blob: 85901eaa6340fec311565240f438c532b2ad9b7f (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
|
# $OpenBSD: dynamic-forward.sh,v 1.17 2024/03/08 11:34:10 dtucker Exp $
# Placed in the Public Domain.
tid="dynamic forwarding"
# This is a reasonable proxy for IPv6 support.
if ! config_defined HAVE_STRUCT_IN6_ADDR ; then
SKIP_IPV6=yes
fi
FWDPORT=`expr $PORT + 1`
make_tmpdir
CTL=${SSH_REGRESS_TMP}/ctl-sock
cp $OBJ/ssh_config $OBJ/ssh_config.orig
proxycmd="$OBJ/netcat -x 127.0.0.1:$FWDPORT -X"
trace "will use ProxyCommand $proxycmd"
start_ssh() {
direction="$1"
arg="$2"
n=0
error="1"
# Use a multiplexed ssh so we can control its lifecycle.
trace "start dynamic -$direction forwarding, fork to background"
(cat $OBJ/ssh_config.orig ; echo "$arg") > $OBJ/ssh_config
${REAL_SSH} -vvvnNfF $OBJ/ssh_config -E$TEST_SSH_LOGFILE \
-$direction $FWDPORT -oExitOnForwardFailure=yes \
-oControlMaster=yes -oControlPath=$CTL somehost
r=$?
test $r -eq 0 || fatal "failed to start dynamic forwarding $r"
if ! ${REAL_SSH} -qF$OBJ/ssh_config -O check \
-oControlPath=$CTL somehost >/dev/null 2>&1 ; then
fatal "forwarding ssh process unresponsive"
fi
}
stop_ssh() {
test -S $CTL || return
if ! ${REAL_SSH} -qF$OBJ/ssh_config -O exit \
-oControlPath=$CTL >/dev/null somehost >/dev/null ; then
fatal "forwarding ssh process did not respond to close"
fi
n=0
while [ "$n" -lt 20 ] ; do
test -S $CTL || break
sleep 1
n=`expr $n + 1`
done
if test -S $CTL ; then
fatal "forwarding ssh process did not exit"
fi
}
check_socks() {
direction=$1
expect_success=$2
for s in 4 5; do
for h in 127.0.0.1 localhost; do
trace "testing ssh socks version $s host $h (-$direction)"
${REAL_SSH} -q -F $OBJ/ssh_config -o \
"ProxyCommand ${TEST_SHELL} -c '${proxycmd}${s} $h $PORT 2>/dev/null'" \
somehost cat ${DATA} > ${COPY}
r=$?
if [ "x$expect_success" = "xY" ] ; then
if [ $r -ne 0 ] ; then
fail "ssh failed with exit status $r"
fi
test -f ${COPY} || fail "failed copy ${DATA}"
cmp ${DATA} ${COPY} || fail "corrupted copy of ${DATA}"
elif [ $r -eq 0 ] ; then
fail "ssh unexpectedly succeeded"
fi
done
done
}
start_sshd
trap "stop_ssh" EXIT
for d in D R; do
verbose "test -$d forwarding"
start_ssh $d
check_socks $d Y
stop_ssh
test "x$d" = "xR" || continue
# Test PermitRemoteOpen
verbose "PermitRemoteOpen=any"
start_ssh $d PermitRemoteOpen=any
check_socks $d Y
stop_ssh
verbose "PermitRemoteOpen=none"
start_ssh $d PermitRemoteOpen=none
check_socks $d N
stop_ssh
verbose "PermitRemoteOpen=explicit"
permit="127.0.0.1:$PORT [::1]:$PORT localhost:$PORT"
test -z "$SKIP_IPV6" || permit="127.0.0.1:$PORT localhost:$PORT"
start_ssh $d PermitRemoteOpen="$permit"
check_socks $d Y
stop_ssh
verbose "PermitRemoteOpen=disallowed"
permit="127.0.0.1:1 [::1]:1 localhost:1"
test -z "$SKIP_IPV6" || permit="127.0.0.1:1 localhost:1"
start_ssh $d PermitRemoteOpen="$permit"
check_socks $d N
stop_ssh
done
|
