lua-cs-bouncer/t/21_appsec_challenge.t at a8352c751e790440a4a2b1eb6056a2da973867c0 · crowdsecurity/lua-cs-bouncer · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
use Test::Nginx::Socket 'no_plan';

run_tests();

__DATA__

=== TEST 1: AppSec 'challenge' remediation serves the challenge page, headers and cookie

--- main_config
load_module /usr/share/nginx/modules/ndk_http_module.so;
load_module /usr/share/nginx/modules/ngx_http_lua_module.so;

--- http_config

lua_package_path './lib/?.lua;;';
lua_shared_dict crowdsec_cache 50m;
lua_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;


init_by_lua_block
{
        cs = require "crowdsec"
        local ok, err = cs.init("./t/conf_t/21_appsec_challenge_crowdsec_nginx_bouncer.conf", "crowdsec-nginx-bouncer/v1.0.8")
        if ok == nil then
                ngx.log(ngx.ERR, "[Crowdsec] " .. err)
                error()
        end
        ngx.log(ngx.ALERT, "[Crowdsec] Initialisation done")
}

server {
    listen 8081;

       location = /v1/decisions {
            content_by_lua_block {
                -- no local decision for the IP, so the request reaches AppSec
                ngx.print('null')
            }
       }
}

server {
    listen 7422;

       location / {
            content_by_lua_block {
                -- AppSec signals a remediation (403) and asks the bouncer to
                -- serve a challenge page verbatim with a 200 status.
                ngx.status = 403
                ngx.print([[{"action":"challenge","http_status":200,"user_body_content":"<html><body>cs-challenge-marker<script>console.log('cs')</script></body></html>","user_headers":{"Content-Type":["text/html"]},"user_cookies":["cs_challenge=abc123; Path=/; HttpOnly"]}]])
            }
       }
}


--- config


location = /t {
    set_real_ip_from 127.0.0.1;
    real_ip_header   X-Forwarded-For;
    real_ip_recursive on;
    access_by_lua_block {
        local cs = require "crowdsec"
        cs.Allow(ngx.var.remote_addr)
    }
    content_by_lua_block {
        -- must never be reached: the challenge short-circuits the request
        ngx.say("Hello, world")
    }
}

--- raw_request eval
"GET /t HTTP/1.1\r\nHost: localhost\r\nX-Forwarded-For: 1.1.1.2\r\nConnection: close\r\n\r\n"

--- response_body eval
"<html><body>cs-challenge-marker<script>console.log('cs')</script></body></html>"
--- response_headers
Content-Type: text/html
Set-Cookie: cs_challenge=abc123; Path=/; HttpOnly
--- error_code: 200


=== TEST 2: AppSec 'challenge' remediation does not leak the protected content

--- main_config
load_module /usr/share/nginx/modules/ndk_http_module.so;
load_module /usr/share/nginx/modules/ngx_http_lua_module.so;

--- http_config

lua_package_path './lib/?.lua;;';
lua_shared_dict crowdsec_cache 50m;
lua_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;


init_by_lua_block
{
        cs = require "crowdsec"
        local ok, err = cs.init("./t/conf_t/21_appsec_challenge_crowdsec_nginx_bouncer.conf", "crowdsec-nginx-bouncer/v1.0.8")
        if ok == nil then
                ngx.log(ngx.ERR, "[Crowdsec] " .. err)
                error()
        end
        ngx.log(ngx.ALERT, "[Crowdsec] Initialisation done")
}

server {
    listen 8081;

       location = /v1/decisions {
            content_by_lua_block {
                ngx.print('null')
            }
       }
}

server {
    listen 7422;

       location / {
            content_by_lua_block {
                ngx.status = 403
                ngx.print([[{"action":"challenge","http_status":200,"user_body_content":"<html><body>cs-challenge-marker</body></html>","user_headers":{"Content-Type":["text/html"]},"user_cookies":["cs_challenge=abc123; Path=/; HttpOnly"]}]])
            }
       }
}


--- config


location = /t {
    set_real_ip_from 127.0.0.1;
    real_ip_header   X-Forwarded-For;
    real_ip_recursive on;
    access_by_lua_block {
        local cs = require "crowdsec"
        cs.Allow(ngx.var.remote_addr)
    }
    content_by_lua_block {
        ngx.say("protected-origin-content")
    }
}

--- raw_request eval
"GET /t HTTP/1.1\r\nHost: localhost\r\nX-Forwarded-For: 1.1.1.3\r\nConnection: close\r\n\r\n"

--- response_body_unlike: protected-origin-content
--- error_code: 200