chore: add HTTP/2 tests

Author: theseion

.github/workflows/verifyimage.yml

@@ -88,27 +88,92 @@ jobs:
             README.md \
             "${{ matrix.target }}.env"
           echo "Starting container ${{ matrix.target }}-verification"
+          # The backend is a dummy
           docker run \
             --pull "never" \
             -d \
             --name ${{ matrix.target }}-test \
             --env-file "${{ matrix.target }}.env" \
+            -p 8080:8080 \
+            -e BACKEND=http://localhost:9999 \
             "${{ matrix.target }}-verification"
-          sleep 30
-          docker logs ${{ matrix.target }}-test
 
       - name: Verify ${{ matrix.target }}
         run: |
-          [ $(docker inspect ${{ matrix.target }}-test --format='{{.State.Running}}') = 'true' ]
-          if grep -q  "nginx "<<< "${{ matrix.target }}"; then
-            curl -q -D headers.txt http://localhost:8080/?test=../../etc/passwd
+          HOST_AND_PORT="localhost:8080"
+          counter=10
+          while true; do
+            printf "Checking whether container is running..."
+            if [ $(docker inspect ${{ matrix.target }}-test --format='{{.State.Running}}') = 'true' ]; then
+              echo "ok"
+              printf "Trying to connect..."
+              if curl -s --connect-timeout 5 --max-time 1 "${HOST_AND_PORT}" > /dev/null 2>&1; then
+                echo "ok"
+                break
+              fi
+            fi
+
+            echo "failed"
+            ((counter--))
+            if [ ${counter} -gt 0 ]; then
+              echo "Will retry in 5 seconds"
+              sleep 5
+            else
+              printf "No more retries. Here'se the log output from the container\n\n\n"
+              docker logs ${{ matrix.target }}-test
+              exit 1
+            fi
+          done
+
+          if grep -q  "nginx"<<< "${{ matrix.target }}"; then
+            printf "\n\n### nginx tests ###\n\n"
+
+            printf "Storing headers for sample attack..."
+            curl -s -D headers.txt -o /dev/null "${HOST_AND_PORT}/?test=../../etc/passwd"
+            printf "...done\n\n\n"
+
+            printf "Check status 403..."
             grep -q "HTTP/1.1 403 Forbidden" headers.txt
+            printf yes\n\n\n"
+
+            printf "Check 'Access-Control-Allow-Origin' header..."
             grep -q "Access-Control-Allow-Origin: *" headers.txt
+            printf yes\n\n\n"
+
+            printf "Check 'Access-Control-Max-Age' header..."
             grep -q "Access-Control-Max-Age: 3600" headers.txt
+            printf yes\n\n\n"
+
+            printf "Check 'Access-Control-Allow-Methods' header..."
             grep -q "Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS" headers.txt
+            printf yes\n\n\n"
+
+            printf "Check 'Access-Control-Allow-Headers'..."
             grep -q "Access-Control-Allow-Headers: *" headers.txt
+            printf yes\n\n\n"
+
+            echo "### nginx tests - done ###"
           fi
 
+          printf "\n\n### generic tests ###\n\n"
+
+          echo "Test HTTP/2 upgrade..."
+          curl -v --http2 --no-progress-meter -o /dev/null "${HOST_AND_PORT}" 2>&1 | tee out.txt
+          grep -iP "< 101 Switching Protocols|< HTTP/2" < out.txt | tee out2.txt
+          wc -l out2.txt | grep -qoP "\d+" | xargs -I % test % -eq 2
+          rm out*.txt
+          printf ...yes\n\n\n"
+
+          echo "Test HTTP/2 prior knowledge..."
+          curl -v --http2-prior-knowledge --no-progress-meter -o /dev/null "${HOST_AND_PORT}"
+          curl -v --http2-prior-knowledge --no-progress-meter -o /dev/null "${HOST_AND_PORT}" 2>&1 | tee out.txt
+          grep --help
+          grep -i "< HTTP/2" out.txt
+          grep -iv "< 101 Switching Protocols" out.txt
+          printf ...yes\n\n\n"
+
+          echo "### generic tests - done ###"
+
       - name: Checkout CRS
         uses: actions/checkout@v4
         with:

apache/Dockerfile

@@ -71,7 +71,7 @@ ENV \
     APACHE_ERRORLOG_FORMAT='"[%{u}t] [%-m:%l] [pid %P:tid %T] %7F: %E: [client\ %a] %M% ,\ referer\ %{Referer}i"' \
     APACHE_LOGFORMAT='"%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\""' \
     APACHE_METRICS_LOGFORMAT='"%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\""' \
-    BACKEND=http://localhost:8080 \
+    BACKEND=http://localhost:80 \
     BACKEND_WS=ws://localhost:8081 \
     ERRORLOG='/proc/self/fd/2' \
     H2_DIRECT=on \

docker-compose.yaml

@@ -1,12 +1,4 @@
 # This docker-compose file starts owasp/modsecurity-crs
-#
-# ATTENTION!
-# Some of the environment variables at the bottom of this
-# docker-compose.yaml file and TLS are only available
-# for self-built images based on Dockerfile-2.9-apache,
-# and only if build args SETTLS and SETPROXY were set during
-# the build of the parent owasp/modsecurity:2.9-apache image.
-
 x-defaults: &default-settings
   environment:
     SERVERNAME: localhost
@@ -29,18 +21,6 @@ x-defaults: &default-settings
     # New in CRS 4
     REPORTING_LEVEL: 2
 
-    #######################################################
-    # Reverse Proxy mode
-    # (only available if SETPROXY was enabled during the
-    # parent ModSecurity image)
-    #######################################################
-    # PROXYLOCATION: Application Backend of Reverse Proxy
-    # PROXYLOCATION: http://app:8000/
-    #
-    # If needed: add own httpd-proxy.conf (only available if SETPROXY
-    # was enabled during build of parent ModSecurity image)
-    #  - ./httpd-proxy.conf:/usr/local/apache2/conf/extra/httpd-proxy.conf
-
     #######################################################
     # Various CRS Variables with Default Values
     #######################################################
@@ -73,8 +53,6 @@ x-defaults: &default-settings
 
     #######################################################
     # Add TLS server certificate and key
-    # (only available if SETPROXY was enabled during the
-    # parent ModSecurity image)
     #######################################################
     #  - ./server.crt:/usr/local/apache2/conf/server.crt
     #  - ./server.key:/usr/local/apache2/conf/server.key
@@ -83,15 +61,13 @@ services:
   crs-apache:
     image: owasp/modsecurity-crs:apache
     ports:
-      - "80:8080"
-      # only available if SETTLS was enabled:      
+      - "8080:8080"
       - "443:8443"
     <<: *default-settings
 
   crs-nginx:
     image: owasp/modsecurity-crs:nginx
     ports:
-      - "80:8080"
-      # only available if SETTLS was enabled:
+      - "8080:8080"
       - "443:8443"
     <<: *default-settings