[Buildroot] [PATCH 1/2] support/testing: add new test for nginx-modsecurity

* [Buildroot] [PATCH 1/2] support/testing: add new test for nginx-modsecurity
@ 2025-06-27 12:19 Raphaël Mélotte via buildroot
  2025-06-27 12:19 ` [Buildroot] [PATCH 2/2] package/nginx-modsecurity: bump to version 1.0.4 Raphaël Mélotte via buildroot
                   ` (3 more replies)
  0 siblings, 4 replies; 6+ messages in thread
From: Raphaël Mélotte via buildroot @ 2025-06-27 12:19 UTC (permalink / raw)
  To: buildroot; +Cc: Raphaël Mélotte

This test verifies that we can run nginx with the modsecurity
directives.
It also checks a very simple rule that blocks requests containing the
keyword "blockme".

Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
---
 DEVELOPERS                                    |  2 ++
 .../tests/package/test_nginx_modsecurity.py   | 36 +++++++++++++++++++
 .../overlay/etc/nginx/modsecurity-rules.conf  |  7 ++++
 .../overlay/etc/nginx/nginx.conf              | 15 ++++++++
 4 files changed, 60 insertions(+)
 create mode 100644 support/testing/tests/package/test_nginx_modsecurity.py
 create mode 100644 support/testing/tests/package/test_nginx_modsecurity/overlay/etc/nginx/modsecurity-rules.conf
 create mode 100644 support/testing/tests/package/test_nginx_modsecurity/overlay/etc/nginx/nginx.conf

diff --git a/DEVELOPERS b/DEVELOPERS
index d127364a58..5731b4bbe0 100644
--- a/DEVELOPERS
+++ b/DEVELOPERS
@@ -2850,6 +2850,8 @@ F:	support/testing/tests/package/sample_python_sdbus.py
 F:	support/testing/tests/package/sample_python_sdbus_networkmanager.py
 F:	support/testing/tests/package/sample_python_urllib3.py
 F:	support/testing/tests/package/test_python_jmespath.py
+F:	support/testing/tests/package/test_nginx_modsecurity
+F:	support/testing/tests/package/test_nginx_modsecurity.py
 F:	support/testing/tests/package/test_python_pymupdf.py
 F:	support/testing/tests/package/test_python_rsa.py
 F:	support/testing/tests/package/test_python_s3transfer.py
diff --git a/support/testing/tests/package/test_nginx_modsecurity.py b/support/testing/tests/package/test_nginx_modsecurity.py
new file mode 100644
index 0000000000..1b34c08e20
--- /dev/null
+++ b/support/testing/tests/package/test_nginx_modsecurity.py
@@ -0,0 +1,36 @@
+import os
+
+import infra.basetest
+
+
+class TestNginxModsecurity(infra.basetest.BRTest):
+    overlay = infra.filepath("tests/package/test_nginx_modsecurity/overlay")
+    config = infra.basetest.BASIC_TOOLCHAIN_CONFIG + \
+        f"""
+        BR2_TOOLCHAIN_EXTERNAL=y
+        BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
+        BR2_USE_MMU=y
+        BR2_TARGET_ROOTFS_CPIO=y
+        BR2_TARGET_ROOTFS_CPIO_GZIP=y
+        BR2_ROOTFS_OVERLAY="{overlay}"
+        BR2_PACKAGE_NGINX=y
+        BR2_PACKAGE_NGINX_HTTP=y
+        BR2_PACKAGE_NGINX_MODSECURITY=y
+        """
+
+    def test_run(self):
+        cpio_file = os.path.join(self.builddir, "images", "rootfs.cpio")
+        self.emulator.boot(arch="armv5",
+                           kernel="builtin",
+                           options=["-initrd", cpio_file])
+        self.emulator.login()
+
+        self.assertRunOk("nginx -V")
+        self.assertRunOk("wget http://localhost/index.html")
+        self.assertRunOk("grep -F 'Welcome to nginx!' index.html")
+        cmd = "wget -q -O /dev/null --server-response 2>&1 " \
+            "http://localhost/blockme/ 2>&1 | awk '/^  HTTP/{print $2}'"
+        out, ret = self.emulator.run(cmd)
+        self.assertEqual(ret, 0)
+        # Check for HTTP 403 Unauthorized:
+        self.assertEqual(out[0], "403")
diff --git a/support/testing/tests/package/test_nginx_modsecurity/overlay/etc/nginx/modsecurity-rules.conf b/support/testing/tests/package/test_nginx_modsecurity/overlay/etc/nginx/modsecurity-rules.conf
new file mode 100644
index 0000000000..94a132a9c7
--- /dev/null
+++ b/support/testing/tests/package/test_nginx_modsecurity/overlay/etc/nginx/modsecurity-rules.conf
@@ -0,0 +1,7 @@
+SecRuleEngine On
+SecRule REQUEST_URI "@contains blockme" \
+    "id:100001, \
+    phase:2, \
+    deny, \
+    status:403, \
+    msg:'Blocked request with forbidden keyword in URI.'"
diff --git a/support/testing/tests/package/test_nginx_modsecurity/overlay/etc/nginx/nginx.conf b/support/testing/tests/package/test_nginx_modsecurity/overlay/etc/nginx/nginx.conf
new file mode 100644
index 0000000000..3d1b990557
--- /dev/null
+++ b/support/testing/tests/package/test_nginx_modsecurity/overlay/etc/nginx/nginx.conf
@@ -0,0 +1,15 @@
+events {
+    worker_connections 1024;
+}
+
+http {
+    server {
+        modsecurity on;
+        listen 80;
+        location / {
+            root   html;
+            index  index.html index.htm;
+            modsecurity_rules_file /etc/nginx/modsecurity-rules.conf;
+        }
+    }
+}
-- 
2.49.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

^ permalink raw reply related	[flat|nested] 6+ messages in thread