path = "/with//many///continuous////slashes" }) assert.equal(1, #errors) assert.is_nil(conf) conf, _, errors = conf_loader(nil, { admin_gui_path = "with!invalid$characters-but-no-leading-slashes" }) assert.equal(2, #errors) assert.is_nil(conf) conf, _, errors = conf_loader(nil, { admin_gui_path = "/kong/manager" }) assert.is_nil(errors) assert.is_not_nil(conf) end) it("errors when dns_resolver is not a list in ipv4/6[:port] format", function() local conf, err = conf_loader(nil, { dns_resolver = "1.2.3.4:53;4.3.2.1" -- ; as separator }) assert.equal("dns_resolver must be a comma separated list in the form of IPv4/6 or IPv4/6:port, got '1.2.3.4:53;4.3.2.1'", err) assert.is_nil(conf) conf, err = conf_loader(nil, { dns_resolver = "198.51.100.0:53" }) assert.is_nil(err) assert.is_table(conf) conf, err = conf_loader(nil, { dns_resolver = "[::1]:53" }) assert.is_nil(err) assert.is_table(conf) conf, err = conf_loader(nil, { dns_resolver = "198.51.100.0,1.2.3.4:53,::1,[::1]:53" }) assert.is_nil(err) assert.is_table(conf) end) it("errors when resolver_address is not a list in ipv4/6[:port] format (new dns)", function() local conf, err = conf_loader(nil, { resolver_address = "1.2.3.4:53;4.3.2.1" -- ; as separator }) assert.equal("resolver_address must be a comma separated list in the form of IPv4/6 or IPv4/6:port, got '1.2.3.4:53;4.3.2.1'", err) assert.is_nil(conf) conf, err = conf_loader(nil, { resolver_address = "198.51.100.0:53" }) assert.is_nil(err) assert.is_table(conf) conf, err = conf_loader(nil, { resolver_address = "[::1]:53" }) assert.is_nil(err) assert.is_table(conf) conf, err = conf_loader(nil, { resolver_address = "198.51.100.0,1.2.3.4:53,::1,[::1]:53" }) assert.is_nil(err) assert.is_table(conf) end) it("errors when node_id is not a valid uuid", function() local conf, err = conf_loader(nil, { node_id = "foobar", }) assert.equal("node_id must be a valid UUID", err) assert.is_nil(conf) end) it("accepts a valid UUID as node_id", function() local conf, err = conf_loader(nil, { node_id = "8b7de2ba-0477-4667-a811-8bca46073ca9", }) assert.is_nil(err) assert.equal("8b7de2ba-0477-4667-a811-8bca46073ca9", conf.node_id) end) it("errors when the hosts file does not exist", function() local tmpfile = "/a_file_that_does_not_exist" local conf, err = conf_loader(nil, { dns_hostsfile = tmpfile, }) assert.equal([[dns_hostsfile: file does not exist]], err) assert.is_nil(conf) end) it("errors when the hosts file does not exist (new dns)", function() -- new dns local tmpfile = "/a_file_that_does_not_exist" local conf, err = conf_loader(nil, { resolver_hosts_file = tmpfile, }) assert.equal([[resolver_hosts_file: file does not exist]], err) assert.is_nil(conf) end) it("accepts an existing hosts file", function() local tmpfile = require("pl.path").tmpname() -- this creates the file! finally(function() os.remove(tmpfile) end) local conf, err = conf_loader(nil, { dns_hostsfile = tmpfile, }) assert.is_nil(err) assert.equal(tmpfile, conf.dns_hostsfile) end) it("accepts an existing hosts file (new dns)", function() local tmpfile = require("pl.path").tmpname() -- this creates the file! finally(function() os.remove(tmpfile) end) local conf, err = conf_loader(nil, { resolver_hosts_file = tmpfile, }) assert.is_nil(err) assert.equal(tmpfile, conf.resolver_hosts_file) end) it("errors on bad entries in the order list", function() local conf, err = conf_loader(nil, { dns_order = "A,CXAME,SRV", }) assert.is_nil(conf) assert.equal([[dns_order: invalid entry 'CXAME']], err) end) it("errors on bad entries in the family list", function() local conf, err = conf_loader(nil, { resolver_family = "A,AAAX,SRV", }) assert.is_nil(conf) assert.equal([[resolver_family: invalid entry 'AAAX']], err) end) it("errors on bad entries in headers", function() local conf, err = conf_loader(nil, { headers = "server_tokens,Foo-Bar", }) assert.is_nil(conf) assert.equal([[headers: invalid entry 'Foo-Bar']], err) end) describe("SSL", function() it("accepts and decodes valid base64 values", function() local ssl_fixtures = require "spec.fixtures.ssl" local cert = ssl_fixtures.cert local cacert = ssl_fixtures.cert_ca local key = ssl_fixtures.key local dhparam = ssl_fixtures.dhparam local properties = { ssl_cert = cert, ssl_cert_key = key, admin_ssl_cert = cert, admin_ssl_cert_key = key, admin_gui_ssl_cert = cert, admin_gui_ssl_cert_key = key, status_ssl_cert = cert, status_ssl_cert_key = key, client_ssl_cert = cert, client_ssl_cert_key = key, cluster_cert = cert, cluster_cert_key = key, cluster_ca_cert = cacert, ssl_dhparam = dhparam, lua_ssl_trusted_certificate = cacert } local conf_params = { ssl_cipher_suite = "old", client_ssl = "on", role = "control_plane", database = "postgres", status_listen = "127.0.0.1:123 ssl", proxy_listen = "127.0.0.1:456 ssl", admin_listen = "127.0.0.1:789 ssl", admin_gui_listen = "127.0.0.1:8445 ssl", } for n, v in pairs(properties) do conf_params[n] = ngx.encode_base64(v) end local conf, err = conf_loader(nil, conf_params) assert.is_nil(err) assert.is_table(conf) for name, decoded_val in pairs(properties) do local values = conf[name] if type(values) == "table" then for i = 1, #values do assert.equals(decoded_val, values[i]) end end if type(values) == "string" then assert.equals(decoded_val, values) end end end) describe("proxy", function() it("does not check SSL cert and key if SSL is off", function() local conf, err = conf_loader(nil, { proxy_listen = "127.0.0.1:123", ssl_cert = "/path/cert.pem" }) assert.is_nil(err) assert.is_table(conf) -- specific case with 'ssl' in the name local conf, err = conf_loader(nil, { proxy_listen = "ssl:23", proxy_ssl_cert = "/path/cert.pem" }) assert.is_nil(err) assert.is_table(conf) end) it("requires both proxy SSL cert and key", function() local conf, err = conf_loader(nil, { ssl_cert = "/path/cert.pem" }) assert.equal("ssl_cert_key must be specified", err) assert.is_nil(conf) conf, err = conf_loader(nil, { ssl_cert_key = "/path/key.pem" }) assert.equal("ssl_cert must be specified", err) assert.is_nil(conf) conf, err = conf_loader(nil, { ssl_cert = "spec/fixtures/kong_spec.crt", ssl_cert_key = "spec/fixtures/kong_spec.key" }) assert.is_nil(err) assert.is_table(conf) end) it("requires SSL cert and key to exist", function() local conf, _, errors = conf_loader(nil, { ssl_cert = "/path/cert.pem", ssl_cert_key = "/path/cert_key.pem" }) assert.equal(2, #errors) assert.contains("ssl_cert: failed loading certificate from /path/cert.pem", errors) assert.contains("ssl_cert_key: failed loading key from /path/cert_key.pem", errors) assert.is_nil(conf) conf, _, errors = conf_loader(nil, { ssl_cert = "spec/fixtures/kong_spec.crt", ssl_cert_key = "/path/cert_key.pem" }) assert.equal(1, #errors) assert.contains("ssl_cert_key: failed loading key from /path/cert_key.pem", errors) assert.is_nil(conf) end) it("requires SSL DH param file to exist", function() local conf, _, errors = conf_loader(nil, { ssl_cipher_suite = "custom", ssl_dhparam = "/path/dhparam.pem" }) assert.equal(1, #errors) assert.contains("ssl_dhparam: failed loading certificate from /path/dhparam.pem", errors) assert.is_nil(conf) conf, _, errors = conf_loader(nil, { ssl_cipher_suite = "custom", nginx_http_ssl_dhparam = "/path/dhparam-http.pem", nginx_stream_ssl_dhparam = "/path/dhparam-stream.pem", }) assert.equal(2, #errors) assert.contains("nginx_http_ssl_dhparam: no such file at /path/dhparam-http.pem", errors) assert.contains("nginx_stream_ssl_dhparam: no such file at /path/dhparam-stream.pem", errors) assert.is_nil(conf) end) it("requires trusted CA cert file to exist", function() local conf, _, errors = conf_loader(nil, { lua_ssl_trusted_certificate = "/path/cert.pem", }) assert.equal(1, #errors) assert.contains("lua_ssl_trusted_certificate: failed loading certificate from /path/cert.pem", errors) assert.is_nil(conf) end) it("accepts several CA certs in lua_ssl_trusted_certificate, setting lua_ssl_trusted_certificate_combined", function() local conf, _, errors = conf_loader(nil, { lua_ssl_trusted_certificate = "spec/fixtures/kong_spec.crt,spec/fixtures/kong_clustering.crt", }) assert.is_nil(errors) assert.same({ pl_path.abspath("spec/fixtures/kong_spec.crt"), pl_path.abspath("spec/fixtures/kong_clustering.crt"), }, conf.lua_ssl_trusted_certificate) assert.matches(".ca_combined", conf.lua_ssl_trusted_certificate_combined) end) it("expands the `system` property in lua_ssl_trusted_certificate", function() local utils = require "kong.tools.system" local old_gstcf = utils.get_system_trusted_certs_filepath local old_exists = pl_path.exists finally(function() utils.get_system_trusted_certs_filepath = old_gstcf pl_path.exists = old_exists end) local system_path = "spec/fixtures/kong_spec.crt" utils.get_system_trusted_certs_filepath = function() return system_path end pl_path.exists = function(path) return path == system_path or old_exists(path) end local conf, _, errors = conf_loader(nil, { lua_ssl_trusted_certificate = "system", }) assert.is_nil(errors) assert.same({ pl_path.abspath(system_path), }, conf.lua_ssl_trusted_certificate) assert.matches(".ca_combined", conf.lua_ssl_trusted_certificate_combined) -- test default local conf, _, errors = conf_loader(nil, {}) assert.is_nil(errors) assert.same({ pl_path.abspath(system_path), }, conf.lua_ssl_trusted_certificate) assert.matches(".ca_combined", conf.lua_ssl_trusted_certificate_combined) end) it("does not throw errors if the host doesn't have system certificates", function() local old_exists = pl_path.exists finally(function() pl_path.exists = old_exists end) pl_path.exists = function(path) return false end local _, _, errors = conf_loader(nil, { lua_ssl_trusted_certificate = "system", }) assert.is_nil(errors) end) it("requires cluster_cert and key files to exist", function() local conf, _, errors = conf_loader(nil, { role = "data_plane", database = "off", cluster_cert = "path/kong_clustering.crt", cluster_cert_key = "path/kong_clustering.key", }) assert.equal(2, #errors) assert.contains("cluster_cert: failed loading certificate from path/kong_clustering.crt", errors) assert.contains("cluster_cert_key: failed loading key from path/kong_clustering.key", errors) assert.is_nil(conf) end) it("requires cluster_ca_cert file to exist", function() local conf, _, errors = conf_loader(nil, { role = "data_plane", database = "off", cluster_ca_cert = "path/kong_clustering_ca.crt", cluster_cert = "spec/fixtures/kong_clustering.crt", cluster_cert_key = "spec/fixtures/kong_clustering.key", }) assert.equal(1, #errors) assert.contains("cluster_ca_cert: failed loading certificate from path/kong_clustering_ca.crt", errors) assert.is_nil(conf) end) it("autoload cluster_cert or cluster_ca_cert for data plane in lua_ssl_trusted_certificate", function() local conf, _, errors = conf_loader(nil, { role = "data_plane", database = "off", cluster_cert = "spec/fixtures/kong_clustering.crt", cluster_cert_key = "spec/fixtures/kong_clustering.key", }) assert.is_nil(errors) assert.contains( pl_path.abspath("spec/fixtures/kong_clustering.crt"), conf.lua_ssl_trusted_certificate ) assert.matches(".ca_combined", conf.lua_ssl_trusted_certificate_combined) local conf, _, errors = conf_loader(nil, { role = "data_plane", database = "off", cluster_mtls = "pki", cluster_cert = "spec/fixtures/kong_clustering.crt", cluster_cert_key = "spec/fixtures/kong_clustering.key", cluster_ca_cert = "spec/fixtures/kong_clustering_ca.crt", }) assert.is_nil(errors) assert.contains( pl_path.abspath("spec/fixtures/kong_clustering_ca.crt"), conf.lua_ssl_trusted_certificate ) assert.matches(".ca_combined", conf.lua_ssl_trusted_certificate_combined) end) it("autoload base64 cluster_cert or cluster_ca_cert for data plane in lua_ssl_trusted_certificate", function() local ssl_fixtures = require "spec.fixtures.ssl" local cert = ssl_fixtures.cert local cacert = ssl_fixtures.cert_ca local key = ssl_fixtures.key local conf, _, errors = conf_loader(nil, { role = "data_plane", database = "off", cluster_cert = ngx.encode_base64(cert), cluster_cert_key = ngx.encode_base64(key), }) assert.is_nil(errors) assert.contains( cert, conf.lua_ssl_trusted_certificate ) local conf, _, errors = conf_loader(nil, { role = "data_plane", database = "off", cluster_mtls = "pki", cluster_cert = ngx.encode_base64(cert), cluster_cert_key = ngx.encode_base64(key), cluster_ca_cert = ngx.encode_base64(cacert), }) assert.is_nil(errors) assert.contains( cacert, conf.lua_ssl_trusted_certificate ) end) it("validates proxy_server", function() local conf, _, errors = conf_loader(nil, { proxy_server = "http://cool:pwd@localhost:2333", }) assert.is_nil(errors) assert.is_table(conf) local conf, _, errors = conf_loader(nil, { proxy_server = "http://😉.tld", }) assert.is_nil(errors) assert.is_table(conf) local conf, _, errors = conf_loader(nil, { proxy_server = "http://%F0%9F%98%89.tld", }) assert.is_nil(errors) assert.is_table(conf) local conf, _, errors = conf_loader(nil, { proxy_server = "://localhost:2333", }) assert.contains("proxy_server missing scheme", errors) assert.is_nil(conf) local conf, _, errors = conf_loader(nil, { proxy_server = "cool://localhost:2333", }) assert.contains("proxy_server only supports \"http\" and \"https\", got cool", errors) assert.is_nil(conf) local conf, _, errors = conf_loader(nil, { proxy_server = "http://:2333", }) assert.contains("proxy_server missing host", errors) assert.is_nil(conf) local conf, _, errors = conf_loader(nil, { proxy_server = "http://localhost:2333/?a=1", }) assert.contains("fragments, query strings or parameters are meaningless in proxy configuration", errors) assert.is_nil(conf) local conf, _, errors = conf_loader(nil, { proxy_server = "http://user:password%23@localhost:2333", }) assert.is_nil(errors) assert.is_table(conf) local conf, _, errors = conf_loader(nil, { proxy_server = "http://user:password#@localhost:2333", }) assert.contains("fragments, query strings or parameters are meaningless in proxy configuration", errors) assert.is_nil(conf) end) it("doesn't allow cluster_use_proxy on CP but allows on DP", function() local conf, _, errors = conf_loader(nil, { role = "data_plane", database = "off", cluster_cert = "spec/fixtures/kong_clustering.crt", cluster_cert_key = "spec/fixtures/kong_clustering.key", cluster_use_proxy = "on", }) assert.contains("cluster_use_proxy is turned on but no proxy_server is configured", errors) assert.is_nil(conf) local conf, _, errors = conf_loader(nil, { role = "data_plane", database = "off", cluster_cert = "spec/fixtures/kong_clustering.crt", cluster_cert_key = "spec/fixtures/kong_clustering.key", cluster_use_proxy = "on", proxy_server = "http://user:pass@localhost:2333/", }) assert.is_nil(errors) assert.is_table(conf) local conf, _, errors = conf_loader(nil, { role = "control_plane", cluster_cert = "spec/fixtures/kong_clustering.crt", cluster_cert_key = "spec/fixtures/kong_clustering.key", cluster_use_proxy = "on", }) assert.contains("cluster_use_proxy can not be used when role = \"control_plane\"", errors) assert.is_nil(conf) end) it("doen't overwrite lua_ssl_trusted_certificate when autoload cluster_cert or cluster_ca_cert", function() local conf, _, errors = conf_loader(nil, { role = "data_plane", database = "off", lua_ssl_trusted_certificate = "spec/fixtures/kong_spec.crt,spec/fixtures/kong_clustering_client.crt", cluster_cert = "spec/fixtures/kong_clustering.crt", cluster_cert_key = "spec/fixtures/kong_clustering.key", }) assert.is_nil(errors) assert.same({ pl_path.abspath("spec/fixtures/kong_spec.crt"), pl_path.abspath("spec/fixtures/kong_clustering_client.crt"), pl_path.abspath("spec/fixtures/kong_clustering.crt"), }, conf.lua_ssl_trusted_certificate) assert.matches(".ca_combined", conf.lua_ssl_trusted_certificate_combined) local conf, _, errors = conf_loader(nil, { role = "data_plane", database = "off", lua_ssl_trusted_certificate = "spec/fixtures/kong_spec.crt,spec/fixtures/kong_clustering_client.crt", cluster_mtls = "pki", cluster_cert = "spec/fixtures/kong_clustering.crt", cluster_cert_key = "spec/fixtures/kong_clustering.key", cluster_ca_cert = "spec/fixtures/kong_clustering_ca.crt", }) assert.is_nil(errors) assert.same({ pl_path.abspath("spec/fixtures/kong_spec.crt"), pl_path.abspath("spec/fixtures/kong_clustering_client.crt"), pl_path.abspath("spec/fixtures/kong_clustering_ca.crt"), }, conf.lua_ssl_trusted_certificate) assert.matches(".ca_combined", conf.lua_ssl_trusted_certificate_combined) end) it("doesn't load cluster_cert or cluster_ca_cert for control plane", function() local conf, _, errors = conf_loader(nil, { role = "control_plane", database = "postgres", cluster_cert = "spec/fixtures/kong_clustering.crt", cluster_cert_key = "spec/fixtures/kong_clustering.key", cluster_ca_cert = "spec/fixtures/kong_clustering_ca.crt", }) assert.is_nil(errors) assert.not_contains( pl_path.abspath("spec/fixtures/kong_clustering_ca.crt"), conf.lua_ssl_trusted_certificate ) end) it("resolves SSL cert/key to absolute path", function() local conf, err = conf_loader(nil, { ssl_cert = "spec/fixtures/kong_spec.crt", ssl_cert_key = "spec/fixtures/kong_spec.key" }) assert.is_nil(err) assert.is_table(conf) for i = 1, #conf.ssl_cert do assert.True(helpers.path.isabs(conf.ssl_cert[i])) assert.True(helpers.path.isabs(conf.ssl_cert_key[i])) end end) it("defines ssl_ciphers by default", function() local conf, err = conf_loader(nil, {}) assert.is_nil(err) assert.equal("ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305", conf.ssl_ciphers) end) it("explicitly defines ssl_ciphers", function() local conf, err = conf_loader(nil, { ssl_cipher_suite = "old" }) assert.is_nil(err) -- looks kinda like a cipher suite assert.matches(":", conf.ssl_ciphers, nil, true) end) it("errors on invalid ssl_cipher_suite", function() local conf, _, errors = conf_loader(nil, { ssl_cipher_suite = "foo" }) assert.is_nil(conf) assert.equal(1, #errors) assert.matches("Undefined cipher suite foo", errors[1], nil, true) end) it("overrides ssl_ciphers when ssl_cipher_suite is custom", function() local conf, err = conf_loader(nil, { ssl_cipher_suite = "custom", ssl_ciphers = "foo:bar", }) assert.is_nil(err) assert.equals("foo:bar", conf.ssl_ciphers) end) it("doesn't override ssl_ciphers when undefined", function() local conf, err = conf_loader(nil, { ssl_cipher_suite = "custom", }) assert.is_nil(err) assert.same(nil, conf.ssl_ciphers) end) it("defines ssl_dhparam with default cipher suite", function() local conf, err = conf_loader() assert.is_nil(err) assert.equal("ffdhe2048", conf.nginx_http_ssl_dhparam) assert.equal("ffdhe2048", conf.nginx_stream_ssl_dhparam) end) it("defines ssl_dhparam with intermediate cipher suite", function() local conf, err = conf_loader(nil, { ssl_cipher_suite = "intermediate", }) assert.is_nil(err) assert.equal("ffdhe2048", conf.nginx_http_ssl_dhparam) assert.equal("ffdhe2048", conf.nginx_stream_ssl_dhparam) end) it("doesn't define ssl_dhparam with modern cipher suite", function() local conf, err = conf_loader(nil, { ssl_cipher_suite = "modern", }) assert.is_nil(err) assert.equal(nil, conf.nginx_http_ssl_dhparam) assert.equal(nil, conf.nginx_stream_ssl_dhparam) end) it("doesn't define ssl_dhparam with old cipher suite (#todo)", function() local conf, err = conf_loader(nil, { ssl_cipher_suite = "old", }) assert.is_nil(err) assert.equal(nil, conf.nginx_http_ssl_dhparam) assert.equal(nil, conf.nginx_stream_ssl_dhparam) end) end) describe("client", function() it("requires both proxy SSL cert and key", function() local conf, err = conf_loader(nil, { client_ssl = true, client_ssl_cert = "/path/cert.pem" }) assert.equal("client_ssl_cert_key must be specified", err) assert.is_nil(conf) conf, err = conf_loader(nil, { client_ssl = true, client_ssl_cert_key = "/path/key.pem" }) assert.equal("client_ssl_cert must be specified", err) assert.is_nil(conf) conf, err = conf_loader(nil, { client_ssl = true, client_ssl_cert = "spec/fixtures/kong_spec.crt", client_ssl_cert_key = "spec/fixtures/kong_spec.key" }) assert.is_nil(err) assert.is_table(conf) end) it("requires SSL cert and key to exist", function() local conf, _, errors = conf_loader(nil, { client_ssl = true, client_ssl_cert = "/path/cert.pem", client_ssl_cert_key = "/path/cert_key.pem" }) assert.equal(2, #errors) assert.contains("client_ssl_cert: failed loading certificate from /path/cert.pem", errors) assert.contains("client_ssl_cert_key: failed loading key from /path/cert_key.pem", errors) assert.is_nil(conf) conf, _, errors = conf_loader(nil, { client_ssl = true, client_ssl_cert = "spec/fixtures/kong_spec.crt", client_ssl_cert_key = "/path/cert_key.pem" }) assert.equal(1, #errors) assert.contains("client_ssl_cert_key: failed loading key from /path/cert_key.pem", errors) assert.is_nil(conf) end) it("resolves SSL cert/key to absolute path", function() local conf, err = conf_loader(nil, { client_ssl = true, client_ssl_cert = "spec/fixtures/kong_spec.crt", client_ssl_cert_key = "spec/fixtures/kong_spec.key" }) assert.is_nil(err) assert.is_table(conf) assert.True(helpers.path.isabs(conf.client_ssl_cert)) assert.True(helpers.path.isabs(conf.client_ssl_cert_key)) end) end) describe("admin", function() it("does not check SSL cert and key if SSL is off", function() local conf, err = conf_loader(nil, { admin_listen = "127.0.0.1:123", admin_ssl_cert = "/path/cert.pem" }) assert.is_nil(err) assert.is_table(conf) -- specific case with 'ssl' in the name local conf, err = conf_loader(nil, { admin_listen = "ssl:23", admin_ssl_cert = "/path/cert.pem" }) assert.is_nil(err) assert.is_table(conf) end) it("requires both admin SSL cert and key", function() local conf, err = conf_loader(nil, { admin_ssl_cert = "/path/cert.pem" }) assert.equal("admin_ssl_cert_key must be specified", err) assert.is_nil(conf) conf, err = conf_loader(nil, { admin_ssl_cert_key = "/path/key.pem" }) assert.equal("admin_ssl_cert must be specified", err) assert.is_nil(conf) conf, err = conf_loader(nil, { admin_ssl_cert = "spec/fixtures/kong_spec.crt", admin_ssl_cert_key = "spec/fixtures/kong_spec.key" }) assert.is_nil(err) assert.is_table(conf) end) it("requires SSL cert and key to exist", function() local conf, _, errors = conf_loader(nil, { admin_ssl_cert = "/path/cert.pem", admin_ssl_cert_key = "/path/cert_key.pem" }) assert.equal(2, #errors) assert.contains("admin_ssl_cert: failed loading certificate from /path/cert.pem", errors) assert.contains("admin_ssl_cert_key: failed loading key from /path/cert_key.pem", errors) assert.is_nil(conf) conf, _, errors = conf_loader(nil, { admin_ssl_cert = "spec/fixtures/kong_spec.crt", admin_ssl_cert_key = "/path/cert_key.pem" }) assert.equal(1, #errors) assert.contains("admin_ssl_cert_key: failed loading key from /path/cert_key.pem", errors) assert.is_nil(conf) end) it("resolves SSL cert/key to absolute path", function() local conf, err = conf_loader(nil, { admin_ssl_cert = "spec/fixtures/kong_spec.crt", admin_ssl_cert_key = "spec/fixtures/kong_spec.key" }) assert.is_nil(err) assert.is_table(conf) for i = 1, #conf.admin_ssl_cert do assert.True(helpers.path.isabs(conf.admin_ssl_cert[i])) assert.True(helpers.path.isabs(conf.admin_ssl_cert_key[i])) end end) end) describe("admin-gui", function() it("does not check SSL cert and key if SSL is off", function() local conf, err = conf_loader(nil, { admin_gui_listen = "127.0.0.1:123", admin_gui_ssl_cert = "/path/cert.pem" }) assert.is_nil(err) assert.is_table(conf) -- specific case with 'ssl' in the name local conf, err = conf_loader(nil, { admin_gui_listen = "ssl:23", admin_gui_ssl_cert = "/path/cert.pem" }) assert.is_nil(err) assert.is_table(conf) end) it("requires both SSL cert and key present", function() local conf, err = conf_loader(nil, { admin_gui_ssl_cert = "/path/cert.pem" }) assert.equal("admin_gui_ssl_cert_key must be specified", err) assert.is_nil(conf) conf, err = conf_loader(nil, { admin_gui_ssl_cert_key = "/path/key.pem" }) assert.equal("admin_gui_ssl_cert must be specified", err) assert.is_nil(conf) conf, err = conf_loader(nil, { admin_gui_ssl_cert = "spec/fixtures/kong_spec.crt", admin_gui_ssl_cert_key = "spec/fixtures/kong_spec.key" }) assert.is_nil(err) assert.is_table(conf) end) it("requires SSL cert and key to exist", function() local conf, _, errors = conf_loader(nil, { admin_gui_ssl_cert = "/path/cert.pem", admin_gui_ssl_cert_key = "/path/cert_key.pem" }) assert.equal(2, #errors) assert.contains("admin_gui_ssl_cert: failed loading certificate from /path/cert.pem", errors) assert.contains("admin_gui_ssl_cert_key: failed loading key from /path/cert_key.pem", errors) assert.is_nil(conf) conf, _, errors = conf_loader(nil, { admin_gui_ssl_cert = "spec/fixtures/kong_spec.crt", admin_gui_ssl_cert_key = "/path/cert_key.pem" }) assert.equal(1, #errors) assert.contains("admin_gui_ssl_cert_key: failed loading key from /path/cert_key.pem", errors) assert.is_nil(conf) end) it("resolves SSL cert/key to absolute path", function() local conf, err = conf_loader(nil, { admin_gui_ssl_cert = "spec/fixtures/kong_spec.crt", admin_gui_ssl_cert_key = "spec/fixtures/kong_spec.key" }) assert.is_nil(err) assert.is_table(conf) for i = 1, #conf.admin_gui_ssl_cert do assert.True(helpers.path.isabs(conf.admin_gui_ssl_cert[i])) assert.True(helpers.path.isabs(conf.admin_gui_ssl_cert_key[i])) end end) end) describe("status", function() it("does not check SSL cert and key if SSL is off", function() local conf, err = conf_loader(nil, { status_listen = "127.0.0.1:123", status_ssl_cert = "/path/cert.pem" }) assert.is_nil(err) assert.is_table(conf) -- specific case with 'ssl' in the name local conf, err = conf_loader(nil, { status_listen = "ssl:23", status_ssl_cert = "/path/cert.pem" }) assert.is_nil(err) assert.is_table(conf) end) it("requires both status SSL cert and key", function() local conf, err = conf_loader(nil, { status_listen = "127.0.0.1:123 ssl", status_ssl_cert = "/path/cert.pem" }) assert.equal("status_ssl_cert_key must be specified", err) assert.is_nil(conf) conf, err = conf_loader(nil, { status_listen = "127.0.0.1:123 ssl", status_ssl_cert_key = "/path/key.pem" }) assert.equal("status_ssl_cert must be specified", err) assert.is_nil(conf) conf, err = conf_loader(nil, { status_listen = "127.0.0.1:123 ssl", status_ssl_cert = "spec/fixtures/kong_spec.crt", status_ssl_cert_key = "spec/fixtures/kong_spec.key" }) assert.is_nil(err) assert.is_table(conf) end) it("requires SSL cert and key to exist", function() local conf, _, errors = conf_loader(nil, { status_listen = "127.0.0.1:123 ssl", status_ssl_cert = "/path/cert.pem", status_ssl_cert_key = "/path/cert_key.pem" }) assert.equal(2, #errors) assert.contains("status_ssl_cert: failed loading certificate from /path/cert.pem", errors) assert.contains("status_ssl_cert_key: failed loading key from /path/cert_key.pem", errors) assert.is_nil(conf) conf, _, errors = conf_loader(nil, { status_listen = "127.0.0.1:123 ssl", status_ssl_cert = "spec/fixtures/kong_spec.crt", status_ssl_cert_key = "/path/cert_key.pem" }) assert.equal(1, #errors) assert.contains("status_ssl_cert_key: failed loading key from /path/cert_key.pem", errors) assert.is_nil(conf) end) it("resolves SSL cert/key to absolute path", function() local conf, err = conf_loader(nil, { status_listen = "127.0.0.1:123 ssl", status_ssl_cert = "spec/fixtures/kong_spec.crt", status_ssl_cert_key = "spec/fixtures/kong_spec.key" }) assert.is_nil(err) assert.is_table(conf) for i = 1, #conf.status_ssl_cert do assert.True(helpers.path.isabs(conf.status_ssl_cert[i])) assert.True(helpers.path.isabs(conf.status_ssl_cert_key[i])) end end) it("supports HTTP/2", function() local conf, err = conf_loader(nil, { status_listen = "127.0.0.1:123 ssl http2", }) assert.is_nil(err) assert.is_table(conf) assert.same({ "127.0.0.1:123 ssl http2" }, conf.status_listen) end) end) describe("lua_ssl_protocls", function() it("sets lua_ssl_protocols to TLS 1.2-1.3 by default", function() local conf, err = conf_loader() assert.is_nil(err) assert.is_table(conf) assert.equal("TLSv1.2 TLSv1.3", conf.nginx_http_lua_ssl_protocols) assert.equal("TLSv1.2 TLSv1.3", conf.nginx_stream_lua_ssl_protocols) end) it("sets lua_ssl_protocols to user specified value", function() local conf, err = conf_loader(nil, { lua_ssl_protocols = "TLSv1.2" }) assert.is_nil(err) assert.is_table(conf) assert.equal("TLSv1.2", conf.nginx_http_lua_ssl_protocols) assert.equal("TLSv1.2", conf.nginx_stream_lua_ssl_protocols) end) it("sets nginx_http_lua_ssl_protocols and nginx_stream_lua_ssl_protocols to different values", function() local conf, err = conf_loader(nil, { nginx_http_lua_ssl_protocols = "TLSv1.2", nginx_stream_lua_ssl_protocols = "TLSv1.3", }) assert.is_nil(err) assert.is_table(conf) assert.equal("TLSv1.2", conf.nginx_http_lua_ssl_protocols) assert.equal("TLSv1.3", conf.nginx_stream_lua_ssl_protocols) end) end) end) it("honors path if provided even if a default file exists", function() conf_loader.add_default_path("spec/fixtures/to-strip.conf") local _os_getenv = os.getenv finally(function() os.getenv = _os_getenv -- luacheck: ignore package.loaded["kong.conf_loader"] = nil package.loaded["kong.conf_loader.constants"] = nil conf_loader = require "kong.conf_loader" end) os.getenv = function() end -- luacheck: ignore local conf = assert(conf_loader(helpers.test_conf_path)) assert.equal(DATABASE, conf.database) end) it("honors path if provided even if a default file exists", function() conf_loader.add_default_path("spec/fixtures/to-strip.conf") local _os_getenv = os.getenv finally(function() os.getenv = _os_getenv -- luacheck: ignore package.loaded["kong.conf_loader"] = nil package.loaded["kong.conf_loader.constants"] = nil conf_loader = require "kong.conf_loader" end) os.getenv = function() end -- luacheck: ignore local conf = assert(conf_loader(helpers.test_conf_path)) assert.equal(DATABASE, conf.database) end) it("should warns user if kong manager is enabled but admin API is not enabled", function () local spy_log = spy.on(log, "warn") finally(function() log.warn:revert() assert:unregister("matcher", "str_match") end) assert:register("matcher", "str_match", function (_state, arguments) local expected = arguments[1] return function(value) return string.match(value, expected) ~= nil end end) local conf, err = conf_loader(nil, { admin_listen = "off", admin_gui_listen = "off", }) assert.is_nil(err) assert.is_table(conf) assert.spy(spy_log).was_called(0) conf, err = conf_loader(nil, { admin_listen = "localhost:8001", admin_gui_listen = "off", }) assert.is_nil(err) assert.is_table(conf) assert.spy(spy_log).was_called(0) conf, err = conf_loader(nil, { admin_listen = "localhost:8001", admin_gui_listen = "localhost:8002", }) assert.is_nil(err) assert.is_table(conf) assert.spy(spy_log).was_called(0) conf, err = conf_loader(nil, { admin_listen = "off", admin_gui_listen = "localhost:8002", }) assert.is_nil(err) assert.is_table(conf) assert.spy(spy_log).was_called(1) assert.spy(spy_log).was_called_with("Kong Manager won't be functional because the Admin API is not listened on any interface") end) end) describe("pg_semaphore options", function() it("rejects a pg_max_concurrent_queries with a negative number", function() local conf, err = conf_loader(nil, { pg_max_concurrent_queries = -1, }) assert.is_nil(conf) assert.equal("pg_max_concurrent_queries must be greater than 0", err) end) it("rejects a pg_max_concurrent_queries with a decimal", function() local conf, err = conf_loader(nil, { pg_max_concurrent_queries = 0.1, }) assert.is_nil(conf) assert.equal("pg_max_concurrent_queries must be an integer greater than 0", err) end) it("rejects a pg_semaphore_timeout with a negative number", function() local conf, err = conf_loader(nil, { pg_semaphore_timeout = -1, }) assert.is_nil(conf) assert.equal("pg_semaphore_timeout must be greater than 0", err) end) it("rejects a pg_semaphore_timeout with a decimal", function() local conf, err = conf_loader(nil, { pg_semaphore_timeout = 0.1, }) assert.is_nil(conf) assert.equal("pg_semaphore_timeout must be an integer greater than 0", err) end) end) describe("pg connection pool options", function() it("rejects a pg_keepalive_timeout with a negative number", function() local conf, err = conf_loader(nil, { pg_keepalive_timeout = -1, }) assert.is_nil(conf) assert.equal("pg_keepalive_timeout must be greater than 0", err) end) it("rejects a pg_keepalive_timeout with a decimal", function() local conf, err = conf_loader(nil, { pg_keepalive_timeout = 0.1, }) assert.is_nil(conf) assert.equal("pg_keepalive_timeout must be an integer greater than 0", err) end) it("rejects a pg_pool_size with a negative number", function() local conf, err = conf_loader(nil, { pg_pool_size = -1, }) assert.is_nil(conf) assert.equal("pg_pool_size must be greater than 0", err) end) it("rejects a pg_pool_size with a decimal", function() local conf, err = conf_loader(nil, { pg_pool_size = 0.1, }) assert.is_nil(conf) assert.equal("pg_pool_size must be an integer greater than 0", err) end) it("rejects a pg_backlog with a negative number", function() local conf, err = conf_loader(nil, { pg_backlog = -1, }) assert.is_nil(conf) assert.equal("pg_backlog must be greater than 0", err) end) it("rejects a pg_backlog with a decimal", function() local conf, err = conf_loader(nil, { pg_backlog = 0.1, }) assert.is_nil(conf) assert.equal("pg_backlog must be an integer greater than 0", err) end) end) describe("pg read-only connection pool options", function() it("rejects a pg_ro_keepalive_timeout with a negative number", function() local conf, err = conf_loader(nil, { pg_ro_keepalive_timeout = -1, }) assert.is_nil(conf) assert.equal("pg_ro_keepalive_timeout must be greater than 0", err) end) it("rejects a pg_ro_keepalive_timeout with a decimal", function() local conf, err = conf_loader(nil, { pg_ro_keepalive_timeout = 0.1, }) assert.is_nil(conf) assert.equal("pg_ro_keepalive_timeout must be an integer greater than 0", err) end) it("rejects a pg_ro_pool_size with a negative number", function() local conf, err = conf_loader(nil, { pg_ro_pool_size = -1, }) assert.is_nil(conf) assert.equal("pg_ro_pool_size must be greater than 0", err) end) it("rejects a pg_ro_pool_size with a decimal", function() local conf, err = conf_loader(nil, { pg_ro_pool_size = 0.1, }) assert.is_nil(conf) assert.equal("pg_ro_pool_size must be an integer greater than 0", err) end) it("rejects a pg_ro_backlog with a negative number", function() local conf, err = conf_loader(nil, { pg_ro_backlog = -1, }) assert.is_nil(conf) assert.equal("pg_ro_backlog must be greater than 0", err) end) it("rejects a pg_ro_backlog with a decimal", function() local conf, err = conf_loader(nil, { pg_ro_backlog = 0.1, }) assert.is_nil(conf) assert.equal("pg_ro_backlog must be an integer greater than 0", err) end) end) describe("worker_state_update_frequency option", function() it("is rejected with a zero", function() local conf, err = conf_loader(nil, { worker_state_update_frequency = 0, }) assert.is_nil(conf) assert.equal("worker_state_update_frequency must be greater than 0", err) end) it("is rejected with a negative number", function() local conf, err = conf_loader(nil, { worker_state_update_frequency = -1, }) assert.is_nil(conf) assert.equal("worker_state_update_frequency must be greater than 0", err) end) it("accepts decimal numbers", function() local conf, err = conf_loader(nil, { worker_state_update_frequency = 0.01, }) assert.equal(conf.worker_state_update_frequency, 0.01) assert.is_nil(err) end) end) describe("clustering properties", function() it("cluster_data_plane_purge_delay is accepted", function() local conf = assert(conf_loader(nil, { cluster_data_plane_purge_delay = 100, })) assert.equal(100, conf.cluster_data_plane_purge_delay) conf = assert(conf_loader(nil, { cluster_data_plane_purge_delay = 60, })) assert.equal(60, conf.cluster_data_plane_purge_delay) end) it("cluster_data_plane_purge_delay < 60 is rejected", function() local conf, err = conf_loader(nil, { cluster_data_plane_purge_delay = 59, }) assert.is_nil(conf) assert.equal("cluster_data_plane_purge_delay must be 60 or greater", err) end) it("cluster_max_payload is accepted", function() local conf = assert(conf_loader(nil, { cluster_max_payload = 4194304, })) assert.equal(4194304, conf.cluster_max_payload) conf = assert(conf_loader(nil, { cluster_max_payload = 8388608, })) assert.equal(8388608, conf.cluster_max_payload) end) it("cluster_max_payload < 4Mb rejected", function() local conf, err = conf_loader(nil, { cluster_max_payload = 1048576, }) assert.is_nil(conf) assert.equal("cluster_max_payload must be 4194304 (4MB) or greater", err) end) end) describe("upstream keepalive properties", function() it("are accepted", function() local conf = assert(conf_loader(nil, { upstream_keepalive_pool_size = 10, upstream_keepalive_max_requests = 20, upstream_keepalive_idle_timeout = 30, })) assert.equal(10, conf.upstream_keepalive_pool_size) assert.equal(20, conf.upstream_keepalive_max_requests) assert.equal(30, conf.upstream_keepalive_idle_timeout) end) it("accepts upstream_keepalive_pool_size = 0", function() local conf = assert(conf_loader(nil, { upstream_keepalive_pool_size = 0, })) assert.equal(0, conf.upstream_keepalive_pool_size) end) it("accepts upstream_keepalive_max_requests = 0", function() local conf = assert(conf_loader(nil, { upstream_keepalive_max_requests = 0, })) assert.equal(0, conf.upstream_keepalive_max_requests) end) it("accepts upstream_keepalive_idle_timeout = 0", function() local conf = assert(conf_loader(nil, { upstream_keepalive_idle_timeout = 0, })) assert.equal(0, conf.upstream_keepalive_idle_timeout) end) it("rejects negative values", function() local conf, err = conf_loader(nil, { upstream_keepalive_pool_size = -1, }) assert.is_nil(conf) assert.equal("upstream_keepalive_pool_size must be 0 or greater", err) local conf, err = conf_loader(nil, { upstream_keepalive_max_requests = -1, }) assert.is_nil(conf) assert.equal("upstream_keepalive_max_requests must be 0 or greater", err) local conf, err = conf_loader(nil, { upstream_keepalive_idle_timeout = -1, }) assert.is_nil(conf) assert.equal("upstream_keepalive_idle_timeout must be 0 or greater", err) end) end) -- TODO: replace these test cases with ones that assert the proper behavior -- after the feature is removed pending("#wasm properties", function() local temp_dir, cleanup local user_filters local bundled_filters local all_filters lazy_setup(function() temp_dir, cleanup = helpers.make_temp_dir() assert(helpers.file.write(temp_dir .. "/filter-a.wasm", "hello!")) assert(helpers.file.write(temp_dir .. "/filter-b.wasm", "hello!")) user_filters = { { name = "filter-a", path = temp_dir .. "/filter-a.wasm", }, { name = "filter-b", path = temp_dir .. "/filter-b.wasm", } } do -- for local builds, the bundled filter path is not constant, so we -- must load the config first to discover the path local conf = assert(conf_loader(nil, { wasm = "on", wasm_filters = "bundled", })) assert(conf.wasm_bundled_filters_path) bundled_filters = {} end all_filters = {} table.insert(all_filters, bundled_filters[1]) table.insert(all_filters, user_filters[1]) table.insert(all_filters, user_filters[2]) end) lazy_teardown(function() cleanup() end) it("wasm disabled", function() local conf, err = conf_loader(nil, { wasm = "off", wasm_filters_path = temp_dir, }) assert.is_nil(err) assert.is_nil(conf.wasm_modules_parsed) end) it("wasm default disabled", function() local conf, err = conf_loader(nil, { wasm_filters_path = temp_dir, }) assert.is_nil(err) assert.is_nil(conf.wasm_modules_parsed) end) it("wasm_filters_path", function() local conf, err = conf_loader(nil, { wasm = "on", wasm_filters_path = temp_dir, }) assert.is_nil(err) assert.same(all_filters, conf.wasm_modules_parsed) assert.same(temp_dir, conf.wasm_filters_path) end) it("invalid wasm_filters_path", function() local conf, err = conf_loader(nil, { wasm = "on", wasm_filters_path = "spec/fixtures/no-wasm-here/unit-test", }) assert.same(err, "wasm_filters_path 'spec/fixtures/no-wasm-here/unit-test' is not a valid directory") assert.is_nil(conf) end) it("wasm_filters default", function() local conf, err = conf_loader(nil, { wasm = "on", wasm_filters_path = temp_dir, }) assert.is_nil(err) assert.same(all_filters, conf.wasm_modules_parsed) assert.same({ "bundled", "user" }, conf.wasm_filters) end) it("wasm_filters = off", function() local conf, err = conf_loader(nil, { wasm = "on", wasm_filters = "off", wasm_filters_path = temp_dir, }) assert.is_nil(err) assert.same({}, conf.wasm_modules_parsed) end) it("wasm_filters = 'user' allows all user filters", function() local conf, err = conf_loader(nil, { wasm = "on", wasm_filters = "user", wasm_filters_path = temp_dir, }) assert.is_nil(err) assert.same(user_filters, conf.wasm_modules_parsed) end) it("wasm_filters can allow individual user filters", function() local conf, err = conf_loader(nil, { wasm = "on", wasm_filters = assert(user_filters[1].name), wasm_filters_path = temp_dir, }) assert.is_nil(err) assert.same({ user_filters[1] }, conf.wasm_modules_parsed) end) it("wasm_filters = 'bundled' allows all bundled filters", function() local conf, err = conf_loader(nil, { wasm = "on", wasm_filters = "bundled", wasm_filters_path = temp_dir, }) assert.is_nil(err) assert.same(bundled_filters, conf.wasm_modules_parsed) end) -- XXX: we don't have any bundled filters to use for this test pending("prefers user filters to bundled filters when a conflict exists", function() local user_filter = temp_dir .. "/datakit.wasm" assert(helpers.file.write(user_filter, "I'm a happy little wasm filter")) finally(function() assert(os.remove(user_filter)) end) local conf, err = conf_loader(nil, { wasm = "on", wasm_filters = "bundled,user", wasm_filters_path = temp_dir, }) assert.is_nil(err) local found = false for _, filter in ipairs(conf.wasm_modules_parsed) do if filter.name == "datakit" then found = true assert.equals(user_filter, filter.path, "user filter should override the bundled filter") end end assert.is_true(found, "expected the user filter to be enabled") end) it("populates wasmtime_cache_* properties", function() local conf, err = conf_loader(nil, { wasm = "on", wasm_filters = "bundled,user", wasm_filters_path = temp_dir, }) assert.is_nil(err) assert.is_string(conf.wasmtime_cache_directory, "wasmtime_cache_directory was not set") assert.is_string(conf.wasmtime_cache_config_file, "wasmtime_cache_config_file was not set") end) end) describe("errors", function() it("returns inexistent file", function() local conf, err = conf_loader "inexistent" assert.equal("no file at: inexistent", err) assert.is_nil(conf) end) it("returns all errors in ret value #3", function() local conf, _, errors = conf_loader(nil, { worker_consistency = "magical", ssl_cert_key = "spec/fixtures/kong_spec.key", }) assert.equal(2, #errors) assert.is_nil(conf) assert.contains("worker_consistency has an invalid value: 'magical' (strict, eventual)", errors, true) assert.contains("ssl_cert must be specified", errors) end) end) describe("remove_sensitive()", function() it("replaces sensitive settings", function() local conf = assert(conf_loader(nil, { pg_password = "hide_me", })) local purged_conf = conf_loader.remove_sensitive(conf) assert.not_equal("hide_me", purged_conf.pg_password) end) it("replaces sensitive vault resolved settings", function() finally(function() helpers.unsetenv("PG_PASSWORD") helpers.unsetenv("PG_DATABASE") end) helpers.setenv("PG_PASSWORD", "pg-password") helpers.setenv("PG_DATABASE", "pg-database") local conf = assert(conf_loader(nil, { pg_password = "{vault://env/pg-password}", pg_database = "{vault://env/pg-database}", })) local purged_conf = conf_loader.remove_sensitive(conf) assert.equal("******", purged_conf.pg_password) assert.equal("{vault://env/pg-database}", purged_conf.pg_database) assert.is_nil(purged_conf["$refs"]) end) it("does not insert placeholder if no value", function() local conf = assert(conf_loader()) local purged_conf = conf_loader.remove_sensitive(conf) assert.is_nil(purged_conf.pg_password) end) end) describe("number as string", function() it("force the numeric pg_password to a string", function() local conf = assert(conf_loader(nil, { pg_password = 123456, })) assert.equal("123456", conf.pg_password) end) end) describe("deprecated properties", function() it("worker_consistency -> deprecate value ", function() local conf, err = assert(conf_loader(nil, { worker_consistency = "strict" })) assert.equal("strict", conf.worker_consistency) assert.equal(nil, err) end) it("privileged_agent -> dedicated_config_processing", function() local conf, err = assert(conf_loader(nil, { privileged_agent = "on", })) assert.same(nil, conf.privileged_agent) assert.same(true, conf.dedicated_config_processing) assert.equal(nil, err) -- no clobber conf, err = assert(conf_loader(nil, { privileged_agent = "on", dedicated_config_processing = "on", })) assert.same(true, conf.dedicated_config_processing) assert.same(nil, conf.privileged_agent) assert.equal(nil, err) conf, err = assert(conf_loader(nil, { privileged_agent = "off", dedicated_config_processing = "on", })) assert.same(true, conf.dedicated_config_processing) assert.same(nil, conf.privileged_agent) assert.equal(nil, err) conf, err = assert(conf_loader(nil, { privileged_agent = "on", dedicated_config_processing = "off", })) assert.same(false, conf.dedicated_config_processing) assert.same(nil, conf.privileged_agent) assert.equal(nil, err) conf, err = assert(conf_loader(nil, { privileged_agent = "off", dedicated_config_processing = "off", })) assert.same(false, conf.dedicated_config_processing) assert.same(nil, conf.privileged_agent) assert.equal(nil, err) end) it("opentelemetry_tracing", function() local conf, err = assert(conf_loader(nil, { opentelemetry_tracing = "request,router", })) assert.same({"request", "router"}, conf.tracing_instrumentations) assert.equal(nil, err) -- no clobber conf, err = assert(conf_loader(nil, { opentelemetry_tracing = "request,router", tracing_instrumentations = "balancer", })) assert.same({ "balancer" }, conf.tracing_instrumentations) assert.equal(nil, err) end) it("opentelemetry_tracing_sampling_rate", function() local conf, err = assert(conf_loader(nil, { opentelemetry_tracing_sampling_rate = 0.5, })) assert.same(0.5, conf.tracing_sampling_rate) assert.equal(nil, err) -- no clobber conf, err = assert(conf_loader(nil, { opentelemetry_tracing_sampling_rate = 0.5, tracing_sampling_rate = 0.75, })) assert.same(0.75, conf.tracing_sampling_rate) assert.equal(nil, err) end) end) describe("vault references", function() it("are collected under $refs property", function() finally(function() helpers.unsetenv("PG_DATABASE") end) helpers.setenv("PG_DATABASE", "pg-database") local conf = assert(conf_loader(nil, { pg_database = "{vault://env/pg-database}", })) assert.equal("pg-database", conf.pg_database) assert.equal("{vault://env/pg-database}", conf["$refs"].pg_database) end) it("are inferred and collected under $refs property", function() finally(function() helpers.unsetenv("PG_PORT") end) helpers.setenv("PG_PORT", "5000") local conf = assert(conf_loader(nil, { pg_port = "{vault://env/pg-port#0}", })) assert.equal(5000, conf.pg_port) assert.equal("{vault://env/pg-port#0}", conf["$refs"].pg_port) end) it("fields in CONF_BASIC can reference env non-entity vault", function() helpers.setenv("VAULT_TEST", "testvalue") helpers.setenv("VAULT_PG", "postgres") helpers.setenv("VAULT_CERT", "/tmp") helpers.setenv("VAULT_DEPTH", "3") finally(function() helpers.unsetenv("VAULT_TEST") helpers.unsetenv("VAULT_PG") helpers.unsetenv("VAULT_CERT") helpers.unsetenv("VAULT_DEPTH") end) local CONF_BASIC = { prefix = true, -- vaults = true, -- except this one database = true, lmdb_environment_path = true, lmdb_map_size = true, lua_ssl_trusted_certificate = true, lua_ssl_verify_depth = true, lua_ssl_protocols = true, nginx_http_lua_ssl_protocols = true, nginx_stream_lua_ssl_protocols = true, -- vault_env_prefix = true, -- except this one } for k, _ in pairs(CONF_BASIC) do if k == "database" then local conf, err = conf_loader(nil, { [k] = "{vault://env/vault_pg}", }) assert.is_nil(err) assert.equal("postgres", conf.database) elseif k == "lua_ssl_trusted_certificate" then local conf, err = conf_loader(nil, { [k] = "{vault://env/vault_cert}", }) assert.is_nil(err) assert.equal("table", type(conf.lua_ssl_trusted_certificate)) assert.equal("/tmp", conf.lua_ssl_trusted_certificate[1]) elseif k == "lua_ssl_verify_depth" then local conf, err = conf_loader(nil, { [k] = "{vault://env/vault_depth}", }) assert.is_nil(err) assert.equal(3, conf.lua_ssl_verify_depth) else local conf, err = conf_loader(nil, { [k] = "{vault://env/vault_test}", }) assert.is_nil(err) -- may be converted into an absolute path assert.matches(".*testvalue", conf[k]) end end end) it("fields in CONF_BASIC will fail to reference vault if vault has other dependency", function() local CONF_BASIC = { prefix = true, vaults = true, database = true, lmdb_environment_path = true, lmdb_map_size = true, lua_ssl_trusted_certificate = true, lua_ssl_verify_depth = true, lua_ssl_protocols = true, nginx_http_lua_ssl_protocols = true, nginx_stream_lua_ssl_protocols = true, vault_env_prefix = true, } for k, _ in pairs(CONF_BASIC) do local conf, err = conf_loader(nil, { [k] = "{vault://test-env/test}", }) -- fail to reference if k == "lua_ssl_trusted_certificate" or k == "database" then assert.is_not_nil(err) elseif k == "lua_ssl_verify_depth" then assert.is_nil(conf[k]) elseif k == "vaults" then assert.is_nil(err) assert.equal("table", type(conf.vaults)) assert.matches("{vault://test%-env/test}", conf.vaults[1]) elseif k == "prefix" then assert.is_nil(err) assert.matches(".*{vault:/test%-env/test}", conf[k]) else assert.is_nil(err) -- path may have a prefix added assert.matches(".*{vault://test%-env/test}", conf[k]) end end end) it("only load a subset of fields when opts.pre_cmd=true", function() local FIELDS = { -- CONF_BASIC prefix = true, socket_path = true, worker_events_sock = true, stream_worker_events_sock = true, stream_rpc_sock = true, stream_config_sock = true, stream_tls_passthrough_sock = true, stream_tls_terminate_sock = true, cluster_proxy_ssl_terminator_sock = true, vaults = true, database = true, lmdb_environment_path = true, lmdb_map_size = true, lua_ssl_trusted_certificate = true, lua_ssl_verify_depth = true, lua_ssl_protocols = true, nginx_http_lua_ssl_protocols = true, nginx_stream_lua_ssl_protocols = true, vault_env_prefix = true, loaded_vaults = true, lua_ssl_trusted_certificate_combined = true, -- PREFIX_PATHS nginx_pid = true, nginx_err_logs = true, nginx_acc_logs = true, admin_acc_logs = true, nginx_conf = true, nginx_kong_gui_include_conf= true, nginx_kong_conf = true, nginx_kong_stream_conf = true, nginx_inject_conf = true, nginx_kong_inject_conf = true, nginx_kong_stream_inject_conf = true, kong_env = true, kong_process_secrets = true, ssl_cert_csr_default = true, ssl_cert_default = true, ssl_cert_key_default = true, ssl_cert_default_ecdsa = true, ssl_cert_key_default_ecdsa = true, client_ssl_cert_default = true, client_ssl_cert_key_default = true, admin_ssl_cert_default = true, admin_ssl_cert_key_default = true, admin_ssl_cert_default_ecdsa = true, admin_ssl_cert_key_default_ecdsa = true, status_ssl_cert_default = true, status_ssl_cert_key_default = true, status_ssl_cert_default_ecdsa = true, status_ssl_cert_key_default_ecdsa = true, admin_gui_ssl_cert_default = true, admin_gui_ssl_cert_key_default = true, admin_gui_ssl_cert_default_ecdsa = true, admin_gui_ssl_cert_key_default_ecdsa = true, } local conf = assert(conf_loader(nil, nil, { pre_cmd = true })) for k, _ in pairs(conf) do assert.equal(true, FIELDS[k], "key " .. k .. " is not in FIELDS") end end) end) describe("comments", function() it("are stripped", function() local conf = assert(conf_loader(helpers.test_conf_path)) assert.equal("foo#bar", conf.pg_password) end) end) describe("lua max limits for request/response headers and request uri/post args", function() it("are accepted", function() local conf, err = assert(conf_loader(nil, { lua_max_req_headers = 1, lua_max_resp_headers = 100, lua_max_uri_args = 500, lua_max_post_args = 1000, })) assert.is_nil(err) assert.equal(1, conf.lua_max_req_headers) assert.equal(100, conf.lua_max_resp_headers) assert.equal(500, conf.lua_max_uri_args) assert.equal(1000, conf.lua_max_post_args) end) it("are not accepted with limits below 1", function() local _, err = conf_loader(nil, { lua_max_req_headers = 0, }) assert.equal("lua_max_req_headers must be an integer between 1 and 1000", err) local _, err = conf_loader(nil, { lua_max_resp_headers = 0, }) assert.equal("lua_max_resp_headers must be an integer between 1 and 1000", err) local _, err = conf_loader(nil, { lua_max_uri_args = 0, }) assert.equal("lua_max_uri_args must be an integer between 1 and 1000", err) local _, err = conf_loader(nil, { lua_max_post_args = 0, }) assert.equal("lua_max_post_args must be an integer between 1 and 1000", err) end) it("are not accepted with limits above 1000", function() local _, err = conf_loader(nil, { lua_max_req_headers = 1001, }) assert.equal("lua_max_req_headers must be an integer between 1 and 1000", err) local _, err = conf_loader(nil, { lua_max_resp_headers = 1001, }) assert.equal("lua_max_resp_headers must be an integer between 1 and 1000", err) local _, err = conf_loader(nil, { lua_max_uri_args = 1001, }) assert.equal("lua_max_uri_args must be an integer between 1 and 1000", err) local _, err = conf_loader(nil, { lua_max_post_args = 1001, }) assert.equal("lua_max_post_args must be an integer between 1 and 1000", err) end) end) describe("Labels", function() local pattern_match_err = ".+ is invalid. Must match pattern: .+" local size_err = ".* must have between 1 and %d+ characters" local invalid_key_err = "label key validation failed: " local invalid_val_err = "label value validation failed: " local valid_labels = { "deployment:mycloud,region:us-east-1", "label_0_name:label-1-value,label-1-name:label_1_value", "MY-LaB3L.nam_e:my_lA831..val", "super_kong:yey", "best_gateway:kong", "This_Key_Is_Just_The_Right_Maximum_Length_To_Pass_TheValidation:value", "key:This_Val_Is_Just_The_Right_Maximum_Length_To_Pass_TheValidation", } local invalid_labels = { { l = "t:h,e:s,E:a,r:e,T:o,o:m,a:n,y:l,A:b,ee:l,S:s", err = "labels validation failed: count exceeded %d+ max elements", },{ l = "_must:start", err = invalid_key_err .. pattern_match_err, },{ l = "and:.end", err = invalid_val_err .. pattern_match_err, },{ l = "with-:alpha", err = invalid_key_err .. pattern_match_err, },{ l = "numeric:characters_", err = invalid_val_err .. pattern_match_err, },{ l = "kong_key:is_reserved", err = invalid_key_err .. pattern_match_err, },{ l = "invalid!@chars:fail", err = invalid_key_err .. pattern_match_err, },{ l = "the:val!dation", err = invalid_val_err .. pattern_match_err, },{ l = "lonelykeywithnoval:", err = invalid_val_err .. size_err, },{ l = "__look_this_key_is_way_too_long_no_way_it_will_pass_validation__:value", err = invalid_key_err .. size_err, },{ l = "key:__look_this_val_is_way_too_long_no_way_it_will_pass_validation__", err = invalid_val_err .. size_err, },{ l = "key", err = invalid_key_err .. size_err, } } it("succeeds to validate valid labels", function() for _, label in ipairs(valid_labels) do local conf, err = assert(conf_loader(nil, { role = "data_plane", database = "off", cluster_cert = "spec/fixtures/kong_clustering.crt", cluster_cert_key = "spec/fixtures/kong_clustering.key", cluster_dp_labels = label, })) assert.is_nil(err) assert.is_not_nil(conf.cluster_dp_labels) end end) it("fails validation for invalid labels", function() for _, label in ipairs(invalid_labels) do local _, err = conf_loader(nil, { role = "data_plane", database = "off", cluster_cert = "spec/fixtures/kong_clustering.crt", cluster_cert_key = "spec/fixtures/kong_clustering.key", cluster_dp_labels = label.l, }) assert.is_not_nil(err) assert.matches(label.err, err) end end) end) describe("pluginserver config", function() describe("fails if", function() it("no query_command and not found in default location", function() local _, err = conf_loader(nil, { pluginserver_names = "gopher", -- query_command = {}, }) assert.is_not_nil(err) assert.matches("query_command undefined for pluginserver gopher", err) end) end) describe("warns if", function() it("no start_command (meaning process is externally maintained)", function() local spy_log = spy.on(log, "warn") finally(function() log.warn:revert() assert:unregister("matcher", "str_match") end) assert:register("matcher", "str_match", function (_state, arguments) local expected = arguments[1] return function(value) return string.match(value, expected) ~= nil end end) local _, err = conf_loader(nil, { pluginserver_names = "gopher", pluginserver_gopher_query_cmd = "gopher -dump", }) assert.is_nil(err) assert.spy(spy_log).was_called(1) assert.spy(spy_log).was_called_with("start_command undefined for pluginserver gopher; assuming external process management") end) end) it("fills in default settings", function() -- mock default conf loader path - as we cannot -- reliably write in the default path (/usr/local/bin) package.loaded["kong.conf_loader"] = nil local conf_constants = require"kong.conf_loader.constants" conf_constants.DEFAULT_PLUGINSERVER_PATH = helpers.external_plugins_path .. "/go" local conf_loader = require"kong.conf_loader" helpers.build_go_plugins(helpers.external_plugins_path .. "/go") finally(function() package.loaded["kong.conf_loader"] = nil package.loaded["kong.conf_loader.constants"] = nil end) local conf, err = conf_loader(nil, { pluginserver_names = "go-hello", -- leave out start_command and query_command so that the defaults -- are used }) assert.is_nil(err) assert.same("go-hello", conf.pluginservers[1].name) assert.same("./spec/fixtures/external_plugins/go/go-hello -dump", conf.pluginservers[1].query_command) assert.same("./spec/fixtures/external_plugins/go/go-hello", conf.pluginservers[1].start_command) assert.same(conf.prefix .. "/go-hello.socket", conf.pluginservers[1].socket) end) it("accepts custom settings", function() local conf, err = conf_loader(nil, { pluginserver_names = "gopher", pluginserver_gopher_query_cmd = "gopher -dump", pluginserver_gopher_start_cmd = "gopher -p $KONG_PREFIX", pluginserver_gopher_socket = "/foo/bar/gopher.socket", }) assert.is_nil(err) assert.same("gopher", conf.pluginservers[1].name) assert.same("gopher -dump", conf.pluginservers[1].query_command) assert.same("gopher -p $KONG_PREFIX", conf.pluginservers[1].start_command) assert.same("/foo/bar/gopher.socket", conf.pluginservers[1].socket) end) end) end)