M2: WLAN-Passwort muss leer (offenes Netz) oder 8..64 Zeichen lang sein (400 "invalid password" bei 1..7 Zeichen). CMake prüft NINLIGHT_WIFI_PASSWORD ebenso (0 oder 8..63 Zeichen) und der Zeichen-Blacklist-Check bekommt `;` dazu. M4: Ein Authorization-Wert, der länger als NL_TOKEN_LEN-1 (64) ist, wird von nl_http_parse() nicht mehr stillschweigend abgeschnitten, sondern setzt `auth_too_long` in nl_http_request_t; nl_api_handle() behandelt eine solche Anfrage als unauthentifiziert (außer bei offenem Zugriff), damit ein abgeschnittener Wert nie zufällig auf ein kürzeres Token passt. M5: get_int() prüfte die (long)-Cast-Gleichheit vor dem Bereichscheck - bei sehr großen oder NaN-Werten ist der Cast von double nach long undefiniertes Verhalten. Bereichs- und NaN-Check laufen jetzt vor dem Cast. T1: sdk/Platform/Drivers/internalflash/wm_internal_fls.c: tls_fls_init() ignorierte den Rückgabewert von tls_os_sem_create(&s_fls2_lock, 1) - jetzt eine TLS_DBGPRT_ERR-Meldung, falls das fehlschlägt (dokumentiert in sdk/PATCHES.md). Tests: test_api.c (Passwortlängen, auth_too_long, 1e300-Brightness), test_http.c (auth_too_long wird gesetzt). Für M5 zeigt der Host-Test kein sichtbares RED, weil der (double)->(long)-Cast auf dieser Plattform/diesem Compiler keinen Crash auslöst (implementation-defined statt UB-Crash) - der Fix wird trotzdem angewendet, da er auf dem Zielcompiler (arm-none-eabi 4.9) nicht garantiert sicher ist.
136 lines
4.9 KiB
C
136 lines
4.9 KiB
C
#include <stdio.h>
|
|
#include <string.h>
|
|
#include "unity.h"
|
|
#include "net/nl_http.h"
|
|
|
|
void setUp(void) {}
|
|
void tearDown(void) {}
|
|
|
|
static nl_http_parse_t parse(const char *s, nl_http_request_t *r)
|
|
{
|
|
return nl_http_parse(s, strlen(s), r);
|
|
}
|
|
|
|
static void test_simple_get(void)
|
|
{
|
|
nl_http_request_t r;
|
|
TEST_ASSERT_EQUAL(NL_HTTP_COMPLETE, parse("GET /api/v1/device/state HTTP/1.1\r\nHost: x\r\n\r\n", &r));
|
|
TEST_ASSERT_EQUAL(NL_HTTP_GET, r.method);
|
|
TEST_ASSERT_EQUAL_STRING("/api/v1/device/state", r.path);
|
|
TEST_ASSERT_EQUAL_STRING("", r.auth);
|
|
TEST_ASSERT_EQUAL_UINT(0, r.body_len);
|
|
}
|
|
|
|
static void test_post_body_arrives_in_parts(void)
|
|
{
|
|
const char *full = "POST /api/v1/device/state HTTP/1.1\r\nContent-Length: 11\r\n\r\n{\"on\":true}";
|
|
nl_http_request_t r;
|
|
TEST_ASSERT_EQUAL(NL_HTTP_INCOMPLETE, nl_http_parse(full, 20, &r));
|
|
TEST_ASSERT_EQUAL(NL_HTTP_INCOMPLETE, nl_http_parse(full, strlen(full) - 1, &r));
|
|
TEST_ASSERT_EQUAL(NL_HTTP_COMPLETE, nl_http_parse(full, strlen(full), &r));
|
|
TEST_ASSERT_EQUAL(NL_HTTP_POST, r.method);
|
|
TEST_ASSERT_EQUAL_UINT(11, r.body_len);
|
|
TEST_ASSERT_EQUAL_MEMORY("{\"on\":true}", r.body, 11);
|
|
}
|
|
|
|
static void test_headers_case_insensitive_and_bearer(void)
|
|
{
|
|
nl_http_request_t r;
|
|
TEST_ASSERT_EQUAL(NL_HTTP_COMPLETE,
|
|
parse("PUT /api/v1/system/command HTTP/1.1\r\nauthorization: Bearer abc123\r\n"
|
|
"CONTENT-LENGTH: 2\r\n\r\n{}", &r));
|
|
TEST_ASSERT_EQUAL(NL_HTTP_PUT, r.method);
|
|
TEST_ASSERT_EQUAL_STRING("abc123", r.auth);
|
|
TEST_ASSERT_EQUAL_UINT(2, r.body_len);
|
|
TEST_ASSERT_FALSE(r.auth_too_long);
|
|
}
|
|
|
|
static void test_auth_too_long_sets_flag(void)
|
|
{
|
|
/* M4: token max is 64 chars (NL_TOKEN_LEN - 1); one char beyond that must be flagged
|
|
* rather than silently truncated and possibly matching by accident. */
|
|
char hdr[128];
|
|
nl_http_request_t r;
|
|
char token[66];
|
|
memset(token, 'a', sizeof token - 1);
|
|
token[sizeof token - 1] = '\0'; /* 65 chars: one more than NL_TOKEN_LEN - 1 */
|
|
snprintf(hdr, sizeof hdr, "GET / HTTP/1.1\r\nAuthorization: %s\r\n\r\n", token);
|
|
TEST_ASSERT_EQUAL(NL_HTTP_COMPLETE, parse(hdr, &r));
|
|
TEST_ASSERT_TRUE(r.auth_too_long);
|
|
}
|
|
|
|
static void test_plain_token_and_query_string(void)
|
|
{
|
|
nl_http_request_t r;
|
|
TEST_ASSERT_EQUAL(NL_HTTP_COMPLETE,
|
|
parse("GET /api/v1/system/info?x=1 HTTP/1.0\r\nAuthorization: aabbccddeeff0011223344\r\n\r\n", &r));
|
|
TEST_ASSERT_EQUAL_STRING("/api/v1/system/info", r.path);
|
|
TEST_ASSERT_EQUAL_STRING("aabbccddeeff0011223344", r.auth);
|
|
}
|
|
|
|
static void test_other_method(void)
|
|
{
|
|
nl_http_request_t r;
|
|
TEST_ASSERT_EQUAL(NL_HTTP_COMPLETE, parse("DELETE /api/v1/device/state HTTP/1.1\r\n\r\n", &r));
|
|
TEST_ASSERT_EQUAL(NL_HTTP_OTHER, r.method);
|
|
}
|
|
|
|
static void test_body_too_large(void)
|
|
{
|
|
nl_http_request_t r;
|
|
TEST_ASSERT_EQUAL(NL_HTTP_TOO_LARGE, parse("POST / HTTP/1.1\r\nContent-Length: 1025\r\n\r\n", &r));
|
|
}
|
|
|
|
static void test_headers_never_end(void)
|
|
{
|
|
static char buf[NL_HTTP_MAX_REQUEST];
|
|
nl_http_request_t r;
|
|
memset(buf, 'a', sizeof buf);
|
|
memcpy(buf, "GET / HTTP/1.1\r\n", 16);
|
|
TEST_ASSERT_EQUAL(NL_HTTP_TOO_LARGE, nl_http_parse(buf, sizeof buf, &r));
|
|
TEST_ASSERT_EQUAL(NL_HTTP_INCOMPLETE, nl_http_parse(buf, 100, &r));
|
|
}
|
|
|
|
static void test_bad_requests(void)
|
|
{
|
|
nl_http_request_t r;
|
|
char longpath[200];
|
|
TEST_ASSERT_EQUAL(NL_HTTP_BAD_REQUEST, parse("GET /x\r\n\r\n", &r));
|
|
TEST_ASSERT_EQUAL(NL_HTTP_BAD_REQUEST, parse("GET /x FTP/1.1\r\n\r\n", &r));
|
|
TEST_ASSERT_EQUAL(NL_HTTP_BAD_REQUEST, parse("\r\n\r\n", &r));
|
|
TEST_ASSERT_EQUAL(NL_HTTP_BAD_REQUEST, parse("POST / HTTP/1.1\r\nContent-Length: abc\r\n\r\n", &r));
|
|
strcpy(longpath, "GET /");
|
|
memset(longpath + 5, 'p', 100);
|
|
strcpy(longpath + 105, " HTTP/1.1\r\n\r\n");
|
|
TEST_ASSERT_EQUAL(NL_HTTP_BAD_REQUEST, parse(longpath, &r));
|
|
}
|
|
|
|
static void test_response(void)
|
|
{
|
|
char out[256];
|
|
size_t n = nl_http_response(out, sizeof out, 404, "{\"error\":\"not found\"}");
|
|
TEST_ASSERT_EQUAL_STRING("HTTP/1.1 404 Not Found\r\nContent-Type: application/json\r\n"
|
|
"Content-Length: 21\r\nConnection: close\r\n\r\n{\"error\":\"not found\"}", out);
|
|
TEST_ASSERT_EQUAL_UINT(strlen(out), n);
|
|
TEST_ASSERT_EQUAL_UINT(0, nl_http_response(out, 20, 200, "{}"));
|
|
TEST_ASSERT_EQUAL_STRING("Accepted", nl_http_reason(202));
|
|
TEST_ASSERT_EQUAL_STRING("Payload Too Large", nl_http_reason(413));
|
|
TEST_ASSERT_EQUAL_STRING("Not Implemented", nl_http_reason(501));
|
|
}
|
|
|
|
int main(void)
|
|
{
|
|
UNITY_BEGIN();
|
|
RUN_TEST(test_simple_get);
|
|
RUN_TEST(test_post_body_arrives_in_parts);
|
|
RUN_TEST(test_headers_case_insensitive_and_bearer);
|
|
RUN_TEST(test_auth_too_long_sets_flag);
|
|
RUN_TEST(test_plain_token_and_query_string);
|
|
RUN_TEST(test_other_method);
|
|
RUN_TEST(test_body_too_large);
|
|
RUN_TEST(test_headers_never_end);
|
|
RUN_TEST(test_bad_requests);
|
|
RUN_TEST(test_response);
|
|
return UNITY_END();
|
|
}
|