/* * torture.c - torture library for testing libssh * * This file is part of the SSH Library * * Copyright (c) 2008-2009 by Andreas Schneider * * The SSH Library is free software; you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation; either version 2.1 of the License, or (at your * option) any later version. * * The SSH Library is distributed in the hope that it will be useful, but * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public * License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with the SSH Library; see the file COPYING. If not, write to * the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, * MA 02111-1307, USA. */ #include "config.h" #include "tests_config.h" #include #include #include #include #include #include #ifndef _WIN32 # include # include # include #endif #ifdef HAVE_UNISTD_H #include #elif (defined _WIN32) || (defined _WIN64) #include #include #define read _read #define open _open #define write _write #define close _close #define chdir _chdir #endif #include "torture.h" #include "torture_key.h" #include "libssh/misc.h" #include "libssh/token.h" #define TORTURE_SSHD_SRV_IPV4 "127.0.0.10" /* socket wrapper IPv6 prefix fd00::5357:5fxx */ #define TORTURE_SSHD_SRV_IPV6 "fd00::5357:5f0a" #define TORTURE_SSHD_SRV_PORT 22 #define TORTURE_SOCKET_DIR "/tmp/test_socket_wrapper_XXXXXX" #define TORTURE_SSHD_PIDFILE "sshd/sshd.pid" #define TORTURE_SSHD_CONFIG "sshd/sshd_config" #define TORTURE_PCAP_FILE "socket_trace.pcap" #ifndef PATH_MAX # define PATH_MAX 4096 #endif static const char torture_rsa_certauth_pub[]= "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCnA2n5vHzZbs/GvRkGloJNV1CXHI" "S5Xnrm05HusUJSWyPq3I1iCMHdYA7oezHa9GCFYbIenaYPy+G6USQRjYQz8SvAZo06" "SFNeJSsa1kAIqxzdPT9kBrRrYK39PZQPsYVfRPqZBdmc+jwrfz97IFEJyXMI47FoTG" "kgEq7eu3z2px/tdIZ34I5Hr5DDBxicZi4jluyRUJHfSPoBxyhF7OkPX4bYkrc691je" "IQDxubl650WYLHgFfad0xTzBIFE6XUb55Dp5AgRdevSoso1Pe0IKFxxMVpP664LCbY" "K06Lv6kcotfFlpvUtR1yx8jToGcSoq5sSzTwvXSHCQQ9ZA1hvF " "torture_certauth_key"; static int verbosity = 0; static const char *pattern = NULL; #ifndef _WIN32 static int _torture_auth_kbdint(ssh_session session, const char *password) { const char *prompt; char echo; int err; if (session == NULL || password == NULL) { return SSH_AUTH_ERROR; } err = ssh_userauth_kbdint(session, NULL, NULL); if (err == SSH_AUTH_ERROR) { return err; } if (ssh_userauth_kbdint_getnprompts(session) != 1) { return SSH_AUTH_ERROR; } prompt = ssh_userauth_kbdint_getprompt(session, 0, &echo); if (prompt == NULL) { return SSH_AUTH_ERROR; } if (ssh_userauth_kbdint_setanswer(session, 0, password) < 0) { return SSH_AUTH_ERROR; } err = ssh_userauth_kbdint(session, NULL, NULL); if (err == SSH_AUTH_INFO) { if (ssh_userauth_kbdint_getnprompts(session) != 0) { return SSH_AUTH_ERROR; } err = ssh_userauth_kbdint(session, NULL, NULL); } return err; } int torture_rmdirs(const char *path) { DIR *d; struct dirent *dp; struct stat sb; char *fname; if ((d = opendir(path)) != NULL) { while(stat(path, &sb) == 0) { /* if we can remove the directory we're done */ if (rmdir(path) == 0) { break; } switch (errno) { case ENOTEMPTY: case EEXIST: case EBADF: break; /* continue */ default: closedir(d); return 0; } while ((dp = readdir(d)) != NULL) { size_t len; /* skip '.' and '..' */ if (dp->d_name[0] == '.' && (dp->d_name[1] == '\0' || (dp->d_name[1] == '.' && dp->d_name[2] == '\0'))) { continue; } len = strlen(path) + strlen(dp->d_name) + 2; fname = malloc(len); if (fname == NULL) { closedir(d); return -1; } snprintf(fname, len, "%s/%s", path, dp->d_name); /* stat the file */ if (lstat(fname, &sb) != -1) { if (S_ISDIR(sb.st_mode) && !S_ISLNK(sb.st_mode)) { if (rmdir(fname) < 0) { /* can't be deleted */ if (errno == EACCES) { closedir(d); SAFE_FREE(fname); return -1; } torture_rmdirs(fname); } } else { unlink(fname); } } /* lstat */ SAFE_FREE(fname); } /* readdir */ rewinddir(d); } } else { return -1; } closedir(d); return 0; } int torture_isdir(const char *path) { struct stat sb; if (lstat (path, &sb) == 0 && S_ISDIR(sb.st_mode)) { return 1; } return 0; } static pid_t torture_read_pidfile(const char *pidfile) { char buf[8] = {0}; long int tmp; pid_t ret; ssize_t rc; int fd; fd = open(pidfile, O_RDONLY); if (fd < 0) { return -1; } rc = read(fd, buf, sizeof(buf)); close(fd); if (rc <= 0) { return -1; } buf[sizeof(buf) - 1] = '\0'; tmp = strtol(buf, NULL, 10); if (tmp == 0 || errno == ERANGE) { return -1; } ret = (pid_t)tmp; /* Check if we are out of pid_t range on this system */ if ((long)ret != tmp) { return -1; } return ret; } int torture_terminate_process(const char *pidfile) { ssize_t rc; pid_t pid; int is_running = 1; int count; /* read the pidfile */ pid = torture_read_pidfile(pidfile); assert_int_not_equal(pid, -1); for (count = 0; count < 10; count++) { /* Make sure the daemon goes away! */ kill(pid, SIGTERM); /* 10 ms */ usleep(10 * 1000); rc = kill(pid, 0); if (rc != 0) { /* Process not found */ if (errno == ESRCH) { is_running = 0; rc = 0; break; } } } if (is_running) { fprintf(stderr, "WARNING: The process with pid %u is still running!\n", pid); } return rc; } ssh_session torture_ssh_session(struct torture_state *s, const char *host, const unsigned int *port, const char *user, const char *password) { ssh_session session; int method; int rc; bool process_config = false; if (host == NULL) { return NULL; } session = ssh_new(); if (session == NULL) { return NULL; } #ifdef WITH_PCAP if (s != NULL && s->plain_pcap != NULL) { ssh_set_pcap_file(session, s->plain_pcap); } #endif /* WITH_PCAP */ if (ssh_options_set(session, SSH_OPTIONS_LOG_VERBOSITY, &verbosity) < 0) { goto failed; } if (ssh_options_set(session, SSH_OPTIONS_HOST, host) < 0) { goto failed; } if (port != NULL) { if (ssh_options_set(session, SSH_OPTIONS_PORT, port) < 0) { goto failed; } } if (user != NULL) { if (ssh_options_set(session, SSH_OPTIONS_USER, user) < 0) { goto failed; } } if (ssh_options_set(session, SSH_OPTIONS_PROCESS_CONFIG, &process_config) < 0) { goto failed; } if (ssh_connect(session)) { goto failed; } /* We are in testing mode, so consinder the hostkey as verified ;) */ /* This request should return a SSH_REQUEST_DENIED error */ rc = ssh_userauth_none(session, NULL); if (rc == SSH_ERROR) { goto failed; } method = ssh_userauth_list(session, NULL); if (method == 0) { goto failed; } if (password != NULL) { if (method & SSH_AUTH_METHOD_PASSWORD) { rc = ssh_userauth_password(session, NULL, password); } else if (method & SSH_AUTH_METHOD_INTERACTIVE) { rc = _torture_auth_kbdint(session, password); } } else { rc = ssh_userauth_publickey_auto(session, NULL, NULL); if (rc == SSH_AUTH_ERROR) { goto failed; } } if (rc != SSH_AUTH_SUCCESS) { goto failed; } return session; failed: if (ssh_is_connected(session)) { ssh_disconnect(session); } ssh_free(session); return NULL; } #ifdef WITH_SERVER ssh_bind torture_ssh_bind(const char *addr, const unsigned int port, enum ssh_keytypes_e key_type, const char *private_key_file) { int rc; ssh_bind sshbind = NULL; enum ssh_bind_options_e opts = -1; sshbind = ssh_bind_new(); if (sshbind == NULL) { goto out; } rc = ssh_bind_options_set(sshbind, SSH_BIND_OPTIONS_BINDADDR, addr); if (rc != 0) { goto out_free; } rc = ssh_bind_options_set(sshbind, SSH_BIND_OPTIONS_BINDPORT, &port); if (rc != 0) { goto out_free; } switch (key_type) { #ifdef HAVE_DSA case SSH_KEYTYPE_DSS: opts = SSH_BIND_OPTIONS_DSAKEY; break; #endif /* HAVE_DSA */ case SSH_KEYTYPE_RSA: opts = SSH_BIND_OPTIONS_RSAKEY; break; case SSH_KEYTYPE_ECDSA_P256: case SSH_KEYTYPE_ECDSA_P384: case SSH_KEYTYPE_ECDSA_P521: opts = SSH_BIND_OPTIONS_ECDSAKEY; break; default: goto out_free; } rc = ssh_bind_options_set(sshbind, opts, private_key_file); if (rc != 0) { goto out_free; } rc = ssh_bind_listen(sshbind); if (rc != SSH_OK) { goto out_free; } goto out; out_free: ssh_bind_free(sshbind); sshbind = NULL; out: return sshbind; } #endif /* WITH_SERVER */ #ifdef WITH_SFTP struct torture_sftp *torture_sftp_session(ssh_session session) { struct torture_sftp *t; char template[] = "/tmp/ssh_torture_XXXXXX"; char *p; int rc; if (session == NULL) { return NULL; } t = malloc(sizeof(struct torture_sftp)); if (t == NULL) { return NULL; } t->ssh = session; t->sftp = sftp_new(session); if (t->sftp == NULL) { goto failed; } rc = sftp_init(t->sftp); if (rc < 0) { goto failed; } p = mkdtemp(template); if (p == NULL) { goto failed; } /* useful if TESTUSER is not the local user */ chmod(template,0777); t->testdir = strdup(p); if (t->testdir == NULL) { goto failed; } return t; failed: if (t->sftp != NULL) { sftp_free(t->sftp); } ssh_disconnect(t->ssh); ssh_free(t->ssh); free(t); return NULL; } void torture_sftp_close(struct torture_sftp *t) { if (t == NULL) { return; } if (t->sftp != NULL) { sftp_free(t->sftp); } if (t->testdir) { torture_rmdirs(t->testdir); } free(t->testdir); free(t); } #endif /* WITH_SFTP */ int torture_server_port(void) { char *env = getenv("TORTURE_SERVER_PORT"); if (env != NULL && env[0] != '\0' && strlen(env) < 6) { int port = atoi(env); if (port > 0 && port < 65536) { return port; } } return TORTURE_SSHD_SRV_PORT; } const char *torture_server_address(int family) { switch (family) { case AF_INET: { const char *ip4 = getenv("TORTURE_SERVER_ADDRESS_IPV4"); if (ip4 != NULL && ip4[0] != '\0') { return ip4; } return TORTURE_SSHD_SRV_IPV4; } case AF_INET6: { const char *ip6 = getenv("TORTURE_SERVER_ADDRESS_IPV6"); if (ip6 != NULL && ip6[0] != '\0') { return ip6; } return TORTURE_SSHD_SRV_IPV6; } default: return NULL; } return NULL; } void torture_setup_socket_dir(void **state) { struct torture_state *s; const char *p; size_t len; char *env = NULL; int rc; s = calloc(1, sizeof(struct torture_state)); assert_non_null(s); #ifdef WITH_PCAP env = getenv("TORTURE_PLAIN_PCAP_FILE"); if (env != NULL && env[0] != '\0') { s->plain_pcap = ssh_pcap_file_new(); assert_non_null(s->plain_pcap); rc = ssh_pcap_file_open(s->plain_pcap, env); assert_int_equal(rc, SSH_OK); } #endif /* WITH_PCAP */ s->socket_dir = torture_make_temp_dir(TORTURE_SOCKET_DIR); assert_non_null(s->socket_dir); p = s->socket_dir; /* pcap file */ len = strlen(p) + 1 + strlen(TORTURE_PCAP_FILE) + 1; s->pcap_file = malloc(len); assert_non_null(s->pcap_file); snprintf(s->pcap_file, len, "%s/%s", p, TORTURE_PCAP_FILE); /* pid file */ len = strlen(p) + 1 + strlen(TORTURE_SSHD_PIDFILE) + 1; s->srv_pidfile = malloc(len); assert_non_null(s->srv_pidfile); snprintf(s->srv_pidfile, len, "%s/%s", p, TORTURE_SSHD_PIDFILE); /* config file */ len = strlen(p) + 1 + strlen(TORTURE_SSHD_CONFIG) + 1; s->srv_config = malloc(len); assert_non_null(s->srv_config); snprintf(s->srv_config, len, "%s/%s", p, TORTURE_SSHD_CONFIG); setenv("SOCKET_WRAPPER_DIR", p, 1); setenv("SOCKET_WRAPPER_DEFAULT_IFACE", "170", 1); env = getenv("TORTURE_GENERATE_PCAP"); if (env != NULL && env[0] == '1') { setenv("SOCKET_WRAPPER_PCAP_FILE", s->pcap_file, 1); } *state = s; } /** * @brief Create a libssh server configuration file * * It is expected the socket directory to be already created before by calling * torture_setup_socket_dir(). The created configuration file will be stored in * the socket directory and the srv_config pointer in the state will be * initialized. * * @param[in] state A pointer to a pointer to an initialized torture_state * structure */ void torture_setup_create_libssh_config(void **state) { struct torture_state *s = *state; char ed25519_hostkey[1024] = {0}; #ifdef HAVE_DSA char dsa_hostkey[1024]; #endif /* HAVE_DSA */ char rsa_hostkey[1024]; char ecdsa_hostkey[1024]; char sshd_config[2048]; char sshd_path[1024]; const char *additional_config = NULL; struct stat sb; const char config_string[]= "LogLevel DEBUG3\n" "Port 22\n" "ListenAddress 127.0.0.10\n" "%s %s\n" "%s %s\n" "%s %s\n" #ifdef HAVE_DSA "%s %s\n" #endif /* HAVE_DSA */ "%s\n"; /* The space for test-specific options */ bool written = false; int rc; assert_non_null(s->socket_dir); snprintf(sshd_path, sizeof(sshd_path), "%s/sshd", s->socket_dir); rc = lstat(sshd_path, &sb); if (rc == 0 ) { /* The directory is already in place */ written = true; } if (!written) { rc = mkdir(sshd_path, 0755); assert_return_code(rc, errno); } snprintf(ed25519_hostkey, sizeof(ed25519_hostkey), "%s/sshd/ssh_host_ed25519_key", s->socket_dir); snprintf(rsa_hostkey, sizeof(rsa_hostkey), "%s/sshd/ssh_host_rsa_key", s->socket_dir); snprintf(ecdsa_hostkey, sizeof(ecdsa_hostkey), "%s/sshd/ssh_host_ecdsa_key", s->socket_dir); #ifdef HAVE_DSA snprintf(dsa_hostkey, sizeof(dsa_hostkey), "%s/sshd/ssh_host_dsa_key", s->socket_dir); #endif /* HAVE_DSA */ if (!written) { torture_write_file(ed25519_hostkey, torture_get_openssh_testkey(SSH_KEYTYPE_ED25519, 0)); torture_write_file(rsa_hostkey, torture_get_testkey(SSH_KEYTYPE_RSA, 0)); torture_write_file(ecdsa_hostkey, torture_get_testkey(SSH_KEYTYPE_ECDSA_P521, 0)); #ifdef HAVE_DSA torture_write_file(dsa_hostkey, torture_get_testkey(SSH_KEYTYPE_DSS, 0)); #endif /* HAVE_DSA */ } additional_config = (s->srv_additional_config != NULL ? s->srv_additional_config : ""); snprintf(sshd_config, sizeof(sshd_config), config_string, "HostKey", ed25519_hostkey, "HostKey", rsa_hostkey, "HostKey", ecdsa_hostkey, #ifdef HAVE_DSA "HostKey", dsa_hostkey, #endif /* HAVE_DSA */ additional_config); torture_write_file(s->srv_config, sshd_config); } static void torture_setup_create_sshd_config(void **state, bool pam) { struct torture_state *s = *state; char ed25519_hostkey[1024] = {0}; #ifdef HAVE_DSA char dsa_hostkey[1024]; #endif /* HAVE_DSA */ char rsa_hostkey[1024]; char ecdsa_hostkey[1024]; char trusted_ca_pubkey[1024]; char sshd_config[4096]; char sshd_path[1024]; const char *additional_config = NULL; struct stat sb; const char *sftp_server_locations[] = { "/usr/lib/ssh/sftp-server", "/usr/libexec/ssh/sftp-server", /* Tumbleweed 20200829 */ "/usr/libexec/sftp-server", "/usr/libexec/openssh/sftp-server", "/usr/lib/openssh/sftp-server", /* Debian */ }; const char config_string[]= "Port 22\n" "ListenAddress 127.0.0.10\n" "%s %s\n" /* ed25519 HostKey */ #ifdef HAVE_DSA "%s %s\n" /* DSA HostKey */ #endif /* HAVE_DSA */ "%s %s\n" /* RSA HostKey */ "%s %s\n" /* ECDSA HostKey */ "\n" "TrustedUserCAKeys %s\n" "\n" "LogLevel DEBUG3\n" "Subsystem sftp %s -l DEBUG2\n" "\n" "PasswordAuthentication yes\n" "PubkeyAuthentication yes\n" "\n" "StrictModes no\n" "\n" "%s\n" /* Here comes UsePam */ "%s" /* The space for test-specific options */ "\n" /* add all supported algorithms */ "HostKeyAlgorithms " OPENSSH_KEYS "\n" #if OPENSSH_VERSION_MAJOR == 8 && OPENSSH_VERSION_MINOR >= 2 "CASignatureAlgorithms " OPENSSH_KEYS "\n" #endif "Ciphers " OPENSSH_CIPHERS "\n" "KexAlgorithms " OPENSSH_KEX "\n" "MACs " OPENSSH_MACS "\n" "\n" "AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES\n" "AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT\n" "AcceptEnv LC_IDENTIFICATION LC_ALL LC_LIBSSH\n" "\n" "PidFile %s\n"; /* FIPS config */ const char fips_config_string[]= "Port 22\n" "ListenAddress 127.0.0.10\n" "%s %s\n" /* RSA HostKey */ "%s %s\n" /* ECDSA HostKey */ "\n" "TrustedUserCAKeys %s\n" /* Trusted CA */ "\n" "LogLevel DEBUG3\n" "Subsystem sftp %s -l DEBUG2\n" /* SFTP server */ "\n" "PasswordAuthentication yes\n" "PubkeyAuthentication yes\n" "\n" "StrictModes no\n" "\n" "%s\n" /* Here comes UsePam */ "%s" /* The space for test-specific options */ "\n" "Ciphers " "aes256-gcm@openssh.com,aes256-ctr,aes256-cbc," "aes128-gcm@openssh.com,aes128-ctr,aes128-cbc" "\n" "MACs " "hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com," "hmac-sha2-512-etm@openssh.com,hmac-sha2-256," "hmac-sha1,hmac-sha2-512" "\n" "GSSAPIKeyExchange no\n" "KexAlgorithms " "ecdh-sha2-nistp256,ecdh-sha2-nistp384," "ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256," "diffie-hellman-group14-sha256,diffie-hellman-group16-sha512," "diffie-hellman-group18-sha512" "\n" "PubkeyAcceptedKeyTypes " "rsa-sha2-256,rsa-sha2-256-cert-v01@openssh.com," "ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com," "ecdsa-sha2-nistp384,ecdsa-sha2-nistp384-cert-v01@openssh.com," "rsa-sha2-512,rsa-sha2-512-cert-v01@openssh.com," "ecdsa-sha2-nistp521,ecdsa-sha2-nistp521-cert-v01@openssh.com" "\n" "AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES\n" "AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT\n" "AcceptEnv LC_IDENTIFICATION LC_ALL LC_LIBSSH\n" "\n" "PidFile %s\n"; /* PID file */ const char usepam_yes[] = "UsePAM yes\n" "KbdInteractiveAuthentication yes\n"; const char usepam_no[] = "UsePAM no\n" "KbdInteractiveAuthentication no\n"; size_t sftp_sl_size = ARRAY_SIZE(sftp_server_locations); const char *sftp_server, *usepam; size_t i; bool written = false; int rc; s->srv_pam = pam; if (pam) { usepam = usepam_yes; } else { usepam = usepam_no; } assert_non_null(s->socket_dir); snprintf(sshd_path, sizeof(sshd_path), "%s/sshd", s->socket_dir); rc = lstat(sshd_path, &sb); if (rc == 0 ) { /* The directory is already in place */ written = true; } if (!written) { rc = mkdir(sshd_path, 0755); assert_return_code(rc, errno); } snprintf(ed25519_hostkey, sizeof(ed25519_hostkey), "%s/sshd/ssh_host_ed25519_key", s->socket_dir); #ifdef HAVE_DSA snprintf(dsa_hostkey, sizeof(dsa_hostkey), "%s/sshd/ssh_host_dsa_key", s->socket_dir); #endif /* HAVE_DSA */ snprintf(rsa_hostkey, sizeof(rsa_hostkey), "%s/sshd/ssh_host_rsa_key", s->socket_dir); snprintf(ecdsa_hostkey, sizeof(ecdsa_hostkey), "%s/sshd/ssh_host_ecdsa_key", s->socket_dir); snprintf(trusted_ca_pubkey, sizeof(trusted_ca_pubkey), "%s/sshd/user_ca.pub", s->socket_dir); if (!written) { torture_write_file(ed25519_hostkey, torture_get_openssh_testkey(SSH_KEYTYPE_ED25519, 0)); #ifdef HAVE_DSA torture_write_file(dsa_hostkey, torture_get_testkey(SSH_KEYTYPE_DSS, 0)); #endif /* HAVE_DSA */ torture_write_file(rsa_hostkey, torture_get_testkey(SSH_KEYTYPE_RSA, 0)); torture_write_file(ecdsa_hostkey, torture_get_testkey(SSH_KEYTYPE_ECDSA_P521, 0)); torture_write_file(trusted_ca_pubkey, torture_rsa_certauth_pub); } sftp_server = getenv("TORTURE_SFTP_SERVER"); if (sftp_server == NULL) { for (i = 0; i < sftp_sl_size; i++) { sftp_server = sftp_server_locations[i]; rc = lstat(sftp_server, &sb); if (rc == 0) { break; } } } assert_non_null(sftp_server); additional_config = (s->srv_additional_config != NULL ? s->srv_additional_config : ""); if (ssh_fips_mode()) { snprintf(sshd_config, sizeof(sshd_config), fips_config_string, "HostKey", rsa_hostkey, "HostKey", ecdsa_hostkey, trusted_ca_pubkey, sftp_server, usepam, additional_config, s->srv_pidfile); } else { snprintf(sshd_config, sizeof(sshd_config), config_string, "HostKey", ed25519_hostkey, #ifdef HAVE_DSA "HostKey", dsa_hostkey, #endif /* HAVE_DSA */ "HostKey", rsa_hostkey, "HostKey", ecdsa_hostkey, trusted_ca_pubkey, sftp_server, usepam, additional_config, s->srv_pidfile); } torture_write_file(s->srv_config, sshd_config); } static int torture_wait_for_daemon(unsigned int seconds) { struct ssh_timestamp start; int rc; ssh_timestamp_init(&start); while (!ssh_timeout_elapsed(&start, seconds * 1000)) { rc = system(SSH_PING_EXECUTABLE " " TORTURE_SSH_SERVER); if (rc == 0) { return 0; } /* Wait 200 ms before retrying */ usleep(200 * 1000); } return 1; } /** * @brief Run a libssh based server under timeout. * * It is expected that the socket directory and libssh configuration file were * already created before by calling torture_setup_socket_dir() and * torture_setup_create_libssh_config() (or alternatively setup the state with * the correct values). * * @param[in] state The content of the address pointed by this variable must be * a pointer to an initialized instance of torture_state * structure; it can be obtained by calling * torture_setup_socket_dir() and * torture_setup_create_libssh_config(). * @param[in] server_path The path to the server executable. * * @note This function will use the state->srv_additional_config field as * additional command line option used when starting the server instead of extra * configuration file options. * */ void torture_setup_libssh_server(void **state, const char *server_path) { struct torture_state *s; char start_cmd[1024]; char timeout_cmd[512]; char env[1024]; char extra_options[1024]; int rc; char *ld_preload = NULL; const char *force_fips = NULL; struct ssh_tokens_st *env_tokens; struct ssh_tokens_st *arg_tokens; pid_t pid; ssize_t printed; s = *state; /* Get all the wrapper libraries to be pre-loaded */ ld_preload = getenv("LD_PRELOAD"); if (s->srv_additional_config != NULL) { printed = snprintf(extra_options, sizeof(extra_options), " %s ", s->srv_additional_config); if (printed < 0) { fail_msg("Failed to print additional config!"); /* Unreachable */ __builtin_unreachable(); } } else { printed = snprintf(extra_options, sizeof(extra_options), " "); if (printed < 0) { fail_msg("Failed to print empty additional config!"); /* Unreachable */ __builtin_unreachable(); } } if (ssh_fips_mode()) { force_fips = "OPENSSL_FORCE_FIPS_MODE=1 "; } else { force_fips = ""; } /* Write the environment setting */ printed = snprintf(env, sizeof(env), "SOCKET_WRAPPER_DIR=%s " "SOCKET_WRAPPER_DEFAULT_IFACE=10 " "LD_PRELOAD=%s " "%s", s->socket_dir, ld_preload, force_fips); if (printed < 0) { fail_msg("Failed to print env!"); /* Unreachable */ __builtin_unreachable(); } #ifdef WITH_TIMEOUT snprintf(timeout_cmd, sizeof(timeout_cmd), "%s %s ", TIMEOUT_EXECUTABLE, "5m"); #else timeout_cmd[0] = '\0'; #endif /* Write the start command */ printed = snprintf(start_cmd, sizeof(start_cmd), "%s" "%s -f%s -v4 -p22 -i%s -C%s%s%s", timeout_cmd, server_path, s->pcap_file, s->srv_pidfile, s->srv_config, extra_options, TORTURE_SSH_SERVER); if (printed < 0) { fail_msg("Failed to print start command!"); /* Unreachable */ __builtin_unreachable(); } pid = fork(); switch(pid) { case 0: env_tokens = ssh_tokenize(env, ' '); if (env_tokens == NULL || env_tokens->tokens == NULL) { fail_msg("Failed to tokenize env!"); /* Unreachable */ __builtin_unreachable(); } arg_tokens = ssh_tokenize(start_cmd, ' '); if (arg_tokens == NULL || arg_tokens->tokens == NULL) { ssh_tokens_free(env_tokens); fail_msg("Failed to tokenize args!"); /* Unreachable */ __builtin_unreachable(); } execve(arg_tokens->tokens[0], (char **)arg_tokens->tokens, (char **)env_tokens->tokens); /* execve returns only in case of error */ ssh_tokens_free(env_tokens); ssh_tokens_free(arg_tokens); fail_msg("Error in execve: %s", strerror(errno)); /* Unreachable */ __builtin_unreachable(); case -1: fail_msg("Failed to fork!"); /* Unreachable */ __builtin_unreachable(); default: /* The parent continues the execution of the tests */ setenv("SOCKET_WRAPPER_DEFAULT_IFACE", "21", 1); unsetenv("PAM_WRAPPER"); /* Wait until the server is ready to accept connections */ rc = torture_wait_for_daemon(15); assert_int_equal(rc, 0); break; } } static int torture_start_sshd_server(void **state) { struct torture_state *s = *state; char sshd_start_cmd[1024]; int rc; /* Set the default interface for the server */ setenv("SOCKET_WRAPPER_DEFAULT_IFACE", "10", 1); setenv("PAM_WRAPPER", "1", 1); snprintf(sshd_start_cmd, sizeof(sshd_start_cmd), SSHD_EXECUTABLE " -r -f %s -E %s/sshd/daemon.log 2> %s/sshd/cwrap.log", s->srv_config, s->socket_dir, s->socket_dir); rc = system(sshd_start_cmd); assert_return_code(rc, errno); setenv("SOCKET_WRAPPER_DEFAULT_IFACE", "21", 1); unsetenv("PAM_WRAPPER"); /* Wait until the sshd is ready to accept connections */ rc = torture_wait_for_daemon(15); assert_int_equal(rc, 0); return SSH_OK; } void torture_setup_sshd_server(void **state, bool pam) { int rc; torture_setup_socket_dir(state); torture_setup_create_sshd_config(state, pam); rc = torture_start_sshd_server(state); assert_int_equal(rc, 0); } void torture_setup_tokens(const char *temp_dir, const char *filename, const char object_name[], const char *load_public) { char token_setup_start_cmd[1024] = {0}; int rc; snprintf(token_setup_start_cmd, sizeof(token_setup_start_cmd), "%s/tests/pkcs11/setup-softhsm-tokens.sh %s %s %s %s", BINARYDIR, temp_dir, filename, object_name, load_public); rc = system(token_setup_start_cmd); assert_return_code(rc, errno); } void torture_teardown_socket_dir(void **state) { struct torture_state *s = *state; char *env = getenv("TORTURE_SKIP_CLEANUP"); int rc; if (env != NULL && env[0] == '1') { fprintf(stderr, "[ TORTURE ] >>> Skipping cleanup of %s\n", s->socket_dir); } else { rc = torture_rmdirs(s->socket_dir); if (rc < 0) { fprintf(stderr, "torture_rmdirs(%s) failed: %s", s->socket_dir, strerror(errno)); } } #ifdef WITH_PCAP if (s->plain_pcap != NULL) { ssh_pcap_file_free(s->plain_pcap); } s->plain_pcap = NULL; #endif /* WITH_PCAP */ free(s->srv_config); free(s->socket_dir); free(s->pcap_file); free(s->srv_pidfile); free(s->srv_additional_config); free(s); } static int torture_reload_sshd_server(void **state) { struct torture_state *s = *state; int rc; rc = torture_terminate_process(s->srv_pidfile); assert_return_code(rc, errno); return torture_start_sshd_server(state); } /* @brief: Updates SSHD server configuration with more options and * reloads the server to apply them. * Note, that this still uses the default configuration options specified * in this file and overwrites options previously specified by this function. */ int torture_update_sshd_config(void **state, const char *config) { struct torture_state *s = *state; int rc; /* Store the configuration in internal structure */ SAFE_FREE(s->srv_additional_config); s->srv_additional_config = strdup(config); assert_non_null(s->srv_additional_config); /* Rewrite the configuration file */ torture_setup_create_sshd_config(state, s->srv_pam); /* Reload the server */ rc = torture_reload_sshd_server(state); assert_int_equal(rc, SSH_OK); return SSH_OK; } void torture_teardown_sshd_server(void **state) { struct torture_state *s = *state; int rc; rc = torture_terminate_process(s->srv_pidfile); assert_return_code(rc, errno); torture_teardown_socket_dir(state); } char *torture_make_temp_dir(const char *template) { char *new_dir = NULL; char *template_copy = NULL; if (template == NULL) { goto end; } template_copy = strdup(template); if (template_copy == NULL) { goto end; } new_dir = mkdtemp(template_copy); if (new_dir == NULL) { SAFE_FREE(template_copy); } end: return template_copy; } char *torture_create_temp_file(const char *template) { char *new_file = NULL; FILE *fp = NULL; mode_t mask; int fd; new_file = strdup(template); if (new_file == NULL) { goto end; } mask = umask(S_IRWXO | S_IRWXG); fd = mkstemp(new_file); umask(mask); if (fd == -1) { goto end; } fp = fdopen(fd, "w"); if (fp == NULL) { SAFE_FREE(new_file); close(fd); goto end; } fclose(fp); end: return new_file; } char *torture_get_current_working_dir(void) { char *cwd = NULL; char *result = NULL; cwd = (char *)malloc(PATH_MAX + 1); if (cwd == NULL) { goto end; } result = getcwd(cwd, PATH_MAX); if (result == NULL) { SAFE_FREE(cwd); goto end; } end: return cwd; } #else /* _WIN32 */ char *torture_make_temp_dir(const char *template) { DWORD rc = 0; char tmp_dir_path[MAX_PATH]; char tmp_file_name[MAX_PATH]; char *prefix = NULL; char *path = NULL; char *prefix_end = NULL; char *slash = NULL; BOOL created; if (template == NULL) { goto end; } prefix = strdup(template); if (prefix == NULL) { goto end; } /* Replace slashes with backslashes */ slash = strchr(prefix, '/'); for (; slash != NULL; slash = strchr(prefix, '/')) { *slash = '\\'; } prefix_end = strstr(prefix, "XXXXXX"); if (prefix_end != NULL) { *prefix_end = '\0'; } rc = GetTempPathA(MAX_PATH, tmp_dir_path); if ((rc > MAX_PATH) || (rc == 0)) { goto free_prefix; } rc = GetTempFileNameA(tmp_dir_path, TEXT(prefix), 0, tmp_file_name); if (rc == 0) { goto free_prefix; } path = strdup(tmp_file_name); if (path == NULL) { goto free_prefix; } /* GetTempFileNameA() creates a temporary file; we need to remove it */ rc = DeleteFileA(path); if (rc == 0) { rc = -1; SAFE_FREE(path); goto free_prefix; } created = CreateDirectoryA(path, NULL); if (!created) { SAFE_FREE(path); } free_prefix: SAFE_FREE(prefix); end: return path; } static int recursive_rm_dir_content(const char *path) { WIN32_FIND_DATA file_data; HANDLE file_handle; DWORD attributes; DWORD last_error = 0; char file_path[MAX_PATH]; int rc = 0; BOOL removed; strcpy(file_path, path); strcat(file_path, "\\*"); file_handle = FindFirstFile(file_path, &file_data); if (file_handle == INVALID_HANDLE_VALUE) { last_error = GetLastError(); /* Empty directory */ if (last_error == ERROR_FILE_NOT_FOUND) { rc = 0; } else { /*TODO print error message?*/ rc = last_error; } goto end; } else { do { rc = strcmp(file_data.cFileName, "."); if (rc == 0) { continue; } rc = strcmp(file_data.cFileName, ".."); if (rc == 0) { continue; } /* Create full file path */ strcpy(file_path, path); strcat(file_path, "\\"); strcat(file_path, file_data.cFileName); attributes = GetFileAttributes(file_path); if (attributes & FILE_ATTRIBUTE_DIRECTORY) { rc = recursive_rm_dir_content((const char *)file_path); if (rc != 0) { goto end; } removed = RemoveDirectoryA(file_path); if (!removed) { last_error = GetLastError(); /*TODO print error message?*/ rc = last_error; goto end; } } else { rc = remove(file_path); if (rc) { goto end; } } } while(FindNextFile(file_handle, &file_data)); FindClose(file_handle); } end: return rc; } int torture_rmdirs(const char *path) { int rc = 0; BOOL removed; rc = recursive_rm_dir_content(path); if (rc) { return rc; } removed = RemoveDirectoryA(path); if (!removed) { rc = -1; } return rc; } int torture_isdir(const char *path) { DWORD attributes = 0; attributes = GetFileAttributes(path); if (attributes & FILE_ATTRIBUTE_DIRECTORY) { return 1; } return 0; } char *torture_create_temp_file(const char *template) { DWORD rc = 0; char tmp_dir_path[MAX_PATH]; char tmp_file_name[MAX_PATH]; char *prefix = NULL; char *path = NULL; char *prefix_end = NULL; char *slash = NULL; if (template == NULL) { goto end; } prefix = strdup(template); if (prefix == NULL) { goto end; } /* Replace slashes with backslashes */ slash = strchr(prefix, '/'); for (; slash != NULL; slash = strchr(prefix, '/')) { *slash = '\\'; } prefix_end = strstr(prefix, "XXXXXX"); if (prefix_end != NULL) { *prefix_end = '\0'; } rc = GetTempPathA(MAX_PATH, tmp_dir_path); if ((rc > MAX_PATH) || (rc == 0)) { goto free_prefix; } /* Remark: this function creates the file */ rc = GetTempFileNameA(tmp_dir_path, TEXT(prefix), 0, tmp_file_name); if (rc == 0) { goto free_prefix; } path = strdup(tmp_file_name); free_prefix: SAFE_FREE(prefix); end: return path; } char *torture_get_current_working_dir(void) { char *cwd = NULL; char *result = NULL; cwd = (char *)malloc(_MAX_PATH + 1); if (cwd == NULL) { goto end; } result = _getcwd(cwd, _MAX_PATH); if (result == NULL) { SAFE_FREE(cwd); goto end; } end: return cwd; } #endif /* _WIN32 */ int torture_change_dir(char *path) { int rc = 0; if (path == NULL) { rc = -1; goto end; } rc = chdir(path); end: return rc; } int torture_libssh_verbosity(void){ return verbosity; } void _torture_filter_tests(struct CMUnitTest *tests, size_t ntests) { (void) tests; (void) ntests; return; } void torture_write_file(const char *filename, const char *data){ int fd; int rc; assert_non_null(filename); assert_true(filename[0] != '\0'); assert_non_null(data); fd = open(filename, O_WRONLY | O_TRUNC | O_CREAT, 0600); assert_true(fd >= 0); rc = write(fd, data, strlen(data)); assert_int_equal(rc, strlen(data)); close(fd); } void torture_reset_config(ssh_session session) { memset(session->opts.options_seen, 0, sizeof(session->opts.options_seen)); } int main(int argc, char **argv) { struct argument_s arguments; char *env = getenv("LIBSSH_VERBOSITY"); arguments.verbose=0; arguments.pattern=NULL; torture_cmdline_parse(argc, argv, &arguments); verbosity=arguments.verbose; pattern=arguments.pattern; if (verbosity == 0 && env != NULL && env[0] != '\0') { if (env[0] > '0' && env[0] < '9') { verbosity = atoi(env); } } #if defined HAVE_CMOCKA_SET_TEST_FILTER cmocka_set_test_filter(pattern); #endif return torture_run_tests(); }