1 file changed, 26 insertions, 16 deletions

diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.luaindex 8306aaf..3470741 100644--- a/tests/extensions/test-auth.lua+++ b/tests/extensions/test-auth.lua@@ -1,16 +1,18 @@ -- Unit checks for the two auth filters, run under a standalone Lua by -- t0505-auth.sh with the script path as the first argument, the variant, -- inline or file, as the second and a directory of the run's own as the--- third, which takes the fixtures. The scripts take luaossl and luaposix at--- load, so the harness meets both with deterministic stand-ins, which keeps--- every check about this script's own logic, the cookie layout, the expiry--- and field rules, the redirect vetting and the action flows, rather than--- about OpenSSL. The signing secret is made in the run's directory, and--- the accounts and access lists are filled through each variant's own--- channel, its commented-out examples switched on for the inline script and--- fixture files reached through a redirected io.open for the file one. Both--- variants carry the same data so the flow checks read identically for the--- two.+-- third, which takes the fixtures and the signing secret. The scripts need+-- luaossl and luaposix, which the harness meets with deterministic+-- stand-ins, so the checks are about the script's own logic, the cookie+-- layout, the expiry and field rules, the redirect vetting and the action+-- flows, rather than about OpenSSL. Given a fourth argument, a hash the+-- system's crypt(3) makes of the password below, the same checks run+-- against the real libraries instead, which is where a misuse of their+-- interfaces would show. The accounts and access lists are filled through+-- each variant's own channel, its commented-out examples switched on for+-- the inline script and fixture files reached through a redirected io.open+-- for the file one. Both variants carry the same data so the flow checks+-- read identically for the two.  local test_directory = arg[0]:match("^(.*)/") or "." local h = dofile(test_directory .. "/harness.lua")@@ -18,13 +20,17 @@ local h = dofile(test_directory .. "/harness.lua") local script = arg[1] local variant = arg[2] local directory = assert(arg[3], "test-auth.lua needs a directory for its fixtures")+local real_hash = arg[4] -h.stub_auth_modules()+if real_hash == nil then+	h.stub_auth_modules()+end --- The password behind every test account, stored as what the harness crypt--- stand-in returns for it so a login with it verifies and any other fails.+-- The password behind every test account. With the stand-ins it is stored+-- as what their crypt returns for it, so a login with it verifies and any+-- other fails. local password = "open sesame"-local stored_hash = "$6$rounds=300000$testsalt$" .. password+local stored_hash = real_hash or "$6$rounds=300000$testsalt$" .. password  if variant == "file" then 	local users_file = io.open(directory .. "/auth-users", "w")@@ -81,8 +87,8 @@ load_script() -- Served over https at the root, the session cookie takes the __Host- name. local session_name = "__Host-cgitauth" --- crypt is watched through its stand-in module, so a check can see whether--- a login spent it and on which hash.+-- crypt is watched through the module the script requires, so a check can+-- see whether a login spent it and on which hash. local unistd = require("posix.unistd") local real_crypt = unistd.crypt local crypt_settings = {}@@ -134,6 +140,10 @@ local _, made = pcall(get_secret) h.check("a new secret is 64 hex characters", 	type(made) == "string" and #made == 64 and not made:find("%X"), tostring(made)) h.equals("and is what its file holds", read_file(directory .. "/auth-secret"), made)+if real_hash then+	local stat = sysstat.stat(directory .. "/auth-secret")+	h.equals("which only its owner can read", stat and stat.st_mode % 512, 384)+end h.equals("it is written under a mask that keeps everyone else out", umasks[1] and umasks[1].mask, 63) h.check("and the mask before it goes back after", 	#umasks == 2 and umasks[2].mask == umasks[1].old)
diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua
index 8306aaf..3470741 100644
--- a/tests/extensions/test-auth.lua
+++ b/tests/extensions/test-auth.lua
@@ -1,16 +1,18 @@
 -- Unit checks for the two auth filters, run under a standalone Lua by
 -- t0505-auth.sh with the script path as the first argument, the variant,
 -- inline or file, as the second and a directory of the run's own as the
--- third, which takes the fixtures. The scripts take luaossl and luaposix at
--- load, so the harness meets both with deterministic stand-ins, which keeps
--- every check about this script's own logic, the cookie layout, the expiry
--- and field rules, the redirect vetting and the action flows, rather than
--- about OpenSSL. The signing secret is made in the run's directory, and
--- the accounts and access lists are filled through each variant's own
--- channel, its commented-out examples switched on for the inline script and
--- fixture files reached through a redirected io.open for the file one. Both
--- variants carry the same data so the flow checks read identically for the
--- two.
+-- third, which takes the fixtures and the signing secret. The scripts need
+-- luaossl and luaposix, which the harness meets with deterministic
+-- stand-ins, so the checks are about the script's own logic, the cookie
+-- layout, the expiry and field rules, the redirect vetting and the action
+-- flows, rather than about OpenSSL. Given a fourth argument, a hash the
+-- system's crypt(3) makes of the password below, the same checks run
+-- against the real libraries instead, which is where a misuse of their
+-- interfaces would show. The accounts and access lists are filled through
+-- each variant's own channel, its commented-out examples switched on for
+-- the inline script and fixture files reached through a redirected io.open
+-- for the file one. Both variants carry the same data so the flow checks
+-- read identically for the two.
 
 local test_directory = arg[0]:match("^(.*)/") or "."
 local h = dofile(test_directory .. "/harness.lua")
@@ -18,13 +20,17 @@ local h = dofile(test_directory .. "/harness.lua")
 local script = arg[1]
 local variant = arg[2]
 local directory = assert(arg[3], "test-auth.lua needs a directory for its fixtures")
+local real_hash = arg[4]
 
-h.stub_auth_modules()
+if real_hash == nil then
+	h.stub_auth_modules()
+end
 
--- The password behind every test account, stored as what the harness crypt
--- stand-in returns for it so a login with it verifies and any other fails.
+-- The password behind every test account. With the stand-ins it is stored
+-- as what their crypt returns for it, so a login with it verifies and any
+-- other fails.
 local password = "open sesame"
-local stored_hash = "$6$rounds=300000$testsalt$" .. password
+local stored_hash = real_hash or "$6$rounds=300000$testsalt$" .. password
 
 if variant == "file" then
 	local users_file = io.open(directory .. "/auth-users", "w")
@@ -81,8 +87,8 @@ load_script()
 -- Served over https at the root, the session cookie takes the __Host- name.
 local session_name = "__Host-cgitauth"
 
--- crypt is watched through its stand-in module, so a check can see whether
--- a login spent it and on which hash.
+-- crypt is watched through the module the script requires, so a check can
+-- see whether a login spent it and on which hash.
 local unistd = require("posix.unistd")
 local real_crypt = unistd.crypt
 local crypt_settings = {}
@@ -134,6 +140,10 @@ local _, made = pcall(get_secret)
 h.check("a new secret is 64 hex characters",
 	type(made) == "string" and #made == 64 and not made:find("%X"), tostring(made))
 h.equals("and is what its file holds", read_file(directory .. "/auth-secret"), made)
+if real_hash then
+	local stat = sysstat.stat(directory .. "/auth-secret")
+	h.equals("which only its owner can read", stat and stat.st_mode % 512, 384)
+end
 h.equals("it is written under a mask that keeps everyone else out", umasks[1] and umasks[1].mask, 63)
 h.check("and the mask before it goes back after",
 	#umasks == 2 and umasks[2].mask == umasks[1].old)