|
 |
75e304 |
From 103a22b85df5c371aefb08e476a3ab950e6882a3 Mon Sep 17 00:00:00 2001
|
|
|
75e304 |
From: Jakub Hrozek <jhrozek@redhat.com>
|
|
|
75e304 |
Date: Tue, 19 Jun 2018 11:39:02 +0200
|
|
|
75e304 |
Subject: [PATCH] TESTS: Add a regression test for SIGHUP handling in
|
|
|
75e304 |
sss_ssh_authorizedkeys
|
|
|
75e304 |
MIME-Version: 1.0
|
|
|
75e304 |
Content-Type: text/plain; charset=UTF-8
|
|
|
75e304 |
Content-Transfer-Encoding: 8bit
|
|
|
75e304 |
|
|
|
75e304 |
A regression test for:
|
|
|
75e304 |
https://pagure.io/SSSD/sssd/issue/3747
|
|
|
75e304 |
|
|
|
75e304 |
Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
|
|
|
75e304 |
(cherry picked from commit 4cc3c1a1b1070c12bcc4351880d8207e47b37496)
|
|
|
75e304 |
---
|
|
|
75e304 |
src/tests/intg/test_ssh_pubkey.py | 58 +++++++++++++++++++++++++++++++++++++++
|
|
|
75e304 |
1 file changed, 58 insertions(+)
|
|
|
75e304 |
|
|
|
75e304 |
diff --git a/src/tests/intg/test_ssh_pubkey.py b/src/tests/intg/test_ssh_pubkey.py
|
|
|
75e304 |
index fbf55566e341373873057ec4e3af1d7f83202aa7..8fb41c62d87ec210c9aad8582023fe1cb00f2b4e 100644
|
|
|
75e304 |
--- a/src/tests/intg/test_ssh_pubkey.py
|
|
|
75e304 |
+++ b/src/tests/intg/test_ssh_pubkey.py
|
|
|
75e304 |
@@ -24,6 +24,8 @@ import time
|
|
|
75e304 |
import ldap
|
|
|
75e304 |
import ldap.modlist
|
|
|
75e304 |
import pytest
|
|
|
75e304 |
+import string
|
|
|
75e304 |
+import random
|
|
|
75e304 |
|
|
|
75e304 |
import config
|
|
|
75e304 |
import ds_openldap
|
|
|
75e304 |
@@ -230,3 +232,59 @@ def test_ssh_pubkey_retrieve(add_user_with_ssh_key):
|
|
|
75e304 |
|
|
|
75e304 |
sshpubkey = get_call_output(["sss_ssh_authorizedkeys", "user2"])
|
|
|
75e304 |
assert len(sshpubkey) == 0
|
|
|
75e304 |
+
|
|
|
75e304 |
+
|
|
|
75e304 |
+@pytest.fixture()
|
|
|
75e304 |
+def sighup_client(request):
|
|
|
75e304 |
+ test_ssh_cli_path = os.path.join(config.ABS_BUILDDIR,
|
|
|
75e304 |
+ "..", "..", "..", "test_ssh_client")
|
|
|
75e304 |
+ assert os.access(test_ssh_cli_path, os.X_OK)
|
|
|
75e304 |
+ return test_ssh_cli_path
|
|
|
75e304 |
+
|
|
|
75e304 |
+
|
|
|
75e304 |
+@pytest.fixture
|
|
|
75e304 |
+def add_user_with_many_keys(request, ldap_conn):
|
|
|
75e304 |
+ # Generate a large list of unique ssh pubkeys
|
|
|
75e304 |
+ pubkey_list = []
|
|
|
75e304 |
+ while len(pubkey_list) < 50:
|
|
|
75e304 |
+ new_pubkey = list(USER1_PUBKEY1)
|
|
|
75e304 |
+ new_pubkey[10] = random.choice(string.ascii_uppercase)
|
|
|
75e304 |
+ new_pubkey[11] = random.choice(string.ascii_uppercase)
|
|
|
75e304 |
+ new_pubkey[12] = random.choice(string.ascii_uppercase)
|
|
|
75e304 |
+ str_new_pubkey = ''.join(c for c in new_pubkey)
|
|
|
75e304 |
+ if str_new_pubkey in pubkey_list:
|
|
|
75e304 |
+ continue
|
|
|
75e304 |
+ pubkey_list.append(str_new_pubkey)
|
|
|
75e304 |
+
|
|
|
75e304 |
+ ent_list = ldap_ent.List(ldap_conn.ds_inst.base_dn)
|
|
|
75e304 |
+ ent_list.add_user("user1", 1001, 2001, sshPubKey=pubkey_list)
|
|
|
75e304 |
+ create_ldap_fixture(request, ldap_conn, ent_list)
|
|
|
75e304 |
+
|
|
|
75e304 |
+ conf = format_basic_conf(ldap_conn, SCHEMA_RFC2307_BIS)
|
|
|
75e304 |
+ create_conf_fixture(request, conf)
|
|
|
75e304 |
+ create_sssd_fixture(request)
|
|
|
75e304 |
+ return None
|
|
|
75e304 |
+
|
|
|
75e304 |
+
|
|
|
75e304 |
+def test_ssh_sighup(add_user_with_many_keys, sighup_client):
|
|
|
75e304 |
+ """
|
|
|
75e304 |
+ A regression test for https://pagure.io/SSSD/sssd/issue/3747
|
|
|
75e304 |
+
|
|
|
75e304 |
+ OpenSSH can close its end of the pipe towards sss_ssh_authorizedkeys
|
|
|
75e304 |
+ before all of the output is read. In that case, older versions
|
|
|
75e304 |
+ of sss_ssh_authorizedkeys were receiving a SIGPIPE
|
|
|
75e304 |
+ """
|
|
|
75e304 |
+ cli_path = sighup_client
|
|
|
75e304 |
+
|
|
|
75e304 |
+ # python actually does the sensible, but unexpected (for a C programmer)
|
|
|
75e304 |
+ # thing and handles SIGPIPE. In order to reproduce the bug, we need
|
|
|
75e304 |
+ # to unset the SIGPIPE handler
|
|
|
75e304 |
+ signal.signal(signal.SIGPIPE, signal.SIG_DFL)
|
|
|
75e304 |
+
|
|
|
75e304 |
+ process = subprocess.Popen([cli_path, "user1"],
|
|
|
75e304 |
+ stdout=subprocess.PIPE,
|
|
|
75e304 |
+ stderr=subprocess.PIPE)
|
|
|
75e304 |
+ _, _ = process.communicate()
|
|
|
75e304 |
+ # If the test tool detects that sss_ssh_authorizedkeys was killed with a
|
|
|
75e304 |
+ # signal, it would have returned 1
|
|
|
75e304 |
+ assert process.returncode == 0
|
|
|
75e304 |
--
|
|
|
75e304 |
2.14.4
|
|
|
75e304 |
|