X-Git-Url: https://ruderich.org/simon/gitweb/?a=blobdiff_plain;f=main_test.go;h=31c9e50064f21276776f5e344edc62da53f9aad0;hb=a8a8f9daebe164d067d004458679dd7e7f0dc087;hp=38499da197bb6fd0be3276e48d11527215a30a8c;hpb=526f6f1db39bde8ca1f7684225a3983634bddafe;p=nsscash%2Fnsscash.git diff --git a/main_test.go b/main_test.go index 38499da..31c9e50 100644 --- a/main_test.go +++ b/main_test.go @@ -25,6 +25,7 @@ import ( "net/http" "net/http/httptest" "os" + "path/filepath" "reflect" "runtime" "strings" @@ -33,11 +34,11 @@ import ( ) const ( - configPath = "testdata/config.toml" - statePath = "testdata/state.json" - passwdPath = "testdata/passwd.nsscash" - plainPath = "testdata/plain" - groupPath = "testdata/group.nsscash" + configPath = "testdata/config.toml" + statePath = "testdata/var/state.json" + passwdPath = "testdata/passwd.nsscash" + plainPath = "testdata/plain" + groupPath = "testdata/group.nsscash" tlsCAPath = "testdata/ca.crt" tlsCertPath = "testdata/server.crt" tlsKeyPath = "testdata/server.key" @@ -66,6 +67,12 @@ func mustNotExist(t *testing.T, paths ...string) { } } +func hashAsHex(x []byte) string { + h := sha1.New() + h.Write(x) + return hex.EncodeToString(h.Sum(nil)) +} + // mustHaveHash checks if the given path content has the given SHA-1 string // (in hex). func mustHaveHash(t *testing.T, path string, hash string) { @@ -74,10 +81,7 @@ func mustHaveHash(t *testing.T, path string, hash string) { t.Fatal(err) } - h := sha1.New() - h.Write(x) - y := hex.EncodeToString(h.Sum(nil)) - + y := hashAsHex(x) if y != hash { t.Errorf("%q has unexpected hash %q", path, y) } @@ -212,6 +216,7 @@ func TestMainFetch(t *testing.T) { fetchStateCannotWrite, fetchCannotDeploy, fetchSecondFetchFails, + fetchBasicAuth, } // HTTP tests @@ -265,6 +270,13 @@ func runMainTest(t *testing.T, f func(args), tls *tls.Config) { // Remove the file at the end of this test run, if it // was created defer os.Remove(p) + + dir := filepath.Dir(p) + err = os.MkdirAll(dir, 0755) + if err != nil { + t.Fatal(err) + } + defer os.Remove(dir) // remove empty directories } var handler func(http.ResponseWriter, *http.Request) @@ -426,6 +438,7 @@ func fetchPasswd(a args) { mustMakeOld(t, passwdPath, statePath) lastChange := time.Now() + change := false *a.handler = func(w http.ResponseWriter, r *http.Request) { if r.URL.Path != "/passwd" { return @@ -438,16 +451,19 @@ func fetchPasswd(a args) { t.Fatalf("invalid If-Modified-Since %v", modified) } - if !x.Before(lastChange) { + if !x.Before(lastChange.Truncate(time.Second)) { w.WriteHeader(http.StatusNotModified) return } } w.Header().Add("Last-Modified", - lastChange.Format(http.TimeFormat)) + lastChange.UTC().Format(http.TimeFormat)) fmt.Fprintln(w, "root:x:0:0:root:/root:/bin/bash") fmt.Fprintln(w, "daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin") + if change { + fmt.Fprintln(w, "bin:x:2:2:bin:/bin:/usr/sbin/nologin") + } } err = mainFetch(configPath) @@ -487,6 +503,22 @@ func fetchPasswd(a args) { mustNotExist(t, plainPath, groupPath) mustBeNew(t, passwdPath, statePath) mustHaveHash(t, passwdPath, "bbb7db67469b111200400e2470346d5515d64c23") + + t.Log("Fetch again with newer server response") + + change = true + lastChange = time.Now().Add(time.Second) + + mustMakeOld(t, passwdPath, statePath) + + err = mainFetch(configPath) + if err != nil { + t.Error(err) + } + + mustNotExist(t, plainPath, groupPath) + mustBeNew(t, passwdPath, statePath) + mustHaveHash(t, passwdPath, "ca9c7477cb425667fc9ecbd79e8e1c2ad0e84423") } func fetchPlainEmpty(a args) { @@ -686,23 +718,27 @@ func fetchStateCannotWrite(a args) { mustHaveHash(t, groupPath, "da39a3ee5e6b4b0d3255bfef95601890afd80709") *a.handler = func(w http.ResponseWriter, r *http.Request) { - // To prevent mainFetch() from trying to update groupPath - // which will also fail - w.WriteHeader(http.StatusNotModified) + if r.URL.Path != "/group" { + return + } + + fmt.Fprintln(w, "root:x:0:") + fmt.Fprintln(w, "daemon:x:1:andariel,duriel,mephisto,diablo,baal") } - err := os.Chmod("testdata", 0500) + err := os.Chmod(filepath.Dir(statePath), 0500) if err != nil { t.Fatal(err) } - defer os.Chmod("testdata", 0755) + defer os.Chmod(filepath.Dir(statePath), 0755) err = mainFetch(configPath) mustBeErrorWithSubstring(t, err, "permission denied") mustNotExist(t, statePath, passwdPath, plainPath) - mustBeOld(t, groupPath) + mustBeNew(t, groupPath) + mustHaveHash(t, groupPath, "8c27a8403278ba2e392b86d98d4dff1fdefcafdd") } func fetchCannotDeploy(a args) { @@ -775,6 +811,87 @@ ca = "%[5]s" mustBeOld(t, passwdPath, groupPath) } +func fetchBasicAuth(a args) { + t := a.t + mustWritePasswdConfig(t, a.url) + mustCreate(t, passwdPath) + mustHaveHash(t, passwdPath, "da39a3ee5e6b4b0d3255bfef95601890afd80709") + + validUser := "username" + validPass := "password" + + *a.handler = func(w http.ResponseWriter, r *http.Request) { + if r.URL.Path != "/passwd" { + return + } + + user, pass, ok := r.BasicAuth() + // NOTE: Do not use this in production because it permits + // attackers to determine the length of user/pass. Instead use + // hashes and subtle.ConstantTimeCompare(). + if !ok || user != validUser || pass != validPass { + w.Header().Set("WWW-Authenticate", `Basic realm="Test"`) + w.WriteHeader(http.StatusUnauthorized) + return + } + + fmt.Fprintln(w, "root:x:0:0:root:/root:/bin/bash") + fmt.Fprintln(w, "daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin") + } + + t.Log("Missing authentication") + + err := mainFetch(configPath) + mustBeErrorWithSubstring(t, err, + "status code 401") + + mustNotExist(t, statePath, groupPath, plainPath) + mustBeOld(t, passwdPath) + + t.Log("Unsafe config permissions") + + mustWriteConfig(t, fmt.Sprintf(` +statepath = "%[1]s" + +[[file]] +type = "passwd" +url = "%[2]s/passwd" +path = "%[3]s" +ca = "%[4]s" +username = "%[5]s" +password = "%[6]s" +`, statePath, a.url, passwdPath, tlsCAPath, validUser, validPass)) + + err = os.Chmod(configPath, 0644) + if err != nil { + t.Fatal(err) + } + + err = mainFetch(configPath) + mustBeErrorWithSubstring(t, err, + "file[0].username/passsword in use and unsafe permissions "+ + "-rw-r--r-- on \"testdata/config.toml\"") + + mustNotExist(t, statePath, groupPath, plainPath) + mustBeOld(t, passwdPath) + + t.Log("Working authentication") + + err = os.Chmod(configPath, 0600) + if err != nil { + t.Fatal(err) + } + + err = mainFetch(configPath) + if err != nil { + t.Error(err) + } + + mustNotExist(t, plainPath, groupPath) + mustBeNew(t, passwdPath, statePath) + mustHaveHash(t, passwdPath, "bbb7db67469b111200400e2470346d5515d64c23") +} + func fetchInvalidCA(a args) { t := a.t