nixosTests.nginx{proxyprotocol,pubhtml,redirectcode,sso,status-page,tmpdir}: migrate to runTest (#394588)
This commit is contained in:
Gaétan Lepage
@@ -807,12 +807,12 @@ in {
|
||||
nginx-modsecurity = runTest ./nginx-modsecurity.nix;
|
||||
nginx-moreheaders = runTest ./nginx-moreheaders.nix;
|
||||
nginx-njs = handleTest ./nginx-njs.nix {};
|
||||
nginx-proxyprotocol = handleTest ./nginx-proxyprotocol {};
|
||||
nginx-pubhtml = handleTest ./nginx-pubhtml.nix {};
|
||||
nginx-redirectcode = handleTest ./nginx-redirectcode.nix {};
|
||||
nginx-sso = handleTest ./nginx-sso.nix {};
|
||||
nginx-status-page = handleTest ./nginx-status-page.nix {};
|
||||
nginx-tmpdir = handleTest ./nginx-tmpdir.nix {};
|
||||
nginx-proxyprotocol = runTest ./nginx-proxyprotocol/default.nix;
|
||||
nginx-pubhtml = runTest ./nginx-pubhtml.nix;
|
||||
nginx-redirectcode = runTest ./nginx-redirectcode.nix;
|
||||
nginx-sso = runTest ./nginx-sso.nix;
|
||||
nginx-status-page = runTest ./nginx-status-page.nix;
|
||||
nginx-tmpdir = runTest ./nginx-tmpdir.nix;
|
||||
nginx-unix-socket = handleTest ./nginx-unix-socket.nix {};
|
||||
nginx-variants = handleTest ./nginx-variants.nix {};
|
||||
nifi = runTestOn ["x86_64-linux"] ./web-apps/nifi.nix;
|
||||
|
||||
@@ -1,164 +1,162 @@
|
||||
let
|
||||
certs = import ./snakeoil-certs.nix;
|
||||
in
|
||||
import ../make-test-python.nix (
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
name = "nginx-proxyprotocol";
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
name = "nginx-proxyprotocol";
|
||||
|
||||
meta = {
|
||||
maintainers = with pkgs.lib.maintainers; [ raitobezarius ];
|
||||
};
|
||||
meta = {
|
||||
maintainers = with pkgs.lib.maintainers; [ raitobezarius ];
|
||||
};
|
||||
|
||||
nodes = {
|
||||
webserver =
|
||||
{ pkgs, lib, ... }:
|
||||
{
|
||||
environment.systemPackages = [ pkgs.netcat ];
|
||||
security.pki.certificateFiles = [
|
||||
certs.ca.cert
|
||||
nodes = {
|
||||
webserver =
|
||||
{ pkgs, lib, ... }:
|
||||
{
|
||||
environment.systemPackages = [ pkgs.netcat ];
|
||||
security.pki.certificateFiles = [
|
||||
certs.ca.cert
|
||||
];
|
||||
|
||||
networking.extraHosts = ''
|
||||
127.0.0.5 proxy.test.nix
|
||||
127.0.0.5 noproxy.test.nix
|
||||
127.0.0.3 direct-nossl.test.nix
|
||||
127.0.0.4 unsecure-nossl.test.nix
|
||||
127.0.0.2 direct-noproxy.test.nix
|
||||
127.0.0.1 direct-proxy.test.nix
|
||||
'';
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
defaultListen = [
|
||||
{
|
||||
addr = "127.0.0.1";
|
||||
proxyProtocol = true;
|
||||
ssl = true;
|
||||
}
|
||||
{ addr = "127.0.0.2"; }
|
||||
{
|
||||
addr = "127.0.0.3";
|
||||
ssl = false;
|
||||
}
|
||||
{
|
||||
addr = "127.0.0.4";
|
||||
ssl = false;
|
||||
proxyProtocol = true;
|
||||
}
|
||||
];
|
||||
|
||||
networking.extraHosts = ''
|
||||
127.0.0.5 proxy.test.nix
|
||||
127.0.0.5 noproxy.test.nix
|
||||
127.0.0.3 direct-nossl.test.nix
|
||||
127.0.0.4 unsecure-nossl.test.nix
|
||||
127.0.0.2 direct-noproxy.test.nix
|
||||
127.0.0.1 direct-proxy.test.nix
|
||||
commonHttpConfig = ''
|
||||
log_format pcombined '(proxy_protocol=$proxy_protocol_addr) - (remote_addr=$remote_addr) - (realip=$realip_remote_addr) - (upstream=) - (remote_user=$remote_user) [$time_local] '
|
||||
'"$request" $status $body_bytes_sent '
|
||||
'"$http_referer" "$http_user_agent"';
|
||||
access_log /var/log/nginx/access.log pcombined;
|
||||
error_log /var/log/nginx/error.log;
|
||||
'';
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
defaultListen = [
|
||||
{
|
||||
addr = "127.0.0.1";
|
||||
proxyProtocol = true;
|
||||
ssl = true;
|
||||
}
|
||||
{ addr = "127.0.0.2"; }
|
||||
{
|
||||
addr = "127.0.0.3";
|
||||
ssl = false;
|
||||
}
|
||||
{
|
||||
addr = "127.0.0.4";
|
||||
ssl = false;
|
||||
proxyProtocol = true;
|
||||
}
|
||||
];
|
||||
commonHttpConfig = ''
|
||||
log_format pcombined '(proxy_protocol=$proxy_protocol_addr) - (remote_addr=$remote_addr) - (realip=$realip_remote_addr) - (upstream=) - (remote_user=$remote_user) [$time_local] '
|
||||
'"$request" $status $body_bytes_sent '
|
||||
'"$http_referer" "$http_user_agent"';
|
||||
access_log /var/log/nginx/access.log pcombined;
|
||||
error_log /var/log/nginx/error.log;
|
||||
'';
|
||||
virtualHosts =
|
||||
let
|
||||
commonConfig = {
|
||||
locations."/".return = "200 '$remote_addr'";
|
||||
extraConfig = ''
|
||||
set_real_ip_from 127.0.0.5/32;
|
||||
real_ip_header proxy_protocol;
|
||||
'';
|
||||
};
|
||||
in
|
||||
{
|
||||
"*.test.nix" = commonConfig // {
|
||||
sslCertificate = certs."*.test.nix".cert;
|
||||
sslCertificateKey = certs."*.test.nix".key;
|
||||
forceSSL = true;
|
||||
};
|
||||
"direct-nossl.test.nix" = commonConfig;
|
||||
"unsecure-nossl.test.nix" = commonConfig // {
|
||||
extraConfig = ''
|
||||
real_ip_header proxy_protocol;
|
||||
'';
|
||||
};
|
||||
virtualHosts =
|
||||
let
|
||||
commonConfig = {
|
||||
locations."/".return = "200 '$remote_addr'";
|
||||
extraConfig = ''
|
||||
set_real_ip_from 127.0.0.5/32;
|
||||
real_ip_header proxy_protocol;
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
services.sniproxy = {
|
||||
enable = true;
|
||||
config = ''
|
||||
error_log {
|
||||
syslog daemon
|
||||
}
|
||||
access_log {
|
||||
syslog daemon
|
||||
}
|
||||
listener 127.0.0.5:443 {
|
||||
protocol tls
|
||||
source 127.0.0.5
|
||||
}
|
||||
table {
|
||||
^proxy\.test\.nix$ 127.0.0.1 proxy_protocol
|
||||
^noproxy\.test\.nix$ 127.0.0.2
|
||||
}
|
||||
'';
|
||||
};
|
||||
in
|
||||
{
|
||||
"*.test.nix" = commonConfig // {
|
||||
sslCertificate = certs."*.test.nix".cert;
|
||||
sslCertificateKey = certs."*.test.nix".key;
|
||||
forceSSL = true;
|
||||
};
|
||||
"direct-nossl.test.nix" = commonConfig;
|
||||
"unsecure-nossl.test.nix" = commonConfig // {
|
||||
extraConfig = ''
|
||||
real_ip_header proxy_protocol;
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
testScript = ''
|
||||
def check_origin_ip(src_ip: str, dst_url: str, failure: bool = False, proxy_protocol: bool = False, expected_ip: str | None = None):
|
||||
check = webserver.fail if failure else webserver.succeed
|
||||
if expected_ip is None:
|
||||
expected_ip = src_ip
|
||||
services.sniproxy = {
|
||||
enable = true;
|
||||
config = ''
|
||||
error_log {
|
||||
syslog daemon
|
||||
}
|
||||
access_log {
|
||||
syslog daemon
|
||||
}
|
||||
listener 127.0.0.5:443 {
|
||||
protocol tls
|
||||
source 127.0.0.5
|
||||
}
|
||||
table {
|
||||
^proxy\.test\.nix$ 127.0.0.1 proxy_protocol
|
||||
^noproxy\.test\.nix$ 127.0.0.2
|
||||
}
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
return check(f"curl {'--haproxy-protocol' if proxy_protocol else '''} --interface {src_ip} --fail -L {dst_url} | grep '{expected_ip}'")
|
||||
testScript = ''
|
||||
def check_origin_ip(src_ip: str, dst_url: str, failure: bool = False, proxy_protocol: bool = False, expected_ip: str | None = None):
|
||||
check = webserver.fail if failure else webserver.succeed
|
||||
if expected_ip is None:
|
||||
expected_ip = src_ip
|
||||
|
||||
webserver.wait_for_unit("nginx")
|
||||
webserver.wait_for_unit("sniproxy")
|
||||
# This should be closed by virtue of ssl = true;
|
||||
webserver.wait_for_closed_port(80, "127.0.0.1")
|
||||
# This should be open by virtue of no explicit ssl
|
||||
webserver.wait_for_open_port(80, "127.0.0.2")
|
||||
# This should be open by virtue of ssl = true;
|
||||
webserver.wait_for_open_port(443, "127.0.0.1")
|
||||
# This should be open by virtue of no explicit ssl
|
||||
webserver.wait_for_open_port(443, "127.0.0.2")
|
||||
# This should be open by sniproxy
|
||||
webserver.wait_for_open_port(443, "127.0.0.5")
|
||||
# This should be closed by sniproxy
|
||||
webserver.wait_for_closed_port(80, "127.0.0.5")
|
||||
return check(f"curl {'--haproxy-protocol' if proxy_protocol else '''} --interface {src_ip} --fail -L {dst_url} | grep '{expected_ip}'")
|
||||
|
||||
# Sanity checks for the NGINX module
|
||||
# direct-HTTP connection to NGINX without TLS, this checks that ssl = false; works well.
|
||||
check_origin_ip("127.0.0.10", "http://direct-nossl.test.nix/")
|
||||
# webserver.execute("openssl s_client -showcerts -connect direct-noproxy.test.nix:443")
|
||||
# direct-HTTP connection to NGINX with TLS
|
||||
check_origin_ip("127.0.0.10", "http://direct-noproxy.test.nix/")
|
||||
check_origin_ip("127.0.0.10", "https://direct-noproxy.test.nix/")
|
||||
# Well, sniproxy is not listening on 80 and cannot redirect
|
||||
check_origin_ip("127.0.0.10", "http://proxy.test.nix/", failure=True)
|
||||
check_origin_ip("127.0.0.10", "http://noproxy.test.nix/", failure=True)
|
||||
webserver.wait_for_unit("nginx")
|
||||
webserver.wait_for_unit("sniproxy")
|
||||
# This should be closed by virtue of ssl = true;
|
||||
webserver.wait_for_closed_port(80, "127.0.0.1")
|
||||
# This should be open by virtue of no explicit ssl
|
||||
webserver.wait_for_open_port(80, "127.0.0.2")
|
||||
# This should be open by virtue of ssl = true;
|
||||
webserver.wait_for_open_port(443, "127.0.0.1")
|
||||
# This should be open by virtue of no explicit ssl
|
||||
webserver.wait_for_open_port(443, "127.0.0.2")
|
||||
# This should be open by sniproxy
|
||||
webserver.wait_for_open_port(443, "127.0.0.5")
|
||||
# This should be closed by sniproxy
|
||||
webserver.wait_for_closed_port(80, "127.0.0.5")
|
||||
|
||||
# Actual PROXY protocol related tests
|
||||
# Connecting through sniproxy should passthrough the originating IP address.
|
||||
check_origin_ip("127.0.0.10", "https://proxy.test.nix/")
|
||||
# Connecting through sniproxy to a non-PROXY protocol enabled listener should not pass the originating IP address.
|
||||
check_origin_ip("127.0.0.10", "https://noproxy.test.nix/", expected_ip="127.0.0.5")
|
||||
# Sanity checks for the NGINX module
|
||||
# direct-HTTP connection to NGINX without TLS, this checks that ssl = false; works well.
|
||||
check_origin_ip("127.0.0.10", "http://direct-nossl.test.nix/")
|
||||
# webserver.execute("openssl s_client -showcerts -connect direct-noproxy.test.nix:443")
|
||||
# direct-HTTP connection to NGINX with TLS
|
||||
check_origin_ip("127.0.0.10", "http://direct-noproxy.test.nix/")
|
||||
check_origin_ip("127.0.0.10", "https://direct-noproxy.test.nix/")
|
||||
# Well, sniproxy is not listening on 80 and cannot redirect
|
||||
check_origin_ip("127.0.0.10", "http://proxy.test.nix/", failure=True)
|
||||
check_origin_ip("127.0.0.10", "http://noproxy.test.nix/", failure=True)
|
||||
|
||||
# Attack tests against spoofing
|
||||
# Let's try to spoof our IP address by connecting direct-y to the PROXY protocol listener.
|
||||
# FIXME(RaitoBezarius): rewrite it using Python + (Scapy|something else) as this is too much broken unfortunately.
|
||||
# Or wait for upstream curl patch.
|
||||
# def generate_attacker_request(original_ip: str, target_ip: str, dst_url: str):
|
||||
# return f"""PROXY TCP4 {original_ip} {target_ip} 80 80
|
||||
# GET / HTTP/1.1
|
||||
# Host: {dst_url}
|
||||
# Actual PROXY protocol related tests
|
||||
# Connecting through sniproxy should passthrough the originating IP address.
|
||||
check_origin_ip("127.0.0.10", "https://proxy.test.nix/")
|
||||
# Connecting through sniproxy to a non-PROXY protocol enabled listener should not pass the originating IP address.
|
||||
check_origin_ip("127.0.0.10", "https://noproxy.test.nix/", expected_ip="127.0.0.5")
|
||||
|
||||
# """
|
||||
# def spoof(original_ip: str, target_ip: str, dst_url: str, tls: bool = False, expect_failure: bool = True):
|
||||
# method = webserver.fail if expect_failure else webserver.succeed
|
||||
# port = 443 if tls else 80
|
||||
# print(webserver.execute(f"cat <<EOF | nc {target_ip} {port}\n{generate_attacker_request(original_ip, target_ip, dst_url)}\nEOF"))
|
||||
# return method(f"cat <<EOF | nc {target_ip} {port} | grep {original_ip}\n{generate_attacker_request(original_ip, target_ip, dst_url)}\nEOF")
|
||||
# Attack tests against spoofing
|
||||
# Let's try to spoof our IP address by connecting direct-y to the PROXY protocol listener.
|
||||
# FIXME(RaitoBezarius): rewrite it using Python + (Scapy|something else) as this is too much broken unfortunately.
|
||||
# Or wait for upstream curl patch.
|
||||
# def generate_attacker_request(original_ip: str, target_ip: str, dst_url: str):
|
||||
# return f"""PROXY TCP4 {original_ip} {target_ip} 80 80
|
||||
# GET / HTTP/1.1
|
||||
# Host: {dst_url}
|
||||
|
||||
# check_origin_ip("127.0.0.10", "http://unsecure-nossl.test.nix", proxy_protocol=True)
|
||||
# spoof("1.1.1.1", "127.0.0.4", "direct-nossl.test.nix")
|
||||
# spoof("1.1.1.1", "127.0.0.4", "unsecure-nossl.test.nix", expect_failure=False)
|
||||
'';
|
||||
}
|
||||
)
|
||||
# """
|
||||
# def spoof(original_ip: str, target_ip: str, dst_url: str, tls: bool = False, expect_failure: bool = True):
|
||||
# method = webserver.fail if expect_failure else webserver.succeed
|
||||
# port = 443 if tls else 80
|
||||
# print(webserver.execute(f"cat <<EOF | nc {target_ip} {port}\n{generate_attacker_request(original_ip, target_ip, dst_url)}\nEOF"))
|
||||
# return method(f"cat <<EOF | nc {target_ip} {port} | grep {original_ip}\n{generate_attacker_request(original_ip, target_ip, dst_url)}\nEOF")
|
||||
|
||||
# check_origin_ip("127.0.0.10", "http://unsecure-nossl.test.nix", proxy_protocol=True)
|
||||
# spoof("1.1.1.1", "127.0.0.4", "direct-nossl.test.nix")
|
||||
# spoof("1.1.1.1", "127.0.0.4", "unsecure-nossl.test.nix", expect_failure=False)
|
||||
'';
|
||||
}
|
||||
|
||||
@@ -1,4 +1,5 @@
|
||||
import ./make-test-python.nix {
|
||||
{ ... }:
|
||||
{
|
||||
name = "nginx-pubhtml";
|
||||
|
||||
nodes.machine =
|
||||
|
||||
@@ -1,30 +1,28 @@
|
||||
import ./make-test-python.nix (
|
||||
{ pkgs, lib, ... }:
|
||||
{
|
||||
name = "nginx-redirectcode";
|
||||
meta.maintainers = with lib.maintainers; [ misterio77 ];
|
||||
{ lib, ... }:
|
||||
{
|
||||
name = "nginx-redirectcode";
|
||||
meta.maintainers = with lib.maintainers; [ misterio77 ];
|
||||
|
||||
nodes = {
|
||||
webserver =
|
||||
{ pkgs, lib, ... }:
|
||||
{
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
virtualHosts.localhost = {
|
||||
globalRedirect = "example.com/foo";
|
||||
# With 308 (and 307), the method and body are to be kept when following it
|
||||
redirectCode = 308;
|
||||
};
|
||||
nodes = {
|
||||
webserver =
|
||||
{ pkgs, lib, ... }:
|
||||
{
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
virtualHosts.localhost = {
|
||||
globalRedirect = "example.com/foo";
|
||||
# With 308 (and 307), the method and body are to be kept when following it
|
||||
redirectCode = 308;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
testScript = ''
|
||||
webserver.wait_for_unit("nginx")
|
||||
webserver.wait_for_open_port(80)
|
||||
testScript = ''
|
||||
webserver.wait_for_unit("nginx")
|
||||
webserver.wait_for_open_port(80)
|
||||
|
||||
# Check the status code
|
||||
webserver.succeed("curl -si http://localhost | grep '^HTTP/[0-9.]\+ 308 Permanent Redirect'")
|
||||
'';
|
||||
}
|
||||
)
|
||||
# Check the status code
|
||||
webserver.succeed("curl -si http://localhost | grep '^HTTP/[0-9.]\+ 308 Permanent Redirect'")
|
||||
'';
|
||||
}
|
||||
|
||||
@@ -1,4 +1,5 @@
|
||||
import ./make-test-python.nix ({ pkgs, ... }: {
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
name = "nginx-sso";
|
||||
meta = {
|
||||
maintainers = with pkgs.lib.maintainers; [ ambroisie ];
|
||||
@@ -8,7 +9,10 @@ import ./make-test-python.nix ({ pkgs, ... }: {
|
||||
services.nginx.sso = {
|
||||
enable = true;
|
||||
configuration = {
|
||||
listen = { addr = "127.0.0.1"; port = 8080; };
|
||||
listen = {
|
||||
addr = "127.0.0.1";
|
||||
port = 8080;
|
||||
};
|
||||
|
||||
providers.token.tokens = {
|
||||
myuser = {
|
||||
@@ -19,7 +23,12 @@ import ./make-test-python.nix ({ pkgs, ... }: {
|
||||
acl = {
|
||||
rule_sets = [
|
||||
{
|
||||
rules = [ { field = "x-application"; equals = "MyApp"; } ];
|
||||
rules = [
|
||||
{
|
||||
field = "x-application";
|
||||
equals = "MyApp";
|
||||
}
|
||||
];
|
||||
allow = [ "myuser" ];
|
||||
}
|
||||
];
|
||||
@@ -47,4 +56,4 @@ import ./make-test-python.nix ({ pkgs, ... }: {
|
||||
"curl -sSf -H 'Authorization: Token MyToken' -H 'X-Application: MyApp' http://localhost:8080/auth"
|
||||
)
|
||||
'';
|
||||
})
|
||||
}
|
||||
|
||||
@@ -1,81 +1,79 @@
|
||||
import ./make-test-python.nix (
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
name = "nginx-status-page";
|
||||
meta = with pkgs.lib.maintainers; {
|
||||
maintainers = [ h7x4 ];
|
||||
};
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
name = "nginx-status-page";
|
||||
meta = with pkgs.lib.maintainers; {
|
||||
maintainers = [ h7x4 ];
|
||||
};
|
||||
|
||||
nodes = {
|
||||
webserver =
|
||||
{ ... }:
|
||||
{
|
||||
virtualisation.vlans = [ 1 ];
|
||||
nodes = {
|
||||
webserver =
|
||||
{ ... }:
|
||||
{
|
||||
virtualisation.vlans = [ 1 ];
|
||||
|
||||
networking = {
|
||||
useNetworkd = true;
|
||||
useDHCP = false;
|
||||
firewall.enable = false;
|
||||
};
|
||||
|
||||
systemd.network.networks."01-eth1" = {
|
||||
name = "eth1";
|
||||
networkConfig.Address = "10.0.0.1/24";
|
||||
};
|
||||
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
statusPage = true;
|
||||
virtualHosts."localhost".locations."/index.html".return = "200 'hello world\n'";
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [ curl ];
|
||||
networking = {
|
||||
useNetworkd = true;
|
||||
useDHCP = false;
|
||||
firewall.enable = false;
|
||||
};
|
||||
|
||||
client =
|
||||
{ ... }:
|
||||
{
|
||||
virtualisation.vlans = [ 1 ];
|
||||
|
||||
networking = {
|
||||
useNetworkd = true;
|
||||
useDHCP = false;
|
||||
firewall.enable = false;
|
||||
};
|
||||
|
||||
systemd.network.networks."01-eth1" = {
|
||||
name = "eth1";
|
||||
networkConfig.Address = "10.0.0.2/24";
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [ curl ];
|
||||
systemd.network.networks."01-eth1" = {
|
||||
name = "eth1";
|
||||
networkConfig.Address = "10.0.0.1/24";
|
||||
};
|
||||
};
|
||||
|
||||
testScript =
|
||||
{ nodes, ... }:
|
||||
''
|
||||
start_all()
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
statusPage = true;
|
||||
virtualHosts."localhost".locations."/index.html".return = "200 'hello world\n'";
|
||||
};
|
||||
|
||||
webserver.wait_for_unit("nginx")
|
||||
webserver.wait_for_open_port(80)
|
||||
environment.systemPackages = with pkgs; [ curl ];
|
||||
};
|
||||
|
||||
def expect_http_code(node, code, url):
|
||||
http_code = node.succeed(f"curl -w '%{{http_code}}' '{url}'")
|
||||
assert http_code.split("\n")[-1].strip() == code, \
|
||||
f"expected {code} but got following response:\n{http_code}"
|
||||
client =
|
||||
{ ... }:
|
||||
{
|
||||
virtualisation.vlans = [ 1 ];
|
||||
|
||||
with subtest("localhost can access status page"):
|
||||
expect_http_code(webserver, "200", "http://localhost/nginx_status")
|
||||
networking = {
|
||||
useNetworkd = true;
|
||||
useDHCP = false;
|
||||
firewall.enable = false;
|
||||
};
|
||||
|
||||
with subtest("localhost can access other page"):
|
||||
expect_http_code(webserver, "200", "http://localhost/index.html")
|
||||
systemd.network.networks."01-eth1" = {
|
||||
name = "eth1";
|
||||
networkConfig.Address = "10.0.0.2/24";
|
||||
};
|
||||
|
||||
with subtest("client can not access status page"):
|
||||
expect_http_code(client, "403", "http://10.0.0.1/nginx_status")
|
||||
environment.systemPackages = with pkgs; [ curl ];
|
||||
};
|
||||
};
|
||||
|
||||
with subtest("client can access other page"):
|
||||
expect_http_code(client, "200", "http://10.0.0.1/index.html")
|
||||
'';
|
||||
}
|
||||
)
|
||||
testScript =
|
||||
{ nodes, ... }:
|
||||
''
|
||||
start_all()
|
||||
|
||||
webserver.wait_for_unit("nginx")
|
||||
webserver.wait_for_open_port(80)
|
||||
|
||||
def expect_http_code(node, code, url):
|
||||
http_code = node.succeed(f"curl -w '%{{http_code}}' '{url}'")
|
||||
assert http_code.split("\n")[-1].strip() == code, \
|
||||
f"expected {code} but got following response:\n{http_code}"
|
||||
|
||||
with subtest("localhost can access status page"):
|
||||
expect_http_code(webserver, "200", "http://localhost/nginx_status")
|
||||
|
||||
with subtest("localhost can access other page"):
|
||||
expect_http_code(webserver, "200", "http://localhost/index.html")
|
||||
|
||||
with subtest("client can not access status page"):
|
||||
expect_http_code(client, "403", "http://10.0.0.1/nginx_status")
|
||||
|
||||
with subtest("client can access other page"):
|
||||
expect_http_code(client, "200", "http://10.0.0.1/index.html")
|
||||
'';
|
||||
}
|
||||
|
||||
@@ -1,7 +1,8 @@
|
||||
let
|
||||
dst-dir = "/run/nginx-test-tmpdir-uploads";
|
||||
in
|
||||
import ./make-test-python.nix {
|
||||
{ ... }:
|
||||
{
|
||||
name = "nginx-tmpdir";
|
||||
|
||||
nodes.machine =
|
||||
|
||||
Reference in New Issue
Block a user