summaryrefslogtreecommitdiff
path: root/tests/basic
blob: 6fe323798052523612d3db2964933fabf0847d32 (plain)
  1. #!/usr/bin/env bash
  2. # Tests to ensure that the monkeysphere is working
  3. #
  4. # unset MONKEYSPHERE_TEST_NO_EXAMINE to get a prompt to examine the
  5. # test state after failure.
  6. # Authors:
  7. # Daniel Kahn Gillmor <dkg@fifthhorseman.net>
  8. # Jameson Rollins <jrollins@fifthhorseman.net>
  9. # Micah Anderson <micah@riseup.net>
  10. #
  11. # Copyright: 2008-2009
  12. # License: GPL v3 or later
  13. # these tests should all be able to run as a non-privileged user.
  14. # put all the test output to stdout
  15. exec 2>&1
  16. # all subcommands in this script should complete without failure:
  17. set -e
  18. # piped commands should return the code of the first non-zero return
  19. set -o pipefail
  20. # make sure the TESTDIR is an absolute path, not a relative one.
  21. export TESTDIR=$(cd $(dirname "$0") && pwd)
  22. source "$TESTDIR"/common
  23. ## make sure that the right tools are installed to run the test. the
  24. ## test has *more* requirements than plain ol' monkeysphere:
  25. [ -f /usr/sbin/sshd ] || { echo "You must have sshd installed to run this test." ; exit 1; }
  26. which socat >/dev/null || { echo "You must have socat installed to run this test." ; exit 1; }
  27. perl -MCrypt::OpenSSL::RSA -e 1 2>/dev/null || { echo "You must have the perl module Crypt::OpenSSL::RSA installed to run this test.
  28. On debian-derived systems, you can set this up with:
  29. apt-get install libcrypt-openssl-rsa-perl" ; exit 1; }
  30. perl -MDigest::SHA -e 1 2>/dev/null || { echo "You must have the perl module Digest::SHA installed to run this test.
  31. On debian-derived systems, you can set this up with:
  32. apt-get install libdigest-sha-perl" ; exit 1; }
  33. ## FIXME: other checks?
  34. ######################################################################
  35. ### FUNCTIONS
  36. # gpg command for test admin user
  37. gpgadmin() {
  38. chmod 0700 "$TEMPDIR"/admin "$TEMPDIR"/admin/.gnupg
  39. GNUPGHOME="$TEMPDIR"/admin/.gnupg gpg --no-tty "$@"
  40. }
  41. # test ssh connection
  42. # first argument is expected return code from ssh connection
  43. ssh_test() {
  44. local RETURN=0
  45. umask 0077
  46. CODE=${1:-0}
  47. # start the ssh daemon on the socket
  48. echo "##### starting ssh server..."
  49. socat EXEC:"/usr/sbin/sshd -f ${SSHD_CONFIG} -i -D -e" "UNIX-LISTEN:${SOCKET}" 2> "$TEMPDIR"/sshd.log &
  50. SSHD_PID="$!"
  51. # wait until the socket is created before continuing
  52. while [ ! -S "$SOCKET" ] ; do
  53. sleep 1
  54. done
  55. # make a client connection to the socket
  56. echo "##### starting ssh client..."
  57. ssh-agent bash -c \
  58. "monkeysphere subkey-to-ssh-agent && ssh -F $TEMPDIR/testuser/.ssh/config ${target_hostname:-testhost} true" \
  59. || RETURN="$?"
  60. # kill the sshd process if it's still running
  61. kill "$SSHD_PID" || true
  62. wait
  63. SSHD_PID=
  64. if [ "$RETURN" = "$CODE" ] ; then
  65. echo "##### ssh connection test PASSED. returned: $RETURN"
  66. return 0
  67. else
  68. echo "##### ssh connection test FAILED. returned: $RETURN, expected: $CODE"
  69. return 1
  70. fi
  71. }
  72. # invoke this instead of ssh_test() if you want this test to be
  73. # skipped when the working directory has bad permissions.
  74. ssh_good_perm_test() {
  75. if [ "$TEMPDIR_PERMISSIONS_SAFE" = no ] ; then
  76. echo "WARNING!!! Test SKIPPED because we are running in an unsafe working directory."
  77. else
  78. ssh_test "$@"
  79. fi
  80. }
  81. SSHD_PID=
  82. ## setup trap
  83. trap failed_cleanup EXIT
  84. ######################################################################
  85. ### SETUP VARIABLES
  86. ## set up some variables to ensure that we're operating strictly in
  87. ## the tests, not system-wide:
  88. # set up temp dir
  89. # NOTE: /tmp can not be used as the temp dir here, since the
  90. # permissions on /tmp are usually such that they will not pass the
  91. # monkeysphere/ssh path permission checking. If you need to use a
  92. # different location than the current source, please set $TMPDIR
  93. # somewhere with tighter permissions.
  94. mkdir -p "$TESTDIR"/tmp
  95. TEMPDIR=$(mktemp -d "${TMPDIR:-$TESTDIR/tmp}/monkeyspheretest.XXXXXXX")
  96. # Use the local copy of executables first, instead of system ones.
  97. # This should help us test without installing.
  98. export PATH="$TESTDIR"/../src:"$PATH"
  99. export MONKEYSPHERE_SYSDATADIR="$TEMPDIR"
  100. export MONKEYSPHERE_SYSCONFIGDIR="$TEMPDIR"
  101. export MONKEYSPHERE_SYSSHAREDIR="$TESTDIR"/../src/share
  102. export MONKEYSPHERE_MONKEYSPHERE_USER=$(whoami)
  103. export MONKEYSPHERE_CHECK_KEYSERVER=false
  104. # example.org does not respond to the HKP port, so this should cause
  105. # any keyserver connection attempts that do happen (they shouldn't!)
  106. # to hang, so we'll notice them:
  107. export MONKEYSPHERE_KEYSERVER=example.org
  108. export MONKEYSPHERE_LOG_LEVEL=DEBUG
  109. export MONKEYSPHERE_CORE_KEYLENGTH=1024
  110. export MONKEYSPHERE_PROMPT=false
  111. # unset SUBKEYS_FOR_AGENT variable which, if set, would confuse the
  112. # into trying to use the user's key, instead of the testuser's key
  113. unset MONKEYSPHERE_SUBKEYS_FOR_AGENT
  114. export SSHD_CONFIG="$TEMPDIR"/sshd_config
  115. export SOCKET="$TEMPDIR"/ssh-socket
  116. # Make sure $DISPLAY is set to convince ssh and monkeysphere to fall
  117. # back on $SSH_ASKPASS. Make sure it's not set to the current actual
  118. # $DISPLAY (if one exists) because this test suite should not be doing
  119. # *anything* with any running X11 session.
  120. export DISPLAY=monkeys
  121. ## we cannot do proper directory permissions checking if the current
  122. ## working directory has unsatisfactory permissions:
  123. if "$MONKEYSPHERE_SYSSHAREDIR"/checkperms $(whoami) "$TEMPDIR"; then
  124. echo "Permissions on temporary directory '$TEMPDIR' are OK for permissions checks."
  125. TEMPDIR_PERMISSIONS_SAFE=yes
  126. else
  127. cat <<EOF
  128. !!!WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING!!!
  129. Permissions on testing directory '$TEMPDIR' are
  130. too loose to do proper strict permissions checking. Some tests
  131. will be disabled or ignored.
  132. To avoid this warning (and to make sure that all tests are run
  133. properly), please run these tests within a directory that meets
  134. sshd's standards for "StrictModes yes" -- the directory (and every
  135. one of its parents) should be owned only be the user running this
  136. test or root, and should not be writable by group or other.
  137. !!!WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING!!!
  138. EOF
  139. # FIXME: what else should we do with this knowledge to make sure
  140. # that the appropriate tests are handled properly?
  141. TEMPDIR_PERMISSIONS_SAFE=no
  142. # this is a new option (as of 0.26) to disable filesystem
  143. # permission checks.
  144. # it should operate by analogy with StrictModes from sshd_config(5)
  145. export MONKEYSPHERE_STRICT_MODES=false
  146. fi
  147. ######################################################################
  148. ### CONFIGURE ENVIRONMENTS
  149. # copy in admin and testuser home to tmp
  150. echo
  151. echo "##################################################"
  152. echo "### configuring testuser home..."
  153. (cd "$TESTDIR"/home && find testuser | cpio -pdu "$TEMPDIR")
  154. # set up environment for testuser
  155. export TESTHOME="$TEMPDIR"/testuser
  156. export GNUPGHOME="$TESTHOME"/.gnupg
  157. chmod 0700 "$GNUPGHOME"
  158. export SSH_ASKPASS="$TESTHOME"/.ssh/askpass
  159. export MONKEYSPHERE_HOME="$TESTHOME"/.monkeysphere
  160. cat <<EOF >> "$TESTHOME"/.ssh/config
  161. UserKnownHostsFile $TESTHOME/.ssh/known_hosts
  162. IdentityFile $TESTHOME/.ssh/no-such-identity
  163. ProxyCommand $TESTHOME/.ssh/proxy-command %h %p $SOCKET
  164. EOF
  165. cat <<EOF >> "$MONKEYSPHERE_HOME"/monkeysphere.conf
  166. KNOWN_HOSTS=$TESTHOME/.ssh/known_hosts
  167. EOF
  168. get_gpg_prng_arg >> "$GNUPGHOME"/gpg.conf
  169. echo
  170. echo "##################################################"
  171. echo "### configuring admin home..."
  172. (cd "$TESTDIR"/home && find admin | cpio -pdu "$TEMPDIR")
  173. # set up sshd
  174. echo
  175. echo "##################################################"
  176. echo "### configuring sshd..."
  177. cp "$TESTDIR"/etc/ssh/sshd_config "$SSHD_CONFIG"
  178. # write the sshd_config
  179. cat <<EOF >> "$SSHD_CONFIG"
  180. HostKey ${MONKEYSPHERE_SYSDATADIR}/ssh_host_rsa_key
  181. AuthorizedKeysFile ${MONKEYSPHERE_SYSDATADIR}/authorized_keys/%u
  182. EOF
  183. # disable sshd's strict permissions settings so that some tests can
  184. # complete when running under a dubious path:
  185. if [ "$TEMPDIR_PERMISSIONS_SAFE" != yes ] ; then
  186. cat <<EOF >> "$SSHD_CONFIG"
  187. StrictModes no
  188. EOF
  189. fi
  190. ######################################################################
  191. ### SERVER HOST SETUP
  192. # import host key
  193. echo
  194. echo "##################################################"
  195. echo "### import host key..."
  196. ssh-keygen -b 1024 -t rsa -N '' -f "$TEMPDIR"/ssh_host_rsa_key
  197. monkeysphere-host import-key "$TEMPDIR"/ssh_host_rsa_key testhost
  198. echo
  199. echo "##################################################"
  200. echo "### getting host key fingerprint..."
  201. HOSTKEYID=$( monkeysphere-host show-key | grep '^OpenPGP fingerprint: ' | cut -f3 -d\ )
  202. echo "$HOSTKEYID"
  203. # change host key expiration
  204. echo
  205. echo "##################################################"
  206. echo "### setting host key expiration..."
  207. monkeysphere-host set-expire 1
  208. # FIXME: how do we check that the expiration has really been set?
  209. # certify host key with the "Admin's Key".
  210. # (this would normally be done via keyservers)
  211. echo
  212. echo "##################################################"
  213. echo "### certifying server host key..."
  214. < "$MONKEYSPHERE_SYSCONFIGDIR"/ssh_host_rsa_key.pub.gpg gpgadmin --import
  215. echo y | gpgadmin --command-fd 0 --sign-key "$HOSTKEYID"
  216. # FIXME: add revoker?
  217. # FIXME: how can we test publish-key without flooding junk into the
  218. # keyservers?
  219. # FIXME: should we run "diagnostics" here to test setup?
  220. ######################################################################
  221. ### SERVER AUTHENTICATION SETUP
  222. # set up monkeysphere authentication
  223. echo
  224. echo "##################################################"
  225. echo "### setup monkeysphere authentication..."
  226. cp "$TESTDIR"/etc/monkeysphere/monkeysphere-authentication.conf "$TEMPDIR"/
  227. cat <<EOF >> "$TEMPDIR"/monkeysphere-authentication.conf
  228. AUTHORIZED_USER_IDS="$MONKEYSPHERE_HOME/authorized_user_ids"
  229. EOF
  230. monkeysphere-authentication setup
  231. get_gpg_prng_arg >> "$MONKEYSPHERE_SYSDATADIR"/authentication/sphere/gpg.conf
  232. # add admin as identity certifier for testhost
  233. echo
  234. echo "##################################################"
  235. echo "### adding admin as certifier..."
  236. monkeysphere-authentication add-id-certifier "$TEMPDIR"/admin/.gnupg/pubkey.gpg
  237. echo
  238. echo "##################################################"
  239. echo "### list certifiers..."
  240. monkeysphere-authentication list-certifiers
  241. # FIXME: should we run "diagnostics" here to test setup?
  242. ######################################################################
  243. ### TESTUSER SETUP
  244. # generate an auth subkey for the test user that expires in 2 days
  245. echo
  246. echo "##################################################"
  247. echo "### generating key for testuser..."
  248. monkeysphere gen-subkey
  249. # add server key to testuser keychain
  250. echo
  251. echo "##################################################"
  252. echo "### export server key to testuser..."
  253. gpgadmin --armor --export "$HOSTKEYID" | gpg --import
  254. # teach the "server" about the testuser's key
  255. echo
  256. echo "##################################################"
  257. echo "### export testuser key to server..."
  258. gpg --export testuser | monkeysphere-authentication gpg-cmd --import
  259. # update authorized_keys for user
  260. echo
  261. echo "##################################################"
  262. echo "### update server authorized_keys file for this testuser..."
  263. monkeysphere-authentication update-users $(whoami)
  264. # FIXME: this is maybe not failing properly for:
  265. # ms: improper group or other writability on path '/tmp'.
  266. ######################################################################
  267. ### TESTS
  268. # connect to test sshd, using monkeysphere ssh-proxycommand to verify
  269. # the identity before connection. This should work in both directions!
  270. echo
  271. echo "##################################################"
  272. echo "### ssh connection test for success..."
  273. ssh_test
  274. # remove the testuser's authorized_user_ids file, update, and make
  275. # sure that the ssh authentication FAILS
  276. echo
  277. echo "##################################################"
  278. echo "### removing testuser authorized_user_ids and updating..."
  279. mv "$TESTHOME"/.monkeysphere/authorized_user_ids{,.bak}
  280. monkeysphere-authentication update-users $(whoami)
  281. echo
  282. echo "##################################################"
  283. echo "### ssh connection test for failure..."
  284. ssh_test 255
  285. mv "$TESTHOME"/.monkeysphere/authorized_user_ids{.bak,}
  286. # put improper permissions on authorized_user_ids file, update, and
  287. # make sure ssh authentication FAILS
  288. echo
  289. echo "##################################################"
  290. echo "### setting group writability on authorized_user_ids and updating..."
  291. chmod g+w "$TESTHOME"/.monkeysphere/authorized_user_ids
  292. monkeysphere-authentication update-users $(whoami)
  293. echo
  294. echo "##################################################"
  295. echo "### ssh connection test for failure..."
  296. ssh_good_perm_test 255
  297. chmod g-w "$TESTHOME"/.monkeysphere/authorized_user_ids
  298. echo
  299. echo "##################################################"
  300. echo "### setting other writability on authorized_user_ids and updating..."
  301. chmod o+w "$TESTHOME"/.monkeysphere/authorized_user_ids
  302. monkeysphere-authentication update-users $(whoami)
  303. echo
  304. echo "##################################################"
  305. echo "### ssh connection test for failure..."
  306. ssh_good_perm_test 255
  307. chmod o-w "$TESTHOME"/.monkeysphere/authorized_user_ids
  308. monkeysphere-authentication update-users $(whoami)
  309. # test symlinks
  310. echo
  311. echo "##################################################"
  312. echo "### setup for symlink tests..."
  313. cp -a "$TESTHOME"/.monkeysphere{,.linktest}
  314. echo
  315. echo "##################################################"
  316. echo "### make authorized_user_ids an absolute symlink and updating..."
  317. mv "$TESTHOME"/.monkeysphere/authorized_user_ids{,.bak}
  318. ln -s "$TESTHOME"/.monkeysphere{.linktest,}/authorized_user_ids
  319. monkeysphere-authentication update-users $(whoami)
  320. echo
  321. echo "##################################################"
  322. echo "### ssh connection test for success..."
  323. ssh_test
  324. echo
  325. echo "##################################################"
  326. echo "### create bad permissions on link dir and updating..."
  327. chmod o+w "$TESTHOME"/.monkeysphere.linktest
  328. monkeysphere-authentication update-users $(whoami)
  329. echo
  330. echo "##################################################"
  331. echo "### ssh connection test for failure..."
  332. ssh_good_perm_test 255
  333. chmod o-w "$TESTHOME"/.monkeysphere.linktest
  334. echo
  335. echo "##################################################"
  336. echo "### make authorized_user_ids a relative symlink and updating..."
  337. ln -sf ../.monkeysphere.linktest/authorized_user_ids "$TESTHOME"/.monkeysphere/authorized_user_ids
  338. monkeysphere-authentication update-users $(whoami)
  339. echo
  340. echo "##################################################"
  341. echo "### ssh connection test for success..."
  342. ssh_test
  343. echo
  344. echo "##################################################"
  345. echo "### create bad permissions on link dir updating..."
  346. chmod o+w "$TESTHOME"/.monkeysphere.linktest
  347. monkeysphere-authentication update-users $(whoami)
  348. echo
  349. echo "##################################################"
  350. echo "### ssh connection test for failure..."
  351. ssh_good_perm_test 255
  352. chmod o-w "$TESTHOME"/.monkeysphere.linktest
  353. # FIXME: implement check of link path, and uncomment this test
  354. # echo
  355. # echo "##################################################"
  356. # echo "### create bad permissions on link dir and updating..."
  357. # chmod o+w "$TESTHOME"/.monkeysphere
  358. # monkeysphere-authentication update-users $(whoami)
  359. # echo
  360. # echo "##################################################"
  361. # echo "### ssh connection test for failure..."
  362. # ssh_good_perm_test 255
  363. # chmod o-w "$TESTHOME"/.monkeysphere
  364. rm "$TESTHOME"/.monkeysphere/authorized_user_ids
  365. mv "$TESTHOME"/.monkeysphere/authorized_user_ids{.bak,}
  366. echo
  367. echo "##################################################"
  368. echo "### make .monkeysphere directory an absolute symlink and updating..."
  369. mv "$TESTHOME"/.monkeysphere{,.bak}
  370. ln -s "$TESTHOME"/.monkeysphere{.linktest,}
  371. monkeysphere-authentication update-users $(whoami)
  372. echo
  373. echo "##################################################"
  374. echo "### ssh connection test for success..."
  375. ssh_test
  376. echo
  377. echo "##################################################"
  378. echo "### create bad permissions on link dir and updating..."
  379. chmod o+w "$TESTHOME"/.monkeysphere.linktest
  380. monkeysphere-authentication update-users $(whoami)
  381. echo
  382. echo "##################################################"
  383. echo "### ssh connection test for failure..."
  384. ssh_good_perm_test 255
  385. chmod o-w "$TESTHOME"/.monkeysphere.linktest
  386. echo
  387. echo "##################################################"
  388. echo "### make .monkeysphere directory a relative symlink and updating..."
  389. ln -sfn .monkeysphere.linktest "$TESTHOME"/.monkeysphere
  390. monkeysphere-authentication update-users $(whoami)
  391. echo
  392. echo "##################################################"
  393. echo "### ssh connection test for success..."
  394. ssh_test
  395. echo
  396. echo "##################################################"
  397. echo "### create bad permissions on link dir updating..."
  398. chmod o+w "$TESTHOME"/.monkeysphere.linktest
  399. monkeysphere-authentication update-users $(whoami)
  400. echo
  401. echo "##################################################"
  402. echo "### ssh connection test for failure..."
  403. ssh_good_perm_test 255
  404. chmod o-w "$TESTHOME"/.monkeysphere.linktest
  405. rm "$TESTHOME"/.monkeysphere
  406. mv "$TESTHOME"/.monkeysphere{.bak,}
  407. # ensure we're back to normal:
  408. echo
  409. echo "##################################################"
  410. echo "### making sure we are back to normal..."
  411. monkeysphere-authentication update-users $(whoami)
  412. ssh_test
  413. echo
  414. echo "##################################################"
  415. echo "### ssh connection test directly to 'testhost2' without new name..."
  416. target_hostname=testhost2 ssh_test 255
  417. echo
  418. echo "##################################################"
  419. echo "### add hostname, certify by admin, import by user..."
  420. monkeysphere-host add-hostname testhost2
  421. < "$MONKEYSPHERE_SYSCONFIGDIR"/ssh_host_rsa_key.pub.gpg gpgadmin --import
  422. printf "y\ny\n" | gpgadmin --command-fd 0 --sign-key "$HOSTKEYID"
  423. echo
  424. echo "##################################################"
  425. echo "### ssh connection test with hostname 'testhost2' added..."
  426. gpgadmin --export "$HOSTKEYID" | gpg --import
  427. gpg --check-trustdb
  428. ssh_test
  429. echo
  430. echo "##################################################"
  431. echo "### ssh connection test directly to 'testhost2' ..."
  432. gpg --import <"$MONKEYSPHERE_SYSCONFIGDIR"/ssh_host_rsa_key.pub.gpg
  433. gpg --check-trustdb
  434. target_hostname=testhost2 ssh_test
  435. echo
  436. echo "##################################################"
  437. echo "### ssh connection test for failure with 'testhost2' revoked..."
  438. monkeysphere-host revoke-hostname testhost2
  439. gpg --import <"$MONKEYSPHERE_SYSCONFIGDIR"/ssh_host_rsa_key.pub.gpg
  440. gpg --check-trustdb
  441. target_hostname=testhost2 ssh_test 255
  442. # FIXME: addtest: remove admin as id-certifier and check ssh failure
  443. # FIXME: addtest: how do we test that set-expire makes sense after new
  444. # hostnames have been added?
  445. # FIXME: addtest: revoke the host key and check ssh failure
  446. # test to make sure things are OK after the previous tests:
  447. echo
  448. echo "##################################################"
  449. echo "### settings reset, updating..."
  450. monkeysphere-authentication update-users $(whoami)
  451. echo
  452. echo "##################################################"
  453. echo "### ssh connection test for success..."
  454. ssh_test
  455. echo
  456. echo "##################################################"
  457. echo "### revoking host key..."
  458. # generate the revocation certificate and feed it directly to the test
  459. # user's keyring (we're not publishing to the keyservers)
  460. monkeysphere-host revoke-key | gpg --import
  461. echo
  462. echo "##################################################"
  463. echo "### ssh connection test for failure..."
  464. ssh_test 255
  465. ######################################################################
  466. trap - EXIT
  467. echo
  468. echo "##################################################"
  469. echo " Monkeysphere basic tests completed successfully!"
  470. echo "##################################################"
  471. cleanup