[TT-1944/TT-12550/TT-12865] [5.0.14 backport] Backport critical fixes (…

…#6515)

https://tyktech.atlassian.net/browse/TT-12865 and related 5.0.14
backports

---------

Co-authored-by: Tit Petric <[email protected]>

.github/workflows/ci-tests.yml

@@ -39,6 +39,13 @@ jobs:
         with:
             python-version: ${{ matrix.python-version }}
 
+      - name: Setup CI Tooling
+        uses: shrink/actions-docker-extract@v3
+        with:
+          image: tykio/ci-tools:latest
+          path: /usr/local/bin/task
+          destination: /usr/local/bin
+
       - name: Install Dependencies and basic hygiene test
         id: hygiene
         run: |
@@ -66,11 +73,9 @@ jobs:
       - name: Fetch base branch
         if: ${{ github.event_name == 'pull_request' }}
         run: git fetch origin ${{ github.base_ref }}
-      - name: Start Redis
-        uses: supercharge/[email protected]
-        with:
-          redis-version: ${{ matrix.redis-version }}
 
+      - name: Start test services
+        run: task services:up
 
       - name: Cache
         uses: actions/cache@v2
@@ -88,6 +93,9 @@ jobs:
           echo "log=$(sed -ze 's/%/%25/g;s/\n/%0A/g' test.log)" >> $GITHUB_OUTPUT
           exit $result_code
 
+      - name: Stop test services
+        run: task services:down
+
       - name: Notify status
         if: ${{ failure() && github.event.pull_request.number }}
         uses: peter-evans/create-or-update-comment@v1

Taskfile.yml

@@ -2,6 +2,9 @@
 version: "3"
 
 includes:
+  services:
+    taskfile: docker/services/Taskfile.yml
+    dir: docker/services/
   deps: ./.taskfiles/deps/Taskfile.yml
   tracetest: ./.taskfiles/tracetest/Taskfile.yml
 

bin/ci-tests.sh

@@ -7,7 +7,7 @@ PKGS="$(go list ./...)"
 # Support passing custom flags (-json, etc.)
 OPTS="$@"
 if [[ -z "$OPTS" ]]; then
-	OPTS="-race -count=1 -failfast -v"
+	OPTS="-p 1 -parallel 1 -race -count=1 -v"
 fi
 
 export PKG_PATH=${GOPATH}/src/github.com/TykTechnologies/tyk

cli/linter/schema.json

@@ -563,6 +563,12 @@
         "enable_strict_routes": {
           "type": "boolean"
         },
+        "enable_path_prefix_matching": {
+          "type": "boolean"
+        },
+        "enable_path_suffix_matching": {
+          "type": "boolean"
+        },
         "flush_interval": {
           "type": "integer"
         },

config/config.go

@@ -373,6 +373,49 @@ type HttpServerOptionsConfig struct {
 	// Regular expressions and parameterized routes will be left alone regardless of this setting.
 	EnableStrictRoutes bool `json:"enable_strict_routes"`
 
+	// EnablePathPrefixMatching changes the URL matching from wildcard mode to prefix mode.
+	// For example, `/json` matches `*/json*` by current default behaviour.
+	// If prefix matching is enabled, the match will be performed as a prefix match (`/json*`).
+	//
+	// The `/json` url would be matched as `^/json` against the following paths:
+	//
+	// - Full listen path and versioning URL (`/listen-path/v4/json`)
+	// - Stripped listen path URL (`/v4/json`)
+	// - Stripped version information (`/json`) - match.
+	//
+	// If versioning is disabled then the following URLs are considered:
+	//
+	// - Full listen path and endpoint (`/listen-path/json`)
+	// - Stripped listen path (`/json`) - match.
+	//
+	// For inputs that start with `/`, a prefix match is ensured by
+	// prepending the start of string `^` caret.
+	//
+	// For all other cases, the pattern remains unmodified.
+	//
+	// Combine this option with `enable_path_suffix_matching` to achieve
+	// exact url matching with `/json` being evaluated as `^/json$`.
+	EnablePathPrefixMatching bool `json:"enable_path_prefix_matching"`
+
+	// EnablePathSuffixMatching changes the URL matching to match as a suffix.
+	// For example: `/json` is matched as `/json$` against the following paths:
+	//
+	// - Full listen path and versioning URL (`/listen-path/v4/json`)
+	// - Stripped listen path URL (`/v4/json`)
+	// - Stripped version information (`/json`) - match.
+	//
+	// If versioning is disabled then the following URLs are considered:
+	//
+	// - Full listen path and endpoint (`/listen-path/json`)
+	// - Stripped listen path (`/json`) - match.
+	//
+	// If the input pattern already ends with a `$` (`/json$`)
+	// then the pattern remains unmodified.
+	//
+	// Combine this option with `enable_path_prefix_matching` to achieve
+	// exact url matching with `/json` being evaluated as `^/json$`.
+	EnablePathSuffixMatching bool `json:"enable_path_suffix_matching"`
+
 	// Disable TLS verification. Required if you are using self-signed certificates.
 	SSLInsecureSkipVerify bool `json:"ssl_insecure_skip_verify"`
 

docker-compose.yml

@@ -1,3 +1,9 @@
+name: tyk-dev
+
+include:
+  - docker/services/redis.yml
+  - docker/services/httpbin.yml
+
 services:
   tyk:
     image: internal/tyk-gateway
@@ -8,13 +14,6 @@ services:
     volumes:
     - ./tyk.conf.example:/opt/tyk-gateway/tyk.conf
 
-  redis:
-    image: redis:4.0-alpine
-    networks: [ proxy ]
-    ports:
-    - 6379:6379
-    command: redis-server --appendonly yes
-
 networks:
   proxy:
     name: proxy

docker/services/Taskfile.yml

@@ -5,7 +5,7 @@ tasks:
   up:
     desc: "Bring up services"
     cmds:
-      - docker compose up -d --remove-orphans
+      - docker compose up -d --remove-orphans --wait
 
   down:
     desc: "Tear down services"

docker/services/docker-compose.yml

@@ -8,6 +8,7 @@
 
 include:
   - ./redis.yml
+  - ./httpbin.yml
 
 networks:
   proxy:

docker/services/httpbin.yml

@@ -0,0 +1,17 @@
+---
+services:
+  httpbin:
+    image: tykio/ci-tools:latest
+    networks:
+      - proxy
+    ports:
+      - 3123:3123
+    volumes:
+      - ./logs:/logs:rw
+    entrypoint:
+      - /usr/local/bin/httpbin-logserver
+    command:
+      - '-addr'
+      - ':3123'
+      - '-output'
+      - '/logs/service.json'

docker/services/redis.yml

@@ -1,7 +1,7 @@
 ---
 services:
   redis:
-    image: redis:6-alpine
+    image: ${REDIS_IMAGE:-redis:6-alpine}
     networks:
       - proxy
     ports: