aboutsummaryrefslogtreecommitdiff
path: root/plugins/tests/check_http.t
diff options
context:
space:
mode:
Diffstat (limited to 'plugins/tests/check_http.t')
-rwxr-xr-xplugins/tests/check_http.t256
1 files changed, 147 insertions, 109 deletions
diff --git a/plugins/tests/check_http.t b/plugins/tests/check_http.t
index 188f5e75..ea11b2ac 100755
--- a/plugins/tests/check_http.t
+++ b/plugins/tests/check_http.t
@@ -3,16 +3,7 @@
# Test check_http by having an actual HTTP server running
#
# To create the https server certificate:
-# openssl req -new -x509 -keyout server-key.pem -out server-cert.pem -days 3650 -nodes
-# to create a new expired certificate:
-# faketime '2008-01-01 12:00:00' openssl req -new -x509 -keyout expired-key.pem -out expired-cert.pem -days 1 -nodes
-# Country Name (2 letter code) [AU]:DE
-# State or Province Name (full name) [Some-State]:Bavaria
-# Locality Name (eg, city) []:Munich
-# Organization Name (eg, company) [Internet Widgits Pty Ltd]:Monitoring Plugins
-# Organizational Unit Name (eg, section) []:
-# Common Name (e.g. server FQDN or YOUR name) []:Monitoring Plugins
-# Email Address []:devel@monitoring-plugins.org
+# ./certs/generate-certs.sh
use strict;
use Test::More;
@@ -23,7 +14,7 @@ $ENV{'LC_TIME'} = "C";
my $common_tests = 70;
my $virtual_port_tests = 8;
-my $ssl_only_tests = 8;
+my $ssl_only_tests = 12;
# Check that all dependent modules are available
eval "use HTTP::Daemon 6.01;";
plan skip_all => 'HTTP::Daemon >= 6.01 required' if $@;
@@ -59,61 +50,87 @@ $HTTP::Daemon::VERSION = "1.00";
my $port_http = 50000 + int(rand(1000));
my $port_https = $port_http + 1;
my $port_https_expired = $port_http + 2;
+my $port_https_clientcert = $port_http + 3;
# This array keeps sockets around for implementing timeouts
my @persist;
# Start up all servers
my @pids;
-my $pid = fork();
-if ($pid) {
- # Parent
- push @pids, $pid;
- if (exists $servers->{https}) {
- # Fork a normal HTTPS server
- $pid = fork();
- if ($pid) {
- # Parent
- push @pids, $pid;
- # Fork an expired cert server
- $pid = fork();
- if ($pid) {
- push @pids, $pid;
- } else {
- my $d = HTTP::Daemon::SSL->new(
- LocalPort => $port_https_expired,
- LocalAddr => "127.0.0.1",
- SSL_cert_file => "$Bin/certs/expired-cert.pem",
- SSL_key_file => "$Bin/certs/expired-key.pem",
- ) || die;
- print "Please contact https expired at: <URL:", $d->url, ">\n";
- run_server( $d );
- exit;
- }
- } else {
- # closing the connection after -C cert checks make the daemon exit with a sigpipe otherwise
- local $SIG{'PIPE'} = 'IGNORE';
- my $d = HTTP::Daemon::SSL->new(
- LocalPort => $port_https,
- LocalAddr => "127.0.0.1",
- SSL_cert_file => "$Bin/certs/server-cert.pem",
- SSL_key_file => "$Bin/certs/server-key.pem",
- ) || die;
- print "Please contact https at: <URL:", $d->url, ">\n";
- run_server( $d );
- exit;
- }
- }
-} else {
- # Child
- #print "child\n";
+# Fork a HTTP server
+my $pid = fork;
+defined $pid or die "Failed to fork";
+if (!$pid) {
+ undef @pids;
my $d = HTTP::Daemon->new(
LocalPort => $port_http,
LocalAddr => "127.0.0.1",
) || die;
print "Please contact http at: <URL:", $d->url, ">\n";
run_server( $d );
- exit;
+ die "webserver stopped";
+}
+push @pids, $pid;
+
+if (exists $servers->{https}) {
+ # Fork a normal HTTPS server
+ $pid = fork;
+ defined $pid or die "Failed to fork";
+ if (!$pid) {
+ undef @pids;
+ # closing the connection after -C cert checks make the daemon exit with a sigpipe otherwise
+ local $SIG{'PIPE'} = 'IGNORE';
+ my $d = HTTP::Daemon::SSL->new(
+ LocalPort => $port_https,
+ LocalAddr => "127.0.0.1",
+ SSL_cert_file => "$Bin/certs/server-cert.pem",
+ SSL_key_file => "$Bin/certs/server-key.pem",
+ ) || die;
+ print "Please contact https at: <URL:", $d->url, ">\n";
+ run_server( $d );
+ die "webserver stopped";
+ }
+ push @pids, $pid;
+
+ # Fork an expired cert server
+ $pid = fork;
+ defined $pid or die "Failed to fork";
+ if (!$pid) {
+ undef @pids;
+ # closing the connection after -C cert checks make the daemon exit with a sigpipe otherwise
+ local $SIG{'PIPE'} = 'IGNORE';
+ my $d = HTTP::Daemon::SSL->new(
+ LocalPort => $port_https_expired,
+ LocalAddr => "127.0.0.1",
+ SSL_cert_file => "$Bin/certs/expired-cert.pem",
+ SSL_key_file => "$Bin/certs/expired-key.pem",
+ ) || die;
+ print "Please contact https expired at: <URL:", $d->url, ">\n";
+ run_server( $d );
+ die "webserver stopped";
+ }
+ push @pids, $pid;
+
+ # Fork an client cert expecting server
+ $pid = fork;
+ defined $pid or die "Failed to fork";
+ if (!$pid) {
+ undef @pids;
+ # closing the connection after -C cert checks make the daemon exit with a sigpipe otherwise
+ local $SIG{'PIPE'} = 'IGNORE';
+ my $d = HTTP::Daemon::SSL->new(
+ LocalPort => $port_https_clientcert,
+ LocalAddr => "127.0.0.1",
+ SSL_cert_file => "$Bin/certs/server-cert.pem",
+ SSL_key_file => "$Bin/certs/server-key.pem",
+ SSL_verify_mode => IO::Socket::SSL->SSL_VERIFY_PEER | IO::Socket::SSL->SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
+ SSL_ca_file => "$Bin/certs/clientca-cert.pem",
+ ) || die;
+ print "Please contact https client cert at: <URL:", $d->url, ">\n";
+ run_server( $d );
+ die "webserver stopped";
+ }
+ push @pids, $pid;
}
# give our webservers some time to startup
@@ -122,60 +139,62 @@ sleep(3);
# Run the same server on http and https
sub run_server {
my $d = shift;
- MAINLOOP: while (my $c = $d->accept ) {
- while (my $r = $c->get_request) {
- if ($r->method eq "GET" and $r->url->path =~ m^/statuscode/(\d+)^) {
- $c->send_basic_header($1);
- $c->send_crlf;
- } elsif ($r->method eq "GET" and $r->url->path =~ m^/file/(.*)^) {
- $c->send_basic_header;
- $c->send_crlf;
- $c->send_file_response("$Bin/var/$1");
- } elsif ($r->method eq "GET" and $r->url->path eq "/slow") {
- $c->send_basic_header;
- $c->send_crlf;
- sleep 1;
- $c->send_response("slow");
- } elsif ($r->url->path eq "/method") {
- if ($r->method eq "DELETE") {
- $c->send_error(HTTP::Status->RC_METHOD_NOT_ALLOWED);
- } elsif ($r->method eq "foo") {
- $c->send_error(HTTP::Status->RC_NOT_IMPLEMENTED);
+ while (1) {
+ MAINLOOP: while (my $c = $d->accept) {
+ while (my $r = $c->get_request) {
+ if ($r->method eq "GET" and $r->url->path =~ m^/statuscode/(\d+)^) {
+ $c->send_basic_header($1);
+ $c->send_crlf;
+ } elsif ($r->method eq "GET" and $r->url->path =~ m^/file/(.*)^) {
+ $c->send_basic_header;
+ $c->send_crlf;
+ $c->send_file_response("$Bin/var/$1");
+ } elsif ($r->method eq "GET" and $r->url->path eq "/slow") {
+ $c->send_basic_header;
+ $c->send_crlf;
+ sleep 1;
+ $c->send_response("slow");
+ } elsif ($r->url->path eq "/method") {
+ if ($r->method eq "DELETE") {
+ $c->send_error(HTTP::Status->RC_METHOD_NOT_ALLOWED);
+ } elsif ($r->method eq "foo") {
+ $c->send_error(HTTP::Status->RC_NOT_IMPLEMENTED);
+ } else {
+ $c->send_status_line(200, $r->method);
+ }
+ } elsif ($r->url->path eq "/postdata") {
+ $c->send_basic_header;
+ $c->send_crlf;
+ $c->send_response($r->method.":".$r->content);
+ } elsif ($r->url->path eq "/redirect") {
+ $c->send_redirect( "/redirect2" );
+ } elsif ($r->url->path eq "/redir_external") {
+ $c->send_redirect(($d->isa('HTTP::Daemon::SSL') ? "https" : "http") . "://169.254.169.254/redirect2" );
+ } elsif ($r->url->path eq "/redirect2") {
+ $c->send_basic_header;
+ $c->send_crlf;
+ $c->send_response(HTTP::Response->new( 200, 'OK', undef, 'redirected' ));
+ } elsif ($r->url->path eq "/redir_timeout") {
+ $c->send_redirect( "/timeout" );
+ } elsif ($r->url->path eq "/timeout") {
+ # Keep $c from being destroyed, but prevent severe leaks
+ unshift @persist, $c;
+ delete($persist[1000]);
+ next MAINLOOP;
+ } elsif ($r->url->path eq "/header_check") {
+ $c->send_basic_header;
+ $c->send_header('foo');
+ $c->send_crlf;
+ } elsif ($r->url->path eq "/virtual_port") {
+ # return sent Host header
+ $c->send_basic_header;
+ $c->send_crlf;
+ $c->send_response(HTTP::Response->new( 200, 'OK', undef, $r->header ('Host')));
} else {
- $c->send_status_line(200, $r->method);
+ $c->send_error(HTTP::Status->RC_FORBIDDEN);
}
- } elsif ($r->url->path eq "/postdata") {
- $c->send_basic_header;
- $c->send_crlf;
- $c->send_response($r->method.":".$r->content);
- } elsif ($r->url->path eq "/redirect") {
- $c->send_redirect( "/redirect2" );
- } elsif ($r->url->path eq "/redir_external") {
- $c->send_redirect(($d->isa('HTTP::Daemon::SSL') ? "https" : "http") . "://169.254.169.254/redirect2" );
- } elsif ($r->url->path eq "/redirect2") {
- $c->send_basic_header;
- $c->send_crlf;
- $c->send_response(HTTP::Response->new( 200, 'OK', undef, 'redirected' ));
- } elsif ($r->url->path eq "/redir_timeout") {
- $c->send_redirect( "/timeout" );
- } elsif ($r->url->path eq "/timeout") {
- # Keep $c from being destroyed, but prevent severe leaks
- unshift @persist, $c;
- delete($persist[1000]);
- next MAINLOOP;
- } elsif ($r->url->path eq "/header_check") {
- $c->send_basic_header;
- $c->send_header('foo');
- $c->send_crlf;
- } elsif ($r->url->path eq "/virtual_port") {
- # return sent Host header
- $c->send_basic_header;
- $c->send_crlf;
- $c->send_response(HTTP::Response->new( 200, 'OK', undef, $r->header ('Host')));
- } else {
- $c->send_error(HTTP::Status->RC_FORBIDDEN);
+ $c->close;
}
- $c->close;
}
}
}
@@ -200,25 +219,44 @@ SKIP: {
skip "HTTP::Daemon::SSL not installed", $common_tests + $ssl_only_tests if ! exists $servers->{https};
run_common_tests( { command => "$command -p $port_https", ssl => 1 } );
+ my $expiry = "Thu Nov 28 21:02:11 2030 +0000";
+
$result = NPTest->testCmd( "$command -p $port_https -S -C 14" );
is( $result->return_code, 0, "$command -p $port_https -S -C 14" );
- is( $result->output, "OK - Certificate 'Monitoring Plugins' will expire on Fri Feb 16 15:31:44 2029 +0000.", "output ok" );
+ is( $result->output, "OK - Certificate 'Monitoring Plugins' will expire on $expiry.", "output ok" );
$result = NPTest->testCmd( "$command -p $port_https -S -C 14000" );
is( $result->return_code, 1, "$command -p $port_https -S -C 14000" );
- like( $result->output, '/WARNING - Certificate \'Monitoring Plugins\' expires in \d+ day\(s\) \(Fri Feb 16 15:31:44 2029 \+0000\)./', "output ok" );
+ like( $result->output, '/WARNING - Certificate \'Monitoring Plugins\' expires in \d+ day\(s\) \(' . quotemeta($expiry) . '\)./', "output ok" );
# Expired cert tests
$result = NPTest->testCmd( "$command -p $port_https -S -C 13960,14000" );
is( $result->return_code, 2, "$command -p $port_https -S -C 13960,14000" );
- like( $result->output, '/CRITICAL - Certificate \'Monitoring Plugins\' expires in \d+ day\(s\) \(Fri Feb 16 15:31:44 2029 \+0000\)./', "output ok" );
+ like( $result->output, '/CRITICAL - Certificate \'Monitoring Plugins\' expires in \d+ day\(s\) \(' . quotemeta($expiry) . '\)./', "output ok" );
$result = NPTest->testCmd( "$command -p $port_https_expired -S -C 7" );
is( $result->return_code, 2, "$command -p $port_https_expired -S -C 7" );
is( $result->output,
- 'CRITICAL - Certificate \'Monitoring Plugins\' expired on Wed Jan 2 11:00:26 2008 +0000.',
+ 'CRITICAL - Certificate \'Monitoring Plugins\' expired on Wed Jan 2 12:00:00 2008 +0000.',
"output ok" );
+ # client cert tests
+ my $cmd;
+ $cmd = "$command -p $port_https_clientcert"
+ . " -J \"$Bin/certs/client-cert.pem\""
+ . " -K \"$Bin/certs/client-key.pem\""
+ . " -u /statuscode/200";
+ $result = NPTest->testCmd($cmd);
+ is( $result->return_code, 0, $cmd);
+ like( $result->output, '/^HTTP OK: HTTP/1.1 200 OK - \d+ bytes in [\d\.]+ second/', "Output correct: ".$result->output );
+
+ $cmd = "$command -p $port_https_clientcert"
+ . " -J \"$Bin/certs/clientchain-cert.pem\""
+ . " -K \"$Bin/certs/clientchain-key.pem\""
+ . " -u /statuscode/200";
+ $result = NPTest->testCmd($cmd);
+ is( $result->return_code, 0, $cmd);
+ like( $result->output, '/^HTTP OK: HTTP/1.1 200 OK - \d+ bytes in [\d\.]+ second/', "Output correct: ".$result->output );
}
my $cmd;
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-22 02:26:43 +0000