v0.31.0 refinements
This commit is contained in:
lixen committed
1 parent
bfcc15613a
commit
6bd5e12a60
52 files changed
+1948
-683
No files matched your search
+20
-20
@@ -96,22 +96,22 @@ section "Rules"
|
||||
rejects() { ! lw --check --source null --sink "$1" >/dev/null 2>"$LOG/check.err" && grep -q -- "$2" "$LOG/check.err" && echo 1 || echo 0; }
|
||||
# warns SINK PATTERN: lw --check builds SINK and WARNs PATTERN
|
||||
warns() { lw --check --source null --sink "$1" 2>&1 >/dev/null | grep ' WARN ' | grep -q -- "$2" && echo 1 || echo 0; }
|
||||
check "an IPv4 entry on an IPv6 listener is refused" "$(rejects 'tcp,host=::1,port=15881,acl.allow=10.0.0.0/8' "not of the listener's family")"
|
||||
check "an acl on a dialer is refused" "$(rejects 'tcp_chain,host=127.0.0.1,port=15881,acl.deny=10.0.0.1' 'unknown key "acl"')"
|
||||
check "a CIDR with host bits warns, naming the network it matches" "$(warns 'tcp,host=127.0.0.1,port=15881,acl.allow=10.0.0.1/8' 'network 10.0.0.0/8')"
|
||||
check "a deny list alone on a wildcard listener warns" "$(warns 'tcp,port=15881,acl.deny=10.0.0.1' 'admits all that acl.deny does not list')"
|
||||
check "an allow entry of a whole family warns" "$(warns 'tcp,port=15881,acl.allow=0.0.0.0/0' 'admits every address of its family')"
|
||||
check "an IPv4 entry on an IPv6 listener is refused" "$(rejects 'tcp:host=::1,port=15881,acl.allow=10.0.0.0/8' "not of the listener's family")"
|
||||
check "an acl on a dialer is refused" "$(rejects 'tcp_chain:host=127.0.0.1,port=15881,acl.deny=10.0.0.1' 'unknown key "acl"')"
|
||||
check "a CIDR with host bits warns, naming the network it matches" "$(warns 'tcp:host=127.0.0.1,port=15881,acl.allow=10.0.0.1/8' 'network 10.0.0.0/8')"
|
||||
check "a deny list alone on a wildcard listener warns" "$(warns 'tcp:port=15881,acl.deny=10.0.0.1' 'admits all that acl.deny does not list')"
|
||||
check "an allow entry of a whole family warns" "$(warns 'tcp:port=15881,acl.allow=0.0.0.0/0' 'admits every address of its family')"
|
||||
check "a proxy_from entry reaching public addresses warns" \
|
||||
"$(warns 'tcp,host=127.0.0.1,port=15881,acl.proxy_protocol=optional,acl.proxy_from=203.0.113.0/24' 'proxy_from reaches public addresses')"
|
||||
"$(warns 'tcp:host=127.0.0.1,port=15881,acl.proxy_protocol=optional,acl.proxy_from=203.0.113.0/24' 'proxy_from reaches public addresses')"
|
||||
check "a request rate on a tcp listener is refused" \
|
||||
"$(rejects 'tcp,host=127.0.0.1,port=15881,acl.requests_per_second_per_client=5' 'applies only to HTTP listeners')"
|
||||
"$(rejects 'tcp:host=127.0.0.1,port=15881,acl.requests_per_second_per_client=5' 'applies only to HTTP listeners')"
|
||||
check "a connection cap behind trusted_proxies, which would count the proxy, is refused" \
|
||||
"$(rejects "http,host=127.0.0.1,port=15881,auth.type=scram,auth.credentials_file=$RUN/users.toml,auth.trusted_proxies=127.0.0.1,acl.max_connections_per_client=2" 'behind trusted_proxies')"
|
||||
"$(rejects "http:host=127.0.0.1,port=15881,auth.type=scram,auth.credentials_file=$RUN/users.toml,auth.trusted_proxies=127.0.0.1,acl.max_connections_per_client=2" 'behind trusted_proxies')"
|
||||
check "optional proxy_protocol warns that a headerless client passes as the proxy" \
|
||||
"$(warns 'tcp,host=127.0.0.1,port=15881,acl.proxy_protocol=optional,acl.proxy_from=127.0.0.1' 'passes as the proxy')"
|
||||
"$(warns 'tcp:host=127.0.0.1,port=15881,acl.proxy_protocol=optional,acl.proxy_from=127.0.0.1' 'passes as the proxy')"
|
||||
|
||||
section "HTTP sink"
|
||||
spawn serve "$BIN" --preset "serve,path=$RUN/edge.log,listen=127.0.0.1:15881,allow=127.0.0.0/8,deny=127.0.0.2"
|
||||
spawn serve "$BIN" --preset "serve:path=$RUN/edge.log,listen=127.0.0.1:15881,allow=127.0.0.0/8,deny=127.0.0.2"
|
||||
wait_port 15881 || abort "the serve preset did not listen" serve
|
||||
check "a client the allow list names reads the status" "$(get http://127.0.0.1:15881/status | grep -q '"acl":"allow=1 deny=1"' && echo 1 || echo 0)"
|
||||
get --interface 127.0.0.2 -o /dev/null http://127.0.0.1:15881/status
|
||||
@@ -127,7 +127,7 @@ section "TCP sink"
|
||||
# the lines of a finite input, once the clients had time to connect
|
||||
seq 1 20000 | sed 's/^/flush /' >"$RUN/flush.in"
|
||||
{ wait_port 15882; sleep 1; cat "$RUN/flush.in"; } |
|
||||
lw --sink "tcp,host=127.0.0.1,port=15882,acl.allow=127.0.0.1,buffer_size=20000,client_buffer_size=20000" 2>"$LOG/tcp.err" &
|
||||
lw --sink "tcp:host=127.0.0.1,port=15882,acl.allow=127.0.0.1,buffer_size=20000,client_buffer_size=20000" 2>"$LOG/tcp.err" &
|
||||
fpid=$!
|
||||
wait_port 15882
|
||||
tcp_read 15882 15 >"$RUN/flush.out" &
|
||||
@@ -141,7 +141,7 @@ check "one it denies gets nothing ($denied bytes) and is logged" \
|
||||
|
||||
section "Behind an L7 proxy"
|
||||
# proxy mode over plaintext loopback: curl is the proxy, its headers name the client
|
||||
spawn web-proxied "$BIN" --source null --sink "http,host=127.0.0.1,port=15882,auth.type=scram,auth.credentials_file=$RUN/users.toml,auth.trusted_proxies=127.0.0.1,acl.deny=198.51.100.5,acl.deny=2001:db8::/32,acl.requests_per_second_per_client=1"
|
||||
spawn web-proxied "$BIN" --source null --sink "http:host=127.0.0.1,port=15882,auth.type=scram,auth.credentials_file=$RUN/users.toml,auth.trusted_proxies=127.0.0.1,acl.deny=198.51.100.5,acl.deny=2001:db8::/32,acl.requests_per_second_per_client=1"
|
||||
wait_port 15882 || abort "the proxy-mode http sink did not listen" web-proxied
|
||||
# as CLIENT [PATH [CURL ARGS]]: the status of a request forwarded for CLIENT,
|
||||
# GET /status by default; there 401 is past the acl, short of a login
|
||||
@@ -162,9 +162,9 @@ section "Chain sources"
|
||||
# pin DAEMON: the pin_sha256 a self-signed listener logged
|
||||
pin() { wait_until 5 logged "$1" pin_sha256 && grep -o 'pin_sha256 "sha256//[^"]*"' "$LOG/$1.out" | head -1 | cut -d'"' -f2; }
|
||||
received() { cat "$RUN/out/$1"/aggregate*.log 2>/dev/null | grep -c 'edge line'; }
|
||||
edge() { spawn "$1" "$BIN" --preset "edge,path=$RUN/edge.log,from=start,to=$2,transport=$3,pin=$4,user=edge-01,password_file=$RUN/edge-01.pass"; }
|
||||
spawn agg-allow "$BIN" --preset "aggregator,listen=127.0.0.1:15884,allow=127.0.0.1,users=$RUN/users.toml,out=$RUN/out/allow"
|
||||
spawn agg-deny "$BIN" --preset "aggregator,listen=127.0.0.1:15885,transport=http,deny=127.0.0.0/8,users=$RUN/users.toml,out=$RUN/out/deny"
|
||||
edge() { spawn "$1" "$BIN" --preset "edge:path=$RUN/edge.log,from=start,to=$2,transport=$3,pin=$4,user=edge-01,password_file=$RUN/edge-01.pass"; }
|
||||
spawn agg-allow "$BIN" --preset "aggregator:listen=127.0.0.1:15884,allow=127.0.0.1,users=$RUN/users.toml,out=$RUN/out/allow"
|
||||
spawn agg-deny "$BIN" --preset "aggregator:listen=127.0.0.1:15885,transport=http,deny=127.0.0.0/8,users=$RUN/users.toml,out=$RUN/out/deny"
|
||||
wait_port 15884 && wait_port 15885 || abort "an aggregator did not listen" agg-allow
|
||||
edge edge-allow 127.0.0.1:15884 tcp "$(pin agg-allow)"
|
||||
edge edge-deny 127.0.0.1:15885 http "$(pin agg-deny)"
|
||||
@@ -181,16 +181,16 @@ section "Behind a PROXY header"
|
||||
# connect from; each is up before a proxy shares its port on another address
|
||||
behind=acl.proxy_protocol=required,acl.proxy_from=127.0.0.1
|
||||
scram="tls.enabled=true,tls.self_signed=true,auth.type=scram,auth.credentials_file=$RUN/users.toml"
|
||||
spawn sink-behind "$BIN" --logging.level=info --source null --sink "http,host=127.0.0.1,port=15886,$scram,$behind,acl.deny=198.51.100.2"
|
||||
spawn tcp-capped "$BIN" --source null --sink "tcp,host=127.0.0.1,port=15889,$behind,acl.max_connections_per_client=2"
|
||||
spawn sink-behind "$BIN" --logging.level=info --source null --sink "http:host=127.0.0.1,port=15886,$scram,$behind,acl.deny=198.51.100.2"
|
||||
spawn tcp-capped "$BIN" --source null --sink "tcp:host=127.0.0.1,port=15889,$behind,acl.max_connections_per_client=2"
|
||||
for t in tcp http; do
|
||||
spawn "agg-$t-behind" "$BIN" --logging.level=info \
|
||||
--source "${t}_chain,host=127.0.0.1,port=$([[ $t == tcp ]] && echo 15888 || echo 15883),$scram,$behind" \
|
||||
--sink "file,directory=$RUN/out/$t-behind,name=aggregate"
|
||||
--source "${t}_chain:host=127.0.0.1,port=$([[ $t == tcp ]] && echo 15888 || echo 15883),$scram,$behind" \
|
||||
--sink "file:directory=$RUN/out/$t-behind,name=aggregate"
|
||||
done
|
||||
# the tcp sink sends its input once the clients connected
|
||||
{ wait_until 30 test -e "$RUN/feed"; seq 1 100 | sed 's/^/behind /'; } |
|
||||
lw --sink "tcp,host=127.0.0.1,port=15887,$behind,acl.deny=198.51.100.2,acl.deny=127.0.0.6" 2>"$LOG/tcp-behind.out" &
|
||||
lw --sink "tcp:host=127.0.0.1,port=15887,$behind,acl.deny=198.51.100.2,acl.deny=127.0.0.6" 2>"$LOG/tcp-behind.out" &
|
||||
fpid=$!
|
||||
for p in 15883 15886 15887 15888 15889; do wait_port $p || abort "a listener behind the proxy did not listen on $p" sink-behind; done
|
||||
spawn proxy "$RUN/proxy/proxy" 127.0.0.11:15886,127.0.0.1:15886,1,198.51.100.1 \
|
||||
|
||||
+3
-3
@@ -55,14 +55,14 @@ rc=${PIPESTATUS[1]}
|
||||
check "reader gone: lw exits on SIGPIPE ($rc)" "$((rc == 141))"
|
||||
|
||||
# 7. filters and formats compose with stdin and stdout
|
||||
check "--filter keeps matching lines" "$(is "$(printf 'x INFO\ny ERROR\n' | lw bare --filter include,patterns=ERROR)" "y ERROR")"
|
||||
check "--filter keeps matching lines" "$(is "$(printf 'x INFO\ny ERROR\n' | lw bare --filter include:patterns=ERROR)" "y ERROR")"
|
||||
|
||||
# 8. control characters pass to a pipe unchanged and are escaped on request
|
||||
check "control bytes reach a pipe unchanged" "$(is "$(printf 'a\033[31mb\n' | lw bare | od -An -tx1 | tr -d ' ')" 611b5b33316d620a)"
|
||||
check "escape=always writes them as <hex>" "$(is "$(printf 'a\033[31mb\n' | lw bare --sink console,escape=always)" 'a<1b>[31mb')"
|
||||
check "escape=always writes them as <hex>" "$(is "$(printf 'a\033[31mb\n' | lw bare --sink console:escape=always)" 'a<1b>[31mb')"
|
||||
|
||||
# 9. at the end of input the file sink writes its queue before lw exits
|
||||
seq 1 5000 | lw bare --sink "file,directory=$RUN/fsink,name=out,buffer_size=10000"
|
||||
seq 1 5000 | lw bare --sink "file:directory=$RUN/fsink,name=out,buffer_size=10000"
|
||||
n=$(cat "$RUN"/fsink/out*.log 2>/dev/null | wc -l)
|
||||
check "file sink holds all 5000 lines at exit ($n)" "$((n == 5000))"
|
||||
|
||||
|
||||
+74
-18
@@ -1,10 +1,12 @@
|
||||
#!/usr/bin/env bash
|
||||
# logwisp preset test: colors, presets, --dump, lw tls, listeners that make
|
||||
# their certificate (self-signed and pinned, or issued), the serve preset's
|
||||
# browser viewer, and the network sinks delivering a finite input whole.
|
||||
# browser viewer, the network sinks delivering a finite input whole, and a
|
||||
# temporary pipe: one SCRAM user whose password is on no disk.
|
||||
# One-shot: both modes run the checks.
|
||||
# Ports: 15890-15896 on 127.0.0.1.
|
||||
# Requires: bash 5+, coreutils, curl, openssl. Linux dev host only.
|
||||
# Ports: 15890-15898 on 127.0.0.1.
|
||||
# Requires: bash 5+, coreutils, curl, openssl; script(1) for the terminal
|
||||
# checks. Linux dev host only.
|
||||
|
||||
set -u
|
||||
. "$(dirname -- "${BASH_SOURCE[0]}")/lib.sh"
|
||||
@@ -14,7 +16,7 @@ e2e_init "$@"
|
||||
|
||||
section "Setup"
|
||||
need curl openssl
|
||||
ports_free 15890 15891 15892 15893 15894 15895 15896
|
||||
ports_free 15890 15891 15892 15893 15894 15895 15896 15897 15898
|
||||
rm -rf "$RUN"
|
||||
mkdir -p "$RUN/out" "$LOG"
|
||||
cd "$RUN" || abort "no run directory"
|
||||
@@ -31,15 +33,15 @@ check "--color paints the level name" "$(is "$(printf 'a ERROR b\n' | lw --color
|
||||
check "--color never, and auto on a pipe, leave it plain" \
|
||||
"$(is "$(printf 'a ERROR b\n' | lw --color never)$(printf 'a ERROR b\n' | lw)" "a ERROR ba ERROR b")"
|
||||
check "LOGWISP_COLOR=always, a sink's own color=never wins" \
|
||||
"$(is "$(printf 'x WARN\n' | LOGWISP_COLOR=always lw --sink console,color=never)" "x WARN")"
|
||||
"$(is "$(printf 'x WARN\n' | LOGWISP_COLOR=always lw --sink console:color=never)" "x WARN")"
|
||||
|
||||
section "Presets"
|
||||
seq 1 5000 >"$RUN/seq.txt"
|
||||
lw --preset pipe <"$RUN/seq.txt" >"$RUN/pipe.out"
|
||||
check "--preset pipe copies stdin line for line" "$(cmp -s "$RUN/seq.txt" "$RUN/pipe.out" && echo 1 || echo 0)"
|
||||
out=$(timeout 3 "$BIN" --preset "tail,path=$RUN/edge.log,from=start" </dev/null 2>/dev/null | head -2 | tr '\n' '|')
|
||||
out=$(timeout 3 "$BIN" --preset "tail:path=$RUN/edge.log,from=start" </dev/null 2>/dev/null | head -2 | tr '\n' '|')
|
||||
check "--preset tail follows a file" "$(is "$out" "edge line 1|edge line 2|")"
|
||||
lw --preset "serve,path=$RUN/edge.log,listen=127.0.0.1:15890,tls=self,hosts=logs.example" --color --dump >"$RUN/dump.toml"
|
||||
lw --preset "serve:path=$RUN/edge.log,listen=127.0.0.1:15890,tls=self,hosts=logs.example" --color --dump >"$RUN/dump.toml"
|
||||
lw -c "$RUN/dump.toml" --dump >"$RUN/dump2.toml"
|
||||
check "--dump prints a file that reads back to the same dump" "$(cmp -s "$RUN/dump.toml" "$RUN/dump2.toml" && echo 1 || echo 0)"
|
||||
check "lw --check builds the dumped preset" "$(lw --check -c "$RUN/dump.toml" 2>"$LOG/check.err" | grep -q 'configuration ok' && echo 1 || echo 0)"
|
||||
@@ -65,24 +67,24 @@ add_users "$RUN/users.toml" edge-01
|
||||
pin() { wait_until 5 logged "$1" pin_sha256 && grep -o 'pin_sha256 "sha256//[^"]*"' "$LOG/$1.out" | head -1 | cut -d'"' -f2; }
|
||||
received() { cat "$RUN/out/$1"/aggregate*.log 2>/dev/null | grep -c 'edge line'; }
|
||||
|
||||
spawn agg-self "$BIN" --preset "aggregator,listen=127.0.0.1:15893,users=$RUN/users.toml,out=$RUN/out/self"
|
||||
spawn agg-self "$BIN" --preset "aggregator:listen=127.0.0.1:15893,users=$RUN/users.toml,out=$RUN/out/self"
|
||||
wait_port 15893 || abort "the self-signed aggregator did not listen" agg-self
|
||||
PIN=$(pin agg-self)
|
||||
check "a self-signed aggregator logs its pin" "$(is_set "$PIN")"
|
||||
spawn edge-pin "$BIN" --preset "edge,path=$RUN/edge.log,from=start,to=127.0.0.1:15893,pin=$PIN,user=edge-01,password_file=$RUN/edge-01.pass"
|
||||
spawn edge-wrong "$BIN" --preset "edge,path=$RUN/edge.log,from=start,to=127.0.0.1:15893,pin=sha256//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=,user=edge-01,password_file=$RUN/edge-01.pass"
|
||||
spawn edge-pin "$BIN" --preset "edge:path=$RUN/edge.log,from=start,to=127.0.0.1:15893,pin=$PIN,user=edge-01,password_file=$RUN/edge-01.pass"
|
||||
spawn edge-wrong "$BIN" --preset "edge:path=$RUN/edge.log,from=start,to=127.0.0.1:15893,pin=sha256//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=,user=edge-01,password_file=$RUN/edge-01.pass"
|
||||
wait_until 10 eval '(( $(received self) >= 300 ))'
|
||||
check "an edge pinning it delivers every line over SCRAM ($(received self))" "$(( $(received self) == 300 ))"
|
||||
wait_until 10 logged edge-wrong 'matches no tls.pin_sha256'
|
||||
check "an edge with another pin is refused before it logs in" "$(logged edge-wrong 'matches no tls.pin_sha256' && echo 1 || echo 0)"
|
||||
|
||||
spawn agg-issuer "$BIN" --preset "aggregator,listen=127.0.0.1:15894,transport=http,tls=issuer,issuer_cert=$RUN/pki/ca.crt,issuer_key=$RUN/pki/ca.key,users=$RUN/users.toml,out=$RUN/out/issuer"
|
||||
spawn agg-issuer "$BIN" --preset "aggregator:listen=127.0.0.1:15894,transport=http,tls=issuer,issuer_cert=$RUN/pki/ca.crt,issuer_key=$RUN/pki/ca.key,users=$RUN/users.toml,out=$RUN/out/issuer"
|
||||
wait_port 15894 || abort "the issuing aggregator did not listen" agg-issuer
|
||||
spawn edge-ca "$BIN" --preset "edge,path=$RUN/edge.log,from=start,to=127.0.0.1:15894,transport=http,ca=$RUN/pki/ca.crt,user=edge-01,password_file=$RUN/edge-01.pass"
|
||||
spawn edge-ca "$BIN" --preset "edge:path=$RUN/edge.log,from=start,to=127.0.0.1:15894,transport=http,ca=$RUN/pki/ca.crt,user=edge-01,password_file=$RUN/edge-01.pass"
|
||||
wait_until 10 eval '(( $(received issuer) >= 300 ))'
|
||||
check "an aggregator signing its own certificate is verified by the CA ($(received issuer))" "$(( $(received issuer) == 300 ))"
|
||||
|
||||
spawn serve "$BIN" --preset "serve,path=$RUN/edge.log,listen=127.0.0.1:15895,tls=self"
|
||||
spawn serve "$BIN" --preset "serve:path=$RUN/edge.log,listen=127.0.0.1:15895,tls=self"
|
||||
wait_port 15895 || abort "the serve preset did not listen" serve
|
||||
SERVE_PIN=$(pin serve)
|
||||
check "curl --pinnedpubkey reads a self-signed stream's status" \
|
||||
@@ -93,7 +95,7 @@ check "a browser at the self-signed root lands on the viewer" \
|
||||
"$(curl -sLk --pinnedpubkey "$SERVE_PIN" https://127.0.0.1:15895/ | grep -q 'name="logwisp-login" content="none"' && echo 1 || echo 0)"
|
||||
|
||||
section "Viewer"
|
||||
spawn serve-plain "$BIN" --preset "serve,path=$RUN/edge.log,listen=127.0.0.1:15896"
|
||||
spawn serve-plain "$BIN" --preset "serve:path=$RUN/edge.log,listen=127.0.0.1:15896"
|
||||
wait_port 15896 || abort "the plain serve preset did not listen" serve-plain
|
||||
root=$(curl -s -o /dev/null -w '%{http_code} %{redirect_url}' http://127.0.0.1:15896/)
|
||||
check "GET / sends a browser to the viewer, which needs no login over plain http ($root)" \
|
||||
@@ -103,13 +105,13 @@ section "Flush at exit"
|
||||
# feed SECONDS PORT: the lines, once a client had time to connect
|
||||
feed() { wait_port "$2"; sleep "$1"; seq 1 20000 | sed 's/^/flush /'; }
|
||||
queues='buffer_size=20000,client_buffer_size=20000'
|
||||
feed 1 15891 | lw --sink "tcp,host=127.0.0.1,port=15891,$queues" 2>"$LOG/flush-tcp.err" &
|
||||
feed 1 15891 | lw --sink "tcp:host=127.0.0.1,port=15891,$queues" 2>"$LOG/flush-tcp.err" &
|
||||
fpid=$!
|
||||
wait_port 15891
|
||||
n=$(tcp_read 15891 15 | grep -c '^flush ')
|
||||
wait "$fpid"
|
||||
check "a tcp client gets all 20000 lines of a finite input ($n)" "$((n == 20000))"
|
||||
feed 1 15892 | lw --sink "http,host=127.0.0.1,port=15892,$queues" 2>"$LOG/flush-http.err" &
|
||||
feed 1 15892 | lw --sink "http:host=127.0.0.1,port=15892,$queues" 2>"$LOG/flush-http.err" &
|
||||
fpid=$!
|
||||
wait_port 15892
|
||||
curl -sN --max-time 15 http://127.0.0.1:15892/stream >"$RUN/flush-http.out"
|
||||
@@ -119,11 +121,65 @@ check "an http stream gets all 20000 lines, then the disconnect event ($n)" \
|
||||
"$( ((n == 20000)) && tail -3 "$RUN/flush-http.out" | grep -q '^event: disconnect' && echo 1 || echo 0)"
|
||||
# 1000 lines: the chain sink's queue, which holds them until the link is up
|
||||
flushed() { cat "$RUN/out/$1"/aggregate*.log 2>/dev/null | grep -c '"flush '; }
|
||||
seq 1 1000 | sed 's/^/flush /' | lw --preset "edge,to=127.0.0.1:15893,pin=$PIN,user=edge-01,password_file=$RUN/edge-01.pass" 2>"$LOG/flush-tcp-chain.err"
|
||||
seq 1 1000 | sed 's/^/flush /' | lw --preset "edge:to=127.0.0.1:15893,pin=$PIN,user=edge-01,password_file=$RUN/edge-01.pass" 2>"$LOG/flush-tcp-chain.err"
|
||||
wait_until 5 eval '(( $(flushed self) >= 1000 ))'
|
||||
check "a tcp_chain edge delivers all 1000 lines before it exits ($(flushed self))" "$(( $(flushed self) == 1000 ))"
|
||||
seq 1 1000 | sed 's/^/flush /' | lw --preset "edge,to=127.0.0.1:15894,transport=http,ca=$RUN/pki/ca.crt,user=edge-01,password_file=$RUN/edge-01.pass" 2>"$LOG/flush-http-chain.err"
|
||||
seq 1 1000 | sed 's/^/flush /' | lw --preset "edge:to=127.0.0.1:15894,transport=http,ca=$RUN/pki/ca.crt,user=edge-01,password_file=$RUN/edge-01.pass" 2>"$LOG/flush-http-chain.err"
|
||||
wait_until 5 eval '(( $(flushed issuer) >= 1000 ))'
|
||||
check "an http_chain edge delivers all 1000 lines before it exits ($(flushed issuer))" "$(( $(flushed issuer) == 1000 ))"
|
||||
|
||||
section "Temporary pipe"
|
||||
# One user on both ends, its password through a descriptor; printf is a
|
||||
# builtin, so the password is in no argv either
|
||||
PW=$(head -c 18 /dev/urandom | base64 | tr '+/' '-_')
|
||||
pw() { printf '%s\n' "$1"; }
|
||||
piped() { cat "$RUN/out/pipe"/aggregate*.log 2>/dev/null | grep -c '^pipe line'; }
|
||||
piped_line() { cat "$RUN/out/pipe"/aggregate*.log 2>/dev/null | grep -qx "pipe line $1"; }
|
||||
seq 1 100 | sed 's/^/pipe line /' >"$RUN/pipe.log"
|
||||
spawn agg-pipe "$BIN" --logging.level=info --preset "aggregator:listen=127.0.0.1:15897,user=pipe,password_file=/dev/fd/3,format=raw,out=$RUN/out/pipe" 3< <(pw "$PW")
|
||||
AGG_PIPE=${PIDS[-1]}
|
||||
wait_port 15897 || abort "the pipe aggregator did not listen" agg-pipe
|
||||
PIPE_PIN=$(pin agg-pipe)
|
||||
spawn edge-pipe "$BIN" --logging.level=info --preset "edge:path=$RUN/pipe.log,from=start,to=127.0.0.1:15897,pin=$PIPE_PIN,user=pipe,password_file=/dev/fd/3" 3< <(pw "$PW")
|
||||
EDGE_PIPE=${PIDS[-1]}
|
||||
spawn edge-pipe-wrong "$BIN" --preset "edge:path=$RUN/pipe.log,from=start,to=127.0.0.1:15897,pin=$PIPE_PIN,user=pipe,password_file=/dev/fd/3" 3< <(pw another-password)
|
||||
wait_until 10 eval '(( $(piped) >= 100 ))'
|
||||
check "an aggregator and an edge given one password on /dev/fd/3 deliver every line ($(piped))" "$(( $(piped) == 100 ))"
|
||||
wait_until 10 logged edge-pipe-wrong 'authentication failed'
|
||||
check "an edge with another password is refused" "$(logged edge-pipe-wrong 'authentication failed' && echo 1 || echo 0)"
|
||||
check "the descriptor, read and closed, draws no permission warning" "$(logged agg-pipe 'readable by all users' && echo 0 || echo 1)"
|
||||
reloaded() { logged agg-pipe 'hot reload completed' && logged edge-pipe 'hot reload completed'; }
|
||||
kill -HUP "$AGG_PIPE" "$EDGE_PIPE"
|
||||
wait_until 10 reloaded
|
||||
check "SIGHUP reloads both, the password kept from the first read" "$(reloaded && echo 1 || echo 0)"
|
||||
seq 101 150 | sed 's/^/pipe line /' >>"$RUN/pipe.log"
|
||||
wait_until 10 piped_line 150
|
||||
check "a second batch is delivered after the reload" "$(piped_line 150 && echo 1 || echo 0)"
|
||||
leaks=$(grep -rlF -- "$PW" "$RUN"; for p in "$AGG_PIPE" "$EDGE_PIPE"; do tr '\0' '\n' <"/proc/$p/cmdline"; tr '\0' '\n' <"/proc/$p/environ"; done | grep -F -- "$PW")
|
||||
check "the password is in no file of the run directory, no argv and no environment" "$(is "$leaks" "")"
|
||||
|
||||
if command -v script >/dev/null && command -v setsid >/dev/null; then
|
||||
setsid -w "$BIN" --check --preset aggregator:listen=127.0.0.1:15898,user=gen </dev/null >"$LOG/no-tty.out" 2>&1
|
||||
check "with no terminal to ask on, a listener's user fails closed" "$(grep -q 'no terminal to ask on' "$LOG/no-tty.out" && echo 1 || echo 0)"
|
||||
# script(1) is lw's terminal, what lw shows there lands in agg-gen-tty.out;
|
||||
# not spawn, whose background command would read /dev/null, not the Enter
|
||||
script -qefc "$(printf '%q ' "$BIN" --preset "aggregator:listen=127.0.0.1:15898,transport=http,user=gen,format=raw,out=$RUN/out/gen")2>$(printf %q "$LOG/agg-gen.out")" /dev/null \
|
||||
< <(printf '\n') >"$LOG/agg-gen-tty.out" 2>&1 &
|
||||
PIDS+=($!) DAEMONS+=(agg-gen-tty)
|
||||
wait_until 10 logged agg-gen-tty 'generated password'
|
||||
GEN=$(grep -o 'shown once: [A-Z2-7]*' "$LOG/agg-gen-tty.out" | cut -d' ' -f3)
|
||||
check "Enter alone at a listener's prompt shows a generated password on its terminal" "$(is_set "$GEN")"
|
||||
wait_port 15898 || abort "the generating aggregator did not listen" agg-gen-tty
|
||||
GEN_PIN=$(pin agg-gen)
|
||||
check "and not in lw's log or stderr" "$([[ -n $GEN ]] && ! grep -qF -- "$GEN" "$LOG/agg-gen.out" && echo 1 || echo 0)"
|
||||
generated() { cat "$RUN/out/gen"/aggregate*.log 2>/dev/null | grep -c '^edge line'; }
|
||||
spawn edge-gen "$BIN" --preset "edge:path=$RUN/edge.log,from=start,to=127.0.0.1:15898,transport=http,pin=$GEN_PIN,user=gen,password_file=/dev/fd/3" 3< <(pw "$GEN")
|
||||
wait_until 10 eval '(( $(generated) >= 300 ))'
|
||||
check "an edge given the generated password delivers every line ($(generated))" "$(( $(generated) == 300 ))"
|
||||
token=$(pw "$GEN" | script -qefc "$(printf '%q ' "$BIN" auth token --url https://127.0.0.1:15898 -u gen --pin-sha256 "$GEN_PIN")" /dev/null | tr -d '\r' | tail -1)
|
||||
check "lw auth token asks on the terminal without --password-file" "$([[ $token =~ ^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$ ]] && echo 1 || echo 0)"
|
||||
else
|
||||
skip "the terminal checks: no script(1) or setsid(1)"
|
||||
fi
|
||||
|
||||
summary
|
||||
Reference in new issue
Block a user