diff options
Diffstat (limited to 'tests/basic')
| -rwxr-xr-x | tests/basic | 63 |
1 files changed, 54 insertions, 9 deletions
diff --git a/tests/basic b/tests/basic index 3d50977..9c5b280 100755 --- a/tests/basic +++ b/tests/basic @@ -12,6 +12,8 @@ # these tests should all be able to run as a non-privileged user. +# put all the test output to stdout +exec 2>&1 # all subcommands in this script should complete without failure: set -e # piped commands should return the code of the first non-zero return @@ -26,6 +28,14 @@ source "$TESTDIR"/common ## test has *more* requirements than plain ol' monkeysphere: which socat >/dev/null || { echo "You must have socat installed to run this test." ; exit 1; } +perl -MCrypt::OpenSSL::RSA -e 1 2>/dev/null || { echo "You must have the perl module Crypt::OpenSSL::RSA installed to run this test. +On debian-derived systems, you can set this up with: + apt-get install libcrypt-openssl-rsa-perl" ; exit 1; } + + +perl -MDigest::SHA1 -e 1 2>/dev/null || { echo "You must have the perl module Digest::SHA1 installed to run this test. +On debian-derived systems, you can set this up with: + apt-get install libdigest-sha1-perl" ; exit 1; } ## FIXME: other checks? @@ -35,7 +45,7 @@ which socat >/dev/null || { echo "You must have socat installed to run this test # gpg command for test admin user gpgadmin() { chmod 0700 "$TEMPDIR"/admin - GNUPGHOME="$TEMPDIR"/admin/.gnupg gpg "$@" + GNUPGHOME="$TEMPDIR"/admin/.gnupg gpg --no-tty "$@" } # test ssh connection @@ -55,20 +65,16 @@ ssh_test() { sleep 1 done - set +e - # make a client connection to the socket echo "##### starting ssh client..." ssh-agent bash -c \ - "monkeysphere subkey-to-ssh-agent && ssh -F $TEMPDIR/testuser/.ssh/config testhost true" - RETURN="$?" + "monkeysphere subkey-to-ssh-agent && ssh -F $TEMPDIR/testuser/.ssh/config testhost true" \ + || RETURN="$?" # kill the sshd process if it's still running kill "$SSHD_PID" SSHD_PID= - set -e - echo "##### return $RETURN" if [ "$RETURN" = "$CODE" ] ; then echo "##### ssh connection test returned as desired" @@ -110,7 +116,13 @@ export MONKEYSPHERE_SYSDATADIR="$TEMPDIR" export MONKEYSPHERE_SYSCONFIGDIR="$TEMPDIR" export MONKEYSPHERE_SYSSHAREDIR="$TESTDIR"/../src/share export MONKEYSPHERE_MONKEYSPHERE_USER=$(whoami) + export MONKEYSPHERE_CHECK_KEYSERVER=false +# example.org does not respond to the HKP port, so this should cause +# any keyserver connection attempts that do happen (they shouldn't!) +# to hang, so we'll notice them: +export MONKEYSPHERE_KEYSERVER=example.org + export MONKEYSPHERE_LOG_LEVEL=DEBUG export MONKEYSPHERE_CORE_KEYLENGTH=1024 export MONKEYSPHERE_PROMPT=false @@ -128,6 +140,7 @@ export DISPLAY=monkeys ## (don't bother if this is being run from the tests). if [ -f "$TESTDIR"/../packaging/debian/changelog ]; then + echo echo "##################################################" echo "### checking version string match..." repver=$(monkeysphere version) @@ -144,6 +157,7 @@ fi ### CONFIGURE ENVIRONMENTS # copy in admin and testuser home to tmp +echo echo "##################################################" echo "### configuring testuser home..." cp -a "$TESTDIR"/home/testuser "$TEMPDIR"/ @@ -163,11 +177,13 @@ KNOWN_HOSTS=$TESTHOME/.ssh/known_hosts EOF get_gpg_prng_arg >> "$GNUPGHOME"/gpg.conf +echo echo "##################################################" echo "### configuring admin home..." cp -a "$TESTDIR"/home/admin "$TEMPDIR"/ # set up sshd +echo echo "##################################################" echo "### configuring sshd..." cp "$TESTDIR"/etc/ssh/sshd_config "$SSHD_CONFIG" @@ -182,17 +198,20 @@ EOF ### SERVER HOST SETUP # import host key +echo echo "##################################################" echo "### import host key..." ssh-keygen -b 1024 -t rsa -N '' -f "$TEMPDIR"/ssh_host_rsa_key monkeysphere-host import-key "$TEMPDIR"/ssh_host_rsa_key testhost +echo echo "##################################################" echo "### getting host key fingerprint..." HOSTKEYID=$( monkeysphere-host show-key | grep '^OpenPGP fingerprint: ' | cut -f3 -d\ ) echo "$HOSTKEYID" # change host key expiration +echo echo "##################################################" echo "### setting host key expiration..." monkeysphere-host set-expire 1 @@ -200,9 +219,10 @@ monkeysphere-host set-expire 1 # certify host key with the "Admin's Key". # (this would normally be done via keyservers) +echo echo "##################################################" echo "### certifying server host key..." -GNUPGHOME="$MONKEYSPHERE_SYSCONFIGDIR"/host gpg --armor --export "$HOSTKEYID" | gpgadmin --import +< "$MONKEYSPHERE_SYSCONFIGDIR"/ssh_host_rsa_key.pub.gpg gpgadmin --import echo y | gpgadmin --command-fd 0 --sign-key "$HOSTKEYID" # FIXME: add revoker? @@ -217,6 +237,7 @@ echo y | gpgadmin --command-fd 0 --sign-key "$HOSTKEYID" ### SERVER AUTHENTICATION SETUP # set up monkeysphere authentication +echo echo "##################################################" echo "### setup monkeysphere authentication..." cp "$TESTDIR"/etc/monkeysphere/monkeysphere-authentication.conf "$TEMPDIR"/ @@ -227,10 +248,12 @@ monkeysphere-authentication setup get_gpg_prng_arg >> "$MONKEYSPHERE_SYSDATADIR"/authentication/sphere/gpg.conf # add admin as identity certifier for testhost +echo echo "##################################################" echo "### adding admin as certifier..." monkeysphere-authentication add-id-certifier "$TEMPDIR"/admin/.gnupg/pubkey.gpg +echo echo "##################################################" echo "### list certifiers..." monkeysphere-authentication list-certifiers @@ -241,21 +264,25 @@ monkeysphere-authentication list-certifiers ### TESTUSER SETUP # generate an auth subkey for the test user that expires in 2 days +echo echo "##################################################" echo "### generating key for testuser..." monkeysphere gen-subkey # add server key to testuser keychain +echo echo "##################################################" echo "### export server key to testuser..." gpgadmin --armor --export "$HOSTKEYID" | gpg --import # teach the "server" about the testuser's key +echo echo "##################################################" echo "### export testuser key to server..." gpg --export testuser | monkeysphere-authentication gpg-cmd --import # update authorized_keys for user +echo echo "##################################################" echo "### update server authorized_keys file for this testuser..." monkeysphere-authentication update-users $(whoami) @@ -268,16 +295,19 @@ monkeysphere-authentication update-users $(whoami) # connect to test sshd, using monkeysphere ssh-proxycommand to verify # the identity before connection. This should work in both directions! +echo echo "##################################################" echo "### ssh connection test for success..." ssh_test # remove the testuser's authorized_user_ids file, update, and make # sure that the ssh authentication FAILS +echo echo "##################################################" echo "### removing testuser authorized_user_ids and updating..." mv "$TESTHOME"/.monkeysphere/authorized_user_ids{,.bak} monkeysphere-authentication update-users $(whoami) +echo echo "##################################################" echo "### ssh connection test for server authentication denial..." ssh_test 255 @@ -285,35 +315,50 @@ mv "$TESTHOME"/.monkeysphere/authorized_user_ids{.bak,} # put improper permissions on authorized_user_ids file, update, and # make sure ssh authentication FAILS +echo echo "##################################################" echo "### setting group writability on authorized_user_ids and updating..." chmod g+w "$TESTHOME"/.monkeysphere/authorized_user_ids monkeysphere-authentication update-users $(whoami) +echo echo "##################################################" echo "### ssh connection test for server authentication denial..." ssh_test 255 chmod g-w "$TESTHOME"/.monkeysphere/authorized_user_ids +echo echo "##################################################" echo "### setting other writability on authorized_user_ids and updating..." chmod o+w "$TESTHOME"/.monkeysphere/authorized_user_ids monkeysphere-authentication update-users $(whoami) +echo echo "##################################################" echo "### ssh connection test for server authentication denial..." ssh_test 255 chmod o-w "$TESTHOME"/.monkeysphere/authorized_user_ids +monkeysphere-authentication update-users $(whoami) # FIXME: addtest: remove admin as id-certifier and check ssh failure # FIXME: addtest: add hostname on host key # FIXME: addtest: revoke hostname on host key and check ssh failure -# FIXME: addtest: revoke the host key and check ssh failure +# addtest: revoke the host key and check ssh failure +# test to make sure things are OK after the previous tests: +ssh_test +echo +echo "##################################################" +echo "### ssh connection test for server with revoked key..." +# generate the revocation certificate and feed it directly to the test +# user's keyring (we're not publishing to the keyservers) +monkeysphere-host revoke-key | gpg --import +ssh_test 255 ###################################################################### trap - EXIT +echo echo "##################################################" echo " Monkeysphere basic tests completed successfully!" echo "##################################################" |