1 # $OpenBSD: forward-control.sh,v 1.4 2017/04/30 23:34:55 djm Exp $
2 # Placed in the Public Domain.
4 tid="sshd control of local and remote forwarding"
11 wait_for_file_to_appear() {
14 while test ! -f $_path ; do
15 test $_n -eq 1 && trace "waiting for $_path to appear"
17 test $_n -ge 20 && return 1
23 wait_for_process_to_exit() {
26 while kill -0 $_pid 2>/dev/null ; do
27 test $_n -eq 1 && trace "waiting for $_pid to exit"
29 test $_n -ge 20 && return 1
35 # usage: check_lfwd Y|N message
40 ${SSH} -F $OBJ/ssh_proxy \
41 -L$LFWD_PORT:127.0.0.1:$PORT \
42 -o ExitOnForwardFailure=yes \
43 -n host exec sh -c \'"sleep 60 & echo \$! > $READY ; wait "\' \
46 wait_for_file_to_appear $READY || \
47 fatal "check_lfwd ssh fail: $_message"
48 ${SSH} -F $OBJ/ssh_config -p $LFWD_PORT \
49 -oConnectionAttempts=4 host true >/dev/null 2>&1
51 kill $_sshpid `cat $READY` 2>/dev/null
52 wait_for_process_to_exit $_sshpid
53 if test "x$_expected" = "xY" -a $_result -ne 0 ; then
54 fail "check_lfwd failed (expecting success): $_message"
55 elif test "x$_expected" = "xN" -a $_result -eq 0 ; then
56 fail "check_lfwd succeeded (expecting failure): $_message"
57 elif test "x$_expected" != "xY" -a "x$_expected" != "xN" ; then
58 fatal "check_lfwd invalid argument \"$_expected\""
60 verbose "check_lfwd done (expecting $_expected): $_message"
64 # usage: check_rfwd Y|N message
69 ${SSH} -F $OBJ/ssh_proxy \
70 -R$RFWD_PORT:127.0.0.1:$PORT \
71 -o ExitOnForwardFailure=yes \
72 -n host exec sh -c \'"sleep 60 & echo \$! > $READY ; wait "\' \
75 wait_for_file_to_appear $READY
77 if test $_result -eq 0 ; then
78 ${SSH} -F $OBJ/ssh_config -p $RFWD_PORT \
79 -oConnectionAttempts=4 host true >/dev/null 2>&1
81 kill $_sshpid `cat $READY` 2>/dev/null
82 wait_for_process_to_exit $_sshpid
84 if test "x$_expected" = "xY" -a $_result -ne 0 ; then
85 fail "check_rfwd failed (expecting success): $_message"
86 elif test "x$_expected" = "xN" -a $_result -eq 0 ; then
87 fail "check_rfwd succeeded (expecting failure): $_message"
88 elif test "x$_expected" != "xY" -a "x$_expected" != "xN" ; then
89 fatal "check_rfwd invalid argument \"$_expected\""
91 verbose "check_rfwd done (expecting $_expected): $_message"
96 cp ${OBJ}/sshd_proxy ${OBJ}/sshd_proxy.bak
97 cp ${OBJ}/authorized_keys_${USER} ${OBJ}/authorized_keys_${USER}.bak
99 # Sanity check: ensure the default config allows forwarding
100 check_lfwd Y "default configuration"
101 check_rfwd Y "default configuration"
103 # Usage: all_tests yes|local|remote|no Y|N Y|N Y|N Y|N Y|N Y|N
113 _goodfwd=127.0.0.1:${PORT}
114 cp ${OBJ}/authorized_keys_${USER}.bak ${OBJ}/authorized_keys_${USER}
115 _prefix="AllowTcpForwarding=$_tcpfwd"
117 ( cat ${OBJ}/sshd_proxy.bak ;
118 echo "AllowTcpForwarding $_tcpfwd" ) \
120 check_lfwd $_plain_lfwd "$_prefix"
121 check_rfwd $_plain_rfwd "$_prefix"
122 # PermitOpen via sshd_config that doesn't match
123 ( cat ${OBJ}/sshd_proxy.bak ;
124 echo "AllowTcpForwarding $_tcpfwd" ;
125 echo "PermitOpen $_badfwd" ) \
127 check_lfwd $_nopermit_lfwd "$_prefix, !PermitOpen"
128 check_rfwd $_nopermit_rfwd "$_prefix, !PermitOpen"
129 # PermitOpen via sshd_config that does match
130 ( cat ${OBJ}/sshd_proxy.bak ;
131 echo "AllowTcpForwarding $_tcpfwd" ;
132 echo "PermitOpen $_badfwd $_goodfwd" ) \
134 # NB. permitopen via authorized_keys should have same
135 # success/fail as via sshd_config
136 # permitopen via authorized_keys that doesn't match
137 sed "s/^/permitopen=\"$_badfwd\" /" \
138 < ${OBJ}/authorized_keys_${USER}.bak \
139 > ${OBJ}/authorized_keys_${USER} || fatal "sed 1 fail"
140 ( cat ${OBJ}/sshd_proxy.bak ;
141 echo "AllowTcpForwarding $_tcpfwd" ) \
143 check_lfwd $_nopermit_lfwd "$_prefix, !permitopen"
144 check_rfwd $_nopermit_rfwd "$_prefix, !permitopen"
145 # permitopen via authorized_keys that does match
146 sed "s/^/permitopen=\"$_badfwd\",permitopen=\"$_goodfwd\" /" \
147 < ${OBJ}/authorized_keys_${USER}.bak \
148 > ${OBJ}/authorized_keys_${USER} || fatal "sed 2 fail"
149 ( cat ${OBJ}/sshd_proxy.bak ;
150 echo "AllowTcpForwarding $_tcpfwd" ) \
152 check_lfwd $_permit_lfwd "$_prefix, permitopen"
153 check_rfwd $_permit_rfwd "$_prefix, permitopen"
156 # no-permitopen mismatch-permitopen match-permitopen
157 # AllowTcpForwarding local remote local remote local remote
158 all_tests yes Y Y N Y Y Y
159 all_tests local Y N N N Y N
160 all_tests remote N Y N Y N Y
161 all_tests no N N N N N N