mirror of
https://github.com/PowerShell/openssh-portable.git
synced 2025-04-08 18:35:05 +02:00
e2287c5cfa
-----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEcWi5g4FaXu9ZpK39Kj9BTnNgYLoFAmA+KckACgkQKj9BTnNg YLoCExAAqxi83JFNUj+D0HdfM/eKas8dGtCXFzxtOA0yomKeeDUVoz1D96CdNLF8 07mL78KAMErN2SfXEyzpS/2yoGa8wPflne/ADWJVIGKZK9cj8/fwvMrCUWp9PJOa CVQm2W8u3yBoEAxoi81S7WJjR5BY4Sv0LtQJW43VfD4bwYjBz8N72ecnr7LknFNL qJXYUu/OWtMLNsSrh2VigXJQgTA9cmJUrItRFamSsfWZGwilL0MpXLrkwcJa5DhO 25PG3aeJSTX5txI/hl25EY5cyeJPQGX+6Nz9kJag50a7C9ZOCJHIbnle7dFcLsDP lCy3VoQnPxEOHe8kmNGLf1tGvv8AIqpJu1a31SlSnbqHEgHFC0XCPXZF0QWDGAaO kDt8j6XSCHYDyml5+nkZJBCP6xcx7eXyLJ2CxnNZBabbRGLb/Rj+jeCk9s+jWo/i UDgmlibbfjreYVgwuZhQV9QI9GB0Mlv+UjeeK55b2S7WnhuLsMLVrxDVQ1Zl4oR1 ckOvXBMGrjMaLQTW9Q1xSV6C3PR1oAbVa09YUP0KSAthOu8L/tGY13kT4DwWm1W/ JBOKzCk/JIfRuOpCrKSftwuj19JKOPYojW8kk10i/48RUq4TiCsCnTtBZI7VvFcB B28s/ZGRq/nETqHSRX63/WLr57lU54pq/+7THQA5iUyFhORPYk4= =npgJ -----END PGP SIGNATURE----- pull V8.5 changes
72 lines
2.5 KiB
Bash
72 lines
2.5 KiB
Bash
# $OpenBSD: addrmatch.sh,v 1.6 2020/08/28 03:17:13 dtucker Exp $
|
|
# Placed in the Public Domain.
|
|
|
|
tid="address match"
|
|
|
|
mv $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
|
|
|
|
run_trial()
|
|
{
|
|
user="$1"; addr="$2"; host="$3"; laddr="$4"; lport="$5"
|
|
expected="$6"; descr="$7"
|
|
|
|
verbose "test $descr for $user $addr $host"
|
|
result=`${SSHD} -f $OBJ/sshd_proxy -T \
|
|
-C user=${user},addr=${addr},host=${host},laddr=${laddr},lport=${lport} | \
|
|
awk '/^forcecommand/ {print $2}'`
|
|
if [ "$os" == "windows" ]; then
|
|
result=${result/$'\r'/} # remove CR (carriage return)
|
|
fi
|
|
if [ "$result" != "$expected" ]; then
|
|
fail "failed '$descr' expected $expected got $result"
|
|
fi
|
|
}
|
|
|
|
cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
|
|
cat >>$OBJ/sshd_proxy <<EOD
|
|
ForceCommand nomatch
|
|
Match Address 192.168.0.0/16,!192.168.30.0/24,10.0.0.0/8,host.example.com
|
|
ForceCommand match1
|
|
Match Address 1.1.1.1,::1,!::3,2000::/16
|
|
ForceCommand match2
|
|
Match LocalAddress 127.0.0.1,::1
|
|
ForceCommand match3
|
|
Match LocalPort 5678
|
|
ForceCommand match4
|
|
EOD
|
|
|
|
run_trial user 192.168.0.1 somehost 1.2.3.4 1234 match1 "first entry"
|
|
run_trial user 192.168.30.1 somehost 1.2.3.4 1234 nomatch "negative match"
|
|
run_trial user 19.0.0.1 somehost 1.2.3.4 1234 nomatch "no match"
|
|
run_trial user 10.255.255.254 somehost 1.2.3.4 1234 match1 "list middle"
|
|
run_trial user 192.168.30.1 192.168.0.1 1.2.3.4 1234 nomatch "faked IP in hostname"
|
|
run_trial user 1.1.1.1 somehost.example.com 1.2.3.4 1234 match2 "bare IP4 address"
|
|
run_trial user 19.0.0.1 somehost 127.0.0.1 1234 match3 "localaddress"
|
|
run_trial user 19.0.0.1 somehost 1.2.3.4 5678 match4 "localport"
|
|
|
|
if test "$TEST_SSH_IPV6" != "no"; then
|
|
run_trial user ::1 somehost.example.com ::2 1234 match2 "bare IP6 address"
|
|
run_trial user ::2 somehost.example.com ::2 1234 nomatch "deny IPv6"
|
|
run_trial user ::3 somehost ::2 1234 nomatch "IP6 negated"
|
|
run_trial user ::4 somehost ::2 1234 nomatch "IP6 no match"
|
|
run_trial user 2000::1 somehost ::2 1234 match2 "IP6 network"
|
|
run_trial user 2001::1 somehost ::2 1234 nomatch "IP6 network"
|
|
run_trial user ::5 somehost ::1 1234 match3 "IP6 localaddress"
|
|
run_trial user ::5 somehost ::2 5678 match4 "IP6 localport"
|
|
fi
|
|
|
|
#
|
|
# Check that we catch invalid address/mask in Match Address/Localaddress
|
|
#
|
|
for i in 10.0.1.0/8 10.0.0.1/24 2000:aa:bb:01::/56; do
|
|
for a in address localaddress; do
|
|
verbose "test invalid Match $a $i"
|
|
echo "Match $a $i" > $OBJ/sshd_proxy
|
|
${SUDO} ${SSHD} -f $OBJ/sshd_proxy -t >/dev/null 2>&1 && \
|
|
fail "accepted invalid match $a $i"
|
|
done
|
|
done
|
|
|
|
cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
|
|
rm $OBJ/sshd_proxy_bak
|