Petr Šabata 81d24c
#!/bin/bash
Petr Šabata 81d24c
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
Petr Šabata 81d24c
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Petr Šabata 81d24c
#
Petr Šabata 81d24c
#   runtest.sh of /CoreOS/openssh/Sanity/port-forwarding
Petr Šabata 81d24c
#   Description: Testing port forwarding (ideally all possibilities: -L, -R, -D)
Petr Šabata 81d24c
#   Author: Stanislav Zidek <szidek@redhat.com>
Petr Šabata 81d24c
#
Petr Šabata 81d24c
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Petr Šabata 81d24c
#
Petr Šabata 81d24c
#   Copyright (c) 2015 Red Hat, Inc.
Petr Šabata 81d24c
#
Petr Šabata 81d24c
#   This program is free software: you can redistribute it and/or
Petr Šabata 81d24c
#   modify it under the terms of the GNU General Public License as
Petr Šabata 81d24c
#   published by the Free Software Foundation, either version 2 of
Petr Šabata 81d24c
#   the License, or (at your option) any later version.
Petr Šabata 81d24c
#
Petr Šabata 81d24c
#   This program is distributed in the hope that it will be
Petr Šabata 81d24c
#   useful, but WITHOUT ANY WARRANTY; without even the implied
Petr Šabata 81d24c
#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
Petr Šabata 81d24c
#   PURPOSE.  See the GNU General Public License for more details.
Petr Šabata 81d24c
#
Petr Šabata 81d24c
#   You should have received a copy of the GNU General Public License
Petr Šabata 81d24c
#   along with this program. If not, see http://www.gnu.org/licenses/.
Petr Šabata 81d24c
#
Petr Šabata 81d24c
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Petr Šabata 81d24c
Petr Šabata 81d24c
# Include Beaker environment
Petr Šabata 81d24c
. /usr/share/beakerlib/beakerlib.sh || exit 1
Petr Šabata 81d24c
Petr Šabata 81d24c
PACKAGE="openssh"
Petr Šabata 81d24c
USER="user$RANDOM"
Petr Šabata 81d24c
FORWARDED=$((RANDOM % 100 + 6800))
Petr Šabata 81d24c
LISTEN=$((RANDOM % 100 + 6900))
Petr Šabata 81d24c
TIMEOUT=5
Petr Šabata 81d24c
MESSAGE="HUGE_SUCCESS"
Petr Šabata 81d24c
SSH_OPTIONS="-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no"
Petr Šabata 81d24c
Petr Šabata 81d24c
rlJournalStart
Petr Šabata 81d24c
    rlPhaseStartSetup
Petr Šabata 81d24c
        rlAssertRpm $PACKAGE
Petr Šabata 81d24c
        rlFileBackup /etc/ssh/sshd_config
Petr Šabata 81d24c
        rlRun "useradd -m $USER"
Petr Šabata 81d24c
        rlRun "su - $USER -c \"mkdir .ssh; chmod 700 .ssh; cd .ssh; ssh-keygen -N '' -f id_rsa; cat id_rsa.pub >authorized_keys; chmod 600 authorized_keys\""
Petr Šabata 81d24c
        rlRun "echo 'LogLevel DEBUG' >>/etc/ssh/sshd_config"
Petr Šabata 81d24c
        rlServiceStart sshd
Petr Šabata 81d24c
        rlRun "IP=\$( ip a |grep 'scope global' |grep -w inet |cut -d'/' -f1 |awk '{ print \$2 }' |tail -1 )"
Petr Šabata 81d24c
        rlRun "echo 'IP=$IP'"
Petr Šabata 81d24c
        rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
Petr Šabata 81d24c
        rlRun "pushd $TmpDir"
Petr Šabata 81d24c
    rlPhaseEnd
Petr Šabata 81d24c
Petr Šabata 81d24c
forwarding_test() {
Petr Šabata 81d24c
    EXP_RESULT=$1
Petr Šabata 81d24c
    FORWARDED=$2
Petr Šabata 81d24c
    HOST=$3
Petr Šabata 81d24c
    LISTEN=$4
Petr Šabata 81d24c
Petr Šabata 81d24c
    rlRun "nc -l $LISTEN &>listen.log &"
Petr Šabata 81d24c
    LISTEN_PID=$!
Petr Šabata 81d24c
    rlWaitForSocket $LISTEN -t $TIMEOUT
Petr Šabata 81d24c
    rlRun "ps -fp $LISTEN_PID"
Petr Šabata 81d24c
    rlRun "su - $USER -c \"ssh $SSH_OPTIONS -N -L $FORWARDED:$HOST:$LISTEN $USER@localhost &\" &>tunnel.log"
Petr Šabata 81d24c
    rlRun "ps -fC ssh"
Petr Šabata 81d24c
    rlRun "SSH_PID=\$( pgrep -n -u $USER ssh )"
Petr Šabata 81d24c
    rlRun "echo SSH_PID is '$SSH_PID'"
Petr Šabata 81d24c
    rlWaitForSocket $FORWARDED -t $TIMEOUT
Petr Šabata 81d24c
    rlRun "[[ -n '$SSH_PID' ]] && ps -fp $SSH_PID"
Petr Šabata 81d24c
    rlRun "echo '$MESSAGE'|nc localhost $FORWARDED" 0,1
Petr Šabata 81d24c
Petr Šabata 81d24c
    if [[ $EXP_RESULT == "success" ]]; then
Petr Šabata 81d24c
        rlAssertGrep "$MESSAGE" listen.log
Petr Šabata 81d24c
    else # failure expected
Petr Šabata 81d24c
        rlAssertGrep "open failed" tunnel.log -i
Petr Šabata 81d24c
        rlAssertGrep "administratively prohibited" tunnel.log -i
Petr Šabata 81d24c
        rlAssertNotGrep "$MESSAGE" listen.log
Petr Šabata 81d24c
    fi
Petr Šabata 81d24c
Petr Šabata 81d24c
    rlRun "kill -9 $LISTEN_PID $SSH_PID" 0,1 "Killing cleanup"
Petr Šabata 81d24c
    rlWaitForSocket $LISTEN -t $TIMEOUT --close
Petr Šabata 81d24c
    rlWaitForSocket $FORWARDED -t $TIMEOUT --close
Petr Šabata 81d24c
    if ! rlGetPhaseState; then
Petr Šabata 81d24c
        rlRun "cat listen.log"
Petr Šabata 81d24c
        rlRun "cat tunnel.log"
Petr Šabata 81d24c
    fi
Petr Šabata 81d24c
    rlFileSubmit listen.log tunnel.log
Petr Šabata 81d24c
    rlRun "rm -f *.log;"
Petr Šabata 81d24c
}
Petr Šabata 81d24c
Petr Šabata 81d24c
    rlPhaseStartTest "Local forwarding"
Petr Šabata 81d24c
        forwarding_test "success" $FORWARDED localhost $LISTEN
Petr Šabata 81d24c
        ((FORWARDED+=1))
Petr Šabata 81d24c
        ((LISTEN+=1))
Petr Šabata 81d24c
    rlPhaseEnd
Petr Šabata 81d24c
Petr Šabata 81d24c
    rlPhaseStartTest "PermitOpen with 'any'"
Petr Šabata 81d24c
        rlFileBackup --namespace permitopen_any /etc/ssh/sshd_config /etc/hosts
Petr Šabata 81d24c
        rlRun "echo 'PermitOpen any' >>/etc/ssh/sshd_config"
Petr Šabata 81d24c
        rlRun "echo '$IP anyhost1 anyhost2' >>/etc/hosts"
Petr Šabata 81d24c
        rlRun "service sshd restart"
Petr Šabata 81d24c
        for i in `seq 3`; do
Petr Šabata 81d24c
            forwarding_test "success" $FORWARDED anyhost1 $LISTEN
Petr Šabata 81d24c
            forwarding_test "success" $FORWARDED anyhost2 $LISTEN
Petr Šabata 81d24c
            ((FORWARDED+=1))
Petr Šabata 81d24c
            ((LISTEN+=1))
Petr Šabata 81d24c
        done
Petr Šabata 81d24c
        rlFileRestore --namespace permitopen_any
Petr Šabata 81d24c
    rlPhaseEnd
Petr Šabata 81d24c
Petr Šabata 81d24c
    if ! rlIsRHEL '<6.7'; then
Petr Šabata 81d24c
        # PermitOpen with wildcards is new feature in RHEL-6.7
Petr Šabata 81d24c
        rlPhaseStartTest "PermitOpen with port wildcard"
Petr Šabata 81d24c
            rlFileBackup --namespace port_wildcard /etc/ssh/sshd_config /etc/hosts
Petr Šabata 81d24c
            rlRun "echo 'PermitOpen wildportallow:*' >>/etc/ssh/sshd_config"
Petr Šabata 81d24c
            rlRun "echo '$IP wildportallow wildportdeny' >>/etc/hosts"
Petr Šabata 81d24c
            rlRun "service sshd restart"
Petr Šabata 81d24c
            forwarding_test "success" $FORWARDED wildportallow $LISTEN
Petr Šabata 81d24c
            ((FORWARDED+=1))
Petr Šabata 81d24c
            ((LISTEN+=1))
Petr Šabata 81d24c
            forwarding_test "failure" $FORWARDED wildportdeny $LISTEN
Petr Šabata 81d24c
            ((FORWARDED+=1))
Petr Šabata 81d24c
            ((LISTEN+=1))
Petr Šabata 81d24c
            rlFileRestore --namespace port_wildcard
Petr Šabata 81d24c
            rlRun "service sshd restart"
Petr Šabata 81d24c
        rlPhaseEnd
Petr Šabata 81d24c
    fi
Petr Šabata 81d24c
Petr Šabata 81d24c
    if ! rlIsRHEL '<7.3'; then
Petr Šabata 81d24c
        rlPhaseStartTest "PermitOpen with host wildcard and specific port"
Petr Šabata 81d24c
            rlFileBackup --namespace host_wildcard /etc/ssh/sshd_config /etc/hosts
Petr Šabata 81d24c
            rlRun "echo 'PermitOpen *:$LISTEN' >>/etc/ssh/sshd_config"
Petr Šabata 81d24c
            rlRun "echo '$IP wildhost1 wildhost2' >>/etc/hosts"
Petr Šabata 81d24c
            rlRun "service sshd restart"
Petr Šabata 81d24c
            forwarding_test "success" $FORWARDED wildhost1 $LISTEN
Petr Šabata 81d24c
            ((FORWARDED+=1))
Petr Šabata 81d24c
            forwarding_test "success" $FORWARDED wildhost2 $LISTEN
Petr Šabata 81d24c
            ((FORWARDED+=1))
Petr Šabata 81d24c
            ((LISTEN+=1)) # different listen port, should fail
Petr Šabata 81d24c
            forwarding_test "failure" $FORWARDED wildhost2 $LISTEN
Petr Šabata 81d24c
            rlFileRestore --namespace host_wildcard
Petr Šabata 81d24c
        rlPhaseEnd
Petr Šabata 81d24c
    fi
Petr Šabata 81d24c
Petr Šabata 81d24c
    rlPhaseStartCleanup
Petr Šabata 81d24c
        rlRun "userdel -rf $USER"
Petr Šabata 81d24c
        rlRun "popd"
Petr Šabata 81d24c
        rlFileRestore
Petr Šabata 81d24c
        rlServiceRestore sshd
Petr Šabata 81d24c
        rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
Petr Šabata 81d24c
    rlPhaseEnd
Petr Šabata 81d24c
rlJournalPrintText
Petr Šabata 81d24c
rlJournalEnd