summaryrefslogtreecommitdiff
path: root/regress
diff options
context:
space:
mode:
Diffstat (limited to 'regress')
-rw-r--r--regress/Makefile10
-rw-r--r--regress/agent-getpeereid.sh7
-rw-r--r--regress/agent-ptrace.sh2
-rw-r--r--regress/cfgmatch.sh106
-rw-r--r--regress/cipher-speed.sh47
-rw-r--r--regress/forcecommand.sh42
-rw-r--r--regress/forwarding.sh32
7 files changed, 239 insertions, 7 deletions
diff --git a/regress/Makefile b/regress/Makefile
index 4f47bc3fd..539956398 100644
--- a/regress/Makefile
+++ b/regress/Makefile
@@ -1,4 +1,4 @@
1# $OpenBSD: Makefile,v 1.36 2005/03/04 08:48:46 djm Exp $ 1# $OpenBSD: Makefile,v 1.42 2006/07/19 13:34:52 dtucker Exp $
2 2
3REGRESS_TARGETS= t1 t2 t3 t4 t5 t6 t7 t-exec 3REGRESS_TARGETS= t1 t2 t3 t4 t5 t6 t7 t-exec
4tests: $(REGRESS_TARGETS) 4tests: $(REGRESS_TARGETS)
@@ -40,7 +40,9 @@ LTESTS= connect \
40 forwarding \ 40 forwarding \
41 multiplex \ 41 multiplex \
42 reexec \ 42 reexec \
43 brokenkeys 43 brokenkeys \
44 cfgmatch \
45 forcecommand
44 46
45USER!= id -un 47USER!= id -un
46CLEANFILES= t2.out t6.out1 t6.out2 t7.out t7.out.pub copy.1 copy.2 \ 48CLEANFILES= t2.out t6.out1 t6.out2 t7.out t7.out.pub copy.1 copy.2 \
@@ -49,8 +51,8 @@ CLEANFILES= t2.out t6.out1 t6.out2 t7.out t7.out.pub copy.1 copy.2 \
49 rsa.pub rsa rsa1.pub rsa1 host.rsa host.rsa1 \ 51 rsa.pub rsa rsa1.pub rsa1 host.rsa host.rsa1 \
50 rsa-agent rsa-agent.pub rsa1-agent rsa1-agent.pub \ 52 rsa-agent rsa-agent.pub rsa1-agent rsa1-agent.pub \
51 ls.copy banner.in banner.out empty.in \ 53 ls.copy banner.in banner.out empty.in \
52 scp-ssh-wrapper.scp ssh_proxy_envpass \ 54 scp-ssh-wrapper.scp ssh_proxy_envpass remote_pid \
53 remote_pid 55 sshd_proxy_bak rsa_ssh2_cr.prv rsa_ssh2_crnl.prv
54 56
55#LTESTS += ssh-com ssh-com-client ssh-com-keygen ssh-com-sftp 57#LTESTS += ssh-com ssh-com-client ssh-com-keygen ssh-com-sftp
56 58
diff --git a/regress/agent-getpeereid.sh b/regress/agent-getpeereid.sh
index 6186a8d48..e5fcedda7 100644
--- a/regress/agent-getpeereid.sh
+++ b/regress/agent-getpeereid.sh
@@ -1,4 +1,4 @@
1# $OpenBSD: agent-getpeereid.sh,v 1.2 2005/11/14 21:25:56 grunk Exp $ 1# $OpenBSD: agent-getpeereid.sh,v 1.3 2006/07/06 12:01:53 grunk Exp $
2# Placed in the Public Domain. 2# Placed in the Public Domain.
3 3
4tid="disallow agent attach from other uid" 4tid="disallow agent attach from other uid"
@@ -12,6 +12,11 @@ then
12 echo "skipped (not supported on this platform)" 12 echo "skipped (not supported on this platform)"
13 exit 0 13 exit 0
14fi 14fi
15if [ -z "$SUDO" ]; then
16 echo "skipped: need SUDO to switch to uid $UNPRIV"
17 exit 0
18fi
19
15 20
16trace "start agent" 21trace "start agent"
17eval `${SSHAGENT} -s -a ${ASOCK}` > /dev/null 22eval `${SSHAGENT} -s -a ${ASOCK}` > /dev/null
diff --git a/regress/agent-ptrace.sh b/regress/agent-ptrace.sh
index 4de2638e4..d5892ed03 100644
--- a/regress/agent-ptrace.sh
+++ b/regress/agent-ptrace.sh
@@ -41,7 +41,7 @@ EOF
41 if [ $? -ne 0 ]; then 41 if [ $? -ne 0 ]; then
42 fail "gdb failed: exit code $?" 42 fail "gdb failed: exit code $?"
43 fi 43 fi
44 egrep 'ptrace: Operation not permitted.|procfs:.*Permission denied.|ttrace attach: Permission denied.|procfs:.*: Invalid argument.' >/dev/null ${OBJ}/gdb.out 44 egrep 'ptrace: Operation not permitted.|procfs:.*Permission denied.|ttrace.*Permission denied.|procfs:.*: Invalid argument.' >/dev/null ${OBJ}/gdb.out
45 r=$? 45 r=$?
46 rm -f ${OBJ}/gdb.out 46 rm -f ${OBJ}/gdb.out
47 if [ $r -ne 0 ]; then 47 if [ $r -ne 0 ]; then
diff --git a/regress/cfgmatch.sh b/regress/cfgmatch.sh
new file mode 100644
index 000000000..d987dcb97
--- /dev/null
+++ b/regress/cfgmatch.sh
@@ -0,0 +1,106 @@
1# $OpenBSD: cfgmatch.sh,v 1.2 2006/07/22 01:50:00 dtucker Exp $
2# Placed in the Public Domain.
3
4tid="sshd_config match"
5
6pidfile=$OBJ/remote_pid
7fwdport=3301
8fwd="-L $fwdport:127.0.0.1:$PORT"
9
10stop_client()
11{
12 pid=`cat $pidfile`
13 if [ ! -z "$pid" ]; then
14 kill $pid
15 sleep 1
16 fi
17}
18
19cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
20
21echo "PermitOpen 127.0.0.1:1" >>$OBJ/sshd_config
22echo "Match Address 127.0.0.1" >>$OBJ/sshd_config
23echo "PermitOpen 127.0.0.1:$PORT" >>$OBJ/sshd_config
24
25echo "PermitOpen 127.0.0.1:1" >>$OBJ/sshd_proxy
26echo "Match Address 127.0.0.1" >>$OBJ/sshd_proxy
27echo "PermitOpen 127.0.0.1:$PORT" >>$OBJ/sshd_proxy
28
29start_sshd
30
31#set -x
32
33# Test Match + PermitOpen in sshd_config. This should be permitted
34for p in 1 2; do
35 rm -f $pidfile
36 trace "match permitopen localhost proto $p"
37 ${SSH} -$p $fwd -F $OBJ/ssh_config -f somehost \
38 "echo \$\$ > $pidfile; exec sleep 100" >>$TEST_SSH_LOGFILE 2>&1 ||\
39 fail "match permitopen proto $p sshd failed"
40 sleep 1;
41 ${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true || \
42 fail "match permitopen permit proto $p"
43 stop_client
44done
45
46# Same but from different source. This should not be permitted
47for p in 1 2; do
48 rm -f $pidfile
49 trace "match permitopen proxy proto $p"
50 ${SSH} -q -$p $fwd -F $OBJ/ssh_proxy -f somehost \
51 "echo \$\$ > $pidfile; exec sleep 100" >>$TEST_SSH_LOGFILE 2>&1 ||\
52 fail "match permitopen proxy proto $p sshd failed"
53 sleep 1;
54 ${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true && \
55 fail "match permitopen deny proto $p"
56 stop_client
57done
58
59# Retry previous with key option, should also be denied.
60echo -n 'permitopen="127.0.0.1:'$PORT'" ' >$OBJ/authorized_keys_$USER
61cat $OBJ/rsa.pub >> $OBJ/authorized_keys_$USER
62echo -n 'permitopen="127.0.0.1:'$PORT'" ' >>$OBJ/authorized_keys_$USER
63cat $OBJ/rsa1.pub >> $OBJ/authorized_keys_$USER
64for p in 1 2; do
65 rm -f $pidfile
66 trace "match permitopen proxy w/key opts proto $p"
67 ${SSH} -q -$p $fwd -F $OBJ/ssh_proxy -f somehost \
68 "echo \$\$ > $pidfile; exec sleep 100" >>$TEST_SSH_LOGFILE 2>&1 ||\
69 fail "match permitopen w/key opt proto $p sshd failed"
70 sleep 1;
71 ${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true && \
72 fail "match permitopen deny w/key opt proto $p"
73 stop_client
74done
75
76# Test both sshd_config and key options permitting the same dst/port pair.
77# Should be permitted.
78for p in 1 2; do
79 rm -f $pidfile
80 trace "match permitopen localhost proto $p"
81 ${SSH} -$p $fwd -F $OBJ/ssh_config -f somehost \
82 "echo \$\$ > $pidfile; exec sleep 100" >>$TEST_SSH_LOGFILE 2>&1 ||\
83 fail "match permitopen proto $p sshd failed"
84 sleep 1;
85 ${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true || \
86 fail "match permitopen permit proto $p"
87 stop_client
88done
89
90cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
91echo "PermitOpen 127.0.0.1:1 127.0.0.1:$PORT 127.0.0.2:2" >>$OBJ/sshd_proxy
92echo "Match User $USER" >>$OBJ/sshd_proxy
93echo "PermitOpen 127.0.0.1:1 127.0.0.1:2" >>$OBJ/sshd_proxy
94
95# Test that a Match overrides a PermitOpen in the global section
96for p in 1 2; do
97 rm -f $pidfile
98 trace "match permitopen proxy w/key opts proto $p"
99 ${SSH} -q -$p $fwd -F $OBJ/ssh_proxy -f somehost \
100 "echo \$\$ > $pidfile; exec sleep 100" >>$TEST_SSH_LOGFILE 2>&1 ||\
101 fail "match override permitopen proto $p sshd failed"
102 sleep 1;
103 ${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true && \
104 fail "match override permitopen proto $p"
105 stop_client
106done
diff --git a/regress/cipher-speed.sh b/regress/cipher-speed.sh
new file mode 100644
index 000000000..592511143
--- /dev/null
+++ b/regress/cipher-speed.sh
@@ -0,0 +1,47 @@
1# $OpenBSD: cipher-speed.sh,v 1.2 2005/05/24 04:09:54 djm Exp $
2# Placed in the Public Domain.
3
4tid="cipher speed"
5
6getbytes ()
7{
8 sed -n '/transferred/s/.*secs (\(.* bytes.sec\).*/\1/p'
9}
10
11tries="1 2"
12DATA=/bin/ls
13DATA=/bsd
14
15macs="hmac-sha1 hmac-md5 hmac-sha1-96 hmac-md5-96"
16ciphers="aes128-cbc 3des-cbc blowfish-cbc cast128-cbc
17 arcfour128 arcfour256 arcfour aes192-cbc aes256-cbc aes128-ctr"
18
19for c in $ciphers; do for m in $macs; do
20 trace "proto 2 cipher $c mac $m"
21 for x in $tries; do
22 echo -n "$c/$m:\t"
23 ( ${SSH} -o 'compression no' \
24 -F $OBJ/ssh_proxy -2 -m $m -c $c somehost \
25 exec sh -c \'"dd of=/dev/null obs=32k"\' \
26 < ${DATA} ) 2>&1 | getbytes
27
28 if [ $? -ne 0 ]; then
29 fail "ssh -2 failed with mac $m cipher $c"
30 fi
31 done
32done; done
33
34ciphers="3des blowfish"
35for c in $ciphers; do
36 trace "proto 1 cipher $c"
37 for x in $tries; do
38 echo -n "$c:\t"
39 ( ${SSH} -o 'compression no' \
40 -F $OBJ/ssh_proxy -1 -c $c somehost \
41 exec sh -c \'"dd of=/dev/null obs=32k"\' \
42 < ${DATA} ) 2>&1 | getbytes
43 if [ $? -ne 0 ]; then
44 fail "ssh -1 failed with cipher $c"
45 fi
46 done
47done
diff --git a/regress/forcecommand.sh b/regress/forcecommand.sh
new file mode 100644
index 000000000..99e51a60f
--- /dev/null
+++ b/regress/forcecommand.sh
@@ -0,0 +1,42 @@
1# $OpenBSD: forcecommand.sh,v 1.1 2006/07/19 13:09:28 dtucker Exp $
2# Placed in the Public Domain.
3
4tid="forced command"
5
6cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
7
8echon 'command="true" ' >$OBJ/authorized_keys_$USER
9cat $OBJ/rsa.pub >> $OBJ/authorized_keys_$USER
10echon 'command="true" ' >>$OBJ/authorized_keys_$USER
11cat $OBJ/rsa1.pub >> $OBJ/authorized_keys_$USER
12
13for p in 1 2; do
14 trace "forced command in key option proto $p"
15 ${SSH} -$p -F $OBJ/ssh_proxy somehost false \ ||
16 fail "forced command in key proto $p"
17done
18
19echon 'command="false" ' >$OBJ/authorized_keys_$USER
20cat $OBJ/rsa.pub >> $OBJ/authorized_keys_$USER
21echon 'command="false" ' >>$OBJ/authorized_keys_$USER
22cat $OBJ/rsa1.pub >> $OBJ/authorized_keys_$USER
23
24cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
25echo "ForceCommand true" >> $OBJ/sshd_proxy
26
27for p in 1 2; do
28 trace "forced command in sshd_config overrides key option proto $p"
29 ${SSH} -$p -F $OBJ/ssh_proxy somehost false \ ||
30 fail "forced command in key proto $p"
31done
32
33cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
34echo "ForceCommand false" >> $OBJ/sshd_proxy
35echo "Match User $USER" >> $OBJ/sshd_proxy
36echo " ForceCommand true" >> $OBJ/sshd_proxy
37
38for p in 1 2; do
39 trace "forced command with match proto $p"
40 ${SSH} -$p -F $OBJ/ssh_proxy somehost false \ ||
41 fail "forced command in key proto $p"
42done
diff --git a/regress/forwarding.sh b/regress/forwarding.sh
index 3b171144f..9ffbb3dd4 100644
--- a/regress/forwarding.sh
+++ b/regress/forwarding.sh
@@ -1,4 +1,4 @@
1# $OpenBSD: forwarding.sh,v 1.5 2005/03/10 10:20:39 dtucker Exp $ 1# $OpenBSD: forwarding.sh,v 1.6 2006/07/11 18:51:21 markus Exp $
2# Placed in the Public Domain. 2# Placed in the Public Domain.
3 3
4tid="local and remote forwarding" 4tid="local and remote forwarding"
@@ -34,6 +34,36 @@ for p in 1 2; do
34done 34done
35 35
36for p in 1 2; do 36for p in 1 2; do
37for d in L R; do
38 trace "exit on -$d forward failure, proto $p"
39
40 # this one should succeed
41 ${SSH} -$p -F $OBJ/ssh_config \
42 -$d ${base}01:127.0.0.1:$PORT \
43 -$d ${base}02:127.0.0.1:$PORT \
44 -$d ${base}03:127.0.0.1:$PORT \
45 -$d ${base}04:127.0.0.1:$PORT \
46 -oExitOnForwardFailure=yes somehost true
47 if [ $? != 0 ]; then
48 fail "connection failed, should not"
49 else
50 # this one should fail
51 ${SSH} -q -$p -F $OBJ/ssh_config \
52 -$d ${base}01:127.0.0.1:$PORT \
53 -$d ${base}02:127.0.0.1:$PORT \
54 -$d ${base}03:127.0.0.1:$PORT \
55 -$d ${base}01:127.0.0.1:$PORT \
56 -$d ${base}04:127.0.0.1:$PORT \
57 -oExitOnForwardFailure=yes somehost true
58 r=$?
59 if [ $r != 255 ]; then
60 fail "connection not termintated, but should ($r)"
61 fi
62 fi
63done
64done
65
66for p in 1 2; do
37 trace "simple clear forwarding proto $p" 67 trace "simple clear forwarding proto $p"
38 ${SSH} -$p -F $OBJ/ssh_config -oClearAllForwardings=yes somehost true 68 ${SSH} -$p -F $OBJ/ssh_config -oClearAllForwardings=yes somehost true
39 69