diff --git a/tests/port-forwarding/Makefile b/tests/port-forwarding/Makefile new file mode 100644 index 0000000..7ca5e33 --- /dev/null +++ b/tests/port-forwarding/Makefile @@ -0,0 +1,63 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/openssh/Sanity/port-forwarding +# Description: Testing port forwarding (ideally all possibilities: -L, -R, -D) +# Author: Stanislav Zidek +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2015 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/openssh/Sanity/port-forwarding +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Stanislav Zidek " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Testing port forwarding (ideally all possibilities: -L, -R, -D)" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 5m" >> $(METADATA) + @echo "RunFor: openssh" >> $(METADATA) + @echo "Requires: openssh net-tools nc" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2+" >> $(METADATA) + @echo "Confidential: yes" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA) + + rhts-lint $(METADATA) diff --git a/tests/port-forwarding/PURPOSE b/tests/port-forwarding/PURPOSE new file mode 100644 index 0000000..5a8bc87 --- /dev/null +++ b/tests/port-forwarding/PURPOSE @@ -0,0 +1,3 @@ +PURPOSE of /CoreOS/openssh/Sanity/port-forwarding +Description: Testing port forwarding (ideally all possibilities: -L, -R, -D) +Author: Stanislav Zidek diff --git a/tests/port-forwarding/runtest.sh b/tests/port-forwarding/runtest.sh new file mode 100755 index 0000000..b9e125a --- /dev/null +++ b/tests/port-forwarding/runtest.sh @@ -0,0 +1,154 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/openssh/Sanity/port-forwarding +# Description: Testing port forwarding (ideally all possibilities: -L, -R, -D) +# Author: Stanislav Zidek +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2015 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="openssh" +USER="user$RANDOM" +FORWARDED=$((RANDOM % 100 + 6800)) +LISTEN=$((RANDOM % 100 + 6900)) +TIMEOUT=5 +MESSAGE="HUGE_SUCCESS" +SSH_OPTIONS="-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + rlFileBackup /etc/ssh/sshd_config /var/log/secure + rlRun "useradd -m $USER" + rlRun "su - $USER -c \"mkdir .ssh; chmod 700 .ssh; cd .ssh; ssh-keygen -N '' -f id_rsa; cat id_rsa.pub >authorized_keys; chmod 600 authorized_keys\"" + rlRun "echo 'LogLevel DEBUG' >>/etc/ssh/sshd_config" + rlRun "echo '' >/var/log/secure" + rlServiceStart sshd + rlRun "IP=\$( ip a |grep 'scope global' |grep -w inet |cut -d'/' -f1 |awk '{ print \$2 }' |tail -1 )" + rlRun "echo 'IP=$IP'" + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlPhaseEnd + +forwarding_test() { + EXP_RESULT=$1 + FORWARDED=$2 + HOST=$3 + LISTEN=$4 + + rlRun "nc -l $LISTEN &>listen.log &" + LISTEN_PID=$! + rlWaitForSocket $LISTEN -t $TIMEOUT + rlRun "ps -fp $LISTEN_PID" + rlRun "su - $USER -c \"ssh $SSH_OPTIONS -N -L $FORWARDED:$HOST:$LISTEN $USER@localhost &\" &>tunnel.log" + rlRun "ps -fC ssh" + rlRun "SSH_PID=\$( pgrep -n -u $USER ssh )" + rlRun "echo SSH_PID is '$SSH_PID'" + rlWaitForSocket $FORWARDED -t $TIMEOUT + rlRun "[[ -n '$SSH_PID' ]] && ps -fp $SSH_PID" + rlRun "echo '$MESSAGE'|nc localhost $FORWARDED" + + if [[ $EXP_RESULT == "success" ]]; then + rlAssertGrep "$MESSAGE" listen.log + else # failure expected + rlAssertGrep "open failed" tunnel.log -i + rlAssertGrep "administratively prohibited" tunnel.log -i + rlAssertNotGrep "$MESSAGE" listen.log + fi + + rlRun "kill -9 $LISTEN_PID $SSH_PID" 0,1 "Killing cleanup" + rlWaitForSocket $LISTEN -t $TIMEOUT --close + rlWaitForSocket $FORWARDED -t $TIMEOUT --close + if ! rlGetPhaseState; then + rlRun "cat listen.log" + rlRun "cat tunnel.log" + rlRun "cat /var/log/secure" + fi + rlFileSubmit listen.log tunnel.log /var/log/secure + rlRun "rm -f *.log; echo '' >/var/log/secure" +} + + rlPhaseStartTest "Local forwarding" + forwarding_test "success" $FORWARDED localhost $LISTEN + ((FORWARDED+=1)) + ((LISTEN+=1)) + rlPhaseEnd + + rlPhaseStartTest "PermitOpen with 'any'" + rlFileBackup --namespace permitopen_any /etc/ssh/sshd_config /etc/hosts + rlRun "echo 'PermitOpen any' >>/etc/ssh/sshd_config" + rlRun "echo '$IP anyhost1 anyhost2' >>/etc/hosts" + rlRun "service sshd restart" + for i in `seq 3`; do + forwarding_test "success" $FORWARDED anyhost1 $LISTEN + forwarding_test "success" $FORWARDED anyhost2 $LISTEN + ((FORWARDED+=1)) + ((LISTEN+=1)) + done + rlFileRestore --namespace permitopen_any + rlPhaseEnd + + if ! rlIsRHEL '<6.7'; then + # PermitOpen with wildcards is new feature in RHEL-6.7 + rlPhaseStartTest "PermitOpen with port wildcard" + rlFileBackup --namespace port_wildcard /etc/ssh/sshd_config /etc/hosts + rlRun "echo 'PermitOpen wildportallow:*' >>/etc/ssh/sshd_config" + rlRun "echo '$IP wildportallow wildportdeny' >>/etc/hosts" + rlRun "service sshd restart" + forwarding_test "success" $FORWARDED wildportallow $LISTEN + ((FORWARDED+=1)) + ((LISTEN+=1)) + forwarding_test "failure" $FORWARDED wildportdeny $LISTEN + ((FORWARDED+=1)) + ((LISTEN+=1)) + rlFileRestore --namespace port_wildcard + rlRun "service sshd restart" + rlPhaseEnd + fi + + if ! rlIsRHEL '<7.3'; then + rlPhaseStartTest "PermitOpen with host wildcard and specific port" + rlFileBackup --namespace host_wildcard /etc/ssh/sshd_config /etc/hosts + rlRun "echo 'PermitOpen *:$LISTEN' >>/etc/ssh/sshd_config" + rlRun "echo '$IP wildhost1 wildhost2' >>/etc/hosts" + rlRun "service sshd restart" + forwarding_test "success" $FORWARDED wildhost1 $LISTEN + ((FORWARDED+=1)) + forwarding_test "success" $FORWARDED wildhost2 $LISTEN + ((FORWARDED+=1)) + ((LISTEN+=1)) # different listen port, should fail + forwarding_test "failure" $FORWARDED wildhost2 $LISTEN + rlFileRestore --namespace host_wildcard + rlPhaseEnd + fi + + rlPhaseStartCleanup + rlRun "userdel -r $USER" + rlRun "popd" + rlFileRestore + rlServiceRestore sshd + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/tests/tests.yml b/tests/tests.yml new file mode 100644 index 0000000..1950859 --- /dev/null +++ b/tests/tests.yml @@ -0,0 +1,26 @@ +--- +# Tests for docker container +- hosts: localhost + tags: + - container + # no compatible tests + +# Tests for classic environment and Atomic Host +- hosts: localhost + tags: + - all + - classic + - atomic + roles: + - role: standard-test-beakerlib + tests: + - port-forwarding + required_packages: + - iproute # needs ip command + - procps-ng # needs ps and pgrep commands + - initscripts # needs service command + - openssh-clients # needs ssh command + - findutils # needs find command + - net-tools # needs netstat command + - libselinux-utils # needs selinuxenabled command + - nmap-ncat # needs nc command