Skip to content

Commit 5c314eb

Browse files
defanatordefanator
committed
Tests: added configuration merge tests
See the following for details: owasp-modsecurity#142 owasp-modsecurity/ModSecurity#1978 owasp-modsecurity#143 owasp-modsecurity/ModSecurity#1990
1 parent ecb255a commit 5c314eb

File tree

1 file changed

+235
-0
lines changed

1 file changed

+235
-0
lines changed

Diff for: ‎tests/modsecurity-config-merge.t

+235
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,235 @@
1+
#!/usr/bin/perl
2+
3+
# (C) Andrei Belov
4+
5+
# Tests for ModSecurity-nginx connector (configuration merge).
6+
7+
###############################################################################
8+
9+
use warnings;
10+
use strict;
11+
12+
use Test::More;
13+
use Socket qw/ CRLF /;
14+
15+
BEGIN { use FindBin; chdir($FindBin::Bin); }
16+
17+
use lib 'lib';
18+
use Test::Nginx;
19+
20+
###############################################################################
21+
22+
select STDERR; $| = 1;
23+
select STDOUT; $| = 1;
24+
25+
my $t = Test::Nginx->new()->has(qw/http proxy/);
26+
27+
$t->write_file_expand('nginx.conf', <<'EOF');
28+
29+
%%TEST_GLOBALS%%
30+
31+
daemon off;
32+
33+
events {
34+
}
35+
36+
http {
37+
%%TEST_GLOBALS_HTTP%%
38+
39+
modsecurity on;
40+
modsecurity_rules '
41+
SecRuleEngine On
42+
SecRequestBodyAccess On
43+
SecRequestBodyLimit 128
44+
SecRequestBodyLimitAction Reject
45+
SecRule REQUEST_BODY "@rx BAD BODY" "id:11,phase:request,deny,log,status:403"
46+
';
47+
48+
server {
49+
listen 127.0.0.1:%%PORT_8080%%;
50+
server_name localhost;
51+
52+
location / {
53+
proxy_pass http://127.0.0.1:%%PORT_8081%%;
54+
}
55+
56+
location /modsec-disabled {
57+
modsecurity_rules '
58+
SecRuleEngine Off
59+
';
60+
proxy_pass http://127.0.0.1:%%PORT_8081%%;
61+
}
62+
63+
location /nobodyaccess {
64+
modsecurity_rules '
65+
SecRequestBodyAccess Off
66+
';
67+
proxy_pass http://127.0.0.1:%%PORT_8081%%;
68+
}
69+
70+
location /bodylimitprocesspartial {
71+
modsecurity_rules '
72+
SecRequestBodyLimitAction ProcessPartial
73+
';
74+
proxy_pass http://127.0.0.1:%%PORT_8081%%;
75+
}
76+
77+
location /bodylimitincreased {
78+
modsecurity_rules '
79+
SecRequestBodyLimit 512
80+
';
81+
proxy_pass http://127.0.0.1:%%PORT_8081%%;
82+
}
83+
84+
location /server {
85+
modsecurity off;
86+
87+
location /server/modsec-disabled {
88+
proxy_pass http://127.0.0.1:%%PORT_8082%%;
89+
}
90+
91+
location /server/nobodyaccess {
92+
proxy_pass http://127.0.0.1:%%PORT_8083%%;
93+
}
94+
95+
location /server/bodylimitprocesspartial {
96+
proxy_pass http://127.0.0.1:%%PORT_8084%%;
97+
}
98+
99+
location /server/bodylimitincreased {
100+
proxy_pass http://127.0.0.1:%%PORT_8085%%;
101+
}
102+
}
103+
}
104+
105+
server {
106+
listen 127.0.0.1:%%PORT_8082%%;
107+
108+
modsecurity_rules '
109+
SecRuleEngine Off
110+
';
111+
112+
location / {
113+
proxy_pass http://127.0.0.1:%%PORT_8081%%;
114+
}
115+
}
116+
117+
server {
118+
listen 127.0.0.1:%%PORT_8083%%;
119+
120+
modsecurity_rules '
121+
SecRequestBodyAccess Off
122+
';
123+
124+
location / {
125+
proxy_pass http://127.0.0.1:%%PORT_8081%%;
126+
}
127+
}
128+
129+
server {
130+
listen 127.0.0.1:%%PORT_8084%%;
131+
132+
modsecurity_rules '
133+
SecRequestBodyLimitAction ProcessPartial
134+
';
135+
136+
location / {
137+
proxy_pass http://127.0.0.1:%%PORT_8081%%;
138+
}
139+
}
140+
141+
server {
142+
listen 127.0.0.1:%%PORT_8085%%;
143+
144+
modsecurity_rules '
145+
SecRequestBodyLimit 512
146+
';
147+
148+
location / {
149+
proxy_pass http://127.0.0.1:%%PORT_8081%%;
150+
}
151+
}
152+
}
153+
EOF
154+
155+
$t->run_daemon(\&http_daemon);
156+
$t->run()->waitforsocket('127.0.0.1:' . port(8081));
157+
158+
$t->plan(10);
159+
160+
###############################################################################
161+
162+
like(http_get_body('/', 'GOOD BODY'), qr/TEST-OK-IF-YOU-SEE-THIS/, "http level defaults, pass");
163+
like(http_get_body('/', 'VERY BAD BODY'), qr/403 Forbidden/, "http level defaults, block");
164+
165+
TODO: {
166+
local $TODO = 'not yet, see https://github.com/SpiderLabs/ModSecurity/pull/1990';
167+
168+
like(http_get_body('/modsec-disabled', 'VERY BAD BODY'), qr/TEST-OK-IF-YOU-SEE-THIS/, "location override for SecRuleEngine, pass");
169+
like(http_get_body('/nobodyaccess', 'VERY BAD BODY'), qr/TEST-OK-IF-YOU-SEE-THIS/, "location override for SecRequestBodyAccess, pass");
170+
like(http_get_body('/bodylimitprocesspartial', 'BODY' x 33), qr/TEST-OK-IF-YOU-SEE-THIS/, "location override for SecRequestBodyLimitAction, pass");
171+
like(http_get_body('/bodylimitincreased', 'BODY' x 64), qr/TEST-OK-IF-YOU-SEE-THIS/, "location override for SecRequestBodyLimit, pass");
172+
173+
like(http_get_body('/server/modsec-disabled', 'VERY BAD BODY'), qr/TEST-OK-IF-YOU-SEE-THIS/, "server override for SecRuleEngine, pass");
174+
like(http_get_body('/server/nobodyaccess', 'VERY BAD BODY'), qr/TEST-OK-IF-YOU-SEE-THIS/, "server override for SecRequestBodyAccess, pass");
175+
like(http_get_body('/server/bodylimitprocesspartial', 'BODY' x 33), qr/TEST-OK-IF-YOU-SEE-THIS/, "server override for SecRequestBodyLimitAction, pass");
176+
like(http_get_body('/server/bodylimitincreased', 'BODY' x 64), qr/TEST-OK-IF-YOU-SEE-THIS/, "server override for SecRequestBodyLimit, pass");
177+
}
178+
179+
###############################################################################
180+
181+
sub http_daemon {
182+
my $server = IO::Socket::INET->new(
183+
Proto => 'tcp',
184+
LocalHost => '127.0.0.1:' . port(8081),
185+
Listen => 5,
186+
Reuse => 1
187+
)
188+
or die "Can't create listening socket: $!\n";
189+
190+
local $SIG{PIPE} = 'IGNORE';
191+
192+
while (my $client = $server->accept()) {
193+
$client->autoflush(1);
194+
195+
my $headers = '';
196+
my $uri = '';
197+
198+
while (<$client>) {
199+
$headers .= $_;
200+
last if (/^\x0d?\x0a?$/);
201+
}
202+
203+
$uri = $1 if $headers =~ /^\S+\s+([^ ]+)\s+HTTP/i;
204+
205+
print $client <<'EOF';
206+
HTTP/1.1 200 OK
207+
Connection: close
208+
209+
EOF
210+
print $client "TEST-OK-IF-YOU-SEE-THIS"
211+
unless $headers =~ /^HEAD/i;
212+
213+
close $client;
214+
}
215+
}
216+
217+
sub http_get_body {
218+
my $uri = shift;
219+
my $last = pop;
220+
return http( join '', (map {
221+
my $body = $_;
222+
"GET $uri HTTP/1.1" . CRLF
223+
. "Host: localhost" . CRLF
224+
. "Content-Length: " . (length $body) . CRLF . CRLF
225+
. $body
226+
} @_),
227+
"GET $uri HTTP/1.1" . CRLF
228+
. "Host: localhost" . CRLF
229+
. "Connection: close" . CRLF
230+
. "Content-Length: " . (length $last) . CRLF . CRLF
231+
. $last
232+
);
233+
}
234+
235+
###############################################################################

0 commit comments

Comments
 (0)