From ef28a3bdc50d0da6fab86b0d27e4c548ac61a749 Mon Sep 17 00:00:00 2001

From: Jakub Hrozek <jhrozek@redhat.com>

Date: Mon, 28 May 2018 21:49:41 +0200

Subject: [PATCH] TESTS: Add a helper binary that can trigger the SIGPIPE to

 authorizedkeys

MIME-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

Adds a test tool that simulates the behaviour of OpenSSH in the sense

that it starts to read the output from the sss_ssh_authorizedkeys tool,

but then closes the pipe before reading the whole output.

Related:

https://pagure.io/SSSD/sssd/issue/3747

Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>

(cherry picked from commit 909c16edb26a3c48b10a49e7919a35d13d31c52e)

---

 Makefile.am                 |  15 +++-

 src/tests/test_ssh_client.c | 133 ++++++++++++++++++++++++++++++++++++

 2 files changed, 147 insertions(+), 1 deletion(-)

 create mode 100644 src/tests/test_ssh_client.c

diff --git a/Makefile.am b/Makefile.am

index 9055130ed74057987795285c243ff47584cf8316..99974cf0e94e1ec6086a53585042653ec5966c2c 100644

--- a/Makefile.am

+++ b/Makefile.am

@@ -331,6 +331,7 @@ endif   # HAVE_CMOCKA

 check_PROGRAMS = \

     stress-tests \

     krb5-child-test \

+    test_ssh_client \

     $(non_interactive_cmocka_based_tests) \

     $(non_interactive_check_based_tests)

@@ -2291,6 +2292,18 @@ krb5_child_test_LDADD = \

     $(SSSD_INTERNAL_LTLIBS) \

     libsss_test_common.la

+test_ssh_client_SOURCES = \

+    src/tests/test_ssh_client.c \

+    $(NULL)

+test_ssh_client_CFLAGS = \

+    $(AM_CFLAGS) \

+    -DSSH_CLIENT_DIR=\"$(abs_top_builddir)\" \

+    $(NULL)

+test_ssh_client_LDADD = \

+    $(SSSD_INTERNAL_LTLIBS) \

+    $(SSSD_LIBS) \

+    $(NULL)

+

 if BUILD_DBUS_TESTS

 sbus_tests_SOURCES = \

@@ -3446,7 +3459,6 @@ test_iobuf_LDADD = \

     $(SSSD_LIBS) \

     $(NULL)

-

 EXTRA_simple_access_tests_DEPENDENCIES = \

     $(ldblib_LTLIBRARIES)

 simple_access_tests_SOURCES = \

@@ -3655,6 +3667,7 @@ intgcheck-prepare:

 	    $(INTGCHECK_CONFIGURE_FLAGS) \

 	    CFLAGS="-O2 -g $$CFLAGS -DKCM_PEER_UID=$$(id -u)"; \

 	$(MAKE) $(AM_MAKEFLAGS) ; \

+	$(MAKE) $(AM_MAKEFLAGS) test_ssh_client; \

 	: Force single-thread install to workaround concurrency issues; \

 	$(MAKE) $(AM_MAKEFLAGS) -j1 install; \

 	: Remove .la files from LDB module directory to avoid loader warnings; \

diff --git a/src/tests/test_ssh_client.c b/src/tests/test_ssh_client.c

new file mode 100644

index 0000000000000000000000000000000000000000..8f963941f3249561178436d6f6dfc376780a4cda

--- /dev/null

+++ b/src/tests/test_ssh_client.c

@@ -0,0 +1,133 @@

+/*

+    Copyright (C) 2018 Red Hat

+

+    This program is free software; you can redistribute it and/or modify

+    it under the terms of the GNU General Public License as published by

+    the Free Software Foundation; either version 3 of the License, or

+    (at your option) any later version.

+

+    This program is distributed in the hope that it will be useful,

+    but WITHOUT ANY WARRANTY; without even the implied warranty of

+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

+    GNU General Public License for more details.

+

+    You should have received a copy of the GNU General Public License

+    along with this program.  If not, see <http://www.gnu.org/licenses/>.

+*/

+

+#include <popt.h>

+#include <sys/wait.h>

+#include "util/util.h"

+

+#ifdef SSH_CLIENT_DIR

+#define SSH_AK_CLIENT_PATH SSH_CLIENT_DIR"/sss_ssh_authorizedkeys"

+#else

+#error "The path to the ssh authorizedkeys helper is not defined"

+#endif /* SSH_CLIENT_DIR */

+

+int main(int argc, const char *argv[])

+{

+    poptContext pc;

+    int opt;

+    struct poptOption long_options[] = {

+        POPT_AUTOHELP

+        SSSD_DEBUG_OPTS

+        POPT_TABLEEND

+    };

+    struct stat sb;

+    int ret;

+    int status;

+    int p[2];

+    pid_t pid;

+    const char *pc_user = NULL;

+    char *av[3];

+    char buf[5]; /* Ridiculously small buffer by design */

+

+    /* Set debug level to invalid value so we can decide if -d 0 was used. */

+    debug_level = SSSDBG_INVALID;

+

+    pc = poptGetContext(argv[0], argc, argv, long_options, 0);

+    poptSetOtherOptionHelp(pc, "USER");

+    while((opt = poptGetNextOpt(pc)) != -1) {

+        switch(opt) {

+        default:

+            fprintf(stderr, "\nInvalid option %s: %s\n\n",

+                    poptBadOption(pc, 0), poptStrerror(opt));

+            poptPrintUsage(pc, stderr, 0);

+            return 3;

+        }

+    }

+

+    pc_user = poptGetArg(pc);

+    if (pc_user == NULL) {

+        fprintf(stderr, "No user specified\n");

+        return 3;

+    }

+

+    poptFreeContext(pc);

+

+    DEBUG_CLI_INIT(debug_level);

+

+    ret = stat(SSH_AK_CLIENT_PATH, &sb);

+    if (ret != 0) {

+        ret = errno;

+        DEBUG(SSSDBG_CRIT_FAILURE,

+              "Could not stat %s [%d]: %s\n",

+              SSH_AK_CLIENT_PATH, ret, strerror(ret));

+        return 3;

+    }

+

+    ret = pipe(p);

+    if (ret != 0) {

+        perror("pipe");

+        return 3;

+    }

+

+    switch (pid = fork()) {

+    case -1:

+        ret = errno;

+        close(p[0]);

+        close(p[1]);

+        DEBUG(SSSDBG_CRIT_FAILURE, "fork failed: %d\n", ret);

+        return 3;

+    case 0:

+        /* child */

+        av[0] = discard_const(SSH_AK_CLIENT_PATH);

+        av[1] = discard_const(pc_user);

+        av[2] = NULL;

+

+        close(p[0]);

+        ret = dup2(p[1], STDOUT_FILENO);

+        if (ret == -1) {

+            perror("dup2");

+            return 3;

+        }

+

+        execv(av[0], av);

+        return 3;

+    default:

+        /* parent */

+        break;

+    }

+

+    close(p[1]);

+    read(p[0], buf, sizeof(buf));

+    close(p[0]);

+

+    pid = waitpid(pid, &status, 0);

+    if (pid == -1) {

+        perror("waitpid");

+        return 3;

+    }

+

+    if (WIFEXITED(status)) {

+        printf("sss_ssh_authorizedkeys exited with return code %d\n", WEXITSTATUS(status));

+        return 0;

+    } else if (WIFSIGNALED(status)) {

+        printf("sss_ssh_authorizedkeys exited with signal %d\n", WTERMSIG(status));

+        return 1;

+    }

+

+    printf("sss_ssh_authorizedkeys exited for another reason\n");

+    return 2;

+}

-- 

2.17.1