permitlisten/PermitListen unit test from Markus

2 files changed, 167 insertions, 1 deletions

diff --git a/regress/usr.bin/ssh/Makefile b/regress/usr.bin/ssh/Makefile
index 254acf1f81a..0ec2546e2ed 100644
--- a/regress/usr.bin/ssh/Makefile
+++ b/regress/usr.bin/ssh/Makefile
@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile,v 1.96 2017/10/24 19:33:32 millert Exp $
+#	$OpenBSD: Makefile,v 1.97 2018/06/07 04:46:34 djm Exp $
 
 .ifndef SKIP_UNIT
 SUBDIR=		unittests
@@ -54,6 +54,7 @@ LTESTS= 	connect \
 		sshcfgparse \
 		cfgparse \
 		cfgmatch \
+		cfgmatchlisten \
 		addrmatch \
 		localcommand \
 		forcecommand \
diff --git a/regress/usr.bin/ssh/cfgmatchlisten.sh b/regress/usr.bin/ssh/cfgmatchlisten.sh
new file mode 100644
index 00000000000..8155c56bca1
--- /dev/null
+++ b/regress/usr.bin/ssh/cfgmatchlisten.sh
@@ -0,0 +1,165 @@
+#	$OpenBSD: cfgmatchlisten.sh,v 1.1 2018/06/07 04:46:34 djm Exp $
+#	Placed in the Public Domain.
+
+tid="sshd_config matchlisten"
+
+pidfile=$OBJ/remote_pid
+fwdport=3301
+fwdspec="localhost:${fwdport}"
+fwd="-R $fwdport:127.0.0.1:$PORT"
+
+echo "ExitOnForwardFailure=yes" >> $OBJ/ssh_config
+echo "ExitOnForwardFailure=yes" >> $OBJ/ssh_proxy
+
+start_client()
+{
+	rm -f $pidfile
+	${SSH} -vvv $fwd "$@" somehost true >>$TEST_REGRESS_LOGFILE 2>&1
+	r=$?
+	if [ $r -ne 0 ]; then
+		return $r
+	fi
+	${SSH} -vvv $fwd "$@" somehost \
+	    exec sh -c \'"echo \$\$ > $pidfile; exec sleep 100"\' &
+	    >>$TEST_REGRESS_LOGFILE 2>&1 &
+	client_pid=$!
+	# Wait for remote end
+	n=0
+	while test ! -f $pidfile ; do
+		sleep 1
+		n=`expr $n + 1`
+		if test $n -gt 5; then
+			kill $client_pid
+			fatal "timeout waiting for background ssh"
+		fi
+	done
+	return $r
+}
+
+expect_client_ok()
+{
+	start_client "$@" ||
+	    fail "client did not start"
+}
+
+expect_client_fail()
+{
+	local failmsg="$1"
+	shift
+	start_client "$@" &&
+	    fail $failmsg
+}
+
+stop_client()
+{
+	pid=`cat $pidfile`
+	if [ ! -z "$pid" ]; then
+		kill $pid
+	fi
+	wait
+}
+
+cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
+echo "PermitListen 127.0.0.1:1" >>$OBJ/sshd_config
+echo "Match Address 127.0.0.1" >>$OBJ/sshd_config
+echo "PermitListen 127.0.0.1:2 127.0.0.1:3 $fwdspec" >>$OBJ/sshd_config
+
+grep -v AuthorizedKeysFile $OBJ/sshd_proxy_bak > $OBJ/sshd_proxy
+echo "AuthorizedKeysFile /dev/null" >>$OBJ/sshd_proxy
+echo "PermitListen 127.0.0.1:1" >>$OBJ/sshd_proxy
+echo "Match user $USER" >>$OBJ/sshd_proxy
+echo "AuthorizedKeysFile /dev/null $OBJ/authorized_keys_%u" >>$OBJ/sshd_proxy
+echo "Match Address 127.0.0.1" >>$OBJ/sshd_proxy
+echo "PermitListen 127.0.0.1:2 127.0.0.1:3 $fwdspec" >>$OBJ/sshd_proxy
+
+start_sshd
+
+#set -x
+
+# Test Match + PermitListen in sshd_config.  This should be permitted
+trace "match permitlisten localhost"
+expect_client_ok -F $OBJ/ssh_config
+${SSH} -q -p $fwdport -F $OBJ/ssh_config somehost true || \
+    fail "match permitlisten permit"
+stop_client
+
+# Same but from different source.  This should not be permitted
+trace "match permitlisten proxy"
+expect_client_fail "match permitlisten deny" \
+    -F $OBJ/ssh_proxy
+
+# Retry previous with key option, should also be denied.
+cp /dev/null $OBJ/authorized_keys_$USER
+for t in ${SSH_KEYTYPES}; do
+	printf 'permitlisten="'$fwdspec'" ' >> $OBJ/authorized_keys_$USER
+	cat $OBJ/$t.pub >> $OBJ/authorized_keys_$USER
+done
+trace "match permitlisten proxy w/key opts"
+expect_client_fail "match permitlisten deny w/key opt"\
+    -F $OBJ/ssh_proxy
+
+# Test both sshd_config and key options permitting the same dst/port pair.
+# Should be permitted.
+trace "match permitlisten localhost"
+expect_client_ok -F $OBJ/ssh_config
+${SSH} -q -p $fwdport -F $OBJ/ssh_config somehost true || \
+    fail "match permitlisten permit"
+stop_client
+
+cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
+echo "PermitListen 127.0.0.1:1 $fwdspec 127.0.0.2:2" >>$OBJ/sshd_proxy
+echo "Match User $USER" >>$OBJ/sshd_proxy
+echo "PermitListen 127.0.0.1:1 127.0.0.1:2" >>$OBJ/sshd_proxy
+
+# Test that a Match overrides a PermitListen in the global section
+trace "match permitlisten proxy w/key opts"
+expect_client_fail "match override permitlisten" \
+    -F $OBJ/ssh_proxy
+
+cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
+echo "PermitListen 127.0.0.1:1 $fwdspec 127.0.0.2:2" >>$OBJ/sshd_proxy
+echo "Match User NoSuchUser" >>$OBJ/sshd_proxy
+echo "PermitListen 127.0.0.1:1 127.0.0.1:2" >>$OBJ/sshd_proxy
+
+# Test that a rule that doesn't match doesn't override, plus test a
+# PermitListen entry that's not at the start of the list
+trace "nomatch permitlisten proxy w/key opts"
+expect_client_ok -F $OBJ/ssh_proxy
+${SSH} -q -p $fwdport -F $OBJ/ssh_config somehost true || \
+    fail "nomatch override permitlisten"
+stop_client
+
+# bind to 127.0.0.1 instead of default localhost
+fwdspec2="127.0.0.1:${fwdport}"
+fwd="-R ${fwdspec2}:127.0.0.1:$PORT"
+
+# first try w/ old fwdspec both in server config and key opts
+cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
+echo "PermitListen 127.0.0.1:1 $fwdspec 127.0.0.2:2" >>$OBJ/sshd_proxy
+cp /dev/null $OBJ/authorized_keys_$USER
+for t in ${SSH_KEYTYPES}; do
+	printf 'permitlisten="'$fwdspec'" ' >> $OBJ/authorized_keys_$USER
+	cat $OBJ/$t.pub >> $OBJ/authorized_keys_$USER
+done
+trace "nomatch permitlisten 127.0.0.1 server config and userkey"
+expect_client_fail "nomatch 127.0.0.1 server config and userkey" \
+    -F $OBJ/ssh_config
+
+# correct server config, denied by key opts
+cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
+echo "PermitListen 127.0.0.1:1 ${fwdspec2} 127.0.0.2:2" >>$OBJ/sshd_proxy
+trace "nomatch permitlisten 127.0.0.1 w/key opts"
+expect_client_fail "nomatch 127.0.0.1 w/key otps" \
+    -F $OBJ/ssh_config
+
+# fix key opts
+cp /dev/null $OBJ/authorized_keys_$USER
+for t in ${SSH_KEYTYPES}; do
+	printf 'permitlisten="'$fwdspec2'" ' >> $OBJ/authorized_keys_$USER
+	cat $OBJ/$t.pub >> $OBJ/authorized_keys_$USER
+done
+trace "match permitlisten 127.0.0.1 server config w/key opts"
+expect_client_ok -F $OBJ/ssh_proxy
+${SSH} -q -p $fwdport -F $OBJ/ssh_config somehost true || \
+    fail "match 127.0.0.1 server config w/key opts"
+stop_client