Changeset 11153 in ntrip for trunk/BNC/tests

Timestamp:

Oct 31, 2026, 11:50:15 PM (6 days ago)

Author:

stuerze

Message:

Credentials files are implemented, with existing configs keep working unchanged

Location:

trunk/BNC/tests

Files:

• README.md (modified) (2 diffs)
• tools/cred_check.py (added)
• tools/fakecaster.py (modified) (7 diffs)

trunk/BNC/tests/README.md

@@ -32 +32 @@
 | `tools/ssl_check.py` | TLS checks of the Ntrip 2s client and upload (not part of `run_tests.py`) |
 | `tools/net_check.py` | UDP/RTP sender filter and upload status checks on loopback (not part of `run_tests.py`) |
+| `tools/cred_check.py` | credentials files (`~/.netrc`, BNC format) for download and upload (not part of `run_tests.py`) |
 | `work/` | scratch output, not versioned |
 
@@ -179 +180 @@
 as broken. Takes about 2 min.
 
+## Credentials check
+
+```
+tests/tools/cred_check.py [--bnc PATH]
+```
+
+BNC against `tools/fakecaster.py --auth user:password` (other credentials
+rejected), each scenario with its own `HOME`: password in the configuration
+file (hint logged), `~/.netrc` with two users for the host, `$NETRC` with
+`machine host:port` preferred, BNC format file (`credentialsFile`) with exact
+port preferred over `*` and a quoted password, URL without user (no
+credentials sent), user without entry, `~/.netrc` readable for others and the
+netrc `default` entry (not used), Ntrip 1 download, Ntrip 2 upload and
+Ntrip 1 upload without user. Takes about 2 min.
+
 ## Adding a replay case
 

trunk/BNC/tests/tools/fakecaster.py

@@ -16 +16 @@
 a GET request (BNC as Ntrip client) is answered with the RTCM bytes of the
 given raw file. With --reply an upload is answered with this text instead
-of the 200 status (e.g. a rejection), and the connection is closed. Failed
+of the 200 status (e.g. a rejection), and the connection is closed. With
+--auth user:password (repeatable, ':password' for an Ntrip 1 upload) only
+these credentials are accepted, others get 401 / 'ERROR - Bad Password'.
+The user received ("-" without user, "none" without credentials) and failed
 TLS handshakes are reported on stdout.
 """
 
 import argparse
+import base64
 import os
 import socket
@@ -70 +74 @@
 
 
-def serve(conn, store, timeout, tls=None, served=None, reply=None):
+def credentials(header):
+    """(user, password) of a request header, None without credentials."""
+    lines = header.split(b"\r\n")
+    if lines[0].startswith(b"SOURCE"):
+        parts = lines[0].split(b" ")
+        return "", parts[1].decode("latin-1") if len(parts) > 1 else ""
+    for line in lines[1:]:
+        key, _, value = line.partition(b":")
+        value = value.strip()
+        if key.strip().lower() == b"authorization" and value.lower().startswith(b"basic "):
+            user, _, password = base64.b64decode(value[6:]).decode("latin-1").partition(":")
+            return user, password
+    return None
+
+
+def serve(conn, store, timeout, tls=None, served=None, reply=None, auth=None):
     conn.settimeout(timeout)
     buf = b""
@@ -88 +107 @@
         header, _, pending = buf.partition(b"\r\n\r\n")
         chunked = b"chunked" in header.lower()
+        cred = credentials(header)
+        ok = auth is None or cred in auth
+        print("auth %s %s" % ("none" if cred is None else (cred[0] or "-"),
+                              "accepted" if ok else "rejected"), flush=True)
+        if not ok:
+            conn.sendall(b"ERROR - Bad Password\r\n" if header.startswith(b"SOURCE")
+                         else b"HTTP/1.1 401 Unauthorized\r\n\r\n")
+            store.rejected += 1
+            return
         if header.startswith(b"GET") and served is not None:
-            conn.sendall(b"HTTP/1.1 200 OK\r\nNtrip-Version: Ntrip/2.0\r\n"
-                         b"Content-Type: gnss/data\r\nConnection: close\r\n\r\n" + served)
+            if b"ntrip-version" in header.lower():
+                conn.sendall(b"HTTP/1.1 200 OK\r\nNtrip-Version: Ntrip/2.0\r\n"
+                             b"Content-Type: gnss/data\r\nConnection: close\r\n\r\n" + served)
+            else:  # Ntrip 1
+                conn.sendall(b"ICY 200 OK\r\n\r\n" + served)
             store.served += len(served)
             return
@@ -134 +165 @@
     ap.add_argument("--tls-client-ca", help="require a client certificate of this CA")
     ap.add_argument("--serve", help="raw file whose RTCM bytes are sent on GET")
+    ap.add_argument("--auth", action="append",
+                    help="accepted user:password (repeatable), others rejected")
     ap.add_argument("--reply", help="answer to uploads instead of 200 ('\\r\\n' escapes allowed)")
     args = ap.parse_args()
@@ -147 +180 @@
     if args.reply is not None:
         reply = args.reply.encode("latin-1").decode("unicode_escape").encode("latin-1")
+    auth = None
+    if args.auth:
+        auth = [tuple(a.split(":", 1)) for a in args.auth]
     served = None
     if args.serve:
@@ -166 +202 @@
         except socket.timeout:
             break
-        t = threading.Thread(target=serve, args=(conn, store, args.timeout, tls, served, reply),
+        t = threading.Thread(target=serve, args=(conn, store, args.timeout, tls, served, reply, auth),
                              daemon=True)
         t.start()
@@ -177 +213 @@
     if served is not None:
         print("served %d bytes" % store.served, flush=True)
-    if reply is not None:
-        print("%d upload(s) answered with --reply" % store.rejected, flush=True)
+    if reply is not None or auth is not None:
+        print("%d connection(s) rejected" % store.rejected, flush=True)
     return 0