Skip to content
Snippets Groups Projects

Compare revisions

Changes are shown as if the source revision was being merged into the target revision. Learn more about comparing revisions.

Source

Select target project
No results found

Target

Select target project
  • fornari/ngx_http_voms_module
  • cnafsd/ngx_http_voms_module
2 results
Show changes
Commits on Source (167)
67 additional commits have been omitted to prevent performance issues.
Hide whitespace changes
Inline Side-by-side
Showing
with 363 additions and 372 deletions
.devcontainer/Dockerfile
View file @ 3c4a7183
# Copyright 2018-2022 Istituto Nazionale di Fisica Nucleare # Copyright 2018-2023 Istituto Nazionale di Fisica Nucleare
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
FROM centos:7 FROM almalinux:9
# Allow customization of build user ID and name # Allow customization of build user ID and name
ARG DEV_USER=vscode ARG USERNAME=vscode
ARG DEV_USER_UID=1000 ARG USER_UID=1000
ARG DEV_GID=${DEV_USER_UID} ARG USER_GID=${USER_UID}
ENV DEV_USER $DEV_USER COPY library-scripts/*.sh /tmp/library-scripts/
ENV DEV_USER_UID $DEV_USER_UID
ENV DEV_GID ${DEV_USER_UID}
COPY assets/provide-user.sh /docker/ RUN \
COPY assets/setup.sh /docker/ sh /tmp/library-scripts/provide-dev-deps.sh && \
COPY assets/user-setup.sh /docker/ sh /tmp/library-scripts/provide-user.sh ${USERNAME} ${USER_UID} ${USER_GID} && \
COPY assets/build-install-openresty.sh /docker/ dnf clean all && rm -rf /var/cache/dnf
RUN yum update -y && \ USER $USERNAME
sh /docker/setup.sh && \
sh /docker/provide-user.sh ${DEV_USER} ${DEV_USER_UID} ${DEV_GID} && \
yum clean all && rm -rf /var/cache/yum
COPY --chown=$DEV_USER:$DEV_USER assets/nginx-httpg_no_delegation.patch /home/$DEV_USER/
COPY --chown=$DEV_USER:$DEV_USER assets/build-install-ngx-voms.sh /home/$DEV_USER/bin/
USER $DEV_USER
RUN sh /docker/build-install-openresty.sh && \
sh /docker/user-setup.sh
\ No newline at end of file
.devcontainer/README.md 0 → 100644
View file @ 3c4a7183
# `ngx_http_voms_module` for developers
A devcontainer is ready to use for the developers. A set of packages without nginx are already installed.
## How to build and install nginx with or without httpg patch
To build and install the latest stable version of [nginx](http://nginx.org/en/download.html) you have to copy the `nginx.repo` file (it is contained in the `docker` directory) into the `/etc/yum.repos.d/` directory and install nginx with `yum`:
```shell
$ sudo cp docker/nginx.repo /etc/yum.repos.d/
$ sudo yum install -y nginx
```
Otherwise, if you want to build and install the latest stable version of [nginx](http://nginx.org/en/download.html) with the httpg patch, a bash library is ready to use. You can source it and follow the commands below:
```shell
$ source .devcontainer/assets/build-library.sh
$ downloadNginx
$ buildHttpgNginxRPM
$ sudo rpm -ivh ~/rpmbuild/RPMS/x86_64/nginx-*.httpg.x86_64.rpm
```
## How to build and install the `ngx_http_voms_module`
If you want to build and install the `ngx_http_voms_module`, nginx have to be installed in the container (see the previous section). When this requirement is satisfied, you can use the library contained in the `.devcontainer/assets` folder as follows (NOTE: if you have already download nginx source file, you can skip the relative command):
```shell
$ source .devcontainer/assets/build-library.sh
$ downloadNginx
$ buildVomsModuleRPM
$ sudo rpm -ivh ~/rpmbuild/RPMS/x86_64/nginx-module-http-voms-*.x86_64.rpm
```
## How to manage this project
If you want to understand how this project works, start from the CI. Three stages are defined:
### 1. build-rpms
Starting from a clear AlmaLinux 9, we install all the useful packages to compile nginx and to build a rpm package. The bash steps that achieves these results are defined in the `.devcontainer/assets/build-library.sh` file, so you can read that bash script to learn which nginx version we use, how to download it, how to set up the environment and how to build the rpm.
It is important to underline that to build the nginx rpm we use the spec file in the `rpm` repo, that is the official nginx 1.24.0 spec file increased by the HTTPG patch. To build the `ngx_http_voms_module` we have defined an appropriate spec file indeed. The files that are used to build the rpm module are written, called and collocated following the common practices of the nginx modules: a source file is defined in the `src` folder, the `config` and the `config.make` files are in the root project directory.
At the end of this stage, all the useful rpms are saved as job artifacts.
### 2. docker-build-rpms
In this stage we set up a docker image with nginx, the httpg patch and the `ngx_http_voms_module`. To do this, we use a set of scripts in the [`helper-scripts`](https://baltig.infn.it/mw-devel/helper-scripts.git) project.
The dockerfile and all the files needed for its compilation are in the `docker` directory. The image starts from AlmaLinux 9, defines a user and installs a set of useful packages. After that we import the nginx repo file, in this way we can download a lot of packages provided by nginx, including its last stable version. In the end we install the rpm packages that we build in the previous stage and the njs module.
### 3. push-to-dockerhub
In this last stage we push on dockerhub the image that we have builded in the previous stage. Note that this stage is run only when we push something in the master branch.
.devcontainer/assets/build-install-ngx-voms.sh deleted 100644 → 0
View file @ 08cee99c
#!/bin/sh
# Copyright 2018-2022 Istituto Nazionale di Fisica Nucleare
# SPDX-License-Identifier: EUPL-1.2
# This script builds in debug mode and installs openresty together with the
# ngx_http_voms_module.
#
# The script requires the locations of the openresty bundle and of the
# ngx_http_voms_module code (for example as checked-out from git). The locations
# are expressed by the environment variables OPENRESTY_ROOT and
# NGX_HTTP_VOMS_MODULE_ROOT respectively, if available. If they are not set,
# they are guessed:
# * a unique openresty bundle is looked for in ${HOME}
# * the ngx_http_voms_module code is looked for in the working directory of the
# continuous integration environment first and then in ${HOME}
#
# The script works best (i.e. it is tested) if run within a docker container
# started from the storm2/ngx-voms-build image.
usage()
{
echo "USAGE: $0 [OPTIONS] [TEXT]"
echo ""
echo "The default optimization level is -O3"
echo ""
echo "OPTIONS"
echo ""
echo "-h|--help"
echo "-o|--opt-log to enable the --with-debug option and the optimization level -O2"
echo "-d|--debug to enable the --with-debug option and the optimization level -O0"
echo "-c|--coverage to add the --coverage option to the --with-{ld|cc}-opt option and enable the debug options"
echo ""
}
#The script at the moment allows only debug builds, i.e. "-O0". This option is kept in shell variables cc2, but there is no way to set it to something else. I propose that by default it is set to -O2 (or even -O3) and is set to -O0 only if the option --debug is passed to the script. Moreover --coverage should imply --debug.
cc1=-g
debug=""
cc3=""
cc2=-O2
ld=""
while [ "$1" != "" ]; do
option=`echo $1 | awk -F= '{print $1}'`
case $option in
-o|--opt-log)
debug='--with-debug'
cc2=-O2
echo Enabled the debug option $debug and the optimization level $cc2
;;
-d|--debug)
debug='--with-debug'
cc2=-O0
echo Enabled the debug option $debug and the optimization level $cc2
;;
-c|--coverage)
cc3=--coverage
ld='--with-ld-opt=--coverage'
echo Enabled the coverage options $cc3 $ld
;;
-h|--help)
usage
exit
;;
*)
debug=""
cc3=""
cc2=-O2
ld=""
;;
esac
shift
done
if [ ! -z "${cc3}" ]; then
if [ -z "${debug}" ]; then
debug="--with-debug"
cc2=-O0
echo Enabled the debug option $debug and the optimization level $cc2
fi
fi
if [ -f "${HOME}/openresty-env" ]; then
. ${HOME}/openresty-env
fi
gcc --version
openresty_root=${OPENRESTY_ROOT:-$(ls -d ${HOME}/openresty-*/ 2> /dev/null)}
if [ $(echo ${openresty_root} | wc -w) != 1 -o ! -d "${openresty_root}" ]; then
>&2 echo 'Invalid openresty environment ("'${openresty_root}'")'
exit 1
fi
module_root=${NGX_HTTP_VOMS_MODULE_ROOT:-${CI_PROJECT_DIR:-${HOME}/ngx_http_voms_module}}
if [ ! -d "${module_root}" ]; then
>&2 echo 'Invalid ngx_http_voms_module environment ("'${module_root}'")'
exit 1
fi
RESTY_PACKAGES_PREFIX=/usr/local/openresty
ZLIB_PREFIX=/usr
OPENSSL_PREFIX=/usr
PCRE_PREFIX=/usr
cd ${openresty_root}
./configure \
--with-cc="ccache gcc -fdiagnostics-color=always" \
--with-cc-opt="-DNGX_LUA_ABORT_AT_PANIC -I${ZLIB_PREFIX}/include -I${PCRE_PREFIX}/include -I${OPENSSL_PREFIX}/include" \
--with-ld-opt="-L${ZLIB_PREFIX}/lib -L${PCRE_PREFIX}/lib -L${OPENSSL_PREFIX}/lib -Wl,-rpath,${ZLIB_PREFIX}/lib:${PCRE_PREFIX}/lib:${OPENSSL_PREFIX}/lib" \
--with-luajit-xcflags="-DLUAJIT_NUMMODE=2 -DLUAJIT_ENABLE_LUA52COMPAT" \
${RESTY_CONFIG_OPTIONS} \
${debug} \
--with-cc-opt="${cc1} ${cc2} ${cc3}" \
${ld} \
--add-module=${module_root}
nginx_version=$(find build -name nginx.h | xargs awk '/define NGINX_VERSION/ {print $3}' | tr -d '"')
cd build/nginx-${nginx_version}
patch -p1 < ${HOME}/nginx-httpg_no_delegation.patch
cd -
make -j $(nproc)
make install
.devcontainer/assets/build-install-openresty.sh deleted 100644 → 0
View file @ 08cee99c
#!/bin/sh
# Copyright 2018-2022 Istituto Nazionale di Fisica Nucleare
# SPDX-License-Identifier: EUPL-1.2
# adapted from https://github.com/openresty/docker-openresty
set -ex
# configuring, building and installing is not strictly necessary, since
# module development requires to rebuild nginx itself, but it's a good
# check to see if everything is ok
# configuring has the benefit that it builds and installs luajit, which
# can then be reused during development (see the additions to .bashrc)
# Docker Build Arguments
RESTY_VERSION=${RESTY_VERSION:-"1.19.9.1"}
RESTY_PREFIX=${HOME}/local/openresty
RESTY_CONFIG_OPTIONS="\
--with-compat \
--with-http_addition_module \
--with-http_auth_request_module \
--with-http_dav_module \
--with-http_flv_module \
--with-http_gunzip_module \
--with-http_gzip_static_module \
--with-http_mp4_module \
--with-http_random_index_module \
--with-http_realip_module \
--with-http_secure_link_module \
--with-http_stub_status_module \
--with-http_sub_module \
--with-http_v2_module \
--without-http_rds_csv_module \
--without-http_rds_json_module \
--without-lua_rds_parser \
--without-mail_imap_module \
--without-mail_pop3_module \
--without-mail_smtp_module \
--with-pcre-jit \
--with-stream \
--with-stream_ssl_module \
--with-stream_ssl_preread_module \
--with-threads \
--prefix=${RESTY_PREFIX} \
"
cd
wget --quiet https://openresty.org/download/openresty-${RESTY_VERSION}.tar.gz
tar zxf openresty-${RESTY_VERSION}.tar.gz
cd openresty-${RESTY_VERSION}
./configure \
--with-cc="ccache gcc -fdiagnostics-color=always" \
--with-cc-opt="-DNGX_LUA_ABORT_AT_PANIC" \
--with-luajit-xcflags="-DLUAJIT_NUMMODE=2 -DLUAJIT_ENABLE_LUA52COMPAT" \
${RESTY_CONFIG_OPTIONS}
make
make install
# add the location of openresty executables to the PATH
# save resty configuration options for future reuse during development
cat << EOF > ${HOME}/openresty-env
PATH="${RESTY_PREFIX}/luajit/bin:${RESTY_PREFIX}/nginx/sbin:${RESTY_PREFIX}/bin:\${PATH}"
export RESTY_CONFIG_OPTIONS="${RESTY_CONFIG_OPTIONS} --with-luajit=${RESTY_PREFIX}/luajit"
EOF
.devcontainer/assets/build-library.sh 0 → 100644
View file @ 3c4a7183
#!/usr/bin/env bash
# Copyright 2018-2023 Istituto Nazionale di Fisica Nucleare
# SPDX-License-Identifier: EUPL-1.2
downloadNginx() {
# check if ~/rpmbuild exists and is not empty
if [ -d ${HOME}/rpmbuild ] && [ "$(ls -A ${HOME}/rpmbuild)" ]; then
>&2 echo "Error: ${HOME}/rpmbuild already exists and is not empty"
return 1
fi
# set nginx version
if [ -z ${ngxVersion} ]; then
ngxVersion=1.26.2-1
fi
elVersion=$(rpmbuild --eval %{rhel})
echo "Downloading nginx version ${ngxVersion} (EL${elVersion})"
src_package_name="nginx-${ngxVersion}.el${elVersion}.ngx.src.rpm"
src_package_url="https://nginx.org/packages/centos/${elVersion}/SRPMS/${src_package_name}"
wget ${src_package_url}
rpm -i ${src_package_name}
}
buildHttpgNginxRPM() {
if ! printenv CI_PROJECT_DIR > /dev/null; then
>&2 echo "CI_PROJECT_DIR is not set in the environment, assuming the current working directory '${PWD}'"
export CI_PROJECT_DIR="${PWD}"
fi
sh ${CI_PROJECT_DIR}/rpm/addPatchToNginxSpec.sh
# build rpm
rpmlint ~/rpmbuild/SPECS/nginx.spec
rpmbuild -ba ~/rpmbuild/SPECS/nginx.spec
}
buildVomsModuleRPM() {
if [ -z ${CI_PROJECT_DIR} ]; then
CI_PROJECT_DIR="/workspaces/ngx_http_voms_module"
fi
# set voms modules sources
cd ~/rpmbuild/SOURCES/
mkdir ngx-http-voms-module
cp ${CI_PROJECT_DIR}/config ngx-http-voms-module/
cp ${CI_PROJECT_DIR}/config.make ngx-http-voms-module/
cp -r ${CI_PROJECT_DIR}/src ngx-http-voms-module/
cp ${CI_PROJECT_DIR}/rpm/nginx-module-http-voms.spec ~/rpmbuild/SPECS
# build rpm
rpmlint ~/rpmbuild/SPECS/nginx-module-http-voms.spec
rpmbuild -ba ~/rpmbuild/SPECS/nginx-module-http-voms.spec
cd ${CI_PROJECT_DIR}
}
.devcontainer/assets/nginx-httpg_no_delegation.patch deleted 100644 → 0
View file @ 08cee99c
diff --git a/src/http/ngx_http_parse.c b/src/http/ngx_http_parse.c
index d9a1dbed..7438816e 100644
--- a/src/http/ngx_http_parse.c
+++ b/src/http/ngx_http_parse.c
@@ -149,7 +149,13 @@ ngx_http_parse_request_line(ngx_http_request_t *r, ngx_buf_t *b)
break;
}
- if ((ch < 'A' || ch > 'Z') && ch != '_' && ch != '-') {
+ if (ch == '0') {
+ // httpg with no delegation
+ // eat the character and continue with the rest of the request
+ ngx_log_debug0(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, "httpg request w/o delegation");
+ r->request_start++;
+ // httpg with a delegation request would fail for an unknown method
+ } else if ((ch < 'A' || ch > 'Z') && ch != '_' && ch != '-') {
return NGX_HTTP_PARSE_INVALID_METHOD;
}
.devcontainer/assets/user-setup.sh deleted 100644 → 0
View file @ 08cee99c
#!/bin/sh
# Copyright 2018-2022 Istituto Nazionale di Fisica Nucleare
# SPDX-License-Identifier: EUPL-1.2
set -ex
cat << EOF >> ${HOME}/.bashrc
if [ -f "\${HOME}/openresty-env" ]; then
. \${HOME}/openresty-env
fi
if [ -d \${HOME}/bin ]; then
PATH=\${HOME}/bin:\${PATH}
fi
if [ -n "\${PS1}" ]; then
echo
echo "To build and install openresty with the ngx_http_voms_module run 'build-install-ngx-voms.sh'"
echo
fi
EOF
.devcontainer/assets/install-build-deps.sh → .devcontainer/library-scripts/provide-dev-deps.sh
View file @ 3c4a7183
#!/bin/sh #!/usr/bin/env bash
# Copyright 2018-2022 Istituto Nazionale di Fisica Nucleare # Copyright 2018-2023 Istituto Nazionale di Fisica Nucleare
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
yum-config-manager --add-repo https://openresty.org/package/centos/openresty.repo set -ex
yum -y install epel-release dnf install -y epel-release
dnf update -y
yum -y install \ dnf install -y --setopt=tsflags=nodocs \
which \
wget \
sudo \
file \
git \
gcc-c++ \ gcc-c++ \
GeoIP-devel \
gd-devel \ gd-devel \
gettext \ gettext \
ccache \ ccache \
libxslt-devel \ libxslt-devel \
lcov \ lcov \
perl-ExtUtils-Embed \ perl-ExtUtils-Embed \
perl-Test-Nginx \
perl-Digest-SHA \ perl-Digest-SHA \
readline-devel \ readline-devel \
boost-devel \ boost-devel \
voms-devel \ voms-devel \
make \ make \
patch patch \
zlib-devel \
pcre2-devel \
rpmdevtools \
rpmlint \
cpan \
voms-clients-cpp
\ No newline at end of file
.devcontainer/assets/provide-user.sh → .devcontainer/library-scripts/provide-user.sh
View file @ 3c4a7183
#!/usr/bin/env bash #!/usr/bin/env bash
# Copyright 2018-2022 Istituto Nazionale di Fisica Nucleare # Copyright 2018-2023 Istituto Nazionale di Fisica Nucleare
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
USERNAME=${1} USERNAME=${1}
...@@ -51,8 +51,7 @@ EOF ...@@ -51,8 +51,7 @@ EOF
)" )"
USER_RC_PATH="/home/${USERNAME}" USER_RC_PATH="/home/${USERNAME}"
echo "${CODESPACES_BASH}" >> "${USER_RC_PATH}/.bashrc" echo "${CODESPACES_BASH}" >> "${USER_RC_PATH}/.bashrc"
chown ${USERNAME}:${USERNAME} "${USER_RC_PATH}/.bashrc" chown ${USERNAME}:${USER_GID} "${USER_RC_PATH}/.bashrc"
echo "Done!" echo "Done!"
.gitignore
View file @ 3c4a7183
.vscode .vscode
servroot* servroot*
nginx nginx
\ No newline at end of file docker/artifacts
node_modules
t/*
!t/README.md
!t/*.t
!t/setup.sh
!t/conf.d
!t/proxies.d
!t/openssl.conf
!t/socket.js
.gitlab-ci.yml
View file @ 3c4a7183
...@@ -4,40 +4,62 @@ stages: ...@@ -4,40 +4,62 @@ stages:
- docker-build - docker-build
- docker-push - docker-push
build-rpm: build-rpms-el8:
stage: build stage: build
image: centos:7 image: almalinux:8
script: script:
- env | sort
- dnf -y install epel-release
- dnf install -y wget openssl-devel zlib-devel pcre2-devel make rpmdevtools rpmlint boost-devel voms-devel gcc-c++
- source .devcontainer/assets/build-library.sh
- CI_PROJECT_DIR=$PWD
- downloadNginx
- buildHttpgNginxRPM
- buildVomsModuleRPM
- cd ${CI_PROJECT_DIR}/docker && mkdir artifacts
- cp ~/rpmbuild/SRPMS/* artifacts/
- cp ~/rpmbuild/RPMS/x86_64/* artifacts/
artifacts:
paths:
- docker/artifacts/
build-rpms-el9:
stage: build
image: almalinux:9
script:
- env | sort - env | sort
- sh .devcontainer/assets/install-build-deps.sh - dnf -y install epel-release
- yum install -y rpm-build redhat-rpm-config rpmdevtools - dnf install -y wget openssl-devel zlib-devel pcre2-devel make rpmdevtools rpmlint boost-devel voms-devel gcc-c++
- cd rpm && sh make_packaging.sh ${CI_PROJECT_DIR} && cd .. - source .devcontainer/assets/build-library.sh
- mv ${HOME}/rpmbuild ./rpmbuild - CI_PROJECT_DIR=$PWD
- downloadNginx
- buildHttpgNginxRPM
- buildVomsModuleRPM
- cd ${CI_PROJECT_DIR}/docker && mkdir artifacts
- cp ~/rpmbuild/SRPMS/* artifacts/
- cp ~/rpmbuild/RPMS/x86_64/* artifacts/
artifacts: artifacts:
paths: paths:
- rpmbuild/SRPMS/ - docker/artifacts/
- rpmbuild/RPMS/noarch/
- rpmbuild/RPMS/x86_64/
docker-build-rpm: docker-build-rpms:
stage: docker-build stage: docker-build
image: docker:latest image: docker:latest
services: services:
- name: docker:dind - name: docker:dind
command: ["--tls=false"] command: ["--tls=false"]
dependencies: dependencies:
- build-rpm - build-rpms-el8
- build-rpms-el9
script: script:
- apk add git bash - apk add git bash
- git clone https://baltig.infn.it/mw-devel/helper-scripts.git helper-scripts - git clone https://baltig.infn.it/mw-devel/helper-scripts.git helper-scripts
- cp helper-scripts/scripts/* /usr/local/bin - cp helper-scripts/scripts/* /usr/local/bin
- cp rpmbuild/RPMS/x86_64/* ${CI_PROJECT_DIR}/docker/openresty-voms/ - rm ${CI_PROJECT_DIR}/docker/artifacts/*-debuginfo*.rpm
- cp rpmbuild/RPMS/noarch/* ${CI_PROJECT_DIR}/docker/openresty-voms/
- rm ${CI_PROJECT_DIR}/docker/openresty-voms/*-debuginfo*.rpm
- docker login -u gitlab-ci-token -p ${CI_JOB_TOKEN} ${CI_REGISTRY} - docker login -u gitlab-ci-token -p ${CI_JOB_TOKEN} ${CI_REGISTRY}
- export DOCKER_REGISTRY_HOST=${CI_REGISTRY} - export DOCKER_REGISTRY_HOST=${CI_REGISTRY}
- export DOCKER_REGISTRY_NAMESPACE=${CI_PROJECT_PATH} - export DOCKER_REGISTRY_NAMESPACE=${CI_PROJECT_PATH}
- cd docker/openresty-voms && build-docker-image.sh && push-docker-image.sh - cd docker && build-docker-image.sh && push-docker-image.sh
push-to-dockerhub: push-to-dockerhub:
stage: docker-push stage: docker-push
...@@ -46,7 +68,7 @@ push-to-dockerhub: ...@@ -46,7 +68,7 @@ push-to-dockerhub:
- name: docker:dind - name: docker:dind
command: ["--tls=false"] command: ["--tls=false"]
dependencies: dependencies:
- docker-build-rpm - docker-build-rpms
script: script:
- apk add git bash - apk add git bash
- git clone https://baltig.infn.it/mw-devel/helper-scripts.git helper-scripts - git clone https://baltig.infn.it/mw-devel/helper-scripts.git helper-scripts
...@@ -56,7 +78,7 @@ push-to-dockerhub: ...@@ -56,7 +78,7 @@ push-to-dockerhub:
- docker login -u gitlab-ci-token -p ${CI_JOB_TOKEN} ${CI_REGISTRY} - docker login -u gitlab-ci-token -p ${CI_JOB_TOKEN} ${CI_REGISTRY}
- export DOCKER_REGISTRY_HOST=${CI_REGISTRY} - export DOCKER_REGISTRY_HOST=${CI_REGISTRY}
- export DOCKER_REGISTRY_NAMESPACE=${CI_PROJECT_PATH} - export DOCKER_REGISTRY_NAMESPACE=${CI_PROJECT_PATH}
- cd docker/openresty-voms && pull-docker-image.sh && unset DOCKER_REGISTRY_HOST - cd docker && pull-docker-image.sh && unset DOCKER_REGISTRY_HOST
- docker login -u ${DOCKERHUB_USER} -p ${DOCKERHUB_PASSWORD} && push-docker-image.sh - docker login -u ${DOCKERHUB_USER} -p ${DOCKERHUB_PASSWORD} && push-docker-image.sh
only: only:
- master - master
README.md
View file @ 3c4a7183
# ngx_http_voms_module # `ngx_http_voms_module`
[![pipeline status](https://baltig.infn.it/storm2/ngx_http_voms_module/badges/master/pipeline.svg)](https://baltig.infn.it/storm2/ngx_http_voms_module/commits/master) [![pipeline status](https://baltig.infn.it/cnafsd/ngx_http_voms_module/badges/master/pipeline.svg)](https://baltig.infn.it/cnafsd/ngx_http_voms_module/commits/master)
## Description ## Description
*ngx_http_voms_module* is a module for the [Nginx web server](https://www.nginx.org/) that enables client-side authentication based on X.509 proxy certificates augmented with VOMS Attribute Certificates, typically obtained from a [Virtual Organization Membership Service](https://italiangrid.github.io/voms/) (VOMS) server. `ngx_http_voms_module` is a module for the [Nginx web server](https://www.nginx.org/) that enables client-side authentication based on X.509 proxy certificates augmented with VOMS Attribute Certificates, typically obtained from a [Virtual Organization Membership Service](https://italiangrid.github.io/voms/) (VOMS) server.
The module defines a set of [*embedded* variables](#embedded-variables), whose values are extracted from the first Attribute Certificate found in the certificate chain. The module defines a set of *embedded* variables, whose values are extracted from the first Attribute Certificate found in the certificate chain.
## Installation ### Embedded Variables
The generic installation instructions are:
```shell
$ cd nginx-x.y.z
$ ./configure --add-module=/path/to/ngx_http_voms_module
$ make && make install
```
The module is written in C++, using features from C++14 that are supported by gcc v. 4.8.5 (the version available in CentOS 7) enabling the option `-std=c++1y` (see [`config.make`](config.make)).
A Docker image is available for use in the context of the StoRM2 project, where the OpenResty distribution is used:
```shell
$ docker run --rm -it -v /path/to/ngx_http_voms_module:/home/build/ngx_http_voms_module storm2/ngx-voms-build
$ cd openresty-x.y.z
$ ./configure ${RESTY_CONFIG_OPTIONS} --add-module=../ngx_http_voms_module
$ make && make install
```
## Embedded Variables
The module makes the following embedded variables available for use in an Nginx configuration file: The module makes the following embedded variables available for use in an Nginx configuration file:
### voms_user #### voms_user
The Subject of the End-Entity certificate, used to sign the proxy. The Subject of the End-Entity certificate, used to sign the proxy.
_Example_: ``/C=IT/O=IGI/CN=test0`` _Example_: ``/C=IT/O=IGI/CN=test0``
### ssl_client_ee_s_dn #### ssl_client_ee_s_dn
Like `voms_user`, the Subject of the End-Entity certificate. Unlike `voms_user`, it is available even for non-VOMS proxies and is formatted according to RFC 2253. Like `voms_user`, the Subject of the End-Entity certificate. Unlike `voms_user`, it is available even for non-VOMS proxies and is formatted according to RFC 2253.
_Example_: `CN=test0,O=IGI,C=IT` _Example_: `CN=test0,O=IGI,C=IT`
### voms_user_ca #### voms_user_ca
The Issuer (Certificate Authority) of the End-Entity certificate. The Issuer (Certificate Authority) of the End-Entity certificate.
_Example_: `/C=IT/O=IGI/CN=Test CA` _Example_: `/C=IT/O=IGI/CN=Test CA`
### ssl_client_ee_i_dn #### ssl_client_ee_i_dn
Like `voms_user_ca`, the Issuer of the End-Entity certificate. Unlike `voms_user_ca`, it is available even for non-VOMS proxies and is formatted according to RFC 2253. Like `voms_user_ca`, the Issuer of the End-Entity certificate. Unlike `voms_user_ca`, it is available even for non-VOMS proxies and is formatted according to RFC 2253.
_Example_: `CN=Test CA,O=IGI,C=IT` _Example_: `CN=Test CA,O=IGI,C=IT`
### voms_fqans #### voms_fqans
A comma-separated list of Fully Qualified Attribute Names. See [The VOMS Attribute Certificate Format](http://ogf.org/documents/GFD.182.pdf) for more details. A comma-separated list of Fully Qualified Attribute Names. See [The VOMS Attribute Certificate Format](http://ogf.org/documents/GFD.182.pdf) for more details.
_Example_: `/test.vo/exp1,/test.vo/exp2,/test.vo/exp3/Role=PIPPO` _Example_: `/test.vo/exp1,/test.vo/exp2,/test.vo/exp3/Role=PIPPO`
### voms_server #### voms_server
The Subject of the VOMS server certificate, used to sign the Attribute Certificate. The Subject of the VOMS server certificate, used to sign the Attribute Certificate.
_Example_: `/C=IT/O=IGI/CN=voms.example` _Example_: `/C=IT/O=IGI/CN=voms.example`
### voms_server_ca #### voms_server_ca
The Issuer (Certificate Authority) of the VOMS server certificate. The Issuer (Certificate Authority) of the VOMS server certificate.
_Example_: `/C=IT/O=IGI/CN=Test CA` _Example_: `/C=IT/O=IGI/CN=Test CA`
### voms_vo #### voms_vo
The name of the Virtual Organization (VO) to which the End Entity belongs. The name of the Virtual Organization (VO) to which the End Entity belongs.
_Example_: `test.vo` _Example_: `test.vo`
### voms_server_uri #### voms_server_uri
The hostname and port of the VOMS network service that issued the Attribute Certificate, in the form _hostname_ :_port_. The hostname and port of the VOMS network service that issued the Attribute Certificate, in the form _hostname_ :_port_.
_Example_: `voms.example:15000` _Example_: `voms.example:15000`
### voms_not_before #### voms_not_before
The date before which the Attribute Certificate is not yet valid, in the form _YYYYMMDDhhmmss_ `Z`. The date before which the Attribute Certificate is not yet valid, in the form _YYYYMMDDhhmmss_ `Z`.
_Example_: `20180101000000Z` _Example_: `20180101000000Z`
### voms_not_after #### voms_not_after
The date after which the Attribute Certificate is not valid anymore, in the form _YYYYMMDDhhmmss_ `Z`. The date after which the Attribute Certificate is not valid anymore, in the form _YYYYMMDDhhmmss_ `Z`.
_Example_: `20180101120000Z` _Example_: `20180101120000Z`
### voms_generic_attributes #### voms_generic_attributes
A comma-separated list of attributes, each defined by three properties and formatted as `n=`_name_ `v=`_value_ `q=`_qualifier_. The qualifier typically coincides with the name of the VO. A comma-separated list of attributes, each defined by three properties and formatted as `n=`_name_ `v=`_value_ `q=`_qualifier_. The qualifier typically coincides with the name of the VO.
_Example_: `n=nickname v=newland q=test.vo,n=nickname v=giaco q=test.vo` _Example_: `n=nickname v=newland q=test.vo,n=nickname v=giaco q=test.vo`
### voms_serial #### voms_serial
The serial number of the Attribute Certificate in hexadecimal format. The serial number of the Attribute Certificate in hexadecimal format.
_Example_: `7B` _Example_: `7B`
## Installation
### prerequisites
The software dependecies are listed in the [provide-deps](docker/library-scripts/provide-deps.sh) script in the `docker` directory.
The nginx source files are also needed. To download them in ```/tmp/nginx-x.y.z``` you can execute:
```shell
$ ngxVersion=<version>
$ wget -O /tmp/nginx-$ngxVersion.tar.gz https://nginx.org/download/nginx-$ngxVersion.tar.gz
$ cd /tmp && tar -xzvf /tmp/nginx-$ngxVersion.tar.gz && cd -
```
### Generic installation
The generic installation instructions are:
```shell
$ cd /tmp/nginx-x.y.z
$ ./configure --add-module=/path/to/ngx_http_voms_module
$ make && make install
```
### Docker container
A Docker image with nginx and the `ngx_http_voms_module` is available, you can find it [here](https://hub.docker.com/r/cnafsd/nginx-httpg-voms).
### For the developers
A [.devcontainer](.devcontainer) is provided for the developers with all the instructions on how to use it, how to build the rpm module and how to install it.
## Testing ## Testing
Setup and files to test the *ngx_http_voms_module* are contained in the [`t`](t) folder. Setup and files to test the `ngx_http_voms_module` are contained in the [`t`](t) folder.
config
View file @ 3c4a7183
ngx_addon_name=ngx_http_voms_module
ngx_module_type=HTTP ngx_module_type=HTTP
ngx_addon_name=voms
ngx_module_name=ngx_http_voms_module ngx_module_name=ngx_http_voms_module
ngx_module_srcs="$ngx_addon_dir/src/ngx_http_voms_module.cpp" ngx_module_srcs="$ngx_addon_dir/src/ngx_http_voms_module.cpp"
ngx_module_libs="-lvomsapi -lstdc++" ngx_module_libs="-lvomsapi -lstdc++"
......
config.make
View file @ 3c4a7183
echo "objs/addon/src/ngx_http_voms_module.o: CFLAGS += --std=c++1y -Werror" >> $NGX_MAKEFILE echo "objs/addon/src/ngx_http_voms_module.o: CFLAGS += -Werror" >> $NGX_MAKEFILE
cov-ngx-voms.sh deleted 100755 → 0
View file @ 08cee99c
#!/bin/sh
# Copyright 2018 Istituto Nazionale di Fisica Nucleare
#
# Licensed under the EUPL, Version 1.2 or - as soon they will be approved by the
# European Commission - subsequent versions of the EUPL (the "Licence"). You may
# not use this work except in compliance with the Licence. You may obtain a copy
# of the Licence at:
#
# https://joinup.ec.europa.eu/software/page/eupl
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the Licence is distributed on an "AS IS" basis, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# Licence for the specific language governing permissions and limitations under
# the Licence.
# This script builds in debug mode and installs openresty together with the
# ngx_http_voms_module.
#
# The script requires the locations of the openresty bundle and of the
# ngx_http_voms_module code (for example as checked-out from git). The locations
# are expressed by the environment variables OPENRESTY_ROOT and
# NGX_HTTP_VOMS_MODULE_ROOT respectively, if available. If they are not set,
# they are guessed:
# * a unique openresty bundle is looked for in ${HOME}
# * the ngx_http_voms_module code is looked for in the working directory of the
# continuous integration environment first and then in ${HOME}
#
# The script works best (i.e. it is tested) if run within a docker container
# started from the storm2/ngx-voms-build image.
#geninfo --base-directory ${HOME}/openresty-1.13.6.1/build/nginx-1.13.6/objs/addon/src/ --output-filename coverage.info ${HOME}/openresty-1.13.6.1/build/nginx-1.13.6/objs/addon/src/
geninfo --output-filename /tmp/coverage.info ${HOME}/openresty-1.15.8.1/build/nginx-1.15.8/objs/addon/src/
genhtml --prefix ${HOME}/openresty-1.15.8.1/build/nginx-1.15.8/objs/addon/src/ --ignore-errors source --demangle-cpp /tmp/coverage.info \
--legend --title "coverage ngix" --output-directory=/tmp/coverage-report
exit_status=$?
if [ ! $exit_status -eq 0 ]; then
echo "check output"
fi
echo $exit_status
docker/openresty-voms/.env → docker/.env
View file @ 3c4a7183
DOCKER_IMAGE=storm2/openresty-voms DOCKER_IMAGE=cnafsd/nginx-httpg-voms
DOCKER_VERBOSE=y DOCKER_VERBOSE=y
DOCKER_GIT_TAG_ENABLED=y DOCKER_GIT_TAG_ENABLED=y
docker/Dockerfile 0 → 100644
View file @ 3c4a7183
# Copyright 2018-2023 Istituto Nazionale di Fisica Nucleare
# SPDX-License-Identifier: EUPL-1.2
ARG EL_VERSION=9
FROM almalinux:${EL_VERSION}
# https://docs.docker.com/reference/dockerfile/#understand-how-arg-and-from-interact
ARG EL_VERSION
# Allow customization of nginx user ID and name
ARG USERNAME=nginx
ARG USER_UID=1000
ARG USER_GID=${USER_UID}
# install dependencies
COPY library-scripts/*.sh /tmp/library-scripts/
RUN dnf update -y && \
sh /tmp/library-scripts/provide-deps.sh && \
sh /tmp/library-scripts/provide-user.sh ${USERNAME} ${USER_UID} ${USER_GID} && \
mkdir /pkgs && \
dnf clean all && rm -rf /var/cache/dnf
COPY artifacts/*.rpm /pkgs/
# install nginx httpg + voms and njs dynamic modules (latest version)
COPY nginx.repo /etc/yum.repos.d/nginx.repo
RUN rpm -ivh /pkgs/nginx-*.el${EL_VERSION}.httpg.x86_64.rpm && \
rpm -ivh /pkgs/nginx-module-http-voms-*.el${EL_VERSION}.x86_64.rpm && \
dnf install -y nginx-module-njs \
# forward request and error logs to docker log collector
&& ln -sf /dev/stdout /var/log/nginx/access.log \
&& ln -sf /dev/stderr /var/log/nginx/error.log
# install nginx + voms and njs dynamic modules
# RUN dnf -y install nginx nginx-module-njs && \
# rpm -ivh /pkgs/nginx-module-http-voms-1.24.0-1.el${EL_VERSION}.x86_64.rpm
EXPOSE 80
STOPSIGNAL SIGQUIT
CMD ["nginx", "-g", "daemon off;"]
docker/README.md deleted 100644 → 0
View file @ 08cee99c
This folder contains the ngx-module-packaging folder that contains a Dockerfile to build Openresty/NGINX voms rpm.
For more details see the [Dockerfile](./ngx-module-packaging/Dockerfile).
.devcontainer/assets/setup.sh → docker/library-scripts/provide-deps.sh
View file @ 3c4a7183
#!/bin/sh #!/usr/bin/env bash
# Copyright 2018-2022 Istituto Nazionale di Fisica Nucleare # Copyright 2018-2023 Istituto Nazionale di Fisica Nucleare
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
set -ex set -ex
yum-config-manager --add-repo https://openresty.org/package/centos/openresty.repo dnf -y install epel-release wget
yum -y install \ # https://openresty.org/en/linux-packages.html#centos
wget https://openresty.org/package/centos/openresty2.repo
mv openresty2.repo /etc/yum.repos.d/openresty.repo
dnf config-manager --set-enabled crb
dnf -y install \
hostname \ hostname \
epel-release \
which \ which \
wget \
tar \ tar \
sudo \ sudo \
file file \
readline \
yum -y install \
gcc-c++ \
GeoIP-devel \
gd-devel \
gettext \ gettext \
ccache \ less \
libxslt-devel \ openssl \
lcov \ zlib-devel \
perl-ExtUtils-Embed \ pcre2-devel \
perl-Test-Nginx \
perl-Digest-SHA \
readline-devel \
boost-devel \ boost-devel \
voms-devel \ voms-devel \
make \
patch \ patch \
less gcc-c++ \
rpmdevtools \
yum -y install https://repo.ius.io/ius-release-el7.rpm centos-release-scl rpmlint \
perl-ExtUtils-Embed \
yum -y install \ perl-Test-Nginx \
git224 \ perl-Digest-SHA \
devtoolset-10 cpan \
voms-clients-cpp \
procps-ng
docker/library-scripts/provide-user.sh 0 → 100644
View file @ 3c4a7183
#!/usr/bin/env bash
# Copyright 2018-2023 Istituto Nazionale di Fisica Nucleare
# SPDX-License-Identifier: EUPL-1.2
USERNAME=${1}
USER_UID=${2}
USER_GID=${3}
set -ex
groupadd --gid $USER_GID $USERNAME
useradd --uid $USER_UID --gid $USER_GID -m $USERNAME
echo $USERNAME ALL=\(root\) NOPASSWD:ALL > /etc/sudoers.d/$USERNAME
chmod 0440 /etc/sudoers.d/$USERNAME