Add basic testing of the mod_intercept_form_submit modules.

The chmod g+r /etc/shadow approach is obviously only for testing.

7 files changed, 99 insertions, 0 deletions

diff --git a/tests/Dockerfile b/tests/Dockerfile
new file mode 100644
index 0000000..8ec9389
--- /dev/null
+++ b/tests/Dockerfile
@@ -0,0 +1,9 @@
+FROM registry.fedoraproject.org/fedora
+COPY Makefile *intercept_form_submit* LICENSE README /src/
+WORKDIR /src
+COPY tests/build.sh /src/tests/
+COPY docs/* /src/docs/
+RUN tests/build.sh
+COPY tests/* /src/tests/
+RUN tests/config.sh
+ENTRYPOINT [ "/usr/sbin/httpd", "-DFOREGROUND" ]
diff --git a/tests/auth.cgi b/tests/auth.cgi
new file mode 100755
index 0000000..6a17487
--- /dev/null
+++ b/tests/auth.cgi
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+echo "Content-Type: text/plain"
+echo "Pragma: no-cache"
+echo
+echo "REMOTE_USER=[$REMOTE_USER]"
+echo ---
+cat
+echo
+echo ---
diff --git a/tests/auth.conf b/tests/auth.conf
new file mode 100644
index 0000000..914d4a5
--- /dev/null
+++ b/tests/auth.conf
@@ -0,0 +1,17 @@
+LoadModule intercept_form_submit_module modules/mod_intercept_form_submit.so
+LoadModule authnz_pam_module modules/mod_authnz_pam.so
+
+ScriptAlias /auth1 /var/www/cgi-bin/auth.cgi
+<LocationMatch ^/auth1>
+	InterceptFormPAMService webl
+	InterceptFormLogin login
+	InterceptFormPassword password
+</LocationMatch>
+
+ScriptAlias /auth1r /var/www/cgi-bin/auth.cgi
+<LocationMatch ^/auth1r>
+	InterceptFormPAMService webl
+	InterceptFormLogin login
+	InterceptFormPassword password
+	InterceptFormPasswordRedact on
+</LocationMatch>
diff --git a/tests/build.sh b/tests/build.sh
new file mode 100755
index 0000000..76e97c3
--- /dev/null
+++ b/tests/build.sh
@@ -0,0 +1,24 @@
+#!/bin/bash
+
+set -e
+set -x
+
+DNF=yum
+BUILDDEP_PROVIDER=yum-utils
+BUILDDEP=yum-builddep
+if type dnf 2> /dev/null ; then
+	DNF=dnf
+	BUILDDEP_PROVIDER='dnf-command(builddep)'
+	BUILDDEP='dnf builddep'
+fi
+
+$DNF install -y rpm-build "$BUILDDEP_PROVIDER"
+$BUILDDEP -y mod_intercept_form_submit.spec
+NAME_VERSION=$( rpm -q --qf '%{name}-%{version}\n' --specfile mod_intercept_form_submit.spec | head -1 )
+mkdir .$NAME_VERSION
+cp -rp * .$NAME_VERSION
+mv .$NAME_VERSION $NAME_VERSION
+mkdir -p ~/rpmbuild/SOURCES
+tar cvzf ~/rpmbuild/SOURCES/$NAME_VERSION.tar.gz $NAME_VERSION
+rpmbuild -bb --define "dist $( rpm --eval '%{dist}' ).localbuild" mod_intercept_form_submit.spec
+$DNF install -y ~/rpmbuild/RPMS/*/$NAME_VERSION-*.localbuild.*.rpm
diff --git a/tests/config.sh b/tests/config.sh
new file mode 100755
index 0000000..3f949b6
--- /dev/null
+++ b/tests/config.sh
@@ -0,0 +1,14 @@
+#!/bin/bash
+
+set -e
+set -x
+
+sed -i 's/^MaxClients.*/MaxClients 1/' /etc/httpd/conf/httpd.conf
+cp -p tests/auth.cgi /var/www/cgi-bin/auth.cgi
+cp tests/pam-webl /etc/pam.d/webl
+chmod a+x /var/log/httpd
+cp tests/auth.conf /etc/httpd/conf.d/
+useradd user1
+echo user1:heslo1 | chpasswd
+chgrp apache /etc/shadow
+chmod g+r /etc/shadow
diff --git a/tests/pam-webl b/tests/pam-webl
new file mode 100644
index 0000000..7ae90c8
--- /dev/null
+++ b/tests/pam-webl
@@ -0,0 +1,2 @@
+auth	sufficient	pam_unix.so
+account	required	pam_unix.so
diff --git a/tests/run.sh b/tests/run.sh
new file mode 100755
index 0000000..ef7d240
--- /dev/null
+++ b/tests/run.sh
@@ -0,0 +1,23 @@
+#!/bin/bash
+
+set -e
+set -x
+
+echo "Wait for the HTTP server to start ..."
+for i in $( seq 1 10 ) ; do
+	if curl -s -o /dev/null http://localhost/ ; then
+		break
+	fi
+	sleep 3
+done
+
+curl -s http://localhost/auth1 | tee /dev/stderr | grep -F 'REMOTE_USER=[]'
+curl -u userx:heslox -s http://localhost/auth1 | tee /dev/stderr | grep -F 'REMOTE_USER=[]'
+curl --data '' -si http://localhost/auth1 | tee /dev/stderr | grep -F 'REMOTE_USER=[]'
+curl --data 'login=user1&password=heslox' -si http://localhost/auth1 | tee /dev/stderr | grep -F 'REMOTE_USER=[]'
+curl --data 'login=user1&password=heslo1' -si http://localhost/auth1 | tee /dev/stderr | grep -F -e 'REMOTE_USER=[user1]' -e 'login=user1&password=heslo1' | wc -l | grep -q 2
+curl --data 'something=somewhere&password=heslo1&something=else&login=user1' -si http://localhost/auth1 | tee /dev/stderr | grep -F -e 'REMOTE_USER=[user1]' -e 'something=somewhere&password=heslo1&something=else&login=user1' | wc -l | grep -q 2
+curl --data 'login=user1&password=heslo1' -si http://localhost/auth1r | tee /dev/stderr | grep -F -e 'REMOTE_USER=[user1]' -e 'login=user1&password=[REDACTED]' | wc -l | grep -q 2
+curl --data 'something=somewhere&password=heslo1&something=else&login=user1' -si http://localhost/auth1r | tee /dev/stderr | grep -F -e 'REMOTE_USER=[user1]' -e 'something=somewhere&password=[REDACTED]&something=else&login=user1' | wc -l | grep -q 2
+
+echo OK $0.