ModSecurity-nginx/tests/modsecurity-h3.t at b95a97cad4cff5f4661fcf49601614fd6cc54e8d · owasp-modsecurity/ModSecurity-nginx · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
#!/usr/bin/perl

# Tests for ModSecurity module (HTTP/3).
# Tests that Host header from :authority pseudo-header is passed to ModSecurity.

###############################################################################

use warnings;
use strict;

use Test::More;

BEGIN { use FindBin; chdir($FindBin::Bin); }

use lib 'lib';
use Test::Nginx;
use Test::Nginx::HTTP3;

###############################################################################

select STDERR; $| = 1;
select STDOUT; $| = 1;

my $t = Test::Nginx->new()->has(qw/http http_v3/)
	->has_daemon('openssl');

$t->write_file_expand('nginx.conf', <<'EOF');

%%TEST_GLOBALS%%

daemon off;

events {
}

http {
    %%TEST_GLOBALS_HTTP%%

    ssl_certificate_key localhost.key;
    ssl_certificate localhost.crt;

    server {
        listen       127.0.0.1:%%PORT_8980_UDP%% quic;
        server_name  localhost;

        location / {
            modsecurity on;
            modsecurity_rules '
                SecRuleEngine On
                SecRule ARGS "@streq whee" "id:10,phase:2"
            ';
            return 200 "OK";
        }

        location /check-host {
            modsecurity on;
            modsecurity_rules '
                SecRuleEngine On
                SecRule &REQUEST_HEADERS:Host "@gt 0" "id:999,phase:1,log,pass,msg:Host header FOUND with value %{REQUEST_HEADERS.Host}"
                SecRule &REQUEST_HEADERS:Host "@eq 0" "id:920280,phase:1,deny,status:449,msg:Missing Host Header"
            ';
            return 200 "Host header present";
        }

        location /inspect-host {
            modsecurity on;
            modsecurity_rules '
                SecRuleEngine On
                SecRule REQUEST_HEADERS:Host "@streq localhost" "id:100,phase:1,pass,setvar:tx.host_matched=1"
                SecRule TX:host_matched "!@eq 1" "id:101,phase:1,deny,status:400,msg:Host header mismatch"
            ';
            return 200 "Host matched";
        }

    }
}
EOF

$t->write_file('openssl.conf', <<EOF);
[ req ]
default_bits = 2048
encrypt_key = no
distinguished_name = req_distinguished_name
[ req_distinguished_name ]
EOF

my $d = $t->testdir();

foreach my $name ('localhost') {
	system('openssl req -x509 -new '
		. "-config $d/openssl.conf -subj /CN=$name/ "
		. "-out $d/$name.crt -keyout $d/$name.key "
		. ">>$d/openssl.out 2>&1") == 0
		or die "Can't create certificate for $name: $!\n";
}

$t->run();
$t->plan(3);

###############################################################################

my ($s, $sid, $frames, $frame);

$s = Test::Nginx::HTTP3->new();
$sid = $s->new_stream({
    headers => [
        { name => ':method', value => 'GET', mode => 0 },
        { name => ':scheme', value => 'http', mode => 0 },
        { name => ':path', value => '/', mode => 0 },
        { name => ':authority', value => 'localhost', mode => 4 },
    ]
});
$frames = $s->read(all => [{ sid => $sid, fin => 1 }]);
($frame) = grep { $_->{type} eq "HEADERS" } @$frames;
is($frame->{headers}->{':status'}, 200, 'basic HTTP/3 request');

$s = Test::Nginx::HTTP3->new();
$sid = $s->new_stream({
    headers => [
        { name => ':method', value => 'GET', mode => 0 },
        { name => ':scheme', value => 'http', mode => 0 },
        { name => ':path', value => '/check-host', mode => 4 },
        { name => ':authority', value => 'localhost', mode => 4 },
    ]
});
$frames = $s->read(all => [{ sid => $sid, fin => 1 }]);
($frame) = grep { $_->{type} eq "HEADERS" } @$frames;
is($frame->{headers}->{':status'}, 200, 'Host header from :authority visible to ModSecurity');

$s = Test::Nginx::HTTP3->new();
$sid = $s->new_stream({
    headers => [
        { name => ':method', value => 'GET', mode => 0 },
        { name => ':scheme', value => 'http', mode => 0 },
        { name => ':path', value => '/inspect-host', mode => 4 },
        { name => ':authority', value => 'localhost', mode => 4 },
    ]
});
$frames = $s->read(all => [{ sid => $sid, fin => 1 }]);
($frame) = grep { $_->{type} eq "HEADERS" } @$frames;
is($frame->{headers}->{':status'}, 200, 'Host header value matches :authority');

###############################################################################