key-options.sh revision 1.9
1# $OpenBSD: key-options.sh,v 1.9 2018/07/03 13:53:26 djm Exp $ 2# Placed in the Public Domain. 3 4tid="key options" 5 6origkeys="$OBJ/authkeys_orig" 7authkeys="$OBJ/authorized_keys_${USER}" 8cp $authkeys $origkeys 9 10# Test command= forced command 11for c in 'command="echo bar"' 'no-pty,command="echo bar"'; do 12 sed "s/.*/$c &/" $origkeys >$authkeys 13 verbose "key option $c" 14 r=`${SSH} -q -F $OBJ/ssh_proxy somehost echo foo` 15 if [ "$r" = "foo" ]; then 16 fail "key option forced command not restricted" 17 fi 18 if [ "$r" != "bar" ]; then 19 fail "key option forced command not executed" 20 fi 21done 22 23# Test no-pty 24expect_pty_succeed() { 25 which=$1 26 opts=$2 27 rm -f $OBJ/data 28 sed "s/.*/$opts &/" $origkeys >$authkeys 29 verbose "key option pty $which" 30 ${SSH} -ttq -F $OBJ/ssh_proxy somehost "tty > $OBJ/data; exit 0" 31 if [ $? -ne 0 ] ; then 32 fail "key option failed $which" 33 else 34 r=`cat $OBJ/data` 35 case "$r" in 36 /dev/*) ;; 37 *) fail "key option failed $which (pty $r)" ;; 38 esac 39 fi 40} 41expect_pty_fail() { 42 which=$1 43 opts=$2 44 rm -f $OBJ/data 45 sed "s/.*/$opts &/" $origkeys >$authkeys 46 verbose "key option pty $which" 47 ${SSH} -ttq -F $OBJ/ssh_proxy somehost "tty > $OBJ/data; exit 0" 48 if [ $? -eq 0 ]; then 49 r=`cat $OBJ/data` 50 if [ -e "$r" ]; then 51 fail "key option failed $which (pty $r)" 52 fi 53 case "$r" in 54 /dev/*) fail "key option failed $which (pty $r)" ;; 55 *) ;; 56 esac 57 fi 58} 59# First ensure that we can allocate a pty by default. 60expect_pty_succeed "default" "" 61expect_pty_fail "no-pty" "no-pty" 62expect_pty_fail "restrict" "restrict" 63expect_pty_succeed "restrict,pty" "restrict,pty" 64 65# Test environment= 66# XXX this can fail if ~/.ssh/environment exists for the user running the test 67echo 'PermitUserEnvironment yes' >> $OBJ/sshd_proxy 68sed 's/.*/environment="FOO=bar" &/' $origkeys >$authkeys 69verbose "key option environment" 70r=`${SSH} -q -F $OBJ/ssh_proxy somehost 'echo $FOO'` 71if [ "$r" != "bar" ]; then 72 fail "key option environment not set" 73fi 74 75# Test from= restriction 76start_sshd 77for f in 127.0.0.1 '127.0.0.0\/8'; do 78 cat $origkeys >$authkeys 79 ${SSH} -q -F $OBJ/ssh_proxy somehost true 80 if [ $? -ne 0 ]; then 81 fail "key option failed without restriction" 82 fi 83 84 sed 's/.*/from="'"$f"'" &/' $origkeys >$authkeys 85 from=`head -1 $authkeys | cut -f1 -d ' '` 86 verbose "key option $from" 87 r=`${SSH} -q -F $OBJ/ssh_proxy somehost 'echo true'` 88 if [ "$r" = "true" ]; then 89 fail "key option $from not restricted" 90 fi 91 92 r=`${SSH} -q -F $OBJ/ssh_config somehost 'echo true'` 93 if [ "$r" != "true" ]; then 94 fail "key option $from not allowed but should be" 95 fi 96done 97 98check_valid_before() { 99 which=$1 100 opts=$2 101 expect=$3 102 sed "s/.*/$opts &/" $origkeys >$authkeys 103 verbose "key option expiry-time $which" 104 ${SSH} -q -F $OBJ/ssh_proxy somehost true 105 case "$expect" in 106 fail) test $? -eq 0 && fail "key option succeeded $which" ;; 107 pass) test $? -ne 0 && fail "key option failed $which" ;; 108 *) fatal "unknown expectation $expect" ;; 109 esac 110} 111check_valid_before "default" "" "pass" 112check_valid_before "invalid" 'expiry-time="INVALID"' "fail" 113check_valid_before "expired" 'expiry-time="19990101"' "fail" 114check_valid_before "valid" 'expiry-time="20380101"' "pass" 115 116