Mercurial > hg > nginx-tests
view secure_link.t @ 1858:cdcd75657e52
Tests: added has_feature() tests for IO::Socket::SSL.
The following distinct features supported:
- "socket_ssl", which requires IO::Socket::SSL and also implies
existance of the IO::Socket::SSL::SSL_VERIFY_NONE() symbol.
It is used by most of the tests.
- "socket_ssl_sni", which requires IO::Socket::SSL with the can_client_sni()
function (1.84), and SNI support available in Net::SSLeay and the OpenSSL
library being used. Used by ssl_sni.t, ssl_sni_sessions.t,
stream_ssl_preread.t. Additional Net::SSLeay testing is believed to be
unneeded and was removed.
- "socket_ssl_alpn", which requires IO::Socket::SSL with ALPN support (2.009),
and ALPN support in Net::SSLeay and the OpenSSL library being used.
Used by h2_ssl.t, h2_ssl_verify_client.t, stream_ssl_alpn.t,
stream_ssl_preread_alpn.t.
- "socket_ssl_sslversion", which requires IO::Socket::SSL with
the get_sslversion() and get_sslversion_int() methods (1.964).
Used by mail_imap_ssl.t.
- "socket_ssl_reused", which requires IO::Socket::SSL with
the get_session_reused() method (2.057). To be used in the following
patches.
This makes it possible to simplify and unify various SSL tests.
author | Maxim Dounin <mdounin@mdounin.ru> |
---|---|
date | Thu, 18 May 2023 18:07:02 +0300 |
parents | 97c8280de681 |
children |
line wrap: on
line source
#!/usr/bin/perl # (C) Maxim Dounin # Tests for nginx secure_link module. ############################################################################### use warnings; use strict; use Test::More; use Digest::MD5 qw/ md5 md5_hex /; use MIME::Base64 qw/ encode_base64 /; BEGIN { use FindBin; chdir($FindBin::Bin); } use lib 'lib'; use Test::Nginx; ############################################################################### select STDERR; $| = 1; select STDOUT; $| = 1; my $t = Test::Nginx->new()->has(qw/http secure_link rewrite/)->plan(19); $t->write_file_expand('nginx.conf', <<'EOF'); %%TEST_GLOBALS%% daemon off; events { } http { %%TEST_GLOBALS_HTTP%% server { listen 127.0.0.1:8080; server_name localhost; location / { # new style # /test.html?hash=BASE64URL secure_link $arg_hash; secure_link_md5 secret$uri; # invalid hash if ($secure_link = "") { return 403; } # expired if ($secure_link = "0") { return 403; } # $secure_link = "1" } location = /expires.html { # new style with expires # /test.html?hash=BASE64URL&expires=12345678 add_header X-Expires $secure_link_expires; secure_link $arg_hash,$arg_expires; secure_link_md5 secret$uri$arg_expires; # invalid hash if ($secure_link = "") { return 403; } # expired if ($secure_link = "0") { return 403; } # $secure_link = "1" } location /p/ { # old style # /p/d8e8fca2dc0f896fd7cb4cb0031ba249/test.html secure_link_secret secret; if ($secure_link = "") { return 403; } rewrite ^ /$secure_link break; } location /inheritance/ { secure_link_secret secret; location = /inheritance/test { secure_link Xr4ilOzQ4PCOq3aQ0qbuaQ==; secure_link_md5 secret; if ($secure_link = "1") { rewrite ^ /test.html break; } return 403; } } location /stub { return 200 x$secure_link${secure_link_expires}x; } } } EOF $t->write_file('test.html', 'PASSED'); $t->write_file('expires.html', 'PASSED'); $t->run(); ############################################################################### # new style like(http_get('/test.html?hash=q-5vpkjBkRXXtkUMXiJVHA=='), qr/PASSED/, 'request md5'); like(http_get('/test.html?hash=q-5vpkjBkRXXtkUMXiJVHA'), qr/PASSED/, 'request md5 no padding'); like(http_get('/test.html?hash=q-5vpkjBkRXXtkUMXiJVHAQQ'), qr/^HTTP.*403/, 'request md5 too long'); like(http_get('/test.html?hash=q-5vpkjBkRXXtkUMXiJVHA-TOOLONG'), qr/^HTTP.*403/, 'request md5 too long encoding'); like(http_get('/test.html?hash=BADHASHLENGTH'), qr/^HTTP.*403/, 'request md5 decode error'); like(http_get('/test.html?hash=q-5vpkjBkRXXtkUMXiJVHX=='), qr/^HTTP.*403/, 'request md5 mismatch'); like(http_get('/test.html'), qr/^HTTP.*403/, 'request no hash'); # new style with expires my ($expires, $hash); $expires = time() + 86400; $hash = encode_base64url(md5("secret/expires.html$expires")); like(http_get('/expires.html?hash=' . $hash . '&expires=' . $expires), qr/PASSED/, 'request md5 not expired'); like(http_get('/expires.html?hash=' . $hash . '&expires=' . $expires), qr/X-Expires: $expires/, 'secure_link_expires variable'); $expires = time() - 86400; $hash = encode_base64url(md5("secret/expires.html$expires")); like(http_get('/expires.html?hash=' . $hash . '&expires=' . $expires), qr/^HTTP.*403/, 'request md5 expired'); $expires = 0; $hash = encode_base64url(md5("secret/expires.html$expires")); like(http_get('/expires.html?hash=' . $hash . '&expires=' . $expires), qr/^HTTP.*403/, 'request md5 invalid expiration'); # old style like(http_get('/p/' . md5_hex('test.html' . 'secret') . '/test.html'), qr/PASSED/, 'request old style'); like(http_get('/p/' . md5_hex('fake') . '/test.html'), qr/^HTTP.*403/, 'request old style fake hash'); like(http_get('/p/' . 'foo' . '/test.html'), qr/^HTTP.*403/, 'request old style short hash'); like(http_get('/p/' . 'x' x 32 . '/test.html'), qr/^HTTP.*403/, 'request old style corrupt hash'); like(http_get('/p%2f'), qr/^HTTP.*403/, 'request old style bad uri'); like(http_get('/p/test.html'), qr/^HTTP.*403/, 'request old style no hash'); like(http_get('/inheritance/test'), qr/PASSED/, 'inheritance'); like(http_get('/stub'), qr/xx/, 'secure_link not found'); ############################################################################### sub encode_base64url { my $e = encode_base64(shift, ""); $e =~ s/=+\z//; $e =~ tr[+/][-_]; return $e; } ###############################################################################