upstream: unit tests for ForwardAgent=/path; from Eric Chiang

OpenBSD-Regress-ID: 24f693f78290b2c17725dab2c614dffe4a88c8da

2 files changed, 54 insertions, 3 deletions

diff --git a/regress/agent.sh b/regress/agent.sh
index 922d8436e..39403653c 100644
--- a/regress/agent.sh
+++ b/regress/agent.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: agent.sh,v 1.16 2019/11/26 23:43:10 djm Exp $
+#       $OpenBSD: agent.sh,v 1.17 2019/12/21 02:33:07 djm Exp $
 #       Placed in the Public Domain.
 
 tid="simple agent test"
@@ -15,6 +15,12 @@ if [ $r -ne 0 ]; then
         fatal "could not start ssh-agent: exit code $r"
 fi
 
+eval `${SSHAGENT} ${EXTRA_AGENT_ARGS} -s | sed 's/SSH_/FW_SSH_/g'` > /dev/null
+r=$?
+if [ $r -ne 0 ]; then
+        fatal "could not start second ssh-agent: exit code $r"
+fi
+
 ${SSHADD} -l > /dev/null 2>&1
 if [ $? -ne 1 ]; then
         fail "ssh-add -l did not fail with exit code 1"
@@ -38,11 +44,16 @@ for t in ${SSH_KEYTYPES}; do
 
         # add to authorized keys
         cat $OBJ/$t-agent.pub >> $OBJ/authorized_keys_$USER
-        # add privat key to agent
+        # add private key to agent
         ${SSHADD} $OBJ/$t-agent #> /dev/null 2>&1
         if [ $? -ne 0 ]; then
                 fail "ssh-add failed exit code $?"
         fi
+        # add private key to second agent
+        SSH_AUTH_SOCK=$FW_SSH_AUTH_SOCK ${SSHADD} $OBJ/$t-agent #> /dev/null 2>&1
+        if [ $? -ne 0 ]; then
+                fail "ssh-add failed exit code $?"
+        fi
         # Remove private key to ensure that we aren't accidentally using it.
         rm -f $OBJ/$t-agent
 done
@@ -90,6 +101,11 @@ r=$?
 if [ $r -ne 0 ]; then
         fail "ssh-add -l via agent fwd failed (exit code $r)"
 fi
+${SSH} "-oForwardAgent=$SSH_AUTH_SOCK" -F $OBJ/ssh_proxy somehost ${SSHADD} -l > /dev/null 2>&1
+r=$?
+if [ $r -ne 0 ]; then
+        fail "ssh-add -l via agent path fwd failed (exit code $r)"
+fi
 ${SSH} -A -F $OBJ/ssh_proxy somehost \
         "${SSH} -F $OBJ/ssh_proxy somehost exit 52"
 r=$?
@@ -97,6 +113,30 @@ if [ $r -ne 52 ]; then
         fail "agent fwd failed (exit code $r)"
 fi
 
+trace "agent forwarding different agent"
+${SSH} "-oForwardAgent=$FW_SSH_AUTH_SOCK" -F $OBJ/ssh_proxy somehost ${SSHADD} -l > /dev/null 2>&1
+r=$?
+if [ $r -ne 0 ]; then
+        fail "ssh-add -l via agent path fwd of different agent failed (exit code $r)"
+fi
+${SSH} '-oForwardAgent=$FW_SSH_AUTH_SOCK' -F $OBJ/ssh_proxy somehost ${SSHADD} -l > /dev/null 2>&1
+r=$?
+if [ $r -ne 0 ]; then
+        fail "ssh-add -l via agent path env fwd of different agent failed (exit code $r)"
+fi
+
+# Remove keys from forwarded agent, ssh-add on remote machine should now fail.
+SSH_AUTH_SOCK=$FW_SSH_AUTH_SOCK ${SSHADD} -D > /dev/null 2>&1
+r=$?
+if [ $r -ne 0 ]; then
+        fail "ssh-add -D failed: exit code $r"
+fi
+${SSH} '-oForwardAgent=$FW_SSH_AUTH_SOCK' -F $OBJ/ssh_proxy somehost ${SSHADD} -l > /dev/null 2>&1
+r=$?
+if [ $r -ne 1 ]; then
+        fail "ssh-add -l with different agent did not fail with exit code 1 (exit code $r)"
+fi
+
 (printf 'cert-authority,principals="estragon" '; cat $OBJ/user_ca_key.pub) \
         > $OBJ/authorized_keys_$USER
 for t in ${SSH_KEYTYPES}; do
@@ -121,3 +161,4 @@ fi
 
 trace "kill agent"
 ${SSHAGENT} -k > /dev/null
+SSH_AGENT_PID=$FW_SSH_AGENT_PID ${SSHAGENT} -k > /dev/null
diff --git a/regress/sshcfgparse.sh b/regress/sshcfgparse.sh
index 2c00b64ef..fc72a0a71 100644
--- a/regress/sshcfgparse.sh
+++ b/regress/sshcfgparse.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: sshcfgparse.sh,v 1.5 2019/07/23 13:32:48 dtucker Exp $
+#       $OpenBSD: sshcfgparse.sh,v 1.6 2019/12/21 02:33:07 djm Exp $
 #       Placed in the Public Domain.
 
 tid="ssh config parse"
@@ -94,5 +94,15 @@ if [ "$dsa" = "1" ]; then
         expect_result_absent "$f" "ssh-dss-cert-v01.*"
 fi
 
+verbose "agentforwarding"
+f=`${SSH} -GF none host | awk '/^forwardagent /{print$2}'`
+expect_result_present "$f" "no"
+f=`${SSH} -GF none -oforwardagent=no host | awk '/^forwardagent /{print$2}'`
+expect_result_present "$f" "no"
+f=`${SSH} -GF none -oforwardagent=yes host | awk '/^forwardagent /{print$2}'`
+expect_result_present "$f" "yes"
+f=`${SSH} -GF none '-oforwardagent=SSH_AUTH_SOCK.forward' host | awk '/^forwardagent /{print$2}'`
+expect_result_present "$f" "SSH_AUTH_SOCK.forward"
+
 # cleanup
 rm -f $OBJ/ssh_config.[012]