summaryrefslogtreecommitdiff
path: root/regress/addrmatch.sh
diff options
context:
space:
mode:
authorColin Watson <cjwatson@debian.org>2012-09-07 00:20:47 +0100
committerColin Watson <cjwatson@debian.org>2012-09-07 00:20:47 +0100
commiteab78da6a54225de06271d9c8da650f04a55ed88 (patch)
treeaa258ca77515939f6d89317ff67fbcb0bca08b24 /regress/addrmatch.sh
parenta26f5de49df59322fde07f7be91b3e3969c9c238 (diff)
parentc6a2c0334e45419875687d250aed9bea78480f2e (diff)
* New upstream release (http://www.openssh.com/txt/release-6.1).
- Enable pre-auth sandboxing by default for new installs. - Allow "PermitOpen none" to refuse all port-forwarding requests (closes: #543683).
Diffstat (limited to 'regress/addrmatch.sh')
-rw-r--r--regress/addrmatch.sh53
1 files changed, 32 insertions, 21 deletions
diff --git a/regress/addrmatch.sh b/regress/addrmatch.sh
index 23ddd65ce..1584bd405 100644
--- a/regress/addrmatch.sh
+++ b/regress/addrmatch.sh
@@ -1,4 +1,4 @@
1# $OpenBSD: addrmatch.sh,v 1.3 2010/02/09 04:57:36 djm Exp $ 1# $OpenBSD: addrmatch.sh,v 1.4 2012/05/13 01:42:32 dtucker Exp $
2# Placed in the Public Domain. 2# Placed in the Public Domain.
3 3
4tid="address match" 4tid="address match"
@@ -7,39 +7,50 @@ mv $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
7 7
8run_trial() 8run_trial()
9{ 9{
10 user="$1"; addr="$2"; host="$3"; expected="$4"; descr="$5" 10 user="$1"; addr="$2"; host="$3"; laddr="$4"; lport="$5"
11 expected="$6"; descr="$7"
11 12
12 verbose "test $descr for $user $addr $host" 13 verbose "test $descr for $user $addr $host"
13 result=`${SSHD} -f $OBJ/sshd_proxy -T \ 14 result=`${SSHD} -f $OBJ/sshd_proxy -T \
14 -C user=${user},addr=${addr},host=${host} | \ 15 -C user=${user},addr=${addr},host=${host},laddr=${laddr},lport=${lport} | \
15 awk '/^passwordauthentication/ {print $2}'` 16 awk '/^forcecommand/ {print $2}'`
16 if [ "$result" != "$expected" ]; then 17 if [ "$result" != "$expected" ]; then
17 fail "failed for $user $addr $host: expected $expected, got $result" 18 fail "failed '$descr' expected $expected got $result"
18 fi 19 fi
19} 20}
20 21
21cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy 22cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
22cat >>$OBJ/sshd_proxy <<EOD 23cat >>$OBJ/sshd_proxy <<EOD
23PasswordAuthentication no 24ForceCommand nomatch
24Match Address 192.168.0.0/16,!192.168.30.0/24,10.0.0.0/8,host.example.com 25Match Address 192.168.0.0/16,!192.168.30.0/24,10.0.0.0/8,host.example.com
25 PasswordAuthentication yes 26 ForceCommand match1
26Match Address 1.1.1.1,::1,!::3,2000::/16 27Match Address 1.1.1.1,::1,!::3,2000::/16
27 PasswordAuthentication yes 28 ForceCommand match2
29Match LocalAddress 127.0.0.1,::1
30 ForceCommand match3
31Match LocalPort 5678
32 ForceCommand match4
28EOD 33EOD
29 34
30run_trial user 192.168.0.1 somehost yes "permit, first entry" 35run_trial user 192.168.0.1 somehost 1.2.3.4 1234 match1 "first entry"
31run_trial user 192.168.30.1 somehost no "deny, negative match" 36run_trial user 192.168.30.1 somehost 1.2.3.4 1234 nomatch "negative match"
32run_trial user 19.0.0.1 somehost no "deny, no match" 37run_trial user 19.0.0.1 somehost 1.2.3.4 1234 nomatch "no match"
33run_trial user 10.255.255.254 somehost yes "permit, list middle" 38run_trial user 10.255.255.254 somehost 1.2.3.4 1234 match1 "list middle"
34run_trial user 192.168.30.1 192.168.0.1 no "deny, faked IP in hostname" 39run_trial user 192.168.30.1 192.168.0.1 1.2.3.4 1234 nomatch "faked IP in hostname"
35run_trial user 1.1.1.1 somehost.example.com yes "permit, bare IP4 address" 40run_trial user 1.1.1.1 somehost.example.com 1.2.3.4 1234 match2 "bare IP4 address"
36test "$TEST_SSH_IPV6" = "no" && exit 41run_trial user 19.0.0.1 somehost 127.0.0.1 1234 match3 "localaddress"
37run_trial user ::1 somehost.example.com yes "permit, bare IP6 address" 42run_trial user 19.0.0.1 somehost 1.2.3.4 5678 match4 "localport"
38run_trial user ::2 somehost.exaple.com no "deny IPv6" 43
39run_trial user ::3 somehost no "deny IP6 negated" 44if test "$TEST_SSH_IPV6" != "no"; then
40run_trial user ::4 somehost no "deny, IP6 no match" 45run_trial user ::1 somehost.example.com ::2 1234 match2 "bare IP6 address"
41run_trial user 2000::1 somehost yes "permit, IP6 network" 46run_trial user ::2 somehost.exaple.com ::2 1234 nomatch "deny IPv6"
42run_trial user 2001::1 somehost no "deny, IP6 network" 47run_trial user ::3 somehost ::2 1234 nomatch "IP6 negated"
48run_trial user ::4 somehost ::2 1234 nomatch "IP6 no match"
49run_trial user 2000::1 somehost ::2 1234 match2 "IP6 network"
50run_trial user 2001::1 somehost ::2 1234 nomatch "IP6 network"
51run_trial user ::5 somehost ::1 1234 match3 "IP6 localaddress"
52run_trial user ::5 somehost ::2 5678 match4 "IP6 localport"
53fi
43 54
44cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy 55cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
45rm $OBJ/sshd_proxy_bak 56rm $OBJ/sshd_proxy_bak