test 3 modes and cdn ip lists

mobula9 · mobula9 · commit b52be38b6e6f · 2020-12-24T15:27:02.000+01:00
diff --git a/docker/php-7.2.Dockerfile b/docker/php-7.2.Dockerfile
@@ -1,5 +1,7 @@
 FROM wordpress:5.6-php7.2
 
+RUN a2disconf remoteip && a2dismod remoteip && service apache2 restart
+
 RUN apt-get update && apt-get install -y git libmemcached-dev zlib1g-dev \
 && pecl install -o -f redis memcached \
 &&  rm -rf /tmp/pear \
diff --git a/docker/php-7.3.Dockerfile b/docker/php-7.3.Dockerfile
@@ -1,5 +1,7 @@
 FROM wordpress:5.6-php7.3
 
+RUN a2disconf remoteip && a2dismod remoteip && service apache2 restart
+
 RUN apt-get update && apt-get install -y git libmemcached-dev zlib1g-dev \
 && pecl install -o -f redis memcached \
 &&  rm -rf /tmp/pear \
diff --git a/docker/php-7.4.Dockerfile b/docker/php-7.4.Dockerfile
@@ -1,5 +1,7 @@
 FROM wordpress:5.6-php7.4
 
+RUN a2disconf remoteip && a2dismod remoteip && service apache2 restart
+
 RUN apt-get update && apt-get install -y git libmemcached-dev zlib1g-dev \
 && pecl install -o -f redis memcached \
 &&  rm -rf /tmp/pear \
diff --git a/docker/wp4.9/php-7.2.Dockerfile b/docker/wp4.9/php-7.2.Dockerfile
@@ -1,5 +1,7 @@
 FROM wordpress:4.9-php7.2
 
+RUN a2disconf remoteip && a2dismod remoteip && service apache2 restart
+
 RUN apt-get update && apt-get install -y git libmemcached-dev zlib1g-dev \
 && pecl install -o -f redis memcached \
 &&  rm -rf /tmp/pear \
diff --git a/docker/wp5.0/php-7.2.Dockerfile b/docker/wp5.0/php-7.2.Dockerfile
@@ -1,5 +1,7 @@
 FROM wordpress:5.0-php7.2
 
+RUN a2disconf remoteip && a2dismod remoteip && service apache2 restart
+
 RUN apt-get update && apt-get install -y git libmemcached-dev zlib1g-dev \
 && pecl install -o -f redis memcached \
 &&  rm -rf /tmp/pear \
diff --git a/docker/wp5.0/php-7.3.Dockerfile b/docker/wp5.0/php-7.3.Dockerfile
@@ -1,5 +1,7 @@
 FROM wordpress:5.0-php7.3
 
+RUN a2disconf remoteip && a2dismod remoteip && service apache2 restart
+
 RUN apt-get update && apt-get install -y git libmemcached-dev zlib1g-dev \
 && pecl install -o -f redis memcached \
 &&  rm -rf /tmp/pear \
diff --git a/docker/wp5.0/php-7.4.Dockerfile b/docker/wp5.0/php-7.4.Dockerfile
@@ -1,5 +1,7 @@
 FROM wordpress:5.0-php7.4
 
+RUN a2disconf remoteip && a2dismod remoteip && service apache2 restart
+
 RUN apt-get update && apt-get install -y git libmemcached-dev zlib1g-dev \
 && pecl install -o -f redis memcached \
 &&  rm -rf /tmp/pear \
diff --git a/docker/wp5.1/php-7.2.Dockerfile b/docker/wp5.1/php-7.2.Dockerfile
@@ -1,5 +1,7 @@
 FROM wordpress:5.1-php7.2
 
+RUN a2disconf remoteip && a2dismod remoteip && service apache2 restart
+
 RUN apt-get update && apt-get install -y git libmemcached-dev zlib1g-dev \
 && pecl install -o -f redis memcached \
 &&  rm -rf /tmp/pear \
diff --git a/docker/wp5.1/php-7.3.Dockerfile b/docker/wp5.1/php-7.3.Dockerfile
@@ -1,5 +1,7 @@
 FROM wordpress:5.1-php7.3
 
+RUN a2disconf remoteip && a2dismod remoteip && service apache2 restart
+
 RUN apt-get update && apt-get install -y git libmemcached-dev zlib1g-dev \
 && pecl install -o -f redis memcached \
 &&  rm -rf /tmp/pear \
diff --git a/docker/wp5.1/php-7.4.Dockerfile b/docker/wp5.1/php-7.4.Dockerfile
@@ -1,5 +1,7 @@
 FROM wordpress:5.1-php7.4
 
+RUN a2disconf remoteip && a2dismod remoteip && service apache2 restart
+
 RUN apt-get update && apt-get install -y git libmemcached-dev zlib1g-dev \
 && pecl install -o -f redis memcached \
 &&  rm -rf /tmp/pear \
diff --git a/docker/wp5.2/php-7.2.Dockerfile b/docker/wp5.2/php-7.2.Dockerfile
@@ -1,5 +1,7 @@
 FROM wordpress:5.2-php7.2
 
+RUN a2disconf remoteip && a2dismod remoteip && service apache2 restart
+
 RUN apt-get update && apt-get install -y git libmemcached-dev zlib1g-dev \
 && pecl install -o -f redis memcached \
 &&  rm -rf /tmp/pear \
diff --git a/docker/wp5.2/php-7.3.Dockerfile b/docker/wp5.2/php-7.3.Dockerfile
@@ -1,5 +1,7 @@
 FROM wordpress:5.2-php7.3
 
+RUN a2disconf remoteip && a2dismod remoteip && service apache2 restart
+
 RUN apt-get update && apt-get install -y git libmemcached-dev zlib1g-dev \
 && pecl install -o -f redis memcached \
 &&  rm -rf /tmp/pear \
diff --git a/docker/wp5.2/php-7.4.Dockerfile b/docker/wp5.2/php-7.4.Dockerfile
@@ -1,5 +1,7 @@
 FROM wordpress:5.2-php7.4
 
+RUN a2disconf remoteip && a2dismod remoteip && service apache2 restart
+
 RUN apt-get update && apt-get install -y git libmemcached-dev zlib1g-dev \
 && pecl install -o -f redis memcached \
 &&  rm -rf /tmp/pear \
diff --git a/docker/wp5.3/php-7.2.Dockerfile b/docker/wp5.3/php-7.2.Dockerfile
@@ -1,5 +1,7 @@
 FROM wordpress:5.3-php7.2
 
+RUN a2disconf remoteip && a2dismod remoteip && service apache2 restart
+
 RUN apt-get update && apt-get install -y git libmemcached-dev zlib1g-dev \
 && pecl install -o -f redis memcached \
 &&  rm -rf /tmp/pear \
diff --git a/docker/wp5.3/php-7.3.Dockerfile b/docker/wp5.3/php-7.3.Dockerfile
@@ -1,5 +1,7 @@
 FROM wordpress:5.3-php7.3
 
+RUN a2disconf remoteip && a2dismod remoteip && service apache2 restart
+
 RUN apt-get update && apt-get install -y git libmemcached-dev zlib1g-dev \
 && pecl install -o -f redis memcached \
 &&  rm -rf /tmp/pear \
diff --git a/docker/wp5.3/php-7.4.Dockerfile b/docker/wp5.3/php-7.4.Dockerfile
@@ -1,5 +1,7 @@
 FROM wordpress:5.3-php7.4
 
+RUN a2disconf remoteip && a2dismod remoteip && service apache2 restart
+
 RUN apt-get update && apt-get install -y git libmemcached-dev zlib1g-dev \
 && pecl install -o -f redis memcached \
 &&  rm -rf /tmp/pear \
diff --git a/docker/wp5.4/php-7.2.Dockerfile b/docker/wp5.4/php-7.2.Dockerfile
@@ -1,5 +1,7 @@
 FROM wordpress:5.4-php7.2
 
+RUN a2disconf remoteip && a2dismod remoteip && service apache2 restart
+
 RUN apt-get update && apt-get install -y git libmemcached-dev zlib1g-dev \
 && pecl install -o -f redis memcached \
 &&  rm -rf /tmp/pear \
diff --git a/docker/wp5.4/php-7.3.Dockerfile b/docker/wp5.4/php-7.3.Dockerfile
@@ -1,5 +1,7 @@
 FROM wordpress:5.4-php7.3
 
+RUN a2disconf remoteip && a2dismod remoteip && service apache2 restart
+
 RUN apt-get update && apt-get install -y git libmemcached-dev zlib1g-dev \
 && pecl install -o -f redis memcached \
 &&  rm -rf /tmp/pear \
diff --git a/docker/wp5.4/php-7.4.Dockerfile b/docker/wp5.4/php-7.4.Dockerfile
@@ -1,5 +1,7 @@
 FROM wordpress:5.4-php7.4
 
+RUN a2disconf remoteip && a2dismod remoteip && service apache2 restart
+
 RUN apt-get update && apt-get install -y git libmemcached-dev zlib1g-dev \
 && pecl install -o -f redis memcached \
 &&  rm -rf /tmp/pear \
diff --git a/docker/wp5.5/php-7.2.Dockerfile b/docker/wp5.5/php-7.2.Dockerfile
@@ -1,5 +1,7 @@
 FROM wordpress:5.5-php7.2
 
+RUN a2disconf remoteip && a2dismod remoteip && service apache2 restart
+
 RUN apt-get update && apt-get install -y git libmemcached-dev zlib1g-dev \
 && pecl install -o -f redis memcached \
 &&  rm -rf /tmp/pear \
diff --git a/docker/wp5.5/php-7.3.Dockerfile b/docker/wp5.5/php-7.3.Dockerfile
@@ -1,5 +1,7 @@
 FROM wordpress:5.5-php7.3
 
+RUN a2disconf remoteip && a2dismod remoteip && service apache2 restart
+
 RUN apt-get update && apt-get install -y git libmemcached-dev zlib1g-dev \
 && pecl install -o -f redis memcached \
 &&  rm -rf /tmp/pear \
diff --git a/docker/wp5.5/php-7.4.Dockerfile b/docker/wp5.5/php-7.4.Dockerfile
@@ -1,5 +1,7 @@
 FROM wordpress:5.5-php7.4
 
+RUN a2disconf remoteip && a2dismod remoteip && service apache2 restart
+
 RUN apt-get update && apt-get install -y git libmemcached-dev zlib1g-dev \
 && pecl install -o -f redis memcached \
 &&  rm -rf /tmp/pear \
diff --git a/docs/contribute.md b/docs/contribute.md
@@ -70,7 +70,7 @@ Debug mode (add tests):
 DEBUG ./tests-local.sh
 ```
 
-> Note: you can add `await jestPlaywright.debug();` at the moment you want to pause the process.
+> Note: you can add `await jestPlaywright.debug()` at the moment you want to pause the process.
 
 All the versions:
 
diff --git a/inc/admin/advanced-settings.php b/inc/admin/advanced-settings.php
@@ -236,6 +236,11 @@ function convertInlineIpRangesToLongArray(string $inlineIpRanges): array
     addFieldString('crowdsec_trust_ip_forward_list', 'Trust these CDN IPs<br>(or Load Balancer, HTTP Proxy)', 'crowdsec_plugin_advanced_settings',
     'crowdsec_advanced_settings', 'crowdsec_admin_advanced_remediations', function ($input) {
         try {
+            if ('' === $input) {
+                update_option('crowdsec_trust_ip_forward_array', []);
+
+                return $input;
+            }
             $longList = convertInlineIpRangesToLongArray($input);
             update_option('crowdsec_trust_ip_forward_array', $longList);
             AdminNotice::displaySuccess('Ips with XFF to trust successfully saved.');
diff --git a/tests-local-wpall.sh b/tests-local-wpall.sh
diff --git a/tests/functional/__tests__/functional.js b/tests/functional/__tests__/functional.js
@@ -10,6 +10,7 @@ const ADMIN_PASSWORD = "my_very_very_secret_admin_password";
 const LAPI_URL = process.env.LAPI_URL_FROM_CONTAINERS;
 const NOTIFY = !!process.env.DEBUG;
 const TIMEOUT = (!!process.env.DEBUG ? 5 * 60 : 8) * 1000;
+const OTHER_IP = "1.2.3.4";
 
 const notify = (message) => {
 	if (NOTIFY) {
@@ -159,11 +160,15 @@ const publicHomepageShouldBeAccessible = async () => {
 	await expect(title).toContain("Just another WordPress site");
 };
 
-const banOwnIpForSeconds = async (seconds) => {
-	await addDecision(CLIENT_IP, "ban", seconds + "s");
+const banIpForSeconds = async (ip, seconds) => {
+	await addDecision(ip, "ban", seconds + "s");
 	await wait(1000);
 };
 
+const banOwnIpForSeconds = async (seconds) => {
+	await banIpForSeconds(CLIENT_IP, seconds);
+};
+
 const captchaOwnIpForSeconds = async (seconds) => {
 	await addDecision(CLIENT_IP, "captcha", seconds + "s");
 	await wait(1000);
@@ -304,23 +309,27 @@ describe(`Run in Live mode`, () => {
 	});
 
 	it('Should display a captcha wall instead of a ban wall in Flex mode"', async () => {
-		
 		// set Flex mode
 		await goToAdmin();
 		await onAdminGoToSettingsPage();
-		page.selectOption('select[name=crowdsec_bouncing_level]', 'flex_boucing');
+		await page.selectOption(
+			"[name=crowdsec_bouncing_level]",
+			"flex_boucing"
+		);
 		await onAdminSaveSettings();
 
 		// Should be a captcha wall
 		await publicHomepageShouldBeCaptchaWall();
 	});
 
 	it('Should be accessible in Disabled mode"', async () => {
-		
 		// set Disabled mode
 		await goToAdmin();
 		await onAdminGoToSettingsPage();
-		page.selectOption('select[name=crowdsec_bouncing_level]', 'bouncing_disabled');
+		await page.selectOption(
+			"[name=crowdsec_bouncing_level]",
+			"bouncing_disabled"
+		);
 		await onAdminSaveSettings();
 
 		// Should be accessible
@@ -329,7 +338,10 @@ describe(`Run in Live mode`, () => {
 		// Go back to normal mode
 		await goToAdmin();
 		await onAdminGoToSettingsPage();
-		page.selectOption('select[name=crowdsec_bouncing_level]', 'normal_boucing');
+		await page.selectOption(
+			"[name=crowdsec_bouncing_level]",
+			"normal_boucing"
+		);
 		await onAdminSaveSettings();
 
 		// Should be a ban wall
@@ -340,6 +352,26 @@ describe(`Run in Live mode`, () => {
 		await removeAllDecisions();
 		await publicHomepageShouldBeAccessible();
 	});
+
+	it('Should handle X-Forwarded-For header for whitelisted IPs only"', async () => {
+		await banIpForSeconds(OTHER_IP, 15 * 60);
+
+		// Should be banned as current IP is not trust by CDN
+		page.setExtraHTTPHeaders({ "X-Forwarded-For": OTHER_IP });
+		await publicHomepageShouldBeAccessible();
+
+		// Add the current IP to the CDN list (via a range)
+		await goToAdmin();
+		await onAdminGoToAdvancedPage();
+		await fillInput("crowdsec_trust_ip_forward_list", CLIENT_IP + "/30");
+		await onAdminSaveSettings();
+
+		// // Should be banned
+		await publicHomepageShouldBeBanWall();
+		
+		// // Remove the XFF header for next requests
+		page.setExtraHTTPHeaders({});
+	});
 });
 
 describe(`Run in Stream mode`, () => {
@@ -407,13 +439,6 @@ Refresh cache
 
 (to write)
 
-# CDN IP
-
-ban IP 1.2.3.4
-In CDN list, add a large range including the current IP
-Try to access homepage simulating 1.2.3.4 via the CDN : const page = await browser.newPage({ extraHTTPHeaders: 'X-Forwarded-For': '1.2.3.4' })
-Should be banned
-
 
 # Recheck clean IP
 
