Mercurial > hg > nginx-tests
view http_disable_symlinks.t @ 1912:f61d1b4ac638
Tests: unbreak quic_ciphers.t with AEAD_AES_128_CCM enabled.
Although CCM ciphers are disabled in a stock OpenSSL as rarely used,
"to reduce ClientHello bloat", AEAD_AES_128_CCM is apparently turned
back in certain distributions such as RHEL. Previously, this caused
testing connections to fail as the CCM cipher being negotiated isn't
supported yet in nginx. Now the test is skipped instead on failure.
While here, fixed nearby style.
author | Sergey Kandaurov <pluknet@nginx.com> |
---|---|
date | Wed, 14 Jun 2023 16:57:01 +0400 |
parents | 56e7da831f46 |
children |
line wrap: on
line source
#!/usr/bin/perl # (C) Andrey Belov # Tests for disable_symlinks directive. ############################################################################### use warnings; use strict; use Test::More; use POSIX; use Cwd qw/ realpath /; BEGIN { use FindBin; chdir($FindBin::Bin); } use lib 'lib'; use Test::Nginx; ############################################################################### select STDERR; $| = 1; select STDOUT; $| = 1; my $t = Test::Nginx->new()->has(qw/http rewrite symlink/) ->write_file_expand('nginx.conf', <<'EOF'); %%TEST_GLOBALS%% daemon off; events { } http { %%TEST_GLOBALS_HTTP%% server { listen 127.0.0.1:8080; server_name s1; location /on/ { disable_symlinks on; } location /not_owner/ { disable_symlinks if_not_owner; } location /try_on/ { disable_symlinks on; try_files $uri $uri.html =404; } location /try_not_owner/ { disable_symlinks if_not_owner; try_files $uri $uri.txt =404; } location /if_on/ { disable_symlinks on; if (-f $request_filename) { return 204; } } location /if_not_owner/ { disable_symlinks if_not_owner; if (-f $request_filename) { return 204; } } location /complex/1/ { disable_symlinks on; alias %%TESTDIR%%/./cached/../; } location /complex/2/ { disable_symlinks on; alias %%TESTDIR%%//./cached/..//; } location /complex/3/ { disable_symlinks on; alias ///%%TESTDIR%%//./cached/..//; } location ~ (.+/)tail$ { disable_symlinks on; alias %%TESTDIR%%/$1; } location ~ (.+/)tailowner$ { disable_symlinks if_not_owner; alias %%TESTDIR%%/$1; } location ~ (.+/)tailoff$ { disable_symlinks off; alias %%TESTDIR%%/$1; } location /dir { disable_symlinks on; try_files $uri/ =404; } location /from { disable_symlinks on from=$document_root; location /from/wo_slash { alias %%TESTDIR%%/dirlink; } location /from/with_slash/ { alias %%TESTDIR%%/dirlink/; } location ~ ^/from/exact/(.+)$ { alias %%TESTDIR%%/$1; } } } server { listen 127.0.0.1:8080; server_name s2; open_file_cache max=16 inactive=60s; open_file_cache_valid 30s; open_file_cache_min_uses 1; open_file_cache_errors on; location /cached-off/ { disable_symlinks off; alias %%TESTDIR%%/cached/; } location /cached-on/ { disable_symlinks on; alias %%TESTDIR%%/cached/; } location /cached-if-not-owner/ { disable_symlinks if_not_owner; alias %%TESTDIR%%/cached/; } location / { disable_symlinks off; } } } EOF my $uid = getuid(); my ($extfile) = grep { -f && !-l && $uid != (stat())[4] } ('/etc/resolv.conf', '/etc/protocols', '/etc/host.conf'); plan(skip_all => 'no external file found') if !defined $extfile; $t->try_run('no disable_symlinks')->plan(28); my $d = $t->testdir(); mkdir("$d/on"); mkdir("$d/not_owner"); mkdir("$d/try_on"); mkdir("$d/try_not_owner"); mkdir("$d/if_on"); mkdir("$d/if_not_owner"); mkdir("$d/cached"); $t->write_file("empty.html", ""); symlink("empty.html", "$d/link"); symlink($extfile, "$d/link2"); $t->write_file("on/empty.html", ""); symlink("empty.html", "$d/on/link"); symlink($extfile, "$d/on/link2"); $t->write_file("not_owner/empty.html", ""); symlink("empty.html", "$d/not_owner/link"); symlink($extfile, "$d/not_owner/link2"); $t->write_file("try_on/try.html", "LOCAL TRY"); symlink($extfile, "$d/try_on/try"); $t->write_file("try_not_owner/try.html", "LOCAL TRY"); symlink($extfile, "$d/try_not_owner/try"); symlink("try.html", "$d/try_not_owner/try.txt"); $t->write_file("if_on/empty.html", ""); symlink("empty.html", "$d/if_on/link"); symlink($extfile, "$d/if_on/link2"); $t->write_file("if_not_owner/empty.html", ""); symlink("empty.html", "$d/if_not_owner/link"); symlink($extfile, "$d/if_not_owner/link2"); mkdir("$d/dir"); $t->write_file("dir/empty.html", ""); symlink("dir", "$d/dirlink"); symlink($extfile, "$d/cached/link"); ############################################################################### SKIP: { skip 'cannot test under symlink', 25 if $d ne realpath($d) or $^O eq 'netbsd'; like(http_get_host('s1', '/link'), qr!200 OK!, 'static (off, same uid)'); like(http_get_host('s1', '/link2'), qr!200 OK!, 'static (off, other uid)'); like(http_get_host('s1', '/on/link'), qr!403 Forbidden!, 'static (on, same uid)'); like(http_get_host('s1', '/on/link2'), qr!403 Forbidden!, 'static (on, other uid)'); like(http_get_host('s1', '/not_owner/link'), qr!200 OK!, 'static (if_not_owner, same uid)'); like(http_get_host('s1', '/not_owner/link2'), qr!403 Forbidden!, 'static (if_not_owner, other uid)'); like(http_get_host('s1', '/try_on/try'), qr/LOCAL TRY/, 'try_files (on)'); like(http_get_host('s1', '/try_not_owner/try'), qr/LOCAL TRY/, 'try_files (if_not_owner)'); like(http_get_host('s1', '/if_on/link'), qr!403 Forbidden!, 'if (on, same uid)'); like(http_get_host('s1', '/if_on/link2'), qr!403 Forbidden!, 'if (on, other uid)'); like(http_get_host('s1', '/if_not_owner/link'), qr!204 No Content!, 'if (if_not_owner, same uid)'); like(http_get_host('s1', '/if_not_owner/link2'), qr!403 Forbidden!, 'if (if_not_owner, other uid)'); like(http_get_host('s2', '/cached-off/link'), qr!200 OK!, 'open_file_cache (pass 1)'); like(http_get_host('s2', '/cached-on/link'), qr!403 Forbidden!, 'open_file_cache (pass 2)'); like(http_get_host('s2', '/cached-off/link'), qr!200 OK!, 'open_file_cache (pass 3)'); like(http_get_host('s2', '/cached-if-not-owner/link'), qr!403 Forbidden!, 'open_file_cache (pass 4)'); like(http_get_host('s2', '/cached-off/link'), qr!200 OK!, 'open_file_cache (pass 5)'); like(http_get('/complex/1/empty.html'), qr!200 OK!, 'complex root 1'); like(http_get('/complex/2/empty.html'), qr!200 OK!, 'complex root 2'); like(http_get('/complex/3/empty.html'), qr!200 OK!, 'complex root 3'); # workaround for freebsd 8: we use O_EXEC instead of O_SEARCH (since there # is no O_SEARCH), and O_DIRECTORY does nothing. setting the 'x' bit # tests to pass as openat() will correctly fail with ENOTDIR chmod(0700, "$d/link"); my $rc = $^O eq 'darwin' ? 200 : 404; like(http_get('/link/tail'), qr!40[34] !, 'file with trailing /, on'); like(http_get('/link/tailowner'), qr!404 !, 'file with trailing /, owner'); like(http_get('/link/tailoff'), qr!$rc !, 'file with trailing /, off'); like(http_get('/dirlink'), qr!404 !, 'directory without /'); like(http_get('/dirlink/'), qr!404 !, 'directory with trailing /'); } # SKIP: cannot test under symlink like(http_get('/from/wo_slash/empty.html'), qr!200 OK!, '"from=" without /'); like(http_get('/from/with_slash/empty.html'), qr!200 OK!, '"from=" with /'); like(http_get('/from/exact/link'), qr!200 OK!, '"from=" exact match'); ############################################################################### sub http_get_host { my ($host, $url) = @_; return http(<<EOF); GET $url HTTP/1.0 Host: $host EOF } ###############################################################################