|
| 1 | +import os |
| 2 | +import re |
| 3 | + |
| 4 | +import pytest |
| 5 | + |
| 6 | +from pyhttpd.conf import HttpdConf |
| 7 | +from .env import MetadataTestEnv |
| 8 | + |
| 9 | + |
| 10 | +@pytest.mark.skipif(condition=not MetadataTestEnv.has_shared_module("remoteip"), |
| 11 | + reason="mod_remoteip not available") |
| 12 | +class TestRemoteIp: |
| 13 | + LOG_FILE = "test_remoteip.log" |
| 14 | + PEER = "127.0.0.1" |
| 15 | + CLIENT = "203.0.113.7" |
| 16 | + CDN = "198.51.100.9" |
| 17 | + |
| 18 | + # The test requests come from the internal proxy PEER and carry |
| 19 | + # "X-Forwarded-For: CLIENT, CDN". The proxies are given directly or in |
| 20 | + # a list file, in the server config or in the vhost. Each case expects |
| 21 | + # the client and the (external) proxies seen by mod_remoteip. |
| 22 | + @pytest.mark.parametrize(["scope", "directives", "listed", "proxies"], [ |
| 23 | + ["vhost", [f"RemoteIPInternalProxy {PEER}", f"RemoteIPTrustedProxy {CDN}"], |
| 24 | + [], CDN], |
| 25 | + ["vhost", [f"RemoteIPInternalProxy {PEER}", "RemoteIPTrustedProxyList {list}"], |
| 26 | + [CDN], CDN], |
| 27 | + ["vhost", ["RemoteIPTrustedProxyList {list}", f"RemoteIPInternalProxy {PEER}"], |
| 28 | + [CDN], CDN], |
| 29 | + ["vhost", ["RemoteIPTrustedProxy 10.142.1.99", "RemoteIPInternalProxyList {list}"], |
| 30 | + [PEER, CDN], "-"], |
| 31 | + ["server", [f"RemoteIPInternalProxy {PEER}", "RemoteIPTrustedProxyList {list}"], |
| 32 | + [CDN], CDN], |
| 33 | + ]) |
| 34 | + def test_metadata_004_01(self, env, scope, directives, listed, proxies): |
| 35 | + list_file = os.path.join(env.gen_dir, "remoteip_proxies.lst") |
| 36 | + with open(list_file, "w") as f: |
| 37 | + f.write("".join(f"{ip}\n" for ip in listed)) |
| 38 | + lines = [d.format(list=list_file) for d in directives] |
| 39 | + conf = HttpdConf(env, extras={ |
| 40 | + "base": [ |
| 41 | + "RemoteIPHeader X-Forwarded-For", |
| 42 | + f'CustomLog logs/{self.LOG_FILE} "%a %{{remoteip-proxy-ip-list}}n"', |
| 43 | + ] + (lines if scope == "server" else []) |
| 44 | + }) |
| 45 | + conf.start_vhost(domains=[f"test1.{env.http_tld}"], doc_root="htdocs/test1") |
| 46 | + if scope == "vhost": |
| 47 | + conf.add(lines) |
| 48 | + conf.end_vhost() |
| 49 | + conf.install() |
| 50 | + assert env.apache_restart() == 0 |
| 51 | + |
| 52 | + log_path = os.path.join(env.server_logs_dir, self.LOG_FILE) |
| 53 | + open(log_path, 'w').close() |
| 54 | + r = env.curl_get(env.mkurl("https", "test1", "/"), options=[ |
| 55 | + '-H', f"X-Forwarded-For: {self.CLIENT}, {self.CDN}"]) |
| 56 | + assert r.response["status"] == 200 |
| 57 | + with open(log_path) as f: |
| 58 | + assert f.read().strip() == f"{self.CLIENT} {proxies}" |
| 59 | + |
| 60 | + WARNING = r".*both the main server and the virtual host" |
| 61 | + |
| 62 | + # The proxy entries of the main server and of a vhost are merged, the |
| 63 | + # ones of the vhost taking precedence where subnets overlap, and a |
| 64 | + # warning tells when both have some. |
| 65 | + @pytest.mark.parametrize(["main", "vhost", "proxies", "warning"], [ |
| 66 | + # only one of the scopes |
| 67 | + [[f"RemoteIPInternalProxy {PEER}", f"RemoteIPTrustedProxy {CDN}"], |
| 68 | + [], CDN, False], |
| 69 | + [[], [f"RemoteIPInternalProxy {PEER}", f"RemoteIPTrustedProxy {CDN}"], |
| 70 | + CDN, False], |
| 71 | + # RemoteIPInternalProxy in the main server, a list in the vhost |
| 72 | + [[f"RemoteIPInternalProxy {PEER}"], ["RemoteIPInternalProxyList {cdn}"], |
| 73 | + "-", True], |
| 74 | + [[f"RemoteIPInternalProxy {PEER}"], ["RemoteIPTrustedProxyList {cdn}"], |
| 75 | + CDN, True], |
| 76 | + # a list in the main server, a direct entry in the vhost |
| 77 | + [["RemoteIPInternalProxyList {peer}"], [f"RemoteIPTrustedProxy {CDN}"], |
| 78 | + CDN, True], |
| 79 | + # direct entries in both |
| 80 | + [[f"RemoteIPInternalProxy {PEER}"], [f"RemoteIPTrustedProxy {CDN}"], |
| 81 | + CDN, True], |
| 82 | + # the CDN is trusted by the main server and internal for the vhost |
| 83 | + [[f"RemoteIPInternalProxy {PEER}", f"RemoteIPTrustedProxy {CDN}"], |
| 84 | + [f"RemoteIPInternalProxy {CDN}"], "-", True], |
| 85 | + [[f"RemoteIPInternalProxy {PEER}", f"RemoteIPTrustedProxy {CDN}"], |
| 86 | + ["RemoteIPInternalProxyList {cdn}"], "-", True], |
| 87 | + ]) |
| 88 | + def test_metadata_004_02(self, env, main, vhost, proxies, warning): |
| 89 | + files = {"cdn": self.CDN, "peer": self.PEER} |
| 90 | + for name, ip in files.items(): |
| 91 | + with open(os.path.join(env.gen_dir, f"remoteip_{name}.lst"), "w") as f: |
| 92 | + f.write(f"{ip}\n") |
| 93 | + paths = {n: os.path.join(env.gen_dir, f"remoteip_{n}.lst") for n in files} |
| 94 | + conf = HttpdConf(env, extras={ |
| 95 | + "base": [ |
| 96 | + "RemoteIPHeader X-Forwarded-For", |
| 97 | + f'CustomLog logs/{self.LOG_FILE} "%a %{{remoteip-proxy-ip-list}}n"', |
| 98 | + ] + [d.format(**paths) for d in main] |
| 99 | + }) |
| 100 | + conf.start_vhost(domains=[f"test1.{env.http_tld}"], doc_root="htdocs/test1") |
| 101 | + conf.add([d.format(**paths) for d in vhost]) |
| 102 | + conf.end_vhost() |
| 103 | + conf.install() |
| 104 | + pos = env.httpd_error_log.current_pos() |
| 105 | + assert env.apache_restart() == 0 |
| 106 | + warned = env.httpd_error_log.wait_for(re.compile(self.WARNING), pos, timeout=1) |
| 107 | + assert warned == warning |
| 108 | + if warned: |
| 109 | + env.httpd_error_log.ignore_recent(matches=[self.WARNING]) |
| 110 | + |
| 111 | + log_path = os.path.join(env.server_logs_dir, self.LOG_FILE) |
| 112 | + open(log_path, 'w').close() |
| 113 | + r = env.curl_get(env.mkurl("https", "test1", "/"), options=[ |
| 114 | + '-H', f"X-Forwarded-For: {self.CLIENT}, {self.CDN}"]) |
| 115 | + assert r.response["status"] == 200 |
| 116 | + with open(log_path) as f: |
| 117 | + assert f.read().strip() == f"{self.CLIENT} {proxies}" |
0 commit comments