Damien Miller | 8cb3587 | 2011-05-29 21:59:10 +1000 | [diff] [blame] | 1 | # $OpenBSD: cfgmatch.sh,v 1.5 2011/05/23 03:31:31 djm Exp $ |
Damien Miller | 7b1877c | 2006-07-24 15:31:41 +1000 | [diff] [blame] | 2 | # Placed in the Public Domain. |
| 3 | |
| 4 | tid="sshd_config match" |
| 5 | |
| 6 | pidfile=$OBJ/remote_pid |
| 7 | fwdport=3301 |
| 8 | fwd="-L $fwdport:127.0.0.1:$PORT" |
| 9 | |
Tim Rice | bc48157 | 2011-06-02 22:26:19 -0700 | [diff] [blame^] | 10 | echo "ExitOnForwardFailure=yes" >> $OBJ/ssh_config |
| 11 | echo "ExitOnForwardFailure=yes" >> $OBJ/ssh_proxy |
Damien Miller | 8cb3587 | 2011-05-29 21:59:10 +1000 | [diff] [blame] | 12 | |
| 13 | start_client() |
| 14 | { |
| 15 | rm -f $pidfile |
| 16 | ${SSH} -q -$p $fwd "$@" somehost \ |
| 17 | exec sh -c \'"echo \$\$ > $pidfile; exec sleep 100"\' \ |
| 18 | >>$TEST_SSH_LOGFILE 2>&1 & |
| 19 | client_pid=$! |
| 20 | # Wait for remote end |
| 21 | n=0 |
| 22 | while test ! -f $pidfile ; do |
| 23 | sleep 1 |
| 24 | n=`expr $n + 1` |
| 25 | if test $n -gt 60; then |
| 26 | kill $client_pid |
| 27 | fatal "timeout waiting for background ssh" |
| 28 | fi |
| 29 | done |
| 30 | } |
| 31 | |
Damien Miller | 7b1877c | 2006-07-24 15:31:41 +1000 | [diff] [blame] | 32 | stop_client() |
| 33 | { |
| 34 | pid=`cat $pidfile` |
| 35 | if [ ! -z "$pid" ]; then |
| 36 | kill $pid |
Darren Tucker | 89f59ce | 2006-09-08 00:03:05 +1000 | [diff] [blame] | 37 | sleep 1 |
Damien Miller | 7b1877c | 2006-07-24 15:31:41 +1000 | [diff] [blame] | 38 | fi |
Damien Miller | 8cb3587 | 2011-05-29 21:59:10 +1000 | [diff] [blame] | 39 | wait |
Damien Miller | 7b1877c | 2006-07-24 15:31:41 +1000 | [diff] [blame] | 40 | } |
| 41 | |
| 42 | cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak |
Damien Miller | 8cb3587 | 2011-05-29 21:59:10 +1000 | [diff] [blame] | 43 | grep -v AuthorizedKeysFile $OBJ/sshd_proxy_bak > $OBJ/sshd_proxy |
| 44 | echo "AuthorizedKeysFile /dev/null" >>$OBJ/sshd_proxy |
Damien Miller | 7b1877c | 2006-07-24 15:31:41 +1000 | [diff] [blame] | 45 | echo "PermitOpen 127.0.0.1:1" >>$OBJ/sshd_config |
Damien Miller | 8cb3587 | 2011-05-29 21:59:10 +1000 | [diff] [blame] | 46 | echo "Match user $USER" >>$OBJ/sshd_proxy |
| 47 | echo "AuthorizedKeysFile /dev/null $OBJ/authorized_keys_%u" >>$OBJ/sshd_proxy |
Damien Miller | 7b1877c | 2006-07-24 15:31:41 +1000 | [diff] [blame] | 48 | echo "Match Address 127.0.0.1" >>$OBJ/sshd_config |
| 49 | echo "PermitOpen 127.0.0.1:$PORT" >>$OBJ/sshd_config |
| 50 | |
| 51 | echo "PermitOpen 127.0.0.1:1" >>$OBJ/sshd_proxy |
| 52 | echo "Match Address 127.0.0.1" >>$OBJ/sshd_proxy |
| 53 | echo "PermitOpen 127.0.0.1:$PORT" >>$OBJ/sshd_proxy |
| 54 | |
| 55 | start_sshd |
| 56 | |
| 57 | #set -x |
| 58 | |
| 59 | # Test Match + PermitOpen in sshd_config. This should be permitted |
| 60 | for p in 1 2; do |
Damien Miller | 7b1877c | 2006-07-24 15:31:41 +1000 | [diff] [blame] | 61 | trace "match permitopen localhost proto $p" |
Damien Miller | 8cb3587 | 2011-05-29 21:59:10 +1000 | [diff] [blame] | 62 | start_client -F $OBJ/ssh_config |
Damien Miller | 7b1877c | 2006-07-24 15:31:41 +1000 | [diff] [blame] | 63 | ${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true || \ |
| 64 | fail "match permitopen permit proto $p" |
| 65 | stop_client |
| 66 | done |
| 67 | |
| 68 | # Same but from different source. This should not be permitted |
| 69 | for p in 1 2; do |
Damien Miller | 7b1877c | 2006-07-24 15:31:41 +1000 | [diff] [blame] | 70 | trace "match permitopen proxy proto $p" |
Damien Miller | 8cb3587 | 2011-05-29 21:59:10 +1000 | [diff] [blame] | 71 | start_client -F $OBJ/ssh_proxy |
Damien Miller | 7b1877c | 2006-07-24 15:31:41 +1000 | [diff] [blame] | 72 | ${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true && \ |
| 73 | fail "match permitopen deny proto $p" |
| 74 | stop_client |
| 75 | done |
| 76 | |
| 77 | # Retry previous with key option, should also be denied. |
Darren Tucker | c614c78 | 2010-03-01 12:49:05 +1100 | [diff] [blame] | 78 | echon 'permitopen="127.0.0.1:'$PORT'" ' >$OBJ/authorized_keys_$USER |
Damien Miller | 7b1877c | 2006-07-24 15:31:41 +1000 | [diff] [blame] | 79 | cat $OBJ/rsa.pub >> $OBJ/authorized_keys_$USER |
Darren Tucker | c614c78 | 2010-03-01 12:49:05 +1100 | [diff] [blame] | 80 | echon 'permitopen="127.0.0.1:'$PORT'" ' >>$OBJ/authorized_keys_$USER |
Damien Miller | 7b1877c | 2006-07-24 15:31:41 +1000 | [diff] [blame] | 81 | cat $OBJ/rsa1.pub >> $OBJ/authorized_keys_$USER |
| 82 | for p in 1 2; do |
Damien Miller | 7b1877c | 2006-07-24 15:31:41 +1000 | [diff] [blame] | 83 | trace "match permitopen proxy w/key opts proto $p" |
Damien Miller | 8cb3587 | 2011-05-29 21:59:10 +1000 | [diff] [blame] | 84 | start_client -F $OBJ/ssh_proxy |
Damien Miller | 7b1877c | 2006-07-24 15:31:41 +1000 | [diff] [blame] | 85 | ${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true && \ |
| 86 | fail "match permitopen deny w/key opt proto $p" |
| 87 | stop_client |
| 88 | done |
| 89 | |
| 90 | # Test both sshd_config and key options permitting the same dst/port pair. |
| 91 | # Should be permitted. |
| 92 | for p in 1 2; do |
Damien Miller | 7b1877c | 2006-07-24 15:31:41 +1000 | [diff] [blame] | 93 | trace "match permitopen localhost proto $p" |
Damien Miller | 8cb3587 | 2011-05-29 21:59:10 +1000 | [diff] [blame] | 94 | start_client -F $OBJ/ssh_config |
Damien Miller | 7b1877c | 2006-07-24 15:31:41 +1000 | [diff] [blame] | 95 | ${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true || \ |
| 96 | fail "match permitopen permit proto $p" |
| 97 | stop_client |
| 98 | done |
| 99 | |
| 100 | cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy |
| 101 | echo "PermitOpen 127.0.0.1:1 127.0.0.1:$PORT 127.0.0.2:2" >>$OBJ/sshd_proxy |
| 102 | echo "Match User $USER" >>$OBJ/sshd_proxy |
| 103 | echo "PermitOpen 127.0.0.1:1 127.0.0.1:2" >>$OBJ/sshd_proxy |
| 104 | |
| 105 | # Test that a Match overrides a PermitOpen in the global section |
| 106 | for p in 1 2; do |
Damien Miller | 7b1877c | 2006-07-24 15:31:41 +1000 | [diff] [blame] | 107 | trace "match permitopen proxy w/key opts proto $p" |
Damien Miller | 8cb3587 | 2011-05-29 21:59:10 +1000 | [diff] [blame] | 108 | start_client -F $OBJ/ssh_proxy |
Damien Miller | 7b1877c | 2006-07-24 15:31:41 +1000 | [diff] [blame] | 109 | ${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true && \ |
| 110 | fail "match override permitopen proto $p" |
| 111 | stop_client |
| 112 | done |
Damien Miller | 80ba130 | 2007-10-26 14:45:13 +1000 | [diff] [blame] | 113 | |
| 114 | cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy |
| 115 | echo "PermitOpen 127.0.0.1:1 127.0.0.1:$PORT 127.0.0.2:2" >>$OBJ/sshd_proxy |
| 116 | echo "Match User NoSuchUser" >>$OBJ/sshd_proxy |
| 117 | echo "PermitOpen 127.0.0.1:1 127.0.0.1:2" >>$OBJ/sshd_proxy |
| 118 | |
| 119 | # Test that a rule that doesn't match doesn't override, plus test a |
| 120 | # PermitOpen entry that's not at the start of the list |
| 121 | for p in 1 2; do |
Damien Miller | 80ba130 | 2007-10-26 14:45:13 +1000 | [diff] [blame] | 122 | trace "nomatch permitopen proxy w/key opts proto $p" |
Damien Miller | 8cb3587 | 2011-05-29 21:59:10 +1000 | [diff] [blame] | 123 | start_client -F $OBJ/ssh_proxy |
Damien Miller | 80ba130 | 2007-10-26 14:45:13 +1000 | [diff] [blame] | 124 | ${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true || \ |
| 125 | fail "nomatch override permitopen proto $p" |
| 126 | stop_client |
| 127 | done |