add app_protect_compressed_requests_action directive (#1643)

* add app_protect_compressed_requests_action directive * add tests for app-protect-compressed-requests-action Co-authored-by: galitskiy <[email protected]>
nginx · Jun 23, 2021 · 154ceef · 154ceef
1 parent 181e18a
commit 154ceef
Show file tree

Hide file tree

Showing 6 changed files with 65 additions and 0 deletions.
diff --git a/docs-web/configuration/global-configuration/configmap-resource.md b/docs-web/configuration/global-configuration/configmap-resource.md
@@ -414,6 +414,10 @@ See the doc about [VirtualServer and VirtualServerRoute resources](/nginx-ingres
      - Sets the tracer configuration in JSON format.
      - N/A
      -
+   * - ``app-protect-compressed-requests-action``
+     - Sets the ``app_protect_compressed_requests_action`` `global directive </nginx-app-protect/configuration/#global-directives>`_.
+     - ``drop``
+     -
    * - ``app-protect-cookie-seed``
      - Sets the ``app_protect_cookie_seed`` `global directive </nginx-app-protect/configuration/#global-directives>`_.
      - Random automatically generated string

diff --git a/internal/configs/config_params.go b/internal/configs/config_params.go
@@ -49,6 +49,7 @@ type ConfigParams struct {
 	AppProtectLogConf                      string
 	AppProtectLogEnable                    string
 	MainAppProtectFailureModeAction        string
+	MainAppProtectCompressedRequestsAction string
 	MainAppProtectCookieSeed               string
 	MainAppProtectCPUThresholds            string
 	MainAppProtectPhysicalMemoryThresholds string

diff --git a/internal/configs/configmaps.go b/internal/configs/configmaps.go
@@ -471,6 +471,14 @@ func ParseConfigMap(cfgm *v1.ConfigMap, nginxPlus bool, hasAppProtect bool) *Con
 			}
 		}
 
+		if appProtectCompressedRequestsAction, exists := cfgm.Data["app-protect-compressed-requests-action"]; exists {
+			if appProtectCompressedRequestsAction == "pass" || appProtectCompressedRequestsAction == "drop" {
+				cfgParams.MainAppProtectCompressedRequestsAction = appProtectCompressedRequestsAction
+			} else {
+				glog.Error("ConfigMap Key 'app-protect-compressed-requests-action' must have value 'pass' or 'drop'. Ignoring.")
+			}
+		}
+
 		if appProtectCookieSeed, exists := cfgm.Data["app-protect-cookie-seed"]; exists {
 			cfgParams.MainAppProtectCookieSeed = appProtectCookieSeed
 		}
@@ -549,6 +557,7 @@ func GenerateNginxMainConfig(staticCfgParams *StaticConfigParams, config *Config
 		VariablesHashMaxSize:               config.VariablesHashMaxSize,
 		AppProtectLoadModule:               staticCfgParams.MainAppProtectLoadModule,
 		AppProtectFailureModeAction:        config.MainAppProtectFailureModeAction,
+		AppProtectCompressedRequestsAction: config.MainAppProtectCompressedRequestsAction,
 		AppProtectCookieSeed:               config.MainAppProtectCookieSeed,
 		AppProtectCPUThresholds:            config.MainAppProtectCPUThresholds,
 		AppProtectPhysicalMemoryThresholds: config.MainAppProtectPhysicalMemoryThresholds,

diff --git a/internal/configs/configmaps_test.go b/internal/configs/configmaps_test.go
@@ -0,0 +1,49 @@
+package configs
+
+import (
+	"testing"
+
+	v1 "k8s.io/api/core/v1"
+)
+
+func TestParseConfigMapWithAppProtectCompressedRequestsAction(t *testing.T) {
+	tests := []struct {
+		action string
+		expect string
+		msg    string
+	}{
+		{
+			action: "pass",
+			expect: "pass",
+			msg:    "valid action pass",
+		},
+		{
+			action: "drop",
+			expect: "drop",
+			msg:    "valid action drop",
+		},
+		{
+			action: "invalid",
+			expect: "",
+			msg:    "invalid action",
+		},
+		{
+			action: "",
+			expect: "",
+			msg:    "empty action",
+		},
+	}
+	nginxPlus := true
+	hasAppProtect := true
+	for _, test := range tests {
+		cm := &v1.ConfigMap{
+			Data: map[string]string{
+				"app-protect-compressed-requests-action": test.action,
+			},
+		}
+		result := ParseConfigMap(cm, nginxPlus, hasAppProtect)
+		if result.MainAppProtectCompressedRequestsAction != test.expect {
+			t.Errorf("ParseConfigMap() returned %q but expected %q for the case %s", result.MainAppProtectCompressedRequestsAction, test.expect, test.msg)
+		}
+	}
+}
diff --git a/internal/configs/version1/config.go b/internal/configs/version1/config.go
@@ -193,6 +193,7 @@ type MainConfig struct {
 	WorkerShutdownTimeout              string
 	AppProtectLoadModule               bool
 	AppProtectFailureModeAction        string
+	AppProtectCompressedRequestsAction string
 	AppProtectCookieSeed               string
 	AppProtectCPUThresholds            string
 	AppProtectPhysicalMemoryThresholds string

diff --git a/internal/configs/version1/nginx-plus.tmpl b/internal/configs/version1/nginx-plus.tmpl
@@ -64,6 +64,7 @@ http {
 
     {{- if .AppProtectLoadModule}}
     {{if .AppProtectFailureModeAction}}app_protect_failure_mode_action {{.AppProtectFailureModeAction}};{{end}}
+    {{if .AppProtectCompressedRequestsAction}}app_protect_compressed_requests_action {{.AppProtectCompressedRequestsAction}};{{end}}
     {{if .AppProtectCookieSeed}}app_protect_cookie_seed {{.AppProtectCookieSeed}};{{end}}
     {{if .AppProtectCPUThresholds}}app_protect_cpu_thresholds {{.AppProtectCPUThresholds}};{{end}}
     {{if .AppProtectPhysicalMemoryThresholds}}app_protect_physical_memory_util_thresholds {{.AppProtectPhysicalMemoryThresholds}};{{end}}