|
1 | 1 | defmodule Auth.IpFilterTest do
|
2 | 2 | use ExUnit.Case
|
3 |
| - use Plug.Test |
4 | 3 |
|
5 | 4 | @org_id UUID.uuid4()
|
6 | 5 |
|
7 | 6 | describe "#block?" do
|
8 | 7 | test "empty ip_allow_list => returns false" do
|
9 |
| - conn = conn(:get, "https://org1.semaphoretest.test/exauth/api/v1alpha/jobs") |
10 |
| - |
11 |
| - refute Auth.IpFilter.block?(conn, %{ |
| 8 | + refute Auth.IpFilter.block?({172, 14, 101, 99}, %{ |
12 | 9 | id: @org_id,
|
13 | 10 | name: "semaphore",
|
14 | 11 | ip_allow_list: []
|
15 | 12 | })
|
16 | 13 | end
|
17 | 14 |
|
18 |
| - test "no X-Forwarded-For header => returns false" do |
19 |
| - conn = conn(:get, "https://org1.semaphoretest.test/exauth/api/v1alpha/jobs") |
20 |
| - |
21 |
| - refute Auth.IpFilter.block?(conn, %{ |
22 |
| - id: @org_id, |
23 |
| - name: "semaphore", |
24 |
| - ip_allow_list: ["172.14.101.99"] |
25 |
| - }) |
26 |
| - end |
27 |
| - |
28 |
| - test "bad X-Forwarded-For header => returns false" do |
29 |
| - conn = |
30 |
| - Plug.Adapters.Test.Conn.conn( |
31 |
| - %Plug.Conn{req_headers: [{"x-forwarded-for", "999.999.999.999"}]}, |
32 |
| - :get, |
33 |
| - "https://org1.semaphoretest.test/exauth/api/v1alpha/jobs", |
34 |
| - nil |
35 |
| - ) |
36 |
| - |
37 |
| - refute Auth.IpFilter.block?(conn, %{ |
38 |
| - id: @org_id, |
39 |
| - name: "semaphore", |
40 |
| - ip_allow_list: ["172.14.101.99"] |
41 |
| - }) |
42 |
| - end |
43 |
| - |
44 |
| - test "single bad IP => returns false" do |
45 |
| - conn = |
46 |
| - Plug.Adapters.Test.Conn.conn( |
47 |
| - %Plug.Conn{req_headers: [{"x-forwarded-for", "172.14.101.99"}]}, |
48 |
| - :get, |
49 |
| - "https://org1.semaphoretest.test/exauth/api/v1alpha/jobs", |
50 |
| - nil |
51 |
| - ) |
52 |
| - |
53 |
| - refute Auth.IpFilter.block?(conn, %{ |
54 |
| - id: @org_id, |
55 |
| - name: "semaphore", |
56 |
| - ip_allow_list: ["999.999.999.999"] |
57 |
| - }) |
58 |
| - end |
59 |
| - |
60 | 15 | test "single IP => returns false if request comes from the same IP" do
|
61 |
| - conn = |
62 |
| - Plug.Adapters.Test.Conn.conn( |
63 |
| - %Plug.Conn{req_headers: [{"x-forwarded-for", "172.14.101.99"}]}, |
64 |
| - :get, |
65 |
| - "https://org1.semaphoretest.test/exauth/api/v1alpha/jobs", |
66 |
| - nil |
67 |
| - ) |
68 |
| - |
69 |
| - refute Auth.IpFilter.block?(conn, %{ |
| 16 | + refute Auth.IpFilter.block?({172, 14, 101, 99}, %{ |
70 | 17 | id: @org_id,
|
71 | 18 | name: "semaphore",
|
72 | 19 | ip_allow_list: ["172.14.101.99"]
|
73 | 20 | })
|
74 | 21 | end
|
75 | 22 |
|
76 | 23 | test "single IP => returns true if request does not come from the same IP" do
|
77 |
| - conn = |
78 |
| - Plug.Adapters.Test.Conn.conn( |
79 |
| - %Plug.Conn{req_headers: [{"x-forwarded-for", "211.191.11.4"}]}, |
80 |
| - :get, |
81 |
| - "https://org1.semaphoretest.test/exauth/api/v1alpha/jobs", |
82 |
| - nil |
83 |
| - ) |
84 |
| - |
85 |
| - assert Auth.IpFilter.block?(conn, %{ |
| 24 | + assert Auth.IpFilter.block?({211, 191, 11, 4}, %{ |
86 | 25 | id: @org_id,
|
87 | 26 | name: "semaphore",
|
88 | 27 | ip_allow_list: ["172.14.101.99"]
|
89 | 28 | })
|
90 | 29 | end
|
91 | 30 |
|
92 | 31 | test "multiple IPs => returns false if request comes from one of the IPs allowed" do
|
93 |
| - conn = |
94 |
| - Plug.Adapters.Test.Conn.conn( |
95 |
| - %Plug.Conn{req_headers: [{"x-forwarded-for", "172.14.101.99"}]}, |
96 |
| - :get, |
97 |
| - "https://org1.semaphoretest.test/exauth/api/v1alpha/jobs", |
98 |
| - nil |
99 |
| - ) |
100 |
| - |
101 |
| - refute Auth.IpFilter.block?(conn, %{ |
| 32 | + refute Auth.IpFilter.block?({172, 14, 101, 99}, %{ |
102 | 33 | id: @org_id,
|
103 | 34 | name: "semaphore",
|
104 | 35 | ip_allow_list: ["32.109.221.12", "172.14.101.99"]
|
105 | 36 | })
|
106 | 37 | end
|
107 | 38 |
|
108 | 39 | test "multiple IPs => returns true if request comes from none of the IPs allowed" do
|
109 |
| - conn = |
110 |
| - Plug.Adapters.Test.Conn.conn( |
111 |
| - %Plug.Conn{req_headers: [{"x-forwarded-for", "211.191.11.4"}]}, |
112 |
| - :get, |
113 |
| - "https://org1.semaphoretest.test/exauth/api/v1alpha/jobs", |
114 |
| - nil |
115 |
| - ) |
116 |
| - |
117 |
| - assert Auth.IpFilter.block?(conn, %{ |
| 40 | + assert Auth.IpFilter.block?({211, 191, 11, 4}, %{ |
118 | 41 | id: @org_id,
|
119 | 42 | name: "semaphore",
|
120 | 43 | ip_allow_list: ["32.109.221.12", "172.14.101.99"]
|
121 | 44 | })
|
122 | 45 | end
|
123 | 46 |
|
124 | 47 | test "single bad CIDR => returns false" do
|
125 |
| - conn = |
126 |
| - Plug.Adapters.Test.Conn.conn( |
127 |
| - %Plug.Conn{req_headers: [{"x-forwarded-for", "172.14.101.99"}]}, |
128 |
| - :get, |
129 |
| - "https://org1.semaphoretest.test/exauth/api/v1alpha/jobs", |
130 |
| - nil |
131 |
| - ) |
132 |
| - |
133 |
| - refute Auth.IpFilter.block?(conn, %{ |
| 48 | + refute Auth.IpFilter.block?({172, 14, 101, 99}, %{ |
134 | 49 | id: @org_id,
|
135 | 50 | name: "semaphore",
|
136 | 51 | ip_allow_list: ["32.109.221.12/999"]
|
137 | 52 | })
|
138 | 53 | end
|
139 | 54 |
|
140 | 55 | test "single CIDR => returns false if request comes from IP inside CIDR" do
|
141 |
| - conn = |
142 |
| - Plug.Adapters.Test.Conn.conn( |
143 |
| - %Plug.Conn{req_headers: [{"x-forwarded-for", "32.109.221.1"}]}, |
144 |
| - :get, |
145 |
| - "https://org1.semaphoretest.test/exauth/api/v1alpha/jobs", |
146 |
| - nil |
147 |
| - ) |
148 |
| - |
149 |
| - refute Auth.IpFilter.block?(conn, %{ |
| 56 | + refute Auth.IpFilter.block?({32, 109, 221, 1}, %{ |
150 | 57 | id: @org_id,
|
151 | 58 | name: "semaphore",
|
152 | 59 | ip_allow_list: ["32.109.221.12/28"]
|
153 | 60 | })
|
154 | 61 | end
|
155 | 62 |
|
156 | 63 | test "single CIDR => returns true if request comes from IP outside the CIDR" do
|
157 |
| - conn = |
158 |
| - Plug.Adapters.Test.Conn.conn( |
159 |
| - %Plug.Conn{req_headers: [{"x-forwarded-for", "32.109.222.1"}]}, |
160 |
| - :get, |
161 |
| - "https://org1.semaphoretest.test/exauth/api/v1alpha/jobs", |
162 |
| - nil |
163 |
| - ) |
164 |
| - |
165 |
| - assert Auth.IpFilter.block?(conn, %{ |
| 64 | + assert Auth.IpFilter.block?({32, 109, 222, 1}, %{ |
166 | 65 | id: @org_id,
|
167 | 66 | name: "semaphore",
|
168 | 67 | ip_allow_list: ["32.109.221.12/28"]
|
169 | 68 | })
|
170 | 69 | end
|
171 | 70 |
|
172 | 71 | test "multiple CIDRs => returns false if request comes from IP inside one of the CIDRs" do
|
173 |
| - conn = |
174 |
| - Plug.Adapters.Test.Conn.conn( |
175 |
| - %Plug.Conn{req_headers: [{"x-forwarded-for", "32.109.221.1"}]}, |
176 |
| - :get, |
177 |
| - "https://org1.semaphoretest.test/exauth/api/v1alpha/jobs", |
178 |
| - nil |
179 |
| - ) |
180 |
| - |
181 |
| - refute Auth.IpFilter.block?(conn, %{ |
| 72 | + refute Auth.IpFilter.block?({32, 109, 221, 1}, %{ |
182 | 73 | id: @org_id,
|
183 | 74 | name: "semaphore",
|
184 | 75 | ip_allow_list: ["113.51.211.0/16", "32.109.221.12/28"]
|
185 | 76 | })
|
186 | 77 | end
|
187 | 78 |
|
188 | 79 | test "multiple CIDRs => returns true if request comes from IP outside all CIDRs" do
|
189 |
| - conn = |
190 |
| - Plug.Adapters.Test.Conn.conn( |
191 |
| - %Plug.Conn{req_headers: [{"x-forwarded-for", "45.111.201.7"}]}, |
192 |
| - :get, |
193 |
| - "https://org1.semaphoretest.test/exauth/api/v1alpha/jobs", |
194 |
| - nil |
195 |
| - ) |
196 |
| - |
197 |
| - assert Auth.IpFilter.block?(conn, %{ |
| 80 | + assert Auth.IpFilter.block?({45, 111, 201, 7}, %{ |
198 | 81 | id: @org_id,
|
199 | 82 | name: "semaphore",
|
200 | 83 | ip_allow_list: ["113.51.211.0/16", "32.109.221.12/28"]
|
201 | 84 | })
|
202 | 85 | end
|
203 | 86 |
|
204 | 87 | test "IP + CIDR => returns false if request comes from IP inside CIDR" do
|
205 |
| - conn = |
206 |
| - Plug.Adapters.Test.Conn.conn( |
207 |
| - %Plug.Conn{req_headers: [{"x-forwarded-for", "32.109.221.1"}]}, |
208 |
| - :get, |
209 |
| - "https://org1.semaphoretest.test/exauth/api/v1alpha/jobs", |
210 |
| - nil |
211 |
| - ) |
212 |
| - |
213 |
| - refute Auth.IpFilter.block?(conn, %{ |
| 88 | + refute Auth.IpFilter.block?({32, 109, 221, 1}, %{ |
214 | 89 | id: @org_id,
|
215 | 90 | name: "semaphore",
|
216 | 91 | ip_allow_list: ["113.51.211.12", "32.109.221.12/28"]
|
217 | 92 | })
|
218 | 93 | end
|
219 | 94 |
|
220 | 95 | test "IP + CIDR => returns false if request comes from one of the allowed IPs" do
|
221 |
| - conn = |
222 |
| - Plug.Adapters.Test.Conn.conn( |
223 |
| - %Plug.Conn{req_headers: [{"x-forwarded-for", "113.51.211.12"}]}, |
224 |
| - :get, |
225 |
| - "https://org1.semaphoretest.test/exauth/api/v1alpha/jobs", |
226 |
| - nil |
227 |
| - ) |
228 |
| - |
229 |
| - refute Auth.IpFilter.block?(conn, %{ |
| 96 | + refute Auth.IpFilter.block?({113, 51, 211, 12}, %{ |
230 | 97 | id: @org_id,
|
231 | 98 | name: "semaphore",
|
232 | 99 | ip_allow_list: ["113.51.211.12", "32.109.221.12/28"]
|
233 | 100 | })
|
234 | 101 | end
|
235 | 102 |
|
236 | 103 | test "IP + CIDR => returns true if request comes from IP not in CIDRs and not in allowed IPs" do
|
237 |
| - conn = |
238 |
| - Plug.Adapters.Test.Conn.conn( |
239 |
| - %Plug.Conn{req_headers: [{"x-forwarded-for", "35.121.222.37"}]}, |
240 |
| - :get, |
241 |
| - "https://org1.semaphoretest.test/exauth/api/v1alpha/jobs", |
242 |
| - nil |
243 |
| - ) |
244 |
| - |
245 |
| - assert Auth.IpFilter.block?(conn, %{ |
| 104 | + assert Auth.IpFilter.block?({35, 121, 222, 37}, %{ |
246 | 105 | id: @org_id,
|
247 | 106 | name: "semaphore",
|
248 | 107 | ip_allow_list: ["113.51.211.12", "32.109.221.12/28"]
|
|
0 commit comments