summaryrefslogtreecommitdiff
path: root/regress/cfgmatchlisten.sh
diff options
context:
space:
mode:
Diffstat (limited to 'regress/cfgmatchlisten.sh')
-rw-r--r--regress/cfgmatchlisten.sh165
1 files changed, 165 insertions, 0 deletions
diff --git a/regress/cfgmatchlisten.sh b/regress/cfgmatchlisten.sh
new file mode 100644
index 000000000..8155c56bc
--- /dev/null
+++ b/regress/cfgmatchlisten.sh
@@ -0,0 +1,165 @@
1# $OpenBSD: cfgmatchlisten.sh,v 1.1 2018/06/07 04:46:34 djm Exp $
2# Placed in the Public Domain.
3
4tid="sshd_config matchlisten"
5
6pidfile=$OBJ/remote_pid
7fwdport=3301
8fwdspec="localhost:${fwdport}"
9fwd="-R $fwdport:127.0.0.1:$PORT"
10
11echo "ExitOnForwardFailure=yes" >> $OBJ/ssh_config
12echo "ExitOnForwardFailure=yes" >> $OBJ/ssh_proxy
13
14start_client()
15{
16 rm -f $pidfile
17 ${SSH} -vvv $fwd "$@" somehost true >>$TEST_REGRESS_LOGFILE 2>&1
18 r=$?
19 if [ $r -ne 0 ]; then
20 return $r
21 fi
22 ${SSH} -vvv $fwd "$@" somehost \
23 exec sh -c \'"echo \$\$ > $pidfile; exec sleep 100"\' &
24 >>$TEST_REGRESS_LOGFILE 2>&1 &
25 client_pid=$!
26 # Wait for remote end
27 n=0
28 while test ! -f $pidfile ; do
29 sleep 1
30 n=`expr $n + 1`
31 if test $n -gt 5; then
32 kill $client_pid
33 fatal "timeout waiting for background ssh"
34 fi
35 done
36 return $r
37}
38
39expect_client_ok()
40{
41 start_client "$@" ||
42 fail "client did not start"
43}
44
45expect_client_fail()
46{
47 local failmsg="$1"
48 shift
49 start_client "$@" &&
50 fail $failmsg
51}
52
53stop_client()
54{
55 pid=`cat $pidfile`
56 if [ ! -z "$pid" ]; then
57 kill $pid
58 fi
59 wait
60}
61
62cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
63echo "PermitListen 127.0.0.1:1" >>$OBJ/sshd_config
64echo "Match Address 127.0.0.1" >>$OBJ/sshd_config
65echo "PermitListen 127.0.0.1:2 127.0.0.1:3 $fwdspec" >>$OBJ/sshd_config
66
67grep -v AuthorizedKeysFile $OBJ/sshd_proxy_bak > $OBJ/sshd_proxy
68echo "AuthorizedKeysFile /dev/null" >>$OBJ/sshd_proxy
69echo "PermitListen 127.0.0.1:1" >>$OBJ/sshd_proxy
70echo "Match user $USER" >>$OBJ/sshd_proxy
71echo "AuthorizedKeysFile /dev/null $OBJ/authorized_keys_%u" >>$OBJ/sshd_proxy
72echo "Match Address 127.0.0.1" >>$OBJ/sshd_proxy
73echo "PermitListen 127.0.0.1:2 127.0.0.1:3 $fwdspec" >>$OBJ/sshd_proxy
74
75start_sshd
76
77#set -x
78
79# Test Match + PermitListen in sshd_config. This should be permitted
80trace "match permitlisten localhost"
81expect_client_ok -F $OBJ/ssh_config
82${SSH} -q -p $fwdport -F $OBJ/ssh_config somehost true || \
83 fail "match permitlisten permit"
84stop_client
85
86# Same but from different source. This should not be permitted
87trace "match permitlisten proxy"
88expect_client_fail "match permitlisten deny" \
89 -F $OBJ/ssh_proxy
90
91# Retry previous with key option, should also be denied.
92cp /dev/null $OBJ/authorized_keys_$USER
93for t in ${SSH_KEYTYPES}; do
94 printf 'permitlisten="'$fwdspec'" ' >> $OBJ/authorized_keys_$USER
95 cat $OBJ/$t.pub >> $OBJ/authorized_keys_$USER
96done
97trace "match permitlisten proxy w/key opts"
98expect_client_fail "match permitlisten deny w/key opt"\
99 -F $OBJ/ssh_proxy
100
101# Test both sshd_config and key options permitting the same dst/port pair.
102# Should be permitted.
103trace "match permitlisten localhost"
104expect_client_ok -F $OBJ/ssh_config
105${SSH} -q -p $fwdport -F $OBJ/ssh_config somehost true || \
106 fail "match permitlisten permit"
107stop_client
108
109cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
110echo "PermitListen 127.0.0.1:1 $fwdspec 127.0.0.2:2" >>$OBJ/sshd_proxy
111echo "Match User $USER" >>$OBJ/sshd_proxy
112echo "PermitListen 127.0.0.1:1 127.0.0.1:2" >>$OBJ/sshd_proxy
113
114# Test that a Match overrides a PermitListen in the global section
115trace "match permitlisten proxy w/key opts"
116expect_client_fail "match override permitlisten" \
117 -F $OBJ/ssh_proxy
118
119cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
120echo "PermitListen 127.0.0.1:1 $fwdspec 127.0.0.2:2" >>$OBJ/sshd_proxy
121echo "Match User NoSuchUser" >>$OBJ/sshd_proxy
122echo "PermitListen 127.0.0.1:1 127.0.0.1:2" >>$OBJ/sshd_proxy
123
124# Test that a rule that doesn't match doesn't override, plus test a
125# PermitListen entry that's not at the start of the list
126trace "nomatch permitlisten proxy w/key opts"
127expect_client_ok -F $OBJ/ssh_proxy
128${SSH} -q -p $fwdport -F $OBJ/ssh_config somehost true || \
129 fail "nomatch override permitlisten"
130stop_client
131
132# bind to 127.0.0.1 instead of default localhost
133fwdspec2="127.0.0.1:${fwdport}"
134fwd="-R ${fwdspec2}:127.0.0.1:$PORT"
135
136# first try w/ old fwdspec both in server config and key opts
137cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
138echo "PermitListen 127.0.0.1:1 $fwdspec 127.0.0.2:2" >>$OBJ/sshd_proxy
139cp /dev/null $OBJ/authorized_keys_$USER
140for t in ${SSH_KEYTYPES}; do
141 printf 'permitlisten="'$fwdspec'" ' >> $OBJ/authorized_keys_$USER
142 cat $OBJ/$t.pub >> $OBJ/authorized_keys_$USER
143done
144trace "nomatch permitlisten 127.0.0.1 server config and userkey"
145expect_client_fail "nomatch 127.0.0.1 server config and userkey" \
146 -F $OBJ/ssh_config
147
148# correct server config, denied by key opts
149cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
150echo "PermitListen 127.0.0.1:1 ${fwdspec2} 127.0.0.2:2" >>$OBJ/sshd_proxy
151trace "nomatch permitlisten 127.0.0.1 w/key opts"
152expect_client_fail "nomatch 127.0.0.1 w/key otps" \
153 -F $OBJ/ssh_config
154
155# fix key opts
156cp /dev/null $OBJ/authorized_keys_$USER
157for t in ${SSH_KEYTYPES}; do
158 printf 'permitlisten="'$fwdspec2'" ' >> $OBJ/authorized_keys_$USER
159 cat $OBJ/$t.pub >> $OBJ/authorized_keys_$USER
160done
161trace "match permitlisten 127.0.0.1 server config w/key opts"
162expect_client_ok -F $OBJ/ssh_proxy
163${SSH} -q -p $fwdport -F $OBJ/ssh_config somehost true || \
164 fail "match 127.0.0.1 server config w/key opts"
165stop_client