Attachment 2557 Details for Bug 2081 – Regression tests keys/principals command

[patch] Regression tests keys/principals command

keys_principals_command_args_regress.diff (text/plain), 7.38 KB, created by Damien Miller on 2015-03-03 06:34:47 AEDT

(hide)

Description:

Filename:

MIME Type:

Creator: Damien Miller

Created: 2015-03-03 06:34:47 AEDT

Size: 7.38 KB

patch

obsolete

>Index: keys-command.sh
>===================================================================
>RCS file: /cvs/src/regress/usr.bin/ssh/keys-command.sh,v
>retrieving revision 1.2
>diff -u -p -r1.2 keys-command.sh
>--- keys-command.sh	6 Dec 2012 06:06:54 -0000	1.2
>+++ keys-command.sh	17 Feb 2015 00:21:57 -0000
>@@ -7,26 +7,63 @@ if [ -z "$SUDO" ]; then
> 	fatal "need SUDO to create file in /var/run, test won't work without"
> fi
> 
>+rm -f $OBJ/keys-command-args
>+
>+touch $OBJ/keys-command-args
>+chmod a+rw $OBJ/keys-command-args
>+
>+expected_key_text=`awk '{ print $2 }' < $OBJ/rsa.pub`
>+expected_key_fp=`$SSHKEYGEN -lf $OBJ/rsa.pub | awk '{ print $2 }'`
>+
> # Establish a AuthorizedKeysCommand in /var/run where it will have
> # acceptable directory permissions.
> KEY_COMMAND="/var/run/keycommand_${LOGNAME}"
>-cat << _EOF | $SUDO sh -c "cat > '$KEY_COMMAND'"
>+cat << _EOF | $SUDO sh -c "rm -f '$KEY_COMMAND' ; cat > '$KEY_COMMAND'"
> #!/bin/sh
>+echo args: "\$@" >> $OBJ/keys-command-args
>+echo "$PATH" | grep -q mekmitasdigoat && exit 7
> test "x\$1" != "x${LOGNAME}" && exit 1
>+if test $# -eq 6 ; then
>+	test "x\$2" != "xblah" && exit 2
>+	test "x\$3" != "x${expected_key_text}" && exit 3
>+	test "x\$4" != "xssh-rsa" && exit 4
>+	test "x\$5" != "x${expected_key_fp}" && exit 5
>+	test "x\$6" != "xblah" && exit 6
>+fi
> exec cat "$OBJ/authorized_keys_${LOGNAME}"
> _EOF
> $SUDO chmod 0755 "$KEY_COMMAND"
> 
>-cp $OBJ/sshd_proxy $OBJ/sshd_proxy.bak
>-(
>-	grep -vi AuthorizedKeysFile $OBJ/sshd_proxy.bak
>-	echo AuthorizedKeysFile none
>-	echo AuthorizedKeysCommand $KEY_COMMAND
>-	echo AuthorizedKeysCommandUser ${LOGNAME}
>-) > $OBJ/sshd_proxy
>-
> if [ -x $KEY_COMMAND ]; then
>-	${SSH} -F $OBJ/ssh_proxy somehost true
>+	cp $OBJ/sshd_proxy $OBJ/sshd_proxy.bak
>+
>+	verbose "AuthorizedKeysCommand with arguments"
>+	(
>+		grep -vi AuthorizedKeysFile $OBJ/sshd_proxy.bak
>+		echo AuthorizedKeysFile none
>+		echo AuthorizedKeysCommand $KEY_COMMAND %u blah %k %t %f blah
>+		echo AuthorizedKeysCommandUser ${LOGNAME}
>+	) > $OBJ/sshd_proxy
>+
>+	# Ensure that $PATH is sanitised in sshd
>+	env PATH=$PATH:/sbin/mekmitasdigoat \
>+	    ${SSH} -F $OBJ/ssh_proxy somehost true
>+	if [ $? -ne 0 ]; then
>+		fail "connect failed"
>+	fi
>+
>+	verbose "AuthorizedKeysCommand without arguments"
>+	# Check legacy behavior of no-args resulting in username being passed.
>+	(
>+		grep -vi AuthorizedKeysFile $OBJ/sshd_proxy.bak
>+		echo AuthorizedKeysFile none
>+		echo AuthorizedKeysCommand $KEY_COMMAND
>+		echo AuthorizedKeysCommandUser ${LOGNAME}
>+	) > $OBJ/sshd_proxy
>+
>+	# Ensure that $PATH is sanitised in sshd
>+	env PATH=$PATH:/sbin/mekmitasdigoat \
>+	    ${SSH} -F $OBJ/ssh_proxy somehost true
> 	if [ $? -ne 0 ]; then
> 		fail "connect failed"
> 	fi
>Index: principals-command.sh
>===================================================================
>RCS file: principals-command.sh
>diff -N principals-command.sh
>--- /dev/null	1 Jan 1970 00:00:00 -0000
>+++ principals-command.sh	17 Feb 2015 00:21:57 -0000
>@@ -0,0 +1,139 @@
>+#	$OpenBSD$
>+#	Placed in the Public Domain.
>+
>+tid="authorized principals command"
>+
>+rm -f $OBJ/user_ca_key* $OBJ/cert_user_key*
>+cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
>+
>+if [ -z "$SUDO" ]; then
>+	fatal "need SUDO to create file in /var/run, test won't work without"
>+fi
>+
>+# Establish a AuthorizedPrincipalsCommand in /var/run where it will have
>+# acceptable directory permissions.
>+PRINCIPALS_COMMAND="/var/run/principals_command_${LOGNAME}"
>+cat << _EOF | $SUDO sh -c "cat > '$PRINCIPALS_COMMAND'"
>+#!/bin/sh
>+test "x\$1" != "x${LOGNAME}" && exit 1
>+test -f "$OBJ/authorized_principals_${LOGNAME}" &&
>+	exec cat "$OBJ/authorized_principals_${LOGNAME}"
>+_EOF
>+test $? -eq 0 || fatal "couldn't prepare principals command"
>+$SUDO chmod 0755 "$PRINCIPALS_COMMAND"
>+
>+# Create a CA key and a user certificate.
>+${SSHKEYGEN} -q -N '' -t ed25519  -f $OBJ/user_ca_key || \
>+	fatal "ssh-keygen of user_ca_key failed"
>+${SSHKEYGEN} -q -N '' -t ed25519 -f $OBJ/cert_user_key || \
>+	fatal "ssh-keygen of cert_user_key failed"
>+${SSHKEYGEN} -q -s $OBJ/user_ca_key -I "regress user key for $USER" \
>+    -z $$ -n ${USER},mekmitasdigoat $OBJ/cert_user_key || \
>+	fatal "couldn't sign cert_user_key"
>+
>+# Test explicitly-specified principals
>+for privsep in yes no ; do
>+	_prefix="privsep $privsep"
>+
>+	# Setup for AuthorizedPrincipalsCommand
>+	rm -f $OBJ/authorized_keys_$USER
>+	(
>+		cat $OBJ/sshd_proxy_bak
>+		echo "UsePrivilegeSeparation $privsep"
>+		echo "AuthorizedKeysFile none"
>+		echo "AuthorizedPrincipalsCommand $PRINCIPALS_COMMAND %u"
>+		echo "AuthorizedPrincipalsCommandUser ${LOGNAME}"
>+		echo "TrustedUserCAKeys $OBJ/user_ca_key.pub"
>+	) > $OBJ/sshd_proxy
>+
>+	# XXX test missing command
>+	# XXX test failing command
>+
>+	# Empty authorized_principals
>+	verbose "$tid: ${_prefix} empty authorized_principals"
>+	echo > $OBJ/authorized_principals_$USER
>+	${SSH} -2i $OBJ/cert_user_key \
>+	    -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
>+	if [ $? -eq 0 ]; then
>+		fail "ssh cert connect succeeded unexpectedly"
>+	fi
>+
>+	# Wrong authorized_principals
>+	verbose "$tid: ${_prefix} wrong authorized_principals"
>+	echo gregorsamsa > $OBJ/authorized_principals_$USER
>+	${SSH} -2i $OBJ/cert_user_key \
>+	    -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
>+	if [ $? -eq 0 ]; then
>+		fail "ssh cert connect succeeded unexpectedly"
>+	fi
>+
>+	# Correct authorized_principals
>+	verbose "$tid: ${_prefix} correct authorized_principals"
>+	echo mekmitasdigoat > $OBJ/authorized_principals_$USER
>+	${SSH} -2i $OBJ/cert_user_key \
>+	    -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
>+	if [ $? -ne 0 ]; then
>+		fail "ssh cert connect failed"
>+	fi
>+
>+	# authorized_principals with bad key option
>+	verbose "$tid: ${_prefix} authorized_principals bad key opt"
>+	echo 'blah mekmitasdigoat' > $OBJ/authorized_principals_$USER
>+	${SSH} -2i $OBJ/cert_user_key \
>+	    -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
>+	if [ $? -eq 0 ]; then
>+		fail "ssh cert connect succeeded unexpectedly"
>+	fi
>+
>+	# authorized_principals with command=false
>+	verbose "$tid: ${_prefix} authorized_principals command=false"
>+	echo 'command="false" mekmitasdigoat' > \
>+	    $OBJ/authorized_principals_$USER
>+	${SSH} -2i $OBJ/cert_user_key \
>+	    -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
>+	if [ $? -eq 0 ]; then
>+		fail "ssh cert connect succeeded unexpectedly"
>+	fi
>+
>+
>+	# authorized_principals with command=true
>+	verbose "$tid: ${_prefix} authorized_principals command=true"
>+	echo 'command="true" mekmitasdigoat' > \
>+	    $OBJ/authorized_principals_$USER
>+	${SSH} -2i $OBJ/cert_user_key \
>+	    -F $OBJ/ssh_proxy somehost false >/dev/null 2>&1
>+	if [ $? -ne 0 ]; then
>+		fail "ssh cert connect failed"
>+	fi
>+
>+	# Setup for principals= key option
>+	rm -f $OBJ/authorized_principals_$USER
>+	(
>+		cat $OBJ/sshd_proxy_bak
>+		echo "UsePrivilegeSeparation $privsep"
>+	) > $OBJ/sshd_proxy
>+
>+	# Wrong principals list
>+	verbose "$tid: ${_prefix} wrong principals key option"
>+	(
>+		printf 'cert-authority,principals="gregorsamsa" '
>+		cat $OBJ/user_ca_key.pub
>+	) > $OBJ/authorized_keys_$USER
>+	${SSH} -2i $OBJ/cert_user_key \
>+	    -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
>+	if [ $? -eq 0 ]; then
>+		fail "ssh cert connect succeeded unexpectedly"
>+	fi
>+
>+	# Correct principals list
>+	verbose "$tid: ${_prefix} correct principals key option"
>+	(
>+		printf 'cert-authority,principals="mekmitasdigoat" '
>+		cat $OBJ/user_ca_key.pub
>+	) > $OBJ/authorized_keys_$USER
>+	${SSH} -2i $OBJ/cert_user_key \
>+	    -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
>+	if [ $? -ne 0 ]; then
>+		fail "ssh cert connect failed"
>+	fi
>+done

Actions: View | Diff

Attachments on bug 2081: 2412 | 2416 | 2417 | 2438 | 2477 | 2478 | 2479 | 2522 | 2544 | 2545 | 2546 | 2549 | 2556 | 2557