File: test-restricted-ssh-commands

package info (click to toggle)
restricted-ssh-commands 0.4-1
  • links: PTS
  • area: main
  • in suites: bullseye, buster, sid
  • size: 88 kB
  • ctags: 20
  • sloc: sh: 125; makefile: 24
file content (111 lines) | stat: -rwxr-xr-x 3,690 bytes parent folder | download | duplicates (2)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
#!/bin/sh

# Copyright (C) 2015, Benjamin Drung <benjamin.drung@profitbricks.com>
#
# Permission is hereby granted, free of charge, to any person obtaining
# a copy of this software and associated documentation files (the
# "Software"), to deal in the Software without restriction, including
# without limitation the rights to use, copy, modify, merge, publish,
# distribute, sublicense, and/or sell copies of the Software, and to
# permit persons to whom the Software is furnished to do so, subject to
# the following conditions:
#
# The above copyright notice and this permission notice shall be included
# in all copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
# IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
# CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
# TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
# SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

COMMAND="${0%/*}/test/restricted-ssh-commands"

runCommand() {
    local ssh_param="$1"
    local param="$2"
    local exp_stdout="$3"
    local exp_stderr="$4"
    local exp_retval=$5
    local stdoutF="${SHUNIT_TMPDIR}/stdout"
    local stderrF="${SHUNIT_TMPDIR}/stderr"
    TEST_ROOT=${SHUNIT_TMPDIR} SSH_ORIGINAL_COMMAND="${ssh_param}" "${COMMAND}" "$param" > ${stdoutF} 2> ${stderrF}
    retval=$?
    assertEquals "standard output of ${COMMAND} $param\n" "$exp_stdout" "$(cat ${stdoutF})"
    assertEquals "error output of ${COMMAND} $param\n" "$exp_stderr" "$(cat ${stderrF})"
    assertEquals "return value of ${COMMAND} $param\n" $exp_retval $retval
}

add_rule() {
    local config_name="$1"
    local config_content="$2"
    mkdir -p "${SHUNIT_TMPDIR}/etc/restricted-ssh-commands"
    printf "%s\n" "$config_content" >> "${SHUNIT_TMPDIR}/etc/restricted-ssh-commands/${config_name}"
}

success() {
    runCommand "$1" "$2" "$3" "" ${4-0}
}

failure() {
    runCommand "$1" "$2" "" "$3" ${4-124}
}

tearDown() {
    rm -rf ${SHUNIT_TMPDIR}/etc
}

test_missing_config() {
    failure "true" "foo" "restricted-ssh-commands: No configuration in ${SHUNIT_TMPDIR}/etc/restricted-ssh-commands/foo. All commands including \"true\" are denied." 125
}

test_empty_config() {
    add_rule "foo" ""
    failure "true" "foo" "restricted-ssh-commands: Empty configuration in ${SHUNIT_TMPDIR}/etc/restricted-ssh-commands/foo. All commands including \"true\" are denied." 125
}

test_single_rule_config() {
    add_rule "$(id -un)" "^echo"
    failure "true" "" "restricted-ssh-commands: Rejecting command \"true\". It does not match the one allow rule in ${SHUNIT_TMPDIR}/etc/restricted-ssh-commands/$(id -un)."
}

test_two_rules_config() {
    add_rule "bar" "^echo"
    add_rule "bar" "^false"
    failure "true" "bar" "restricted-ssh-commands: Rejecting command \"true\". It does not match any of the 2 allow rules in ${SHUNIT_TMPDIR}/etc/restricted-ssh-commands/bar."
}

test_matching_rule() {
    add_rule "foo" '^true$'
    success "true" "foo" ""
}

test_user_config() {
    add_rule "$(id -un)" '^true$'
    success "true" "" ""
}

test_custom_config() {
    add_rule "foobar" '^true$'
    success "true" "foobar" ""
}

test_failing_command() {
    add_rule "bla" '^true$'
    add_rule "bla" '^false$'
    failure "false" "bla" "" 1
}

test_cat() {
    add_rule "bla" '^cat'
    echo test | success "cat" "bla" "test"
}

test_shell_command() {
    add_rule "user" '^export '
    success 'export text=test; echo $text' "user" "test"
}

. shunit2