mirror of
https://github.com/3proxy/3proxy.git
synced 2026-11-05 01:15:48 +08:00
629a978c00
Some checks failed
C/C++ CI Linux / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Has been cancelled
C/C++ CI Linux / ${{ matrix.target }} (ubuntu-latest) (push) Has been cancelled
C/C++ CI MacOS / ${{ matrix.target }} (macos-15) (push) Has been cancelled
C/C++ CI Windows / ${{ matrix.target }} (windows-2022) (push) Has been cancelled
C/C++ CI cmake / ${{ matrix.target }} (macos-15) (push) Has been cancelled
C/C++ CI cmake / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Has been cancelled
C/C++ CI cmake / ${{ matrix.target }} (ubuntu-latest) (push) Has been cancelled
C/C++ CI cmake / ${{ matrix.target }} (windows-2022) (push) Has been cancelled
C/C++ CI cmake / ubuntu-latest (wolfSSL) (push) Has been cancelled
3proxy --help (and the usage message of a bad invocation) now lists what the build was made with: TLS and its backend, RADIUS, PCRE, IPv6, UNIX sockets, the built-in HTTP server, transparency, ODBC and the optional proxy services. The test runner reads the list before the first case and the cases state the features they need with t.skip_unless(), so a build without a feature skips its cases instead of failing them; a binary too old to report anything skips the cases with needs and runs the rest.
52 lines
1.7 KiB
Python
52 lines
1.7 KiB
Python
"""Authentication and access rules in front of the HTTP server."""
|
|
|
|
|
|
def run(t):
|
|
if not t.skip_unless("httpsrv"):
|
|
return
|
|
srv = t.free_port()
|
|
openport = t.free_port()
|
|
t.start("httpsrv_auth", f"""
|
|
log
|
|
http echo * /echo
|
|
auth strong
|
|
users alice:CL:secret bob:CL:hunter2
|
|
allow alice
|
|
httpsrv -p{srv}
|
|
|
|
flush
|
|
http echo * /echo
|
|
auth iponly
|
|
allow *
|
|
httpsrv -p{openport}
|
|
""", ports=[srv, openport])
|
|
|
|
url = f"http://127.0.0.1:{srv}"
|
|
|
|
r = t.http(url + "/echo")
|
|
t.eq(401, r.status, "no credentials gives 401")
|
|
t.ne(None, r.header("WWW-Authenticate"),
|
|
"the 401 carries a WWW-Authenticate header")
|
|
|
|
t.eq(200, t.http(url + "/echo", auth=("alice", "secret")).status,
|
|
"valid credentials pass")
|
|
t.eq(401, t.http(url + "/echo", auth=("alice", "wrong")).status,
|
|
"a wrong password gives 401")
|
|
t.eq(401, t.http(url + "/echo", auth=("nobody", "secret")).status,
|
|
"an unknown user gives 401")
|
|
|
|
# bob authenticates, but no rule admits him
|
|
t.eq(403, t.http(url + "/echo", auth=("bob", "hunter2")).status,
|
|
"authenticated but not allowed gives 403")
|
|
|
|
# authentication comes before dispatch, so an unmatched URL still needs it
|
|
t.eq(401, t.http(url + "/nosuchpath").status,
|
|
"authentication precedes the rule lookup")
|
|
|
|
# the second service kept its own iponly authentication
|
|
t.eq(200, t.http(f"http://127.0.0.1:{openport}/echo").status,
|
|
"the open service needs no credentials")
|
|
|
|
t.contains(t.http(url + "/echo", auth=("alice", "secret")), "path=/echo",
|
|
"an authenticated request is dispatched")
|