Skip to content

Commit 96f385f

Browse files
xeioexxeioex
committed
Tests: added stream fetch tests for js_access directive.
1 parent 8ca1011 commit 96f385f

File tree

2 files changed

+152
-5
lines changed

2 files changed

+152
-5
lines changed

‎stream_js_fetch.t

Lines changed: 40 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,14 @@ http {
5454
location /validate {
5555
js_content test.validate;
5656
}
57+
58+
location /success {
59+
return 200;
60+
}
61+
62+
location /fail {
63+
return 403;
64+
}
5765
}
5866
}
5967
@@ -73,6 +81,18 @@ stream {
7381
js_filter test.filter_verify;
7482
proxy_pass 127.0.0.1:8091;
7583
}
84+
85+
server {
86+
listen 127.0.0.1:8083;
87+
js_access test.access_ok;
88+
proxy_pass 127.0.0.1:8090;
89+
}
90+
91+
server {
92+
listen 127.0.0.1:8084;
93+
js_access test.access_nok;
94+
proxy_pass 127.0.0.1:8090;
95+
}
7696
}
7797
7898
EOF
@@ -132,10 +152,25 @@ $t->write_file('test.js', <<EOF);
132152
});
133153
}
134154
135-
export default {njs: test_njs, validate, preread_verify, filter_verify};
155+
async function access_ok(s) {
156+
let reply = await ngx.fetch('http://127.0.0.1:$p/success',
157+
{headers: {Host:'aaa'}});
158+
159+
(reply.status == 200) ? s.allow(): s.deny();
160+
}
161+
162+
async function access_nok(s) {
163+
let reply = await ngx.fetch('http://127.0.0.1:$p/fail',
164+
{headers: {Host:'aaa'}});
165+
166+
(reply.status == 200) ? s.allow(): s.deny();
167+
}
168+
169+
export default {njs: test_njs, validate, preread_verify, filter_verify,
170+
access_ok, access_nok};
136171
EOF
137172

138-
$t->try_run('no stream njs available')->plan(7);
173+
$t->try_run('no stream njs available')->plan(9);
139174

140175
$t->run_daemon(\&stream_daemon, port(8090), port(8091));
141176
$t->waitforsocket('127.0.0.1:' . port(8090));
@@ -167,6 +202,9 @@ is(stream('127.0.0.1:' . port(8082))->io("\xAB\xCDQQ##"), '',
167202

168203
}
169204

205+
is(stream('127.0.0.1:' . port(8083))->io('ABC'), 'ABC', 'access fetch ok');
206+
is(stream('127.0.0.1:' . port(8084))->io('ABC'), '', 'access fetch nok');
207+
170208
###############################################################################
171209

172210
sub stream_daemon {

‎stream_js_fetch_https.t

Lines changed: 112 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,11 @@ use Test::Nginx::Stream qw/ stream /;
2323
select STDERR; $| = 1;
2424
select STDOUT; $| = 1;
2525

26+
eval { require IO::Socket::SSL; };
27+
plan(skip_all => 'IO::Socket::SSL not installed') if $@;
28+
eval { IO::Socket::SSL::SSL_VERIFY_NONE(); };
29+
plan(skip_all => 'IO::Socket::SSL too old') if $@;
30+
2631
my $t = Test::Nginx->new()->has(qw/http http_ssl rewrite stream stream_return/)
2732
->write_file_expand('nginx.conf', <<'EOF');
2833
@@ -57,6 +62,18 @@ http {
5762
location /loc {
5863
return 200 "You are at default.example.com.";
5964
}
65+
66+
location /success {
67+
return 200;
68+
}
69+
70+
location /fail {
71+
return 403;
72+
}
73+
74+
location /backend {
75+
return 200 "BACKEND OK";
76+
}
6077
}
6178
6279
server {
@@ -76,19 +93,20 @@ stream {
7693
%%TEST_GLOBALS_STREAM%%
7794
7895
js_import test.js;
79-
js_preread test.preread;
8096
js_var $message;
8197
8298
resolver 127.0.0.1:%%PORT_8981_UDP%%;
8399
resolver_timeout 1s;
84100
85101
server {
86102
listen 127.0.0.1:8082;
103+
js_preread test.preread;
87104
return "default CA $message";
88105
}
89106
90107
server {
91108
listen 127.0.0.1:8083;
109+
js_preread test.preread;
92110
return "my CA $message";
93111
94112
js_fetch_ciphers HIGH:!aNull:!MD5;
@@ -98,11 +116,38 @@ stream {
98116
99117
server {
100118
listen 127.0.0.1:8084;
119+
js_preread test.preread;
101120
return "my CA with verify_depth=0 $message";
102121
103122
js_fetch_verify_depth 0;
104123
js_fetch_trusted_certificate myca.crt;
105124
}
125+
126+
server {
127+
listen 127.0.0.1:8085;
128+
129+
js_access test.access_ok;
130+
ssl_preread on;
131+
132+
js_fetch_ciphers HIGH:!aNull:!MD5;
133+
js_fetch_protocols TLSv1.1 TLSv1.2;
134+
js_fetch_trusted_certificate myca.crt;
135+
136+
proxy_pass 127.0.0.1:8081;
137+
}
138+
139+
server {
140+
listen 127.0.0.1:8086;
141+
142+
js_access test.access_nok;
143+
ssl_preread on;
144+
145+
js_fetch_ciphers HIGH:!aNull:!MD5;
146+
js_fetch_protocols TLSv1.1 TLSv1.2;
147+
js_fetch_trusted_certificate myca.crt;
148+
149+
proxy_pass 127.0.0.1:8081;
150+
}
106151
}
107152
108153
EOF
@@ -137,7 +182,21 @@ $t->write_file('test.js', <<EOF);
137182
});
138183
}
139184
140-
export default {njs: test_njs, preread};
185+
async function access_ok(s) {
186+
let r = await ngx.fetch('https://default.example.com:$p1/success',
187+
{body: s.remoteAddress});
188+
189+
(r.status == 200) ? s.allow(): s.deny();
190+
}
191+
192+
async function access_nok(s) {
193+
let r = await ngx.fetch('https://default.example.com:$p1/fail',
194+
{body: s.remoteAddress});
195+
196+
(r.status == 200) ? s.allow(): s.deny();
197+
}
198+
199+
export default {njs: test_njs, preread, access_ok, access_nok};
141200
EOF
142201

143202
my $d = $t->testdir();
@@ -204,7 +263,7 @@ foreach my $name ('default.example.com', '1.example.com') {
204263
. $t->read_file('intermediate.crt'));
205264
}
206265

207-
$t->try_run('no njs.fetch')->plan(4);
266+
$t->try_run('no njs.fetch')->plan(6);
208267

209268
$t->run_daemon(\&dns_daemon, port(8981), $t);
210269
$t->waitforfile($t->testdir . '/' . port(8981));
@@ -223,6 +282,56 @@ like(stream("127.0.0.1:$p3")->io('GOlocalhost'),
223282
like(stream("127.0.0.1:$p4")->io('GOdefaul.example.com'),
224283
qr/connect failed/s, 'stream verify_depth too small');
225284

285+
like(https_get('default.example.com', port(8085), '/backend'),
286+
qr!BACKEND OK!, 'access https fetch');
287+
is(https_get('default.example.com', port(8086), '/backend'), '<conn failed>',
288+
'access https fetch not');
289+
290+
###############################################################################
291+
292+
sub get_ssl_socket {
293+
my ($host, $port) = @_;
294+
my $s;
295+
296+
eval {
297+
local $SIG{ALRM} = sub { die "timeout\n" };
298+
local $SIG{PIPE} = sub { die "sigpipe\n" };
299+
alarm(8);
300+
$s = IO::Socket::SSL->new(
301+
Proto => 'tcp',
302+
PeerAddr => '127.0.0.1:' . $port,
303+
SSL_verify_mode => IO::Socket::SSL::SSL_VERIFY_NONE(),
304+
SSL_error_trap => sub { die $_[1] }
305+
);
306+
307+
alarm(0);
308+
};
309+
310+
alarm(0);
311+
312+
if ($@) {
313+
log_in("died: $@");
314+
return undef;
315+
}
316+
317+
return $s;
318+
}
319+
320+
sub https_get {
321+
my ($host, $port, $url) = @_;
322+
my $s = get_ssl_socket($host, $port);
323+
324+
if (!$s) {
325+
return '<conn failed>';
326+
}
327+
328+
return http(<<EOF, socket => $s);
329+
GET $url HTTP/1.0
330+
Host: $host
331+
332+
EOF
333+
}
334+
226335
###############################################################################
227336

228337
sub reply_handler {

0 commit comments

Comments
 (0)