Roll Your Own API Management Platform with nginx and Lua
18 likes47,438 views
The document outlines the development of an API management platform using Nginx and Lua, focusing on access control and capacity management techniques like rate limiting. It describes implementing OAuth signature validation and includes testing functions for code reliability. Additionally, it provides insights on network architecture and deployment strategies utilizing tools like Vagrant and Ansible.
![--- Validates the OAuth signature!
-- @return Const.HTTP_UNAUTHORIZED if either the key or signature is invalid!
-- this method is internal and should not be called directly!
function _M.validate_signature(self)!
local headers = self.req.get_oauth_params()!
local key = headers[Const.OAUTH_CONSUMER_KEY]!
local keyconf = self.conf.keys[key]!
if keyconf == nil then!
return {!
code = Const.HTTP_UNAUTHORIZED!
error = Const.ERROR_INVALID_CONSUMER_KEY!
}!
end!
!
local sig = get_hmac_signature(self.req, keyconf.secret)!
if sig ~= headers[Const.OAUTH_SIGNATURE] then!
return {!
code = Const.HTTP_UNAUTHORIZED,!
error = Const.ERROR_INVALID_SIGNATURE!
}!
end!
end!](https://image.slidesharecdn.com/roll-your-own-api-mgmt-150520235300-lva1-app6891/85/Roll-Your-Own-API-Management-Platform-with-nginx-and-Lua-9-320.jpg)
![function TestOAuth1:test_reject_request_when_signature_invalid()!
local header = Header:new()!
header[Const.OAUTH_SIGNATURE] = “invalid”!
local req = Req:new({oauth_params = header })!
local conf = Conf:new()!
local oauth = OAuth1:new(conf, req)!
!
local res = oauth:authorize()!
assertEquals(res.code, Const.HTTP_UNAUTHORIZED)!
assertEquals(res.error, Const.ERROR_INVALID_SIGNATURE)!
end!
!
lu = LuaUnit.new()!
Lu:setOutputType(“tap”)!
os.exit(lu:runSuite())!](https://image.slidesharecdn.com/roll-your-own-api-mgmt-150520235300-lva1-app6891/85/Roll-Your-Own-API-Management-Platform-with-nginx-and-Lua-12-320.jpg)
![function get_oauth_params_from_auth_header(env)!
env = env or ngx!
local auth_hdrs = env.req.get_headers()[“Authorization”]!
...!](https://image.slidesharecdn.com/roll-your-own-api-mgmt-150520235300-lva1-app6891/85/Roll-Your-Own-API-Management-Platform-with-nginx-and-Lua-16-320.jpg)
![function get_oauth_params_from_auth_header(env)!
env = env or ngx!
local auth_hdrs = env.req.get_headers()[“Authorization”]!
...!](https://image.slidesharecdn.com/roll-your-own-api-mgmt-150520235300-lva1-app6891/85/Roll-Your-Own-API-Management-Platform-with-nginx-and-Lua-17-320.jpg)
![function get_oauth_params_from_auth_header(env)!
env = env or ngx!
local auth_hdrs = env.req.get_headers()[“Authorization”]!
...!](https://image.slidesharecdn.com/roll-your-own-api-mgmt-150520235300-lva1-app6891/85/Roll-Your-Own-API-Management-Platform-with-nginx-and-Lua-18-320.jpg)
![function TestRequest:test_retrieve_oauth_params_from_header()!
local header = [[Oauth realm=“example.com”, ]]!
.. [[oauth_consumer_key=“mykey”,]]!
.. [[oauth_version=“1.0”]]!
local ngx = StubNgx:new({ Authorization = header })!
local res = get_oauth_params_from_auth_header(ngx)!
assertEquals(“1.0”, res.oauth_version)!
...!](https://image.slidesharecdn.com/roll-your-own-api-mgmt-150520235300-lva1-app6891/85/Roll-Your-Own-API-Management-Platform-with-nginx-and-Lua-19-320.jpg)
![function TestRequest:test_retrieve_oauth_params_from_header()!
local header = [[Oauth realm=“example.com”, ]]!
.. [[oauth_consumer_key=“mykey”,]]!
.. [[oauth_version=“1.0”]]!
local ngx = StubNgx:new({ Authorization = header })!
local res = get_oauth_params_from_auth_header(ngx)!
assertEquals(“1.0”, res.oauth_version)!
...!](https://image.slidesharecdn.com/roll-your-own-api-mgmt-150520235300-lva1-app6891/85/Roll-Your-Own-API-Management-Platform-with-nginx-and-Lua-20-320.jpg)
![function TestRequest:test_retrieve_oauth_params_from_header()!
local header = [[Oauth realm=“example.com”, ]]!
.. [[oauth_consumer_key=“mykey”,]]!
.. [[oauth_version=“1.0”]]!
local ngx = StubNgx:new({ Authorization = header })!
local res = get_oauth_params_from_auth_header(ngx)!
assertEquals(“1.0”, res.oauth_version)!
...!](https://image.slidesharecdn.com/roll-your-own-api-mgmt-150520235300-lva1-app6891/85/Roll-Your-Own-API-Management-Platform-with-nginx-and-Lua-21-320.jpg)
![function TestRequest:test_retrieve_oauth_params_from_header()!
local header = [[Oauth realm=“example.com”, ]]!
.. [[oauth_consumer_key=“mykey”,]]!
.. [[oauth_version=“1.0”]]!
local ngx = StubNgx:new({ Authorization = header })!
local res = get_oauth_params_from_auth_header(ngx)!
assertEquals(“1.0”, res.oauth_version)!
...!](https://image.slidesharecdn.com/roll-your-own-api-mgmt-150520235300-lva1-app6891/85/Roll-Your-Own-API-Management-Platform-with-nginx-and-Lua-22-320.jpg)
![function TestRequest:test_retrieve_oauth_params_from_header()!
local header = [[Oauth realm=“example.com”, ]]!
.. [[oauth_consumer_key=“mykey”,]]!
.. [[oauth_version=“1.0”]]!
local ngx = StubNgx:new({ Authorization = header })!
local res = get_oauth_params_from_auth_header(ngx)!
assertEquals(“1.0”, res.oauth_version)!
...!](https://image.slidesharecdn.com/roll-your-own-api-mgmt-150520235300-lva1-app6891/85/Roll-Your-Own-API-Management-Platform-with-nginx-and-Lua-23-320.jpg)
![def spec_using_valid_oauth_credentials(self, harness)!
auth = OAuth1(“mykey”, “mysecret”)!
body_data = “{‘function’: ‘tick’}”!
harness.reset_data()!
response = requests.post(root_url, data=body_data, auth=auth,!
headers={‘Content-Type’:!
‘application/json’})!
assert response.status_code == 200!
assert “Authorization” in harness.forwarded_headers!
assert “Oauth” in harness.forwarded_headers[“Authorization”]!
assert harness.forwarded_body == body_data!](https://image.slidesharecdn.com/roll-your-own-api-mgmt-150520235300-lva1-app6891/85/Roll-Your-Own-API-Management-Platform-with-nginx-and-Lua-31-320.jpg)
![def spec_using_valid_oauth_credentials(self, harness)!
auth = OAuth1(“mykey”, “mysecret”)!
body_data = “{‘function’: ‘tick’}”!
harness.reset_data()!
response = requests.post(root_url, data=body_data, auth=auth,!
headers={‘Content-Type’:!
‘application/json’})!
assert response.status_code == 200!
assert “Authorization” in harness.forwarded_headers!
assert “Oauth” in harness.forwarded_headers[“Authorization”]!
assert harness.forwarded_body == body_data!](https://image.slidesharecdn.com/roll-your-own-api-mgmt-150520235300-lva1-app6891/85/Roll-Your-Own-API-Management-Platform-with-nginx-and-Lua-32-320.jpg)
![def spec_using_valid_oauth_credentials(self, harness)!
auth = OAuth1(“mykey”, “mysecret”)!
body_data = “{‘function’: ‘tick’}”!
harness.reset_data()!
response = requests.post(root_url, data=body_data, auth=auth,!
headers={‘Content-Type’:!
‘application/json’})!
assert response.status_code == 200!
assert “Authorization” in harness.forwarded_headers!
assert “Oauth” in harness.forwarded_headers[“Authorization”]!
assert harness.forwarded_body == body_data!](https://image.slidesharecdn.com/roll-your-own-api-mgmt-150520235300-lva1-app6891/85/Roll-Your-Own-API-Management-Platform-with-nginx-and-Lua-33-320.jpg)
![def spec_using_valid_oauth_credentials(self, harness)!
auth = OAuth1(“mykey”, “mysecret”)!
body_data = “{‘function’: ‘tick’}”!
harness.reset_data()!
response = requests.post(root_url, data=body_data, auth=auth,!
headers={‘Content-Type’:!
‘application/json’})!
assert response.status_code == 200!
assert “Authorization” in harness.forwarded_headers!
assert “Oauth” in harness.forwarded_headers[“Authorization”]!
assert harness.forwarded_body == body_data!](https://image.slidesharecdn.com/roll-your-own-api-mgmt-150520235300-lva1-app6891/85/Roll-Your-Own-API-Management-Platform-with-nginx-and-Lua-34-320.jpg)
![def spec_using_valid_oauth_credentials(self, harness)!
auth = OAuth1(“mykey”, “mysecret”)!
body_data = “{‘function’: ‘tick’}”!
harness.reset_data()!
response = requests.post(root_url, data=body_data, auth=auth,!
headers={‘Content-Type’:!
‘application/json’})!
assert response.status_code == 200!
assert “Authorization” in harness.forwarded_headers!
assert “Oauth” in harness.forwarded_headers[“Authorization”]!
assert harness.forwarded_body == body_data!](https://image.slidesharecdn.com/roll-your-own-api-mgmt-150520235300-lva1-app6891/85/Roll-Your-Own-API-Management-Platform-with-nginx-and-Lua-35-320.jpg)
![def spec_using_valid_oauth_credentials(self, harness)!
auth = OAuth1(“mykey”, “mysecret”)!
body_data = “{‘function’: ‘tick’}”!
harness.reset_data()!
response = requests.post(root_url, data=body_data, auth=auth,!
headers={‘Content-Type’:!
‘application/json’})!
assert response.status_code == 200!
assert “Authorization” in harness.forwarded_headers!
assert “Oauth” in harness.forwarded_headers[“Authorization”]!
assert harness.forwarded_body == body_data!](https://image.slidesharecdn.com/roll-your-own-api-mgmt-150520235300-lva1-app6891/85/Roll-Your-Own-API-Management-Platform-with-nginx-and-Lua-36-320.jpg)
![def spec_using_valid_oauth_credentials(self, harness)!
auth = OAuth1(“mykey”, “mysecret”)!
body_data = “{‘function’: ‘tick’}”!
harness.reset_data()!
response = requests.post(root_url, data=body_data, auth=auth,!
headers={‘Content-Type’:!
‘application/json’})!
assert response.status_code == 200!
assert “Authorization” in harness.forwarded_headers!
assert “Oauth” in harness.forwarded_headers[“Authorization”]!
assert harness.forwarded_body == body_data!](https://image.slidesharecdn.com/roll-your-own-api-mgmt-150520235300-lva1-app6891/85/Roll-Your-Own-API-Management-Platform-with-nginx-and-Lua-37-320.jpg)
Roll Your Own API Management Platform with nginx and Lua
- 1. Roll Your Own API Management Platform with nginx and Lua Jon Moore Senior Fellow, Comcast Cable @jon_moore
- 6. Lua
- 9. --- Validates the OAuth signature! -- @return Const.HTTP_UNAUTHORIZED if either the key or signature is invalid! -- this method is internal and should not be called directly! function _M.validate_signature(self)! local headers = self.req.get_oauth_params()! local key = headers[Const.OAUTH_CONSUMER_KEY]! local keyconf = self.conf.keys[key]! if keyconf == nil then! return {! code = Const.HTTP_UNAUTHORIZED! error = Const.ERROR_INVALID_CONSUMER_KEY! }! end! ! local sig = get_hmac_signature(self.req, keyconf.secret)! if sig ~= headers[Const.OAUTH_SIGNATURE] then! return {! code = Const.HTTP_UNAUTHORIZED,! error = Const.ERROR_INVALID_SIGNATURE! }! end! end!
- 10. Lua < 3k LOC
- 11. testing
- 12. function TestOAuth1:test_reject_request_when_signature_invalid()! local header = Header:new()! header[Const.OAUTH_SIGNATURE] = “invalid”! local req = Req:new({oauth_params = header })! local conf = Conf:new()! local oauth = OAuth1:new(conf, req)! ! local res = oauth:authorize()! assertEquals(res.code, Const.HTTP_UNAUTHORIZED)! assertEquals(res.error, Const.ERROR_INVALID_SIGNATURE)! end! ! lu = LuaUnit.new()! Lu:setOutputType(“tap”)! os.exit(lu:runSuite())!
- 16. function get_oauth_params_from_auth_header(env)! env = env or ngx! local auth_hdrs = env.req.get_headers()[“Authorization”]! ...!
- 17. function get_oauth_params_from_auth_header(env)! env = env or ngx! local auth_hdrs = env.req.get_headers()[“Authorization”]! ...!
- 18. function get_oauth_params_from_auth_header(env)! env = env or ngx! local auth_hdrs = env.req.get_headers()[“Authorization”]! ...!
- 19. function TestRequest:test_retrieve_oauth_params_from_header()! local header = [[Oauth realm=“example.com”, ]]! .. [[oauth_consumer_key=“mykey”,]]! .. [[oauth_version=“1.0”]]! local ngx = StubNgx:new({ Authorization = header })! local res = get_oauth_params_from_auth_header(ngx)! assertEquals(“1.0”, res.oauth_version)! ...!
- 20. function TestRequest:test_retrieve_oauth_params_from_header()! local header = [[Oauth realm=“example.com”, ]]! .. [[oauth_consumer_key=“mykey”,]]! .. [[oauth_version=“1.0”]]! local ngx = StubNgx:new({ Authorization = header })! local res = get_oauth_params_from_auth_header(ngx)! assertEquals(“1.0”, res.oauth_version)! ...!
- 21. function TestRequest:test_retrieve_oauth_params_from_header()! local header = [[Oauth realm=“example.com”, ]]! .. [[oauth_consumer_key=“mykey”,]]! .. [[oauth_version=“1.0”]]! local ngx = StubNgx:new({ Authorization = header })! local res = get_oauth_params_from_auth_header(ngx)! assertEquals(“1.0”, res.oauth_version)! ...!
- 22. function TestRequest:test_retrieve_oauth_params_from_header()! local header = [[Oauth realm=“example.com”, ]]! .. [[oauth_consumer_key=“mykey”,]]! .. [[oauth_version=“1.0”]]! local ngx = StubNgx:new({ Authorization = header })! local res = get_oauth_params_from_auth_header(ngx)! assertEquals(“1.0”, res.oauth_version)! ...!
- 23. function TestRequest:test_retrieve_oauth_params_from_header()! local header = [[Oauth realm=“example.com”, ]]! .. [[oauth_consumer_key=“mykey”,]]! .. [[oauth_version=“1.0”]]! local ngx = StubNgx:new({ Authorization = header })! local res = get_oauth_params_from_auth_header(ngx)! assertEquals(“1.0”, res.oauth_version)! ...!
- 26. test harness
- 31. def spec_using_valid_oauth_credentials(self, harness)! auth = OAuth1(“mykey”, “mysecret”)! body_data = “{‘function’: ‘tick’}”! harness.reset_data()! response = requests.post(root_url, data=body_data, auth=auth,! headers={‘Content-Type’:! ‘application/json’})! assert response.status_code == 200! assert “Authorization” in harness.forwarded_headers! assert “Oauth” in harness.forwarded_headers[“Authorization”]! assert harness.forwarded_body == body_data!
- 32. def spec_using_valid_oauth_credentials(self, harness)! auth = OAuth1(“mykey”, “mysecret”)! body_data = “{‘function’: ‘tick’}”! harness.reset_data()! response = requests.post(root_url, data=body_data, auth=auth,! headers={‘Content-Type’:! ‘application/json’})! assert response.status_code == 200! assert “Authorization” in harness.forwarded_headers! assert “Oauth” in harness.forwarded_headers[“Authorization”]! assert harness.forwarded_body == body_data!
- 33. def spec_using_valid_oauth_credentials(self, harness)! auth = OAuth1(“mykey”, “mysecret”)! body_data = “{‘function’: ‘tick’}”! harness.reset_data()! response = requests.post(root_url, data=body_data, auth=auth,! headers={‘Content-Type’:! ‘application/json’})! assert response.status_code == 200! assert “Authorization” in harness.forwarded_headers! assert “Oauth” in harness.forwarded_headers[“Authorization”]! assert harness.forwarded_body == body_data!
- 34. def spec_using_valid_oauth_credentials(self, harness)! auth = OAuth1(“mykey”, “mysecret”)! body_data = “{‘function’: ‘tick’}”! harness.reset_data()! response = requests.post(root_url, data=body_data, auth=auth,! headers={‘Content-Type’:! ‘application/json’})! assert response.status_code == 200! assert “Authorization” in harness.forwarded_headers! assert “Oauth” in harness.forwarded_headers[“Authorization”]! assert harness.forwarded_body == body_data!
- 35. def spec_using_valid_oauth_credentials(self, harness)! auth = OAuth1(“mykey”, “mysecret”)! body_data = “{‘function’: ‘tick’}”! harness.reset_data()! response = requests.post(root_url, data=body_data, auth=auth,! headers={‘Content-Type’:! ‘application/json’})! assert response.status_code == 200! assert “Authorization” in harness.forwarded_headers! assert “Oauth” in harness.forwarded_headers[“Authorization”]! assert harness.forwarded_body == body_data!
- 36. def spec_using_valid_oauth_credentials(self, harness)! auth = OAuth1(“mykey”, “mysecret”)! body_data = “{‘function’: ‘tick’}”! harness.reset_data()! response = requests.post(root_url, data=body_data, auth=auth,! headers={‘Content-Type’:! ‘application/json’})! assert response.status_code == 200! assert “Authorization” in harness.forwarded_headers! assert “Oauth” in harness.forwarded_headers[“Authorization”]! assert harness.forwarded_body == body_data!
- 37. def spec_using_valid_oauth_credentials(self, harness)! auth = OAuth1(“mykey”, “mysecret”)! body_data = “{‘function’: ‘tick’}”! harness.reset_data()! response = requests.post(root_url, data=body_data, auth=auth,! headers={‘Content-Type’:! ‘application/json’})! assert response.status_code == 200! assert “Authorization” in harness.forwarded_headers! assert “Oauth” in harness.forwarded_headers[“Authorization”]! assert harness.forwarded_body == body_data!
- 39. N = XR # concurrent requests transaction rate response time
- 41. API Mgmt client origin 1s2 req/s N = XR = 2 req/s × 1s = 2 req
- 42. API Mgmt client origin 1s2 req/s N = XR = 2 req/s × 1s = 2 req
- 43. API Mgmt client origin 1s2 req/s N = XR = 2 req/s × 1s = 2 req
- 44. API Mgmt client origin 1s2 req/s N = XR = 2 req/s × 1s = 2 req
- 45. API Mgmt client origin 1s2 req/s N = XR = 2 req/s × 1s = 2 req
- 47. API Mgmt client origin 10s2 req/s N = XR = 2 req/s × 10s = 20 req
- 48. API Mgmt client origin 10s2 req/s N = XR = 2 req/s × 10s = 20 req
- 49. API Mgmt client origin 10s2 req/s N = XR = 2 req/s × 10s = 20 req
- 50. API Mgmt client origin 10s2 req/s N = XR = 2 req/s × 10s = 20 req
- 51. API Mgmt client origin 10s2 req/s N = XR = 2 req/s × 10s = 20 req
- 52. API Mgmt client origin 10s2 req/s N = XR = 2 req/s × 10s = 20 req
- 53. API Mgmt client origin 10s2 req/s ✗ N = XR = 2 req/s × 10s = 20 req
- 54. API Mgmt client origin 10s2 req/s ✗ ✗ N = XR = 2 req/s × 10s = 20 req
- 56. deployment
- 59. architecture
- 60. HAProxy HAProxy VIP . . . <API>
- 61. DC1 DC2 DC3 VIP VIP VIP entry-vip-dc1. A 10.1.0.1! <foo> <foo> <bar> <bar> foo-dc1. CNAME entry-vip-dc1.! foo. CNAME foo-dc1.! (GSLB) entry-vip-dc2. A 10.2.0.1! entry-vip-dc3. A 10.3.0.1!
- 62. DC1 DC2 DC3 VIP VIP VIP entry-vip-dc1. A 10.1.0.1! <foo> <foo> <bar> <bar> foo-dc1. CNAME entry-vip-dc1.! foo. CNAME foo-dc1.! (GSLB) entry-vip-dc2. A 10.2.0.1! entry-vip-dc3. A 10.3.0.1!
- 63. DC1 DC2 DC3 VIP VIP VIP entry-vip-dc1. A 10.1.0.1! <foo> <foo> <bar> <bar> foo-dc1. CNAME entry-vip-dc1.! foo. CNAME foo-dc1.! (GSLB) entry-vip-dc2. A 10.2.0.1! entry-vip-dc3. A 10.3.0.1!
- 64. DC1 DC2 DC3 VIP VIP VIP entry-vip-dc1. A 10.1.0.1! <foo> <foo> <bar> <bar> foo-dc1. CNAME entry-vip-dc1.! foo. CNAME foo-dc1.! (GSLB) entry-vip-dc2. A 10.2.0.1! entry-vip-dc3. A 10.3.0.1!
- 65. DC1 DC2 DC3 VIP VIP VIP entry-vip-dc1. A 10.1.0.1! <foo> <foo> <bar> <bar> foo-dc1. CNAME entry-vip-dc1.! foo. CNAME foo-dc1.! (GSLB) entry-vip-dc2. A 10.2.0.1! entry-vip-dc3. A 10.3.0.1!
- 66. DC1 DC2 DC3 VIP VIP VIP entry-vip-dc1. A 10.1.0.1! <foo> <foo> <bar> <bar> foo-dc1. CNAME entry-vip-dc1.! foo. CNAME foo-dc1.! (GSLB) entry-vip-dc2. A 10.2.0.1! entry-vip-dc3. A 10.3.0.1!
- 67. Roll Your Own API Management with nginx and Lua • nginx + Lua => great for HTTP middleware with a small amount of custom logic • Automated test and deployment pipeline with Vagrant, Python, and Ansible • Concurrent request limiting, not rate limiting • Network architecture with operational flexibility Presentation title (optional)67