Darren Tucker | 3013903 | 2012-06-30 15:01:22 +1000 | [diff] [blame] | 1 | # $OpenBSD: addrmatch.sh,v 1.4 2012/05/13 01:42:32 dtucker Exp $ |
Darren Tucker | 10f9242 | 2008-06-10 23:16:46 +1000 | [diff] [blame] | 2 | # Placed in the Public Domain. |
| 3 | |
| 4 | tid="address match" |
| 5 | |
Damien Miller | bb4ae55 | 2010-02-24 17:26:38 +1100 | [diff] [blame] | 6 | mv $OBJ/sshd_proxy $OBJ/sshd_proxy_bak |
Darren Tucker | 10f9242 | 2008-06-10 23:16:46 +1000 | [diff] [blame] | 7 | |
| 8 | run_trial() |
| 9 | { |
Darren Tucker | 3013903 | 2012-06-30 15:01:22 +1000 | [diff] [blame] | 10 | user="$1"; addr="$2"; host="$3"; laddr="$4"; lport="$5" |
| 11 | expected="$6"; descr="$7" |
Darren Tucker | 10f9242 | 2008-06-10 23:16:46 +1000 | [diff] [blame] | 12 | |
| 13 | verbose "test $descr for $user $addr $host" |
| 14 | result=`${SSHD} -f $OBJ/sshd_proxy -T \ |
Darren Tucker | 3013903 | 2012-06-30 15:01:22 +1000 | [diff] [blame] | 15 | -C user=${user},addr=${addr},host=${host},laddr=${laddr},lport=${lport} | \ |
| 16 | awk '/^forcecommand/ {print $2}'` |
Darren Tucker | 10f9242 | 2008-06-10 23:16:46 +1000 | [diff] [blame] | 17 | if [ "$result" != "$expected" ]; then |
Darren Tucker | 3013903 | 2012-06-30 15:01:22 +1000 | [diff] [blame] | 18 | fail "failed '$descr' expected $expected got $result" |
Darren Tucker | 10f9242 | 2008-06-10 23:16:46 +1000 | [diff] [blame] | 19 | fi |
| 20 | } |
| 21 | |
Damien Miller | bb4ae55 | 2010-02-24 17:26:38 +1100 | [diff] [blame] | 22 | cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy |
Darren Tucker | 10f9242 | 2008-06-10 23:16:46 +1000 | [diff] [blame] | 23 | cat >>$OBJ/sshd_proxy <<EOD |
Darren Tucker | 3013903 | 2012-06-30 15:01:22 +1000 | [diff] [blame] | 24 | ForceCommand nomatch |
Darren Tucker | 10f9242 | 2008-06-10 23:16:46 +1000 | [diff] [blame] | 25 | Match Address 192.168.0.0/16,!192.168.30.0/24,10.0.0.0/8,host.example.com |
Darren Tucker | 3013903 | 2012-06-30 15:01:22 +1000 | [diff] [blame] | 26 | ForceCommand match1 |
Darren Tucker | 10f9242 | 2008-06-10 23:16:46 +1000 | [diff] [blame] | 27 | Match Address 1.1.1.1,::1,!::3,2000::/16 |
Darren Tucker | 3013903 | 2012-06-30 15:01:22 +1000 | [diff] [blame] | 28 | ForceCommand match2 |
| 29 | Match LocalAddress 127.0.0.1,::1 |
| 30 | ForceCommand match3 |
| 31 | Match LocalPort 5678 |
| 32 | ForceCommand match4 |
Darren Tucker | 10f9242 | 2008-06-10 23:16:46 +1000 | [diff] [blame] | 33 | EOD |
| 34 | |
Darren Tucker | 3013903 | 2012-06-30 15:01:22 +1000 | [diff] [blame] | 35 | run_trial user 192.168.0.1 somehost 1.2.3.4 1234 match1 "first entry" |
| 36 | run_trial user 192.168.30.1 somehost 1.2.3.4 1234 nomatch "negative match" |
| 37 | run_trial user 19.0.0.1 somehost 1.2.3.4 1234 nomatch "no match" |
| 38 | run_trial user 10.255.255.254 somehost 1.2.3.4 1234 match1 "list middle" |
| 39 | run_trial user 192.168.30.1 192.168.0.1 1.2.3.4 1234 nomatch "faked IP in hostname" |
| 40 | run_trial user 1.1.1.1 somehost.example.com 1.2.3.4 1234 match2 "bare IP4 address" |
| 41 | run_trial user 19.0.0.1 somehost 127.0.0.1 1234 match3 "localaddress" |
| 42 | run_trial user 19.0.0.1 somehost 1.2.3.4 5678 match4 "localport" |
| 43 | |
Darren Tucker | d0d3fff | 2012-04-27 10:55:39 +1000 | [diff] [blame] | 44 | if test "$TEST_SSH_IPV6" != "no"; then |
Darren Tucker | 3013903 | 2012-06-30 15:01:22 +1000 | [diff] [blame] | 45 | run_trial user ::1 somehost.example.com ::2 1234 match2 "bare IP6 address" |
| 46 | run_trial user ::2 somehost.exaple.com ::2 1234 nomatch "deny IPv6" |
| 47 | run_trial user ::3 somehost ::2 1234 nomatch "IP6 negated" |
| 48 | run_trial user ::4 somehost ::2 1234 nomatch "IP6 no match" |
| 49 | run_trial user 2000::1 somehost ::2 1234 match2 "IP6 network" |
| 50 | run_trial user 2001::1 somehost ::2 1234 nomatch "IP6 network" |
| 51 | run_trial user ::5 somehost ::1 1234 match3 "IP6 localaddress" |
| 52 | run_trial user ::5 somehost ::2 5678 match4 "IP6 localport" |
Darren Tucker | d0d3fff | 2012-04-27 10:55:39 +1000 | [diff] [blame] | 53 | fi |
Damien Miller | bb4ae55 | 2010-02-24 17:26:38 +1100 | [diff] [blame] | 54 | |
| 55 | cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy |
| 56 | rm $OBJ/sshd_proxy_bak |