external/srs
1
0
Fork 0
mirror of https://github.com/ossrs/srs.git synced 2025-03-09 15:49:59 +00:00
Code Issues Releases Wiki Activity

For #1186, refactor security check. 3.0.114

Browse source
This commit is contained in:
winlin 2020-02-04 19:07:54 +08:00
parent c01806d5c4
commit c51c378869
7 changed files with 178 additions and 53 deletions
Download patch file Download diff file Expand all files Collapse all files

115
trunk/src/utest/srs_utest_app.cpp
View file

@ -26,6 +26,8 @@ using namespace std;
#include <srs_kernel_error.hpp>
#include <srs_app_fragment.hpp>
#include <srs_app_security.hpp>
#include <srs_app_config.hpp>
#include <srs_app_st.hpp>
@ -372,3 +374,116 @@ VOID TEST(AppFragmentTest, CheckDuration)
}
}
VOID TEST(AppSecurity, CheckSecurity)
{
srs_error_t err;
// Deny if no rules.
if (true) {
SrsSecurity sec; SrsRequest rr;
HELPER_EXPECT_FAILED(sec.do_check(NULL, SrsRtmpConnUnknown, "", &rr));
}
// Deny if not allowed.
if (true) {
SrsSecurity sec; SrsRequest rr; SrsConfDirective rules;
HELPER_EXPECT_FAILED(sec.do_check(&rules, SrsRtmpConnUnknown, "", &rr));
}
if (true) {
SrsSecurity sec; SrsRequest rr; SrsConfDirective rules;
rules.get_or_create("others"); rules.get_or_create("any");
HELPER_EXPECT_FAILED(sec.do_check(&rules, SrsRtmpConnUnknown, "", &rr));
}
// Deny by rule.
if (true) {
SrsSecurity sec; SrsRequest rr; SrsConfDirective rules;
rules.get_or_create("deny", "play", "all");
HELPER_EXPECT_FAILED(sec.do_check(&rules, SrsRtmpConnPlay, "", &rr));
}
if (true) {
SrsSecurity sec; SrsRequest rr; SrsConfDirective rules;
rules.get_or_create("deny", "play", "12.13.14.15");
HELPER_EXPECT_FAILED(sec.do_check(&rules, SrsRtmpConnPlay, "12.13.14.15", &rr));
}
if (true) {
SrsSecurity sec; SrsRequest rr; SrsConfDirective rules;
rules.get_or_create("deny", "play", "11.12.13.14");
if (true) {
SrsConfDirective* d = new SrsConfDirective();
d->name = "deny";
d->args.push_back("play");
d->args.push_back("12.13.14.15");
rules.directives.push_back(d);
}
HELPER_EXPECT_FAILED(sec.do_check(&rules, SrsRtmpConnPlay, "12.13.14.15", &rr));
}
// Allowed if not denied.
if (true) {
SrsSecurity sec; SrsRequest rr; SrsConfDirective rules;
rules.get_or_create("deny", "play", "all");
HELPER_EXPECT_SUCCESS(sec.do_check(&rules, SrsRtmpConnFMLEPublish, "12.13.14.15", &rr));
}
if (true) {
SrsSecurity sec; SrsRequest rr; SrsConfDirective rules;
rules.get_or_create("deny", "play", "12.13.14.15");
HELPER_EXPECT_SUCCESS(sec.do_check(&rules, SrsRtmpConnFMLEPublish, "12.13.14.15", &rr));
}
if (true) {
SrsSecurity sec; SrsRequest rr; SrsConfDirective rules;
rules.get_or_create("deny", "play", "12.13.14.15");
HELPER_EXPECT_SUCCESS(sec.do_check(&rules, SrsRtmpConnPlay, "11.12.13.14", &rr));
}
// Allowed by rule.
if (true) {
SrsSecurity sec; SrsRequest rr; SrsConfDirective rules;
rules.get_or_create("allow", "play", "12.13.14.15");
HELPER_EXPECT_SUCCESS(sec.do_check(&rules, SrsRtmpConnPlay, "12.13.14.15", &rr));
}
if (true) {
SrsSecurity sec; SrsRequest rr; SrsConfDirective rules;
rules.get_or_create("allow", "play", "all");
HELPER_EXPECT_SUCCESS(sec.do_check(&rules, SrsRtmpConnPlay, "12.13.14.15", &rr));
}
// Allowed if not denied.
if (true) {
SrsSecurity sec; SrsRequest rr; SrsConfDirective rules;
rules.get_or_create("deny", "play", "12.13.14.15");
HELPER_EXPECT_SUCCESS(sec.do_check(&rules, SrsRtmpConnFMLEPublish, "12.13.14.15", &rr));
}
if (true) {
SrsSecurity sec; SrsRequest rr; SrsConfDirective rules;
rules.get_or_create("deny", "play", "all");
HELPER_EXPECT_SUCCESS(sec.do_check(&rules, SrsRtmpConnFMLEPublish, "12.13.14.15", &rr));
}
// Denied if not allowd.
if (true) {
SrsSecurity sec; SrsRequest rr; SrsConfDirective rules;
rules.get_or_create("allow", "play", "11.12.13.14");
HELPER_EXPECT_FAILED(sec.do_check(&rules, SrsRtmpConnFMLEPublish, "12.13.14.15", &rr));
}
if (true) {
SrsSecurity sec; SrsRequest rr; SrsConfDirective rules;
rules.get_or_create("allow", "play", "11.12.13.14");
HELPER_EXPECT_FAILED(sec.do_check(&rules, SrsRtmpConnPlay, "12.13.14.15", &rr));
}
// Denied if dup.
if (true) {
SrsSecurity sec; SrsRequest rr; SrsConfDirective rules;
rules.get_or_create("allow", "play", "11.12.13.14");
rules.get_or_create("deny", "play", "11.12.13.14");
HELPER_EXPECT_FAILED(sec.do_check(&rules, SrsRtmpConnPlay, "11.12.13.14", &rr));
}
// SRS apply the following simple strategies one by one:
// 1. allow all if security disabled.
// 2. default to deny all when security enabled.
// 3. allow if matches allow strategy.
// 4. deny if matches deny strategy.
}