Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit cf8dcb0

Browse filesBrowse files
drakkanbsiegert
drakkan
authored and
bsiegert
committed
ssh: add test case against ssh CLI
These tests try to ensure better compatibility of our server implementation with the ssh CLI. With these tests in place: 1) before merging CL 447757 we would have noticed that our server implementation was broken with OpenSSH 8.8+ 2) after merging CL 447757 we would have noticed that our server implementation was broken with OpenSSH 7.2-7.7 The ssh CLI from $PATH is used by default, but can be overridden using the SSH_CLI_PATH environment variable. Change-Id: I93d64be41c7613132b0364afac8397f57c2dcbca Reviewed-on: https://go-review.googlesource.com/c/crypto/+/506837 TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Benny Siegert <bsiegert@gmail.com> Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Nicola Murino <nicola.murino@gmail.com>
1 parent 4f30245 commit cf8dcb0
Copy full SHA for cf8dcb0

File tree

Expand file treeCollapse file tree

3 files changed

+200
-0
lines changed
Filter options
Expand file treeCollapse file tree

3 files changed

+200
-0
lines changed

‎ssh/test/server_test.go

Copy file name to clipboard
+98Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
// Copyright 2023 The Go Authors. All rights reserved.
2+
// Use of this source code is governed by a BSD-style
3+
// license that can be found in the LICENSE file.
4+
5+
package test
6+
7+
import (
8+
"net"
9+
10+
"golang.org/x/crypto/ssh"
11+
)
12+
13+
type exitStatusMsg struct {
14+
Status uint32
15+
}
16+
17+
// goServer is a test Go SSH server that accepts public key and certificate
18+
// authentication and replies with a 0 exit status to any exec request without
19+
// running any commands.
20+
type goTestServer struct {
21+
listener net.Listener
22+
config *ssh.ServerConfig
23+
done <-chan struct{}
24+
}
25+
26+
func newTestServer(config *ssh.ServerConfig) (*goTestServer, error) {
27+
server := &goTestServer{
28+
config: config,
29+
}
30+
listener, err := net.Listen("tcp", "127.0.0.1:")
31+
if err != nil {
32+
return nil, err
33+
}
34+
server.listener = listener
35+
done := make(chan struct{}, 1)
36+
server.done = done
37+
go server.acceptConnections(done)
38+
39+
return server, nil
40+
}
41+
42+
func (s *goTestServer) port() (string, error) {
43+
_, port, err := net.SplitHostPort(s.listener.Addr().String())
44+
return port, err
45+
}
46+
47+
func (s *goTestServer) acceptConnections(done chan<- struct{}) {
48+
defer close(done)
49+
50+
for {
51+
c, err := s.listener.Accept()
52+
if err != nil {
53+
return
54+
}
55+
_, chans, reqs, err := ssh.NewServerConn(c, s.config)
56+
if err != nil {
57+
return
58+
}
59+
go ssh.DiscardRequests(reqs)
60+
defer c.Close()
61+
62+
for newChannel := range chans {
63+
if newChannel.ChannelType() != "session" {
64+
newChannel.Reject(ssh.UnknownChannelType, "unknown channel type")
65+
continue
66+
}
67+
68+
channel, requests, err := newChannel.Accept()
69+
if err != nil {
70+
continue
71+
}
72+
73+
go func(in <-chan *ssh.Request) {
74+
for req := range in {
75+
ok := false
76+
switch req.Type {
77+
case "exec":
78+
ok = true
79+
go func() {
80+
channel.SendRequest("exit-status", false, ssh.Marshal(&exitStatusMsg{Status: 0}))
81+
channel.Close()
82+
}()
83+
}
84+
if req.WantReply {
85+
req.Reply(ok, nil)
86+
}
87+
}
88+
}(requests)
89+
}
90+
}
91+
}
92+
93+
func (s *goTestServer) Close() error {
94+
err := s.listener.Close()
95+
// wait for the accept loop to exit
96+
<-s.done
97+
return err
98+
}

‎ssh/test/sshcli_test.go

Copy file name to clipboard
+96Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
// Copyright 2023 The Go Authors. All rights reserved.
2+
// Use of this source code is governed by a BSD-style
3+
// license that can be found in the LICENSE file.
4+
5+
package test
6+
7+
import (
8+
"bytes"
9+
"fmt"
10+
"os"
11+
"os/exec"
12+
"path/filepath"
13+
"testing"
14+
15+
"golang.org/x/crypto/internal/testenv"
16+
"golang.org/x/crypto/ssh"
17+
"golang.org/x/crypto/ssh/testdata"
18+
)
19+
20+
func sshClient(t *testing.T) string {
21+
if testing.Short() {
22+
t.Skip("Skipping test that executes OpenSSH in -short mode")
23+
}
24+
sshCLI := os.Getenv("SSH_CLI_PATH")
25+
if sshCLI == "" {
26+
sshCLI = "ssh"
27+
}
28+
var err error
29+
sshCLI, err = exec.LookPath(sshCLI)
30+
if err != nil {
31+
t.Skipf("Can't find an ssh(1) client to test against: %v", err)
32+
}
33+
return sshCLI
34+
}
35+
36+
func TestSSHCLIAuth(t *testing.T) {
37+
sshCLI := sshClient(t)
38+
dir := t.TempDir()
39+
keyPrivPath := filepath.Join(dir, "rsa")
40+
41+
for fn, content := range map[string][]byte{
42+
keyPrivPath: testdata.PEMBytes["rsa"],
43+
keyPrivPath + ".pub": ssh.MarshalAuthorizedKey(testPublicKeys["rsa"]),
44+
filepath.Join(dir, "rsa-cert.pub"): testdata.SSHCertificates["rsa-user-testcertificate"],
45+
} {
46+
if err := os.WriteFile(fn, content, 0600); err != nil {
47+
t.Fatalf("WriteFile(%q): %v", fn, err)
48+
}
49+
}
50+
51+
certChecker := ssh.CertChecker{
52+
IsUserAuthority: func(k ssh.PublicKey) bool {
53+
return bytes.Equal(k.Marshal(), testPublicKeys["ca"].Marshal())
54+
},
55+
UserKeyFallback: func(conn ssh.ConnMetadata, key ssh.PublicKey) (*ssh.Permissions, error) {
56+
if conn.User() == "testpubkey" && bytes.Equal(key.Marshal(), testPublicKeys["rsa"].Marshal()) {
57+
return nil, nil
58+
}
59+
60+
return nil, fmt.Errorf("pubkey for %q not acceptable", conn.User())
61+
},
62+
}
63+
64+
config := &ssh.ServerConfig{
65+
PublicKeyCallback: certChecker.Authenticate,
66+
}
67+
config.AddHostKey(testSigners["rsa"])
68+
69+
server, err := newTestServer(config)
70+
if err != nil {
71+
t.Fatalf("unable to start test server: %v", err)
72+
}
73+
defer server.Close()
74+
75+
port, err := server.port()
76+
if err != nil {
77+
t.Fatalf("unable to get server port: %v", err)
78+
}
79+
80+
// test public key authentication.
81+
cmd := testenv.Command(t, sshCLI, "-vvv", "-i", keyPrivPath, "-o", "StrictHostKeyChecking=no",
82+
"-p", port, "testpubkey@127.0.0.1", "true")
83+
out, err := cmd.CombinedOutput()
84+
if err != nil {
85+
t.Fatalf("public key authentication failed, error: %v, command output %q", err, string(out))
86+
}
87+
// Test SSH user certificate authentication.
88+
// The username must match one of the principals included in the certificate.
89+
// The certificate "rsa-user-testcertificate" has "testcertificate" as principal.
90+
cmd = testenv.Command(t, sshCLI, "-vvv", "-i", keyPrivPath, "-o", "StrictHostKeyChecking=no",
91+
"-p", port, "testcertificate@127.0.0.1", "true")
92+
out, err = cmd.CombinedOutput()
93+
if err != nil {
94+
t.Fatalf("user certificate authentication failed, error: %v, command output %q", err, string(out))
95+
}
96+
}

‎ssh/testdata/keys.go

Copy file name to clipboardExpand all lines: ssh/testdata/keys.go
+6Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -195,6 +195,12 @@ var SSHCertificates = map[string][]byte{
195195
"rsa-sha2-256": []byte(`ssh-rsa-cert-v01@openssh.com AAAAHHNzaC1yc2EtY2VydC12MDFAb3BlbnNzaC5jb20AAAAgOyK28gunJkM60qp4EbsYAjgbUsyjS8u742OLjipIgc0AAAADAQABAAAAgQC8A6FGHDiWCSREAXCq6yBfNVr0xCVG2CzvktFNRpue+RXrGs/2a6ySEJQb3IYquw7HlJgu6fg3WIWhOmHCjfpG0PrL4CRwbqQ2LaPPXhJErWYejcD8Di00cF3677+G10KMZk9RXbmHtuBFZT98wxg8j+ZsBMqGM1+7yrWUvynswQAAAAAAAAAAAAAAAgAAABRob3N0LmV4YW1wbGUuY29tLWtleQAAABQAAAAQaG9zdC5leGFtcGxlLmNvbQAAAABeSMJ4AAAAAHBPBLwAAAAAAAAAAAAAAAAAAAEXAAAAB3NzaC1yc2EAAAADAQABAAABAQC+D11D0hEbn2Vglv4YRJ8pZNyHjIGmvth3DWOQrq++2vH2MujmGQDxfr4SVE9GpMBlKU3lwGbpgIBxAg6yZcNSfo6PWVU9ACg6NMFO+yMzc2MaG+/naQdNjSewywF5j2rkNO2XOaViRVSrZroe2B/aY2LTV0jDl8nu5NOjwRs1/s7SLe5z1rw/X0dpmXk0qJY3gQhmR8HZZ1dhEkJUGwaBCPd0T8asSYf1Ag2rUD4aQ28r3q69mbwfWOOa6rMemVZruUV5dzHwVNVNtVv+ImtnYtz8m8g+K0plaGptHn3KsaOnASkh3tujhaE7kvc4HR9Igli9+76jhZie3h/dTN5zAAABFAAAAAxyc2Etc2hhMi0yNTYAAAEAbG4De/+QiqopPS3O1H7ySeEUCY56qmdgr02sFErnihdXPDaWXUXxacvJHaEtLrSTSaPL/3v3iKvjLWDOHaQ5c+cN9J7Tqzso7RQCXZD2nK9bwCUyBoiDyBCRe8w4DQEtfL5okpVzQsSAiojQ8hBohMOpy3gFfXrdm4PVC1ZKqlZh4fAc7ajieRq/Tpq2xOLdHwxkcgPNR83WVHva6K9/xjev/5n227/gkHo0qbGs8YYDOFXIEhENi+B23IzxdNVieWdyQpYpe0C2i95Jhyo0wJmaFY2ArruTS+D1jGQQpMPvAQRy26/A5hI83GLhpwyhrN/M8wCxzAhyPL6Ieuh5tQ== host.example.com
196196
`),
197197
"rsa-sha2-512": []byte(`ssh-rsa-cert-v01@openssh.com AAAAHHNzaC1yc2EtY2VydC12MDFAb3BlbnNzaC5jb20AAAAgFGv4IpXfs4L/Y0b3rmUdPFhWoUrVnXuPxXr6aHGs7wgAAAADAQABAAAAgQC8A6FGHDiWCSREAXCq6yBfNVr0xCVG2CzvktFNRpue+RXrGs/2a6ySEJQb3IYquw7HlJgu6fg3WIWhOmHCjfpG0PrL4CRwbqQ2LaPPXhJErWYejcD8Di00cF3677+G10KMZk9RXbmHtuBFZT98wxg8j+ZsBMqGM1+7yrWUvynswQAAAAAAAAAAAAAAAgAAABRob3N0LmV4YW1wbGUuY29tLWtleQAAABQAAAAQaG9zdC5leGFtcGxlLmNvbQAAAABeSMRYAAAAAHBPBp4AAAAAAAAAAAAAAAAAAAEXAAAAB3NzaC1yc2EAAAADAQABAAABAQC+D11D0hEbn2Vglv4YRJ8pZNyHjIGmvth3DWOQrq++2vH2MujmGQDxfr4SVE9GpMBlKU3lwGbpgIBxAg6yZcNSfo6PWVU9ACg6NMFO+yMzc2MaG+/naQdNjSewywF5j2rkNO2XOaViRVSrZroe2B/aY2LTV0jDl8nu5NOjwRs1/s7SLe5z1rw/X0dpmXk0qJY3gQhmR8HZZ1dhEkJUGwaBCPd0T8asSYf1Ag2rUD4aQ28r3q69mbwfWOOa6rMemVZruUV5dzHwVNVNtVv+ImtnYtz8m8g+K0plaGptHn3KsaOnASkh3tujhaE7kvc4HR9Igli9+76jhZie3h/dTN5zAAABFAAAAAxyc2Etc2hhMi01MTIAAAEAnF4fVj6mm+UFeNCIf9AKJCv9WzymjjPvzzmaMWWkPWqoV0P0m5SiYfvbY9SbA73Blpv8SOr0DmpublF183kodREia4KyVuC8hLhSCV2Y16hy9MBegOZMepn80w+apj7Rn9QCz5OfEakDdztp6OWTBtqxnZFcTQ4XrgFkNWeWRElGdEvAVNn2WHwHi4EIdz0mdv48Imv5SPlOuW862ZdFG4Do1dUfDIiGsBofLlgcyIYlf+eNHul6sBeUkuwFxisMpI5DQzNp8PX1g/QJA2wzwT674PTqDXNttKjyh50Fdr4sXxm9Gz1+jVLoESvFNa55ERdSyAqNu4wTy11MZsWwSA== host.example.com
198+
`),
199+
// Assumes "ca" key above in file named "ca", sign a user cert for "rsa.pub"
200+
// using "testcertificate" as principal:
201+
//
202+
// ssh-keygen -s ca -I username -n testcertificate rsa.pub
203+
"rsa-user-testcertificate": []byte(`ssh-rsa-cert-v01@openssh.com AAAAHHNzaC1yc2EtY2VydC12MDFAb3BlbnNzaC5jb20AAAAgr0MnhSf+KkQWEQmweJOGsJfOrUt80pQZDaI9YiwSfDUAAAADAQABAAAAgQC8A6FGHDiWCSREAXCq6yBfNVr0xCVG2CzvktFNRpue+RXrGs/2a6ySEJQb3IYquw7HlJgu6fg3WIWhOmHCjfpG0PrL4CRwbqQ2LaPPXhJErWYejcD8Di00cF3677+G10KMZk9RXbmHtuBFZT98wxg8j+ZsBMqGM1+7yrWUvynswQAAAAAAAAAAAAAAAQAAAAh1c2VybmFtZQAAABMAAAAPdGVzdGNlcnRpZmljYXRlAAAAAAAAAAD//////////wAAAAAAAACCAAAAFXBlcm1pdC1YMTEtZm9yd2FyZGluZwAAAAAAAAAXcGVybWl0LWFnZW50LWZvcndhcmRpbmcAAAAAAAAAFnBlcm1pdC1wb3J0LWZvcndhcmRpbmcAAAAAAAAACnBlcm1pdC1wdHkAAAAAAAAADnBlcm1pdC11c2VyLXJjAAAAAAAAAAAAAAEXAAAAB3NzaC1yc2EAAAADAQABAAABAQC+D11D0hEbn2Vglv4YRJ8pZNyHjIGmvth3DWOQrq++2vH2MujmGQDxfr4SVE9GpMBlKU3lwGbpgIBxAg6yZcNSfo6PWVU9ACg6NMFO+yMzc2MaG+/naQdNjSewywF5j2rkNO2XOaViRVSrZroe2B/aY2LTV0jDl8nu5NOjwRs1/s7SLe5z1rw/X0dpmXk0qJY3gQhmR8HZZ1dhEkJUGwaBCPd0T8asSYf1Ag2rUD4aQ28r3q69mbwfWOOa6rMemVZruUV5dzHwVNVNtVv+ImtnYtz8m8g+K0plaGptHn3KsaOnASkh3tujhaE7kvc4HR9Igli9+76jhZie3h/dTN5zAAABFAAAAAxyc2Etc2hhMi01MTIAAAEAFuA+67KvnlmcodIp0Lv4mR9UW/CHghAaN1csBJTkI8mx3wXKyIPTsS2uXboEhWD0a7S9gps2SEwC5m6E3kV2Rzg7aH1S03GZqMvVlK2VHe7fzuoW2yOKk6yEPjeTF0pKCFbUQ6mce8pRpD/zdvjG0Z287XM3c3Axlrn7qq7TS0MDTjEZ/dsUNFHxep3co/HuAsWVWPVDItr/FPnvZ6WVH1yc8N/AJn0gLHobkGgug22vI9rNIge1wrnXxU9BUSouzkau/PQsrCQapnn+I1H7HaQt0wdk45nxMP+ags+HRI9qpX/p8WDn6+zpqYqN/nfw2aoytyaJqhsV32Teuqtrgg== rsa.pub
198204
`),
199205
}
200206

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.