#2165 Global configuration SecurityOptions

src/Ocelot/Configuration/Creator/ISecurityOptionsCreator.cs

@@ -4,6 +4,6 @@ namespace Ocelot.Configuration.Creator
 {
     public interface ISecurityOptionsCreator
     {
-        SecurityOptions Create(FileSecurityOptions securityOptions);
+        SecurityOptions Create(FileSecurityOptions securityOptions, FileGlobalConfiguration globalConfiguration);
     }
 }

src/Ocelot/Configuration/Creator/RoutesCreator.cs

@@ -108,7 +108,7 @@ private DownstreamRoute SetUpDownstreamRoute(FileRoute fileRoute, FileGlobalConf
 
             var lbOptions = _loadBalancerOptionsCreator.Create(fileRoute.LoadBalancerOptions);
 
-            var securityOptions = _securityOptionsCreator.Create(fileRoute.SecurityOptions);
+            var securityOptions = _securityOptionsCreator.Create(fileRoute.SecurityOptions, globalConfiguration);
 
             var downstreamHttpVersion = _versionCreator.Create(fileRoute.DownstreamHttpVersion);
 

src/Ocelot/Configuration/Creator/SecurityOptionsCreator.cs

@@ -5,35 +5,26 @@ namespace Ocelot.Configuration.Creator
 {
     public class SecurityOptionsCreator : ISecurityOptionsCreator
     {
-        public SecurityOptions Create(FileSecurityOptions securityOptions)
-        {
-            var ipAllowedList = new List<string>();
-            var ipBlockedList = new List<string>();
+        public SecurityOptions Create(FileSecurityOptions securityOptions, FileGlobalConfiguration globalConfiguration) 
+            => Create(securityOptions.IsFullFilled() ? securityOptions : globalConfiguration.SecurityOptions);
 
-            foreach (var allowed in securityOptions.IPAllowedList)
-            {
-                if (IPAddressRange.TryParse(allowed, out var allowedIpAddressRange))
-                {
-                    var allowedIps = allowedIpAddressRange.Select<IPAddress, string>(x => x.ToString());
-                    ipAllowedList.AddRange(allowedIps);
-                }
-            }
-
-            foreach (var blocked in securityOptions.IPBlockedList)
-            {
-                if (IPAddressRange.TryParse(blocked, out var blockedIpAddressRange))
-                {
-                    var blockedIps = blockedIpAddressRange.Select<IPAddress, string>(x => x.ToString());
-                    ipBlockedList.AddRange(blockedIps);
-                }
-            }
+        private static SecurityOptions Create(FileSecurityOptions securityOptions)
+        {
+            var ipAllowedList = SetIpAddressList(securityOptions.IPAllowedList);
+            var ipBlockedList = SetIpAddressList(securityOptions.IPBlockedList);
 
             if (securityOptions.ExcludeAllowedFromBlocked)
             {
-                ipBlockedList = ipBlockedList.Except(ipAllowedList).ToList();
+                ipBlockedList = ipBlockedList.Except(ipAllowedList).ToArray();
             }
 
             return new SecurityOptions(ipAllowedList, ipBlockedList);
         }
-    }
+
+        private static string[] SetIpAddressList(IList<string> ipValueList)
+            => ipValueList
+                .Where(ipValue => IPAddressRange.TryParse(ipValue, out _))
+                .SelectMany(ipValue => IPAddressRange.Parse(ipValue).Select<IPAddress, string>(ip => ip.ToString()))
+                .ToArray();
+        }
 }

src/Ocelot/Configuration/File/FileGlobalConfiguration.cs

@@ -13,6 +13,7 @@ public FileGlobalConfiguration()
             HttpHandlerOptions = new FileHttpHandlerOptions();
             CacheOptions = new FileCacheOptions();
             MetadataOptions = new FileMetadataOptions();
+            SecurityOptions = new FileSecurityOptions();
         }
 
         public string RequestIdKey { get; set; }
@@ -48,5 +49,7 @@ public FileGlobalConfiguration()
         public FileCacheOptions CacheOptions { get; set; }
 
         public FileMetadataOptions MetadataOptions { get; set; }
+
+        public FileSecurityOptions SecurityOptions { get; set; }
     }
 }

src/Ocelot/Configuration/File/FileSecurityOptionsExtensions.cs

@@ -0,0 +1,8 @@
+namespace Ocelot.Configuration.File
+{
+    internal static class FileSecurityOptionsExtensions
+    {
+        internal static bool IsFullFilled(this FileSecurityOptions fileSecurityOptions) 
+            => fileSecurityOptions.IPAllowedList.Count > 0 || fileSecurityOptions.IPBlockedList.Count > 0;
+    }
+}

src/Ocelot/Configuration/SecurityOptions.cs

@@ -4,8 +4,8 @@ public class SecurityOptions
     {
         public SecurityOptions()
         {
-            IPAllowedList = new();
-            IPBlockedList = new();
+            IPAllowedList = new List<string>();
+            IPBlockedList = new List<string>();
         }
 
         public SecurityOptions(string allowed = null, string blocked = null)
@@ -22,13 +22,13 @@ public SecurityOptions(string allowed = null, string blocked = null)
             }
         }
 
-        public SecurityOptions(List<string> allowedList = null, List<string> blockedList = null)
+        public SecurityOptions(IList<string> allowedList = null, IList<string> blockedList = null)
         {
-            IPAllowedList = allowedList ?? new();
-            IPBlockedList = blockedList ?? new();
+            IPAllowedList = allowedList ?? new List<string>();
+            IPBlockedList = blockedList ?? new List<string>();
         }
 
-        public List<string> IPAllowedList { get; }
-        public List<string> IPBlockedList { get; }
+        public IList<string> IPAllowedList { get; }
+        public IList<string> IPBlockedList { get; }
     }
 }

src/Ocelot/Security/IPSecurity/IPSecurityPolicy.cs

@@ -16,18 +16,18 @@ public async Task<Response> Security(DownstreamRoute downstreamRoute, HttpContex
                 return new OkResponse();
             }
 
-            if (securityOptions.IPBlockedList != null)
+            if (securityOptions.IPBlockedList != null && securityOptions.IPBlockedList.Count > 0 && clientIp != null)
             {
-                if (securityOptions.IPBlockedList.Exists(f => f == clientIp.ToString()))
+                if (securityOptions.IPBlockedList.Contains(clientIp.ToString()))
                 {
                     var error = new UnauthenticatedError($" This request rejects access to {clientIp} IP");
                     return new ErrorResponse(error);
                 }
             }
 
-            if (securityOptions.IPAllowedList?.Count > 0)
+            if (securityOptions.IPAllowedList != null && securityOptions.IPAllowedList.Count > 0 && clientIp != null)
             {
-                if (!securityOptions.IPAllowedList.Exists(f => f == clientIp.ToString()))
+                if (!securityOptions.IPAllowedList.Contains(clientIp.ToString()))
                 {
                     var error = new UnauthenticatedError($"{clientIp} does not allow access, the request is invalid");
                     return new ErrorResponse(error);

test/Ocelot.AcceptanceTests/Security/SecurityOptionsTests.cs

@@ -0,0 +1,163 @@
+using Microsoft.AspNetCore.Http;
+using Ocelot.Configuration.File;
+
+namespace Ocelot.AcceptanceTests.Security
+{
+    public sealed class SecurityOptionsTests: Steps
+    {
+        private readonly ServiceHandler _serviceHandler;
+
+        public SecurityOptionsTests()
+        {
+            _serviceHandler = new ServiceHandler();
+        }
+
+        public override void Dispose()
+        {
+            _serviceHandler.Dispose();
+            base.Dispose();
+        }
+
+        [Fact]
+        public void should_call_with_allowed_ip_in_global_config()
+        {
+            var port = PortFinder.GetRandomPort();
+            var ip = Dns.GetHostAddresses("192.168.1.35")[0];
+            var route = GivenRoute(port, "/myPath", "/worldPath");
+            var configuration = GivenConfigurationWithSecurityOptions(route);
+
+            this.Given(x => x.GivenThereIsAServiceRunningOn(DownstreamUrl(port), ip))
+                .And(x => GivenThereIsAConfiguration(configuration))
+                .And(x => GivenOcelotIsRunning())
+                .When(x => WhenIGetUrlOnTheApiGateway("/worldPath"))
+                .Then(x => ThenTheStatusCodeShouldBe(HttpStatusCode.OK));
+        }
+
+        [Fact]
+        public void should_block_call_with_blocked_ip_in_global_config()
+        {
+            var port = PortFinder.GetRandomPort();
+            var ip = Dns.GetHostAddresses("192.168.1.55")[0];
+            var route = GivenRoute(port, "/myPath", "/worldPath");
+            var configuration = GivenConfigurationWithSecurityOptions(route);
+
+            this.Given(x => x.GivenThereIsAServiceRunningOn(DownstreamUrl(port), ip))
+                .And(x => GivenThereIsAConfiguration(configuration))
+                .And(x => GivenOcelotIsRunning())
+                .When(x => WhenIGetUrlOnTheApiGateway("/worldPath"))
+                .Then(x => ThenTheStatusCodeShouldBe(HttpStatusCode.Unauthorized));
+        }
+
+        [Fact]
+        public void should_call_with_allowed_ip_in_route_config()
+        {
+            var port = PortFinder.GetRandomPort();
+            var ip = Dns.GetHostAddresses("192.168.1.1")[0];
+            var securityConfig = new FileSecurityOptions
+            {
+                IPAllowedList = new List<string> { "192.168.1.1" },
+            };
+
+            var route = GivenRoute(port, "/myPath", "/worldPath", securityConfig);
+            var configuration = GivenConfiguration(route);
+
+            this.Given(x => x.GivenThereIsAServiceRunningOn(DownstreamUrl(port), ip))
+                .And(x => GivenThereIsAConfiguration(configuration))
+                .And(x => GivenOcelotIsRunning())
+                .When(x => WhenIGetUrlOnTheApiGateway("/worldPath"))
+                .Then(x => ThenTheStatusCodeShouldBe(HttpStatusCode.OK));
+        }
+
+        [Fact]
+        public void should_block_call_with_blocked_ip_in_route_config()
+        {
+            var port = PortFinder.GetRandomPort();
+            var ip = Dns.GetHostAddresses("192.168.1.1")[0];
+            var securityConfig = new FileSecurityOptions
+            {
+                IPBlockedList = new List<string> { "192.168.1.1" },
+            };
+
+            var route = GivenRoute(port, "/myPath", "/worldPath", securityConfig);
+            var configuration = GivenConfiguration(route);
+
+            this.Given(x => x.GivenThereIsAServiceRunningOn(DownstreamUrl(port), ip))
+                .And(x => GivenThereIsAConfiguration(configuration))
+                .And(x => GivenOcelotIsRunning())
+                .When(x => WhenIGetUrlOnTheApiGateway("/worldPath"))
+                .Then(x => ThenTheStatusCodeShouldBe(HttpStatusCode.Unauthorized));
+        }
+
+        [Fact]
+        public void should_call_with_allowed_ip_in_route_config_and_blocked_ip_in_global_config()
+        {
+            var port = PortFinder.GetRandomPort();
+            var ip = Dns.GetHostAddresses("192.168.1.55")[0];
+            var securityConfig = new FileSecurityOptions
+            {
+                IPAllowedList = new List<string> { "192.168.1.55" },
+            };
+
+            var route = GivenRoute(port, "/myPath", "/worldPath", securityConfig);
+            var configuration = GivenConfigurationWithSecurityOptions(route);
+
+            this.Given(x => x.GivenThereIsAServiceRunningOn(DownstreamUrl(port), ip))
+               .And(x => GivenThereIsAConfiguration(configuration))
+               .And(x => GivenOcelotIsRunning())
+               .When(x => WhenIGetUrlOnTheApiGateway("/worldPath"))
+               .Then(x => ThenTheStatusCodeShouldBe(HttpStatusCode.OK));
+        }
+
+        [Fact]
+        public void should_block_call_with_blocked_ip_in_route_config_and_allowed_ip_in_global_config()
+        {
+            var port = PortFinder.GetRandomPort();
+            var ip = Dns.GetHostAddresses("192.168.1.35")[0];
+            var securityConfig = new FileSecurityOptions
+            {
+                IPBlockedList = new List<string> { "192.168.1.35" },
+            };
+
+            var route = GivenRoute(port, "/myPath", "/worldPath", securityConfig);
+            var configuration = GivenConfigurationWithSecurityOptions(route);
+
+            this.Given(x => x.GivenThereIsAServiceRunningOn(DownstreamUrl(port), ip))
+               .And(x => GivenThereIsAConfiguration(configuration))
+               .And(x => GivenOcelotIsRunning())
+               .When(x => WhenIGetUrlOnTheApiGateway("/worldPath"))
+               .Then(x => ThenTheStatusCodeShouldBe(HttpStatusCode.Unauthorized));
+        }
+
+        private void GivenThereIsAServiceRunningOn(string url, IPAddress ipAddess)
+        {
+            _serviceHandler.GivenThereIsAServiceRunningOn(url, async context =>
+            {
+                context.Connection.RemoteIpAddress = ipAddess;
+                context.Response.StatusCode = (int)HttpStatusCode.OK;
+                await context.Response.WriteAsync("a valida response body");
+            });
+        }
+
+        private static FileConfiguration GivenConfigurationWithSecurityOptions(params FileRoute[] routes)
+        {
+            var config = GivenConfiguration(routes);
+            config.GlobalConfiguration.SecurityOptions = new FileSecurityOptions
+            {
+                IPAllowedList = new List<string> { "192.168.1.30-50" },
+                IPBlockedList = new List<string> { "192.168.1.1-100" },
+                ExcludeAllowedFromBlocked = true
+            };
+
+            return config;
+        }
+
+        private FileRoute GivenRoute(int port, string downstream, string upstream, FileSecurityOptions fileSecurityOptions = null)
+            => new()
+            {
+                DownstreamPathTemplate = downstream,
+                UpstreamPathTemplate = upstream,
+                UpstreamHttpMethod = new List<string> { "Get" },
+                SecurityOptions = fileSecurityOptions ?? new FileSecurityOptions(),
+            };
+    }
+}

test/Ocelot.UnitTests/Configuration/RoutesCreatorTests.cs

@@ -303,7 +303,7 @@ private void ThenTheDepsAreCalledFor(FileRoute fileRoute, FileGlobalConfiguratio
             _hfarCreator.Verify(x => x.Create(fileRoute), Times.Once);
             _daCreator.Verify(x => x.Create(fileRoute), Times.Once);
             _lboCreator.Verify(x => x.Create(fileRoute.LoadBalancerOptions), Times.Once);
-            _soCreator.Verify(x => x.Create(fileRoute.SecurityOptions), Times.Once);
+            _soCreator.Verify(x => x.Create(fileRoute.SecurityOptions, globalConfig), Times.Once);
             _metadataCreator.Verify(x => x.Create(fileRoute.Metadata, globalConfig), Times.Once);
         }
     }