2023-01-27 21:37:20 +00:00
|
|
|
// Copyright (c) Tailscale Inc & AUTHORS
|
|
|
|
// SPDX-License-Identifier: BSD-3-Clause
|
2022-02-18 22:10:26 +00:00
|
|
|
|
2022-02-24 20:27:42 +00:00
|
|
|
//go:build linux || darwin
|
2022-02-18 22:10:26 +00:00
|
|
|
|
|
|
|
package tailssh
|
|
|
|
|
|
|
|
import (
|
2022-02-24 22:35:40 +00:00
|
|
|
"bytes"
|
2023-03-24 20:50:33 +00:00
|
|
|
"context"
|
2022-10-09 01:54:53 +01:00
|
|
|
"crypto/ed25519"
|
|
|
|
"crypto/rand"
|
2022-04-17 05:49:22 +01:00
|
|
|
"crypto/sha256"
|
2022-10-09 01:54:53 +01:00
|
|
|
"encoding/json"
|
2022-02-24 21:31:54 +00:00
|
|
|
"errors"
|
|
|
|
"fmt"
|
2022-04-17 05:49:22 +01:00
|
|
|
"io"
|
2022-02-24 21:31:54 +00:00
|
|
|
"net"
|
2022-04-17 05:49:22 +01:00
|
|
|
"net/http"
|
|
|
|
"net/http/httptest"
|
2022-07-26 04:55:44 +01:00
|
|
|
"net/netip"
|
2022-02-24 22:35:40 +00:00
|
|
|
"os"
|
2022-02-24 21:31:54 +00:00
|
|
|
"os/exec"
|
|
|
|
"os/user"
|
2022-04-17 05:49:22 +01:00
|
|
|
"reflect"
|
2022-10-09 01:54:53 +01:00
|
|
|
"runtime"
|
2023-06-22 03:57:45 +01:00
|
|
|
"strconv"
|
2022-02-24 22:35:40 +00:00
|
|
|
"strings"
|
2022-10-09 01:54:53 +01:00
|
|
|
"sync"
|
2022-04-17 05:49:22 +01:00
|
|
|
"sync/atomic"
|
2022-02-18 22:10:26 +00:00
|
|
|
"testing"
|
|
|
|
"time"
|
|
|
|
|
2022-10-09 01:54:53 +01:00
|
|
|
gossh "github.com/tailscale/golang-x-crypto/ssh"
|
2022-02-24 21:31:54 +00:00
|
|
|
"tailscale.com/ipn/ipnlocal"
|
2022-02-28 21:08:45 +00:00
|
|
|
"tailscale.com/ipn/store/mem"
|
2023-01-30 18:53:58 +00:00
|
|
|
"tailscale.com/net/memnet"
|
2022-02-24 21:31:54 +00:00
|
|
|
"tailscale.com/net/tsdial"
|
2022-02-18 22:10:26 +00:00
|
|
|
"tailscale.com/tailcfg"
|
2022-03-25 22:35:36 +00:00
|
|
|
"tailscale.com/tempfork/gliderlabs/ssh"
|
2023-05-03 21:57:17 +01:00
|
|
|
"tailscale.com/tsd"
|
2022-04-17 05:49:22 +01:00
|
|
|
"tailscale.com/tstest"
|
2023-05-05 03:49:32 +01:00
|
|
|
"tailscale.com/types/key"
|
2022-02-24 21:31:54 +00:00
|
|
|
"tailscale.com/types/logger"
|
2023-03-23 17:49:56 +00:00
|
|
|
"tailscale.com/types/logid"
|
2022-10-09 01:54:53 +01:00
|
|
|
"tailscale.com/types/netmap"
|
2022-03-18 21:46:38 +00:00
|
|
|
"tailscale.com/util/cibuild"
|
2022-02-24 22:35:40 +00:00
|
|
|
"tailscale.com/util/lineread"
|
2022-10-09 01:54:53 +01:00
|
|
|
"tailscale.com/util/must"
|
2022-12-14 22:20:50 +00:00
|
|
|
"tailscale.com/version/distro"
|
2022-02-24 21:31:54 +00:00
|
|
|
"tailscale.com/wgengine"
|
2022-02-18 22:10:26 +00:00
|
|
|
)
|
|
|
|
|
|
|
|
func TestMatchRule(t *testing.T) {
|
|
|
|
someAction := new(tailcfg.SSHAction)
|
|
|
|
tests := []struct {
|
|
|
|
name string
|
|
|
|
rule *tailcfg.SSHRule
|
2022-02-24 16:58:53 +00:00
|
|
|
ci *sshConnInfo
|
2022-02-18 22:10:26 +00:00
|
|
|
wantErr error
|
|
|
|
wantUser string
|
|
|
|
}{
|
2022-07-21 16:46:55 +01:00
|
|
|
{
|
|
|
|
name: "invalid-conn",
|
|
|
|
rule: &tailcfg.SSHRule{
|
|
|
|
Action: someAction,
|
|
|
|
Principals: []*tailcfg.SSHPrincipal{{Any: true}},
|
|
|
|
SSHUsers: map[string]string{
|
|
|
|
"*": "ubuntu",
|
|
|
|
},
|
|
|
|
},
|
|
|
|
wantErr: errInvalidConn,
|
|
|
|
},
|
2022-02-18 22:10:26 +00:00
|
|
|
{
|
|
|
|
name: "nil-rule",
|
2022-07-21 16:46:55 +01:00
|
|
|
ci: &sshConnInfo{},
|
2022-02-18 22:10:26 +00:00
|
|
|
rule: nil,
|
|
|
|
wantErr: errNilRule,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "nil-action",
|
2022-07-21 16:46:55 +01:00
|
|
|
ci: &sshConnInfo{},
|
2022-02-18 22:10:26 +00:00
|
|
|
rule: &tailcfg.SSHRule{},
|
|
|
|
wantErr: errNilAction,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "expired",
|
|
|
|
rule: &tailcfg.SSHRule{
|
|
|
|
Action: someAction,
|
|
|
|
RuleExpires: timePtr(time.Unix(100, 0)),
|
|
|
|
},
|
2022-04-21 01:36:19 +01:00
|
|
|
ci: &sshConnInfo{},
|
2022-02-18 22:10:26 +00:00
|
|
|
wantErr: errRuleExpired,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "no-principal",
|
|
|
|
rule: &tailcfg.SSHRule{
|
|
|
|
Action: someAction,
|
2022-04-01 20:57:12 +01:00
|
|
|
SSHUsers: map[string]string{
|
|
|
|
"*": "ubuntu",
|
|
|
|
}},
|
|
|
|
ci: &sshConnInfo{},
|
2022-02-18 22:10:26 +00:00
|
|
|
wantErr: errPrincipalMatch,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "no-user-match",
|
|
|
|
rule: &tailcfg.SSHRule{
|
|
|
|
Action: someAction,
|
|
|
|
Principals: []*tailcfg.SSHPrincipal{{Any: true}},
|
|
|
|
},
|
2022-02-24 16:58:53 +00:00
|
|
|
ci: &sshConnInfo{sshUser: "alice"},
|
2022-02-18 22:10:26 +00:00
|
|
|
wantErr: errUserMatch,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "ok-wildcard",
|
|
|
|
rule: &tailcfg.SSHRule{
|
|
|
|
Action: someAction,
|
|
|
|
Principals: []*tailcfg.SSHPrincipal{{Any: true}},
|
|
|
|
SSHUsers: map[string]string{
|
|
|
|
"*": "ubuntu",
|
|
|
|
},
|
|
|
|
},
|
2022-02-24 16:58:53 +00:00
|
|
|
ci: &sshConnInfo{sshUser: "alice"},
|
2022-02-18 22:10:26 +00:00
|
|
|
wantUser: "ubuntu",
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "ok-wildcard-and-nil-principal",
|
|
|
|
rule: &tailcfg.SSHRule{
|
|
|
|
Action: someAction,
|
|
|
|
Principals: []*tailcfg.SSHPrincipal{
|
|
|
|
nil, // don't crash on this
|
|
|
|
{Any: true},
|
|
|
|
},
|
|
|
|
SSHUsers: map[string]string{
|
|
|
|
"*": "ubuntu",
|
|
|
|
},
|
|
|
|
},
|
2022-02-24 16:58:53 +00:00
|
|
|
ci: &sshConnInfo{sshUser: "alice"},
|
2022-02-18 22:10:26 +00:00
|
|
|
wantUser: "ubuntu",
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "ok-exact",
|
|
|
|
rule: &tailcfg.SSHRule{
|
|
|
|
Action: someAction,
|
|
|
|
Principals: []*tailcfg.SSHPrincipal{{Any: true}},
|
|
|
|
SSHUsers: map[string]string{
|
|
|
|
"*": "ubuntu",
|
|
|
|
"alice": "thealice",
|
|
|
|
},
|
|
|
|
},
|
2022-02-24 16:58:53 +00:00
|
|
|
ci: &sshConnInfo{sshUser: "alice"},
|
2022-02-18 22:10:26 +00:00
|
|
|
wantUser: "thealice",
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "no-users-for-reject",
|
|
|
|
rule: &tailcfg.SSHRule{
|
|
|
|
Principals: []*tailcfg.SSHPrincipal{{Any: true}},
|
|
|
|
Action: &tailcfg.SSHAction{Reject: true},
|
|
|
|
},
|
2022-02-24 16:58:53 +00:00
|
|
|
ci: &sshConnInfo{sshUser: "alice"},
|
2022-02-18 22:10:26 +00:00
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "match-principal-node-ip",
|
|
|
|
rule: &tailcfg.SSHRule{
|
|
|
|
Action: someAction,
|
|
|
|
Principals: []*tailcfg.SSHPrincipal{{NodeIP: "1.2.3.4"}},
|
|
|
|
SSHUsers: map[string]string{"*": "ubuntu"},
|
|
|
|
},
|
2022-07-26 04:55:44 +01:00
|
|
|
ci: &sshConnInfo{src: netip.MustParseAddrPort("1.2.3.4:30343")},
|
2022-02-18 22:10:26 +00:00
|
|
|
wantUser: "ubuntu",
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "match-principal-node-id",
|
|
|
|
rule: &tailcfg.SSHRule{
|
|
|
|
Action: someAction,
|
|
|
|
Principals: []*tailcfg.SSHPrincipal{{Node: "some-node-ID"}},
|
|
|
|
SSHUsers: map[string]string{"*": "ubuntu"},
|
|
|
|
},
|
2023-08-18 15:57:44 +01:00
|
|
|
ci: &sshConnInfo{node: (&tailcfg.Node{StableID: "some-node-ID"}).View()},
|
2022-02-18 22:10:26 +00:00
|
|
|
wantUser: "ubuntu",
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "match-principal-userlogin",
|
|
|
|
rule: &tailcfg.SSHRule{
|
|
|
|
Action: someAction,
|
|
|
|
Principals: []*tailcfg.SSHPrincipal{{UserLogin: "foo@bar.com"}},
|
|
|
|
SSHUsers: map[string]string{"*": "ubuntu"},
|
|
|
|
},
|
2022-10-09 01:54:53 +01:00
|
|
|
ci: &sshConnInfo{uprof: tailcfg.UserProfile{LoginName: "foo@bar.com"}},
|
2022-02-18 22:10:26 +00:00
|
|
|
wantUser: "ubuntu",
|
|
|
|
},
|
2022-03-21 17:39:54 +00:00
|
|
|
{
|
|
|
|
name: "ssh-user-equal",
|
|
|
|
rule: &tailcfg.SSHRule{
|
|
|
|
Action: someAction,
|
|
|
|
Principals: []*tailcfg.SSHPrincipal{{Any: true}},
|
|
|
|
SSHUsers: map[string]string{
|
|
|
|
"*": "=",
|
|
|
|
},
|
|
|
|
},
|
|
|
|
ci: &sshConnInfo{sshUser: "alice"},
|
|
|
|
wantUser: "alice",
|
|
|
|
},
|
2022-02-18 22:10:26 +00:00
|
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
|
|
t.Run(tt.name, func(t *testing.T) {
|
2022-04-21 01:36:19 +01:00
|
|
|
c := &conn{
|
|
|
|
info: tt.ci,
|
2022-07-21 16:46:55 +01:00
|
|
|
srv: &server{logf: t.Logf},
|
2022-04-21 01:36:19 +01:00
|
|
|
}
|
|
|
|
got, gotUser, err := c.matchRule(tt.rule, nil)
|
2022-02-18 22:10:26 +00:00
|
|
|
if err != tt.wantErr {
|
|
|
|
t.Errorf("err = %v; want %v", err, tt.wantErr)
|
|
|
|
}
|
|
|
|
if gotUser != tt.wantUser {
|
|
|
|
t.Errorf("user = %q; want %q", gotUser, tt.wantUser)
|
|
|
|
}
|
|
|
|
if err == nil && got == nil {
|
|
|
|
t.Errorf("expected non-nil action on success")
|
|
|
|
}
|
|
|
|
})
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func timePtr(t time.Time) *time.Time { return &t }
|
2022-02-24 21:31:54 +00:00
|
|
|
|
2022-10-09 01:54:53 +01:00
|
|
|
// localState implements ipnLocalBackend for testing.
|
|
|
|
type localState struct {
|
|
|
|
sshEnabled bool
|
|
|
|
matchingRule *tailcfg.SSHRule
|
|
|
|
|
|
|
|
// serverActions is a map of the action name to the action.
|
|
|
|
// It is served for paths like https://unused/ssh-action/<action-name>.
|
|
|
|
// The action name is the last part of the action URL.
|
|
|
|
serverActions map[string]*tailcfg.SSHAction
|
|
|
|
}
|
|
|
|
|
|
|
|
var (
|
|
|
|
currentUser = os.Getenv("USER") // Use the current user for the test.
|
|
|
|
testSigner gossh.Signer
|
|
|
|
testSignerOnce sync.Once
|
|
|
|
)
|
|
|
|
|
2023-03-23 21:47:04 +00:00
|
|
|
func (ts *localState) Dialer() *tsdial.Dialer {
|
2023-04-20 05:33:33 +01:00
|
|
|
return &tsdial.Dialer{}
|
2023-03-23 21:47:04 +00:00
|
|
|
}
|
|
|
|
|
2022-10-09 01:54:53 +01:00
|
|
|
func (ts *localState) GetSSH_HostKeys() ([]gossh.Signer, error) {
|
|
|
|
testSignerOnce.Do(func() {
|
|
|
|
_, priv, err := ed25519.GenerateKey(rand.Reader)
|
|
|
|
if err != nil {
|
|
|
|
panic(err)
|
|
|
|
}
|
|
|
|
s, err := gossh.NewSignerFromSigner(priv)
|
|
|
|
if err != nil {
|
|
|
|
panic(err)
|
|
|
|
}
|
|
|
|
testSigner = s
|
|
|
|
})
|
|
|
|
return []gossh.Signer{testSigner}, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func (ts *localState) ShouldRunSSH() bool {
|
|
|
|
return ts.sshEnabled
|
|
|
|
}
|
|
|
|
|
|
|
|
func (ts *localState) NetMap() *netmap.NetworkMap {
|
|
|
|
var policy *tailcfg.SSHPolicy
|
|
|
|
if ts.matchingRule != nil {
|
|
|
|
policy = &tailcfg.SSHPolicy{
|
|
|
|
Rules: []*tailcfg.SSHRule{
|
|
|
|
ts.matchingRule,
|
|
|
|
},
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return &netmap.NetworkMap{
|
2023-08-21 18:53:57 +01:00
|
|
|
SelfNode: (&tailcfg.Node{
|
2022-10-09 01:54:53 +01:00
|
|
|
ID: 1,
|
2023-08-21 18:53:57 +01:00
|
|
|
}).View(),
|
2022-10-09 01:54:53 +01:00
|
|
|
SSHPolicy: policy,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2023-08-18 15:57:44 +01:00
|
|
|
func (ts *localState) WhoIs(ipp netip.AddrPort) (n tailcfg.NodeView, u tailcfg.UserProfile, ok bool) {
|
|
|
|
return (&tailcfg.Node{
|
2022-10-09 01:54:53 +01:00
|
|
|
ID: 2,
|
|
|
|
StableID: "peer-id",
|
2023-08-18 15:57:44 +01:00
|
|
|
}).View(), tailcfg.UserProfile{
|
2022-10-09 01:54:53 +01:00
|
|
|
LoginName: "peer",
|
|
|
|
}, true
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
func (ts *localState) DoNoiseRequest(req *http.Request) (*http.Response, error) {
|
|
|
|
rec := httptest.NewRecorder()
|
2023-02-01 21:43:06 +00:00
|
|
|
k, ok := strings.CutPrefix(req.URL.Path, "/ssh-action/")
|
2022-10-09 01:54:53 +01:00
|
|
|
if !ok {
|
|
|
|
rec.WriteHeader(http.StatusNotFound)
|
|
|
|
}
|
|
|
|
a, ok := ts.serverActions[k]
|
|
|
|
if !ok {
|
|
|
|
rec.WriteHeader(http.StatusNotFound)
|
|
|
|
return rec.Result(), nil
|
|
|
|
}
|
|
|
|
rec.WriteHeader(http.StatusOK)
|
|
|
|
if err := json.NewEncoder(rec).Encode(a); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
return rec.Result(), nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func (ts *localState) TailscaleVarRoot() string {
|
|
|
|
return ""
|
|
|
|
}
|
|
|
|
|
2023-05-05 03:49:32 +01:00
|
|
|
func (ts *localState) NodeKey() key.NodePublic {
|
|
|
|
return key.NewNode().Public()
|
|
|
|
}
|
|
|
|
|
2022-10-09 01:54:53 +01:00
|
|
|
func newSSHRule(action *tailcfg.SSHAction) *tailcfg.SSHRule {
|
|
|
|
return &tailcfg.SSHRule{
|
|
|
|
SSHUsers: map[string]string{
|
|
|
|
"*": currentUser,
|
|
|
|
},
|
|
|
|
Action: action,
|
|
|
|
Principals: []*tailcfg.SSHPrincipal{
|
|
|
|
{
|
|
|
|
Any: true,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2023-03-25 17:19:51 +00:00
|
|
|
func TestSSHRecordingCancelsSessionsOnUploadFailure(t *testing.T) {
|
|
|
|
if runtime.GOOS != "linux" && runtime.GOOS != "darwin" {
|
|
|
|
t.Skipf("skipping on %q; only runs on linux and darwin", runtime.GOOS)
|
|
|
|
}
|
|
|
|
|
|
|
|
var handler http.HandlerFunc
|
|
|
|
recordingServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
|
|
handler(w, r)
|
|
|
|
}))
|
|
|
|
defer recordingServer.Close()
|
|
|
|
|
|
|
|
s := &server{
|
2023-04-20 05:33:33 +01:00
|
|
|
logf: t.Logf,
|
2023-03-25 17:19:51 +00:00
|
|
|
lb: &localState{
|
|
|
|
sshEnabled: true,
|
|
|
|
matchingRule: newSSHRule(
|
|
|
|
&tailcfg.SSHAction{
|
|
|
|
Accept: true,
|
|
|
|
Recorders: []netip.AddrPort{
|
|
|
|
netip.MustParseAddrPort(recordingServer.Listener.Addr().String()),
|
|
|
|
},
|
2023-04-20 05:33:33 +01:00
|
|
|
OnRecordingFailure: &tailcfg.SSHRecorderFailureAction{
|
|
|
|
RejectSessionWithMessage: "session rejected",
|
|
|
|
TerminateSessionWithMessage: "session terminated",
|
|
|
|
},
|
2023-03-25 17:19:51 +00:00
|
|
|
},
|
|
|
|
),
|
|
|
|
},
|
|
|
|
}
|
|
|
|
defer s.Shutdown()
|
|
|
|
|
|
|
|
const sshUser = "alice"
|
|
|
|
cfg := &gossh.ClientConfig{
|
|
|
|
User: sshUser,
|
|
|
|
HostKeyCallback: gossh.InsecureIgnoreHostKey(),
|
|
|
|
}
|
|
|
|
|
|
|
|
tests := []struct {
|
|
|
|
name string
|
|
|
|
handler func(w http.ResponseWriter, r *http.Request)
|
|
|
|
sshCommand string
|
|
|
|
wantClientOutput string
|
2023-04-05 16:35:02 +01:00
|
|
|
|
|
|
|
clientOutputMustNotContain []string
|
2023-03-25 17:19:51 +00:00
|
|
|
}{
|
|
|
|
{
|
|
|
|
name: "upload-denied",
|
|
|
|
handler: func(w http.ResponseWriter, r *http.Request) {
|
|
|
|
w.WriteHeader(http.StatusForbidden)
|
|
|
|
},
|
|
|
|
sshCommand: "echo hello",
|
2023-04-20 05:33:33 +01:00
|
|
|
wantClientOutput: "session rejected\r\n",
|
2023-04-05 16:35:02 +01:00
|
|
|
|
|
|
|
clientOutputMustNotContain: []string{"hello"},
|
2023-03-25 17:19:51 +00:00
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "upload-fails-after-starting",
|
|
|
|
handler: func(w http.ResponseWriter, r *http.Request) {
|
|
|
|
r.Body.Read(make([]byte, 1))
|
|
|
|
time.Sleep(100 * time.Millisecond)
|
|
|
|
w.WriteHeader(http.StatusInternalServerError)
|
|
|
|
},
|
|
|
|
sshCommand: "echo hello && sleep 1 && echo world",
|
2023-04-20 05:33:33 +01:00
|
|
|
wantClientOutput: "\r\n\r\nsession terminated\r\n\r\n",
|
2023-04-05 16:35:02 +01:00
|
|
|
|
|
|
|
clientOutputMustNotContain: []string{"world"},
|
2023-03-25 17:19:51 +00:00
|
|
|
},
|
|
|
|
}
|
|
|
|
|
|
|
|
src, dst := must.Get(netip.ParseAddrPort("100.100.100.101:2231")), must.Get(netip.ParseAddrPort("100.100.100.102:22"))
|
|
|
|
|
|
|
|
for _, tt := range tests {
|
|
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
|
|
tstest.Replace(t, &handler, tt.handler)
|
|
|
|
sc, dc := memnet.NewTCPConn(src, dst, 1024)
|
|
|
|
var wg sync.WaitGroup
|
|
|
|
wg.Add(1)
|
|
|
|
go func() {
|
|
|
|
defer wg.Done()
|
|
|
|
c, chans, reqs, err := gossh.NewClientConn(sc, sc.RemoteAddr().String(), cfg)
|
|
|
|
if err != nil {
|
|
|
|
t.Errorf("client: %v", err)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
client := gossh.NewClient(c, chans, reqs)
|
|
|
|
defer client.Close()
|
|
|
|
session, err := client.NewSession()
|
|
|
|
if err != nil {
|
|
|
|
t.Errorf("client: %v", err)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
defer session.Close()
|
|
|
|
t.Logf("client established session")
|
|
|
|
got, err := session.CombinedOutput(tt.sshCommand)
|
|
|
|
if err != nil {
|
|
|
|
t.Logf("client got: %q: %v", got, err)
|
|
|
|
} else {
|
|
|
|
t.Errorf("client did not get kicked out: %q", got)
|
|
|
|
}
|
2023-04-05 16:35:02 +01:00
|
|
|
gotStr := string(got)
|
|
|
|
if !strings.HasSuffix(gotStr, tt.wantClientOutput) {
|
2023-03-25 17:19:51 +00:00
|
|
|
t.Errorf("client got %q, want %q", got, tt.wantClientOutput)
|
|
|
|
}
|
2023-04-05 16:35:02 +01:00
|
|
|
for _, x := range tt.clientOutputMustNotContain {
|
|
|
|
if strings.Contains(gotStr, x) {
|
|
|
|
t.Errorf("client output must not contain %q", x)
|
|
|
|
}
|
|
|
|
}
|
2023-03-25 17:19:51 +00:00
|
|
|
}()
|
|
|
|
if err := s.HandleSSHConn(dc); err != nil {
|
|
|
|
t.Errorf("unexpected error: %v", err)
|
|
|
|
}
|
|
|
|
wg.Wait()
|
|
|
|
})
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2023-04-20 05:33:33 +01:00
|
|
|
func TestMultipleRecorders(t *testing.T) {
|
|
|
|
if runtime.GOOS != "linux" && runtime.GOOS != "darwin" {
|
|
|
|
t.Skipf("skipping on %q; only runs on linux and darwin", runtime.GOOS)
|
|
|
|
}
|
|
|
|
done := make(chan struct{})
|
|
|
|
recordingServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
|
|
defer close(done)
|
|
|
|
io.ReadAll(r.Body)
|
|
|
|
w.WriteHeader(http.StatusOK)
|
|
|
|
}))
|
|
|
|
defer recordingServer.Close()
|
|
|
|
badRecorder, err := net.Listen("tcp", ":0")
|
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
badRecorderAddr := badRecorder.Addr().String()
|
|
|
|
badRecorder.Close()
|
|
|
|
|
|
|
|
badRecordingServer500 := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
|
|
w.WriteHeader(500)
|
|
|
|
}))
|
|
|
|
defer badRecordingServer500.Close()
|
|
|
|
|
|
|
|
badRecordingServer200 := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
|
|
w.WriteHeader(200)
|
|
|
|
}))
|
|
|
|
defer badRecordingServer200.Close()
|
|
|
|
|
|
|
|
s := &server{
|
|
|
|
logf: t.Logf,
|
|
|
|
lb: &localState{
|
|
|
|
sshEnabled: true,
|
|
|
|
matchingRule: newSSHRule(
|
|
|
|
&tailcfg.SSHAction{
|
|
|
|
Accept: true,
|
|
|
|
Recorders: []netip.AddrPort{
|
|
|
|
netip.MustParseAddrPort(badRecorderAddr),
|
|
|
|
netip.MustParseAddrPort(badRecordingServer500.Listener.Addr().String()),
|
|
|
|
netip.MustParseAddrPort(badRecordingServer200.Listener.Addr().String()),
|
|
|
|
netip.MustParseAddrPort(recordingServer.Listener.Addr().String()),
|
|
|
|
},
|
|
|
|
OnRecordingFailure: &tailcfg.SSHRecorderFailureAction{
|
|
|
|
RejectSessionWithMessage: "session rejected",
|
|
|
|
TerminateSessionWithMessage: "session terminated",
|
|
|
|
},
|
|
|
|
},
|
|
|
|
),
|
|
|
|
},
|
|
|
|
}
|
|
|
|
defer s.Shutdown()
|
|
|
|
|
|
|
|
src, dst := must.Get(netip.ParseAddrPort("100.100.100.101:2231")), must.Get(netip.ParseAddrPort("100.100.100.102:22"))
|
|
|
|
sc, dc := memnet.NewTCPConn(src, dst, 1024)
|
|
|
|
|
|
|
|
const sshUser = "alice"
|
|
|
|
cfg := &gossh.ClientConfig{
|
|
|
|
User: sshUser,
|
|
|
|
HostKeyCallback: gossh.InsecureIgnoreHostKey(),
|
|
|
|
}
|
|
|
|
|
|
|
|
var wg sync.WaitGroup
|
|
|
|
wg.Add(1)
|
|
|
|
go func() {
|
|
|
|
defer wg.Done()
|
|
|
|
c, chans, reqs, err := gossh.NewClientConn(sc, sc.RemoteAddr().String(), cfg)
|
|
|
|
if err != nil {
|
|
|
|
t.Errorf("client: %v", err)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
client := gossh.NewClient(c, chans, reqs)
|
|
|
|
defer client.Close()
|
|
|
|
session, err := client.NewSession()
|
|
|
|
if err != nil {
|
|
|
|
t.Errorf("client: %v", err)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
defer session.Close()
|
|
|
|
t.Logf("client established session")
|
|
|
|
out, err := session.CombinedOutput("echo Ran echo!")
|
|
|
|
if err != nil {
|
|
|
|
t.Errorf("client: %v", err)
|
|
|
|
}
|
|
|
|
if string(out) != "Ran echo!\n" {
|
|
|
|
t.Errorf("client: unexpected output: %q", out)
|
|
|
|
}
|
|
|
|
}()
|
|
|
|
if err := s.HandleSSHConn(dc); err != nil {
|
|
|
|
t.Errorf("unexpected error: %v", err)
|
|
|
|
}
|
|
|
|
wg.Wait()
|
|
|
|
select {
|
|
|
|
case <-done:
|
|
|
|
case <-time.After(1 * time.Second):
|
|
|
|
t.Fatal("timed out waiting for recording")
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2023-03-24 20:50:33 +00:00
|
|
|
// TestSSHRecordingNonInteractive tests that the SSH server records the SSH session
|
|
|
|
// when the client is not interactive (i.e. no PTY).
|
|
|
|
// It starts a local SSH server and a recording server. The recording server
|
|
|
|
// records the SSH session and returns it to the test.
|
|
|
|
// The test then verifies that the recording has a valid CastHeader, it does not
|
|
|
|
// validate the contents of the recording.
|
|
|
|
func TestSSHRecordingNonInteractive(t *testing.T) {
|
|
|
|
if runtime.GOOS != "linux" && runtime.GOOS != "darwin" {
|
|
|
|
t.Skipf("skipping on %q; only runs on linux and darwin", runtime.GOOS)
|
|
|
|
}
|
|
|
|
var recording []byte
|
|
|
|
ctx, cancel := context.WithTimeout(context.Background(), time.Second)
|
|
|
|
recordingServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
|
|
defer cancel()
|
|
|
|
var err error
|
2023-08-23 16:42:44 +01:00
|
|
|
recording, err = io.ReadAll(r.Body)
|
2023-03-24 20:50:33 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Error(err)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
}))
|
|
|
|
defer recordingServer.Close()
|
|
|
|
|
|
|
|
s := &server{
|
2023-04-20 05:33:33 +01:00
|
|
|
logf: logger.Discard,
|
2023-03-25 17:19:51 +00:00
|
|
|
lb: &localState{
|
|
|
|
sshEnabled: true,
|
|
|
|
matchingRule: newSSHRule(
|
|
|
|
&tailcfg.SSHAction{
|
|
|
|
Accept: true,
|
|
|
|
Recorders: []netip.AddrPort{
|
|
|
|
must.Get(netip.ParseAddrPort(recordingServer.Listener.Addr().String())),
|
|
|
|
},
|
2023-04-20 05:33:33 +01:00
|
|
|
OnRecordingFailure: &tailcfg.SSHRecorderFailureAction{
|
|
|
|
RejectSessionWithMessage: "session rejected",
|
|
|
|
TerminateSessionWithMessage: "session terminated",
|
|
|
|
},
|
2023-03-25 17:19:51 +00:00
|
|
|
},
|
|
|
|
),
|
|
|
|
},
|
2023-03-24 20:50:33 +00:00
|
|
|
}
|
|
|
|
defer s.Shutdown()
|
|
|
|
|
|
|
|
src, dst := must.Get(netip.ParseAddrPort("100.100.100.101:2231")), must.Get(netip.ParseAddrPort("100.100.100.102:22"))
|
|
|
|
sc, dc := memnet.NewTCPConn(src, dst, 1024)
|
|
|
|
|
|
|
|
const sshUser = "alice"
|
|
|
|
cfg := &gossh.ClientConfig{
|
|
|
|
User: sshUser,
|
|
|
|
HostKeyCallback: gossh.InsecureIgnoreHostKey(),
|
|
|
|
}
|
|
|
|
|
|
|
|
var wg sync.WaitGroup
|
|
|
|
wg.Add(1)
|
|
|
|
go func() {
|
|
|
|
defer wg.Done()
|
|
|
|
c, chans, reqs, err := gossh.NewClientConn(sc, sc.RemoteAddr().String(), cfg)
|
|
|
|
if err != nil {
|
|
|
|
t.Errorf("client: %v", err)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
client := gossh.NewClient(c, chans, reqs)
|
|
|
|
defer client.Close()
|
|
|
|
session, err := client.NewSession()
|
|
|
|
if err != nil {
|
|
|
|
t.Errorf("client: %v", err)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
defer session.Close()
|
|
|
|
t.Logf("client established session")
|
|
|
|
_, err = session.CombinedOutput("echo Ran echo!")
|
|
|
|
if err != nil {
|
|
|
|
t.Errorf("client: %v", err)
|
|
|
|
}
|
|
|
|
}()
|
|
|
|
if err := s.HandleSSHConn(dc); err != nil {
|
|
|
|
t.Errorf("unexpected error: %v", err)
|
|
|
|
}
|
|
|
|
wg.Wait()
|
|
|
|
|
|
|
|
<-ctx.Done() // wait for recording to finish
|
|
|
|
var ch CastHeader
|
|
|
|
if err := json.NewDecoder(bytes.NewReader(recording)).Decode(&ch); err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
if ch.SSHUser != sshUser {
|
|
|
|
t.Errorf("SSHUser = %q; want %q", ch.SSHUser, sshUser)
|
|
|
|
}
|
|
|
|
if ch.Command != "echo Ran echo!" {
|
|
|
|
t.Errorf("Command = %q; want %q", ch.Command, "echo Ran echo!")
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-10-09 01:54:53 +01:00
|
|
|
func TestSSHAuthFlow(t *testing.T) {
|
2023-03-24 20:50:33 +00:00
|
|
|
if runtime.GOOS != "linux" && runtime.GOOS != "darwin" {
|
|
|
|
t.Skipf("skipping on %q; only runs on linux and darwin", runtime.GOOS)
|
2022-10-09 01:54:53 +01:00
|
|
|
}
|
|
|
|
acceptRule := newSSHRule(&tailcfg.SSHAction{
|
|
|
|
Accept: true,
|
|
|
|
Message: "Welcome to Tailscale SSH!",
|
|
|
|
})
|
|
|
|
rejectRule := newSSHRule(&tailcfg.SSHAction{
|
|
|
|
Reject: true,
|
|
|
|
Message: "Go Away!",
|
|
|
|
})
|
|
|
|
|
|
|
|
tests := []struct {
|
2022-10-11 22:48:01 +01:00
|
|
|
name string
|
|
|
|
sshUser string // defaults to alice
|
|
|
|
state *localState
|
|
|
|
wantBanners []string
|
|
|
|
usesPassword bool
|
|
|
|
authErr bool
|
2022-10-09 01:54:53 +01:00
|
|
|
}{
|
|
|
|
{
|
|
|
|
name: "no-policy",
|
|
|
|
state: &localState{
|
|
|
|
sshEnabled: true,
|
|
|
|
},
|
|
|
|
authErr: true,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "accept",
|
|
|
|
state: &localState{
|
|
|
|
sshEnabled: true,
|
|
|
|
matchingRule: acceptRule,
|
|
|
|
},
|
2022-10-09 18:31:19 +01:00
|
|
|
wantBanners: []string{"Welcome to Tailscale SSH!"},
|
2022-10-09 01:54:53 +01:00
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "reject",
|
|
|
|
state: &localState{
|
|
|
|
sshEnabled: true,
|
|
|
|
matchingRule: rejectRule,
|
|
|
|
},
|
2022-10-09 18:31:19 +01:00
|
|
|
wantBanners: []string{"Go Away!"},
|
|
|
|
authErr: true,
|
2022-10-09 01:54:53 +01:00
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "simple-check",
|
|
|
|
state: &localState{
|
|
|
|
sshEnabled: true,
|
|
|
|
matchingRule: newSSHRule(&tailcfg.SSHAction{
|
|
|
|
HoldAndDelegate: "https://unused/ssh-action/accept",
|
|
|
|
}),
|
|
|
|
serverActions: map[string]*tailcfg.SSHAction{
|
|
|
|
"accept": acceptRule.Action,
|
|
|
|
},
|
|
|
|
},
|
2022-10-09 18:31:19 +01:00
|
|
|
wantBanners: []string{"Welcome to Tailscale SSH!"},
|
2022-10-09 01:54:53 +01:00
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "multi-check",
|
|
|
|
state: &localState{
|
|
|
|
sshEnabled: true,
|
|
|
|
matchingRule: newSSHRule(&tailcfg.SSHAction{
|
2022-10-09 18:31:19 +01:00
|
|
|
Message: "First",
|
2022-10-09 01:54:53 +01:00
|
|
|
HoldAndDelegate: "https://unused/ssh-action/check1",
|
|
|
|
}),
|
|
|
|
serverActions: map[string]*tailcfg.SSHAction{
|
|
|
|
"check1": {
|
|
|
|
Message: "url-here",
|
|
|
|
HoldAndDelegate: "https://unused/ssh-action/check2",
|
|
|
|
},
|
|
|
|
"check2": acceptRule.Action,
|
|
|
|
},
|
|
|
|
},
|
2022-10-09 18:31:19 +01:00
|
|
|
wantBanners: []string{"First", "url-here", "Welcome to Tailscale SSH!"},
|
2022-10-09 01:54:53 +01:00
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "check-reject",
|
|
|
|
state: &localState{
|
|
|
|
sshEnabled: true,
|
|
|
|
matchingRule: newSSHRule(&tailcfg.SSHAction{
|
2022-10-09 18:31:19 +01:00
|
|
|
Message: "First",
|
2022-10-09 01:54:53 +01:00
|
|
|
HoldAndDelegate: "https://unused/ssh-action/reject",
|
|
|
|
}),
|
|
|
|
serverActions: map[string]*tailcfg.SSHAction{
|
|
|
|
"reject": rejectRule.Action,
|
|
|
|
},
|
|
|
|
},
|
2022-10-09 18:31:19 +01:00
|
|
|
wantBanners: []string{"First", "Go Away!"},
|
|
|
|
authErr: true,
|
2022-10-09 01:54:53 +01:00
|
|
|
},
|
2022-10-11 22:48:01 +01:00
|
|
|
{
|
|
|
|
name: "force-password-auth",
|
|
|
|
sshUser: "alice+password",
|
|
|
|
state: &localState{
|
|
|
|
sshEnabled: true,
|
|
|
|
matchingRule: acceptRule,
|
|
|
|
},
|
|
|
|
usesPassword: true,
|
|
|
|
wantBanners: []string{"Welcome to Tailscale SSH!"},
|
|
|
|
},
|
2022-10-09 01:54:53 +01:00
|
|
|
}
|
|
|
|
s := &server{
|
|
|
|
logf: logger.Discard,
|
|
|
|
}
|
|
|
|
defer s.Shutdown()
|
|
|
|
src, dst := must.Get(netip.ParseAddrPort("100.100.100.101:2231")), must.Get(netip.ParseAddrPort("100.100.100.102:22"))
|
|
|
|
for _, tc := range tests {
|
|
|
|
t.Run(tc.name, func(t *testing.T) {
|
2023-01-30 18:53:58 +00:00
|
|
|
sc, dc := memnet.NewTCPConn(src, dst, 1024)
|
2022-10-09 01:54:53 +01:00
|
|
|
s.lb = tc.state
|
2022-10-11 22:48:01 +01:00
|
|
|
sshUser := "alice"
|
|
|
|
if tc.sshUser != "" {
|
|
|
|
sshUser = tc.sshUser
|
|
|
|
}
|
|
|
|
var passwordUsed atomic.Bool
|
2022-10-09 01:54:53 +01:00
|
|
|
cfg := &gossh.ClientConfig{
|
2022-10-11 22:48:01 +01:00
|
|
|
User: sshUser,
|
2022-10-09 01:54:53 +01:00
|
|
|
HostKeyCallback: gossh.InsecureIgnoreHostKey(),
|
2022-10-11 22:48:01 +01:00
|
|
|
Auth: []gossh.AuthMethod{
|
|
|
|
gossh.PasswordCallback(func() (secret string, err error) {
|
|
|
|
if !tc.usesPassword {
|
|
|
|
t.Error("unexpected use of PasswordCallback")
|
|
|
|
return "", errors.New("unexpected use of PasswordCallback")
|
|
|
|
}
|
|
|
|
passwordUsed.Store(true)
|
|
|
|
return "any-pass", nil
|
|
|
|
}),
|
|
|
|
},
|
2022-10-09 01:54:53 +01:00
|
|
|
BannerCallback: func(message string) error {
|
2022-10-09 18:31:19 +01:00
|
|
|
if len(tc.wantBanners) == 0 {
|
|
|
|
t.Errorf("unexpected banner: %q", message)
|
|
|
|
} else if message != tc.wantBanners[0] {
|
|
|
|
t.Errorf("banner = %q; want %q", message, tc.wantBanners[0])
|
|
|
|
} else {
|
|
|
|
t.Logf("banner = %q", message)
|
|
|
|
tc.wantBanners = tc.wantBanners[1:]
|
2022-10-09 01:54:53 +01:00
|
|
|
}
|
|
|
|
return nil
|
|
|
|
},
|
|
|
|
}
|
|
|
|
var wg sync.WaitGroup
|
|
|
|
wg.Add(1)
|
|
|
|
go func() {
|
|
|
|
defer wg.Done()
|
|
|
|
c, chans, reqs, err := gossh.NewClientConn(sc, sc.RemoteAddr().String(), cfg)
|
|
|
|
if err != nil {
|
|
|
|
if !tc.authErr {
|
|
|
|
t.Errorf("client: %v", err)
|
|
|
|
}
|
|
|
|
return
|
|
|
|
} else if tc.authErr {
|
|
|
|
c.Close()
|
|
|
|
t.Errorf("client: expected error, got nil")
|
|
|
|
return
|
|
|
|
}
|
|
|
|
client := gossh.NewClient(c, chans, reqs)
|
|
|
|
defer client.Close()
|
|
|
|
session, err := client.NewSession()
|
|
|
|
if err != nil {
|
|
|
|
t.Errorf("client: %v", err)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
defer session.Close()
|
2022-10-09 18:31:19 +01:00
|
|
|
_, err = session.CombinedOutput("echo Ran echo!")
|
2022-10-09 01:54:53 +01:00
|
|
|
if err != nil {
|
|
|
|
t.Errorf("client: %v", err)
|
|
|
|
}
|
|
|
|
}()
|
|
|
|
if err := s.HandleSSHConn(dc); err != nil {
|
|
|
|
t.Errorf("unexpected error: %v", err)
|
|
|
|
}
|
|
|
|
wg.Wait()
|
2022-10-09 18:31:19 +01:00
|
|
|
if len(tc.wantBanners) > 0 {
|
|
|
|
t.Errorf("missing banners: %v", tc.wantBanners)
|
|
|
|
}
|
2022-10-09 01:54:53 +01:00
|
|
|
})
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-02-24 21:31:54 +00:00
|
|
|
func TestSSH(t *testing.T) {
|
2022-03-09 05:35:55 +00:00
|
|
|
var logf logger.Logf = t.Logf
|
2023-05-03 21:57:17 +01:00
|
|
|
sys := &tsd.System{}
|
|
|
|
eng, err := wgengine.NewFakeUserspaceEngine(logf, sys.Set)
|
2022-02-24 21:31:54 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
2023-05-03 21:57:17 +01:00
|
|
|
sys.Set(eng)
|
|
|
|
sys.Set(new(mem.Store))
|
|
|
|
lb, err := ipnlocal.NewLocalBackend(logf, logid.PublicID{}, sys, 0)
|
2022-02-24 21:31:54 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
defer lb.Shutdown()
|
|
|
|
dir := t.TempDir()
|
|
|
|
lb.SetVarRoot(dir)
|
|
|
|
|
2022-03-09 19:25:07 +00:00
|
|
|
srv := &server{
|
|
|
|
lb: lb,
|
|
|
|
logf: logf,
|
|
|
|
}
|
2022-04-20 21:39:15 +01:00
|
|
|
sc, err := srv.newConn()
|
2022-02-24 21:31:54 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
2022-04-20 21:39:15 +01:00
|
|
|
// Remove the auth checks for the test
|
|
|
|
sc.insecureSkipTailscaleAuth = true
|
2022-02-24 21:31:54 +00:00
|
|
|
|
|
|
|
u, err := user.Current()
|
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
2023-05-21 15:35:33 +01:00
|
|
|
um, err := userLookup(u.Username)
|
2023-05-08 17:42:31 +01:00
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
sc.localUser = um
|
2022-04-21 01:36:19 +01:00
|
|
|
sc.info = &sshConnInfo{
|
2022-02-24 21:31:54 +00:00
|
|
|
sshUser: "test",
|
2022-07-26 04:55:44 +01:00
|
|
|
src: netip.MustParseAddrPort("1.2.3.4:32342"),
|
|
|
|
dst: netip.MustParseAddrPort("1.2.3.5:22"),
|
2023-08-18 15:57:44 +01:00
|
|
|
node: (&tailcfg.Node{}).View(),
|
2022-10-09 01:54:53 +01:00
|
|
|
uprof: tailcfg.UserProfile{},
|
2022-02-24 21:31:54 +00:00
|
|
|
}
|
2023-03-23 19:32:44 +00:00
|
|
|
sc.action0 = &tailcfg.SSHAction{Accept: true}
|
|
|
|
sc.finalAction = sc.action0
|
2022-02-24 21:31:54 +00:00
|
|
|
|
2022-04-20 21:39:15 +01:00
|
|
|
sc.Handler = func(s ssh.Session) {
|
2022-06-27 19:50:11 +01:00
|
|
|
sc.newSSHSession(s).run()
|
2022-02-24 21:31:54 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
ln, err := net.Listen("tcp4", "127.0.0.1:0")
|
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
defer ln.Close()
|
|
|
|
port := ln.Addr().(*net.TCPAddr).Port
|
|
|
|
|
|
|
|
go func() {
|
|
|
|
for {
|
|
|
|
c, err := ln.Accept()
|
|
|
|
if err != nil {
|
|
|
|
if !errors.Is(err, net.ErrClosed) {
|
|
|
|
t.Errorf("Accept: %v", err)
|
|
|
|
}
|
|
|
|
return
|
|
|
|
}
|
2022-04-20 21:39:15 +01:00
|
|
|
go sc.HandleConn(c)
|
2022-02-24 21:31:54 +00:00
|
|
|
}
|
|
|
|
}()
|
|
|
|
|
2022-02-24 22:35:40 +00:00
|
|
|
execSSH := func(args ...string) *exec.Cmd {
|
|
|
|
cmd := exec.Command("ssh",
|
2022-04-22 03:05:27 +01:00
|
|
|
"-F",
|
|
|
|
"none",
|
2022-04-20 21:39:15 +01:00
|
|
|
"-v",
|
2022-02-24 22:35:40 +00:00
|
|
|
"-p", fmt.Sprint(port),
|
|
|
|
"-o", "StrictHostKeyChecking=no",
|
|
|
|
"user@127.0.0.1")
|
|
|
|
cmd.Args = append(cmd.Args, args...)
|
|
|
|
return cmd
|
2022-02-24 21:31:54 +00:00
|
|
|
}
|
2022-02-24 22:35:40 +00:00
|
|
|
|
|
|
|
t.Run("env", func(t *testing.T) {
|
2022-03-18 21:46:38 +00:00
|
|
|
if cibuild.On() {
|
2022-03-17 21:33:09 +00:00
|
|
|
t.Skip("Skipping for now; see https://github.com/tailscale/tailscale/issues/4051")
|
|
|
|
}
|
2022-03-09 05:35:55 +00:00
|
|
|
cmd := execSSH("LANG=foo env")
|
|
|
|
cmd.Env = append(os.Environ(), "LOCAL_ENV=bar")
|
2022-02-24 22:35:40 +00:00
|
|
|
got, err := cmd.CombinedOutput()
|
|
|
|
if err != nil {
|
2022-04-20 21:39:15 +01:00
|
|
|
t.Fatal(err, string(got))
|
2022-02-24 22:35:40 +00:00
|
|
|
}
|
|
|
|
m := parseEnv(got)
|
|
|
|
if got := m["USER"]; got == "" || got != u.Username {
|
|
|
|
t.Errorf("USER = %q; want %q", got, u.Username)
|
|
|
|
}
|
|
|
|
if got := m["HOME"]; got == "" || got != u.HomeDir {
|
|
|
|
t.Errorf("HOME = %q; want %q", got, u.HomeDir)
|
|
|
|
}
|
|
|
|
if got := m["PWD"]; got == "" || got != u.HomeDir {
|
|
|
|
t.Errorf("PWD = %q; want %q", got, u.HomeDir)
|
|
|
|
}
|
|
|
|
if got := m["SHELL"]; got == "" {
|
|
|
|
t.Errorf("no SHELL")
|
|
|
|
}
|
|
|
|
if got, want := m["LANG"], "foo"; got != want {
|
|
|
|
t.Errorf("LANG = %q; want %q", got, want)
|
|
|
|
}
|
2022-03-09 05:35:55 +00:00
|
|
|
if got := m["LOCAL_ENV"]; got != "" {
|
|
|
|
t.Errorf("LOCAL_ENV leaked over ssh: %v", got)
|
|
|
|
}
|
2022-02-24 22:35:40 +00:00
|
|
|
t.Logf("got: %+v", m)
|
|
|
|
})
|
|
|
|
|
|
|
|
t.Run("stdout_stderr", func(t *testing.T) {
|
|
|
|
cmd := execSSH("sh", "-c", "echo foo; echo bar >&2")
|
|
|
|
var outBuf, errBuf bytes.Buffer
|
|
|
|
cmd.Stdout = &outBuf
|
|
|
|
cmd.Stderr = &errBuf
|
|
|
|
if err := cmd.Run(); err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
t.Logf("Got: %q and %q", outBuf.Bytes(), errBuf.Bytes())
|
|
|
|
// TODO: figure out why these aren't right. should be
|
|
|
|
// "foo\n" and "bar\n", not "\n" and "bar\n".
|
|
|
|
})
|
|
|
|
|
2023-06-22 03:57:45 +01:00
|
|
|
t.Run("large_file", func(t *testing.T) {
|
|
|
|
const wantSize = 1e6
|
|
|
|
var outBuf bytes.Buffer
|
|
|
|
cmd := execSSH("head", "-c", strconv.Itoa(wantSize), "/dev/zero")
|
|
|
|
cmd.Stdout = &outBuf
|
|
|
|
if err := cmd.Run(); err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
if gotSize := outBuf.Len(); gotSize != wantSize {
|
|
|
|
t.Fatalf("got %d, want %d", gotSize, int(wantSize))
|
|
|
|
}
|
|
|
|
})
|
|
|
|
|
2022-02-24 22:35:40 +00:00
|
|
|
t.Run("stdin", func(t *testing.T) {
|
2022-03-18 21:46:38 +00:00
|
|
|
if cibuild.On() {
|
2022-03-18 17:45:05 +00:00
|
|
|
t.Skip("Skipping for now; see https://github.com/tailscale/tailscale/issues/4051")
|
|
|
|
}
|
2022-02-24 22:35:40 +00:00
|
|
|
cmd := execSSH("cat")
|
|
|
|
var outBuf bytes.Buffer
|
|
|
|
cmd.Stdout = &outBuf
|
|
|
|
const str = "foo\nbar\n"
|
|
|
|
cmd.Stdin = strings.NewReader(str)
|
|
|
|
if err := cmd.Run(); err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
if got := outBuf.String(); got != str {
|
|
|
|
t.Errorf("got %q; want %q", got, str)
|
|
|
|
}
|
|
|
|
})
|
|
|
|
}
|
|
|
|
|
|
|
|
func parseEnv(out []byte) map[string]string {
|
|
|
|
e := map[string]string{}
|
|
|
|
lineread.Reader(bytes.NewReader(out), func(line []byte) error {
|
|
|
|
i := bytes.IndexByte(line, '=')
|
|
|
|
if i == -1 {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
e[string(line[:i])] = string(line[i+1:])
|
|
|
|
return nil
|
|
|
|
})
|
|
|
|
return e
|
2022-02-24 21:31:54 +00:00
|
|
|
}
|
2022-04-17 05:49:22 +01:00
|
|
|
|
|
|
|
func TestPublicKeyFetching(t *testing.T) {
|
|
|
|
var reqsTotal, reqsIfNoneMatchHit, reqsIfNoneMatchMiss int32
|
|
|
|
ts := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
|
|
atomic.AddInt32((&reqsTotal), 1)
|
|
|
|
etag := fmt.Sprintf("W/%q", sha256.Sum256([]byte(r.URL.Path)))
|
|
|
|
w.Header().Set("Etag", etag)
|
|
|
|
if v := r.Header.Get("If-None-Match"); v != "" {
|
|
|
|
if v == etag {
|
|
|
|
atomic.AddInt32(&reqsIfNoneMatchHit, 1)
|
|
|
|
w.WriteHeader(304)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
atomic.AddInt32(&reqsIfNoneMatchMiss, 1)
|
|
|
|
}
|
|
|
|
io.WriteString(w, "foo\nbar\n"+string(r.URL.Path)+"\n")
|
|
|
|
}))
|
|
|
|
ts.StartTLS()
|
|
|
|
defer ts.Close()
|
|
|
|
keys := ts.URL
|
|
|
|
|
|
|
|
clock := &tstest.Clock{}
|
|
|
|
srv := &server{
|
|
|
|
pubKeyHTTPClient: ts.Client(),
|
|
|
|
timeNow: clock.Now,
|
|
|
|
}
|
|
|
|
for i := 0; i < 2; i++ {
|
|
|
|
got, err := srv.fetchPublicKeysURL(keys + "/alice.keys")
|
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
if want := []string{"foo", "bar", "/alice.keys"}; !reflect.DeepEqual(got, want) {
|
|
|
|
t.Errorf("got %q; want %q", got, want)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if got, want := atomic.LoadInt32(&reqsTotal), int32(1); got != want {
|
|
|
|
t.Errorf("got %d requests; want %d", got, want)
|
|
|
|
}
|
|
|
|
if got, want := atomic.LoadInt32(&reqsIfNoneMatchHit), int32(0); got != want {
|
|
|
|
t.Errorf("got %d etag hits; want %d", got, want)
|
|
|
|
}
|
|
|
|
clock.Advance(5 * time.Minute)
|
|
|
|
got, err := srv.fetchPublicKeysURL(keys + "/alice.keys")
|
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
if want := []string{"foo", "bar", "/alice.keys"}; !reflect.DeepEqual(got, want) {
|
|
|
|
t.Errorf("got %q; want %q", got, want)
|
|
|
|
}
|
|
|
|
if got, want := atomic.LoadInt32(&reqsTotal), int32(2); got != want {
|
|
|
|
t.Errorf("got %d requests; want %d", got, want)
|
|
|
|
}
|
|
|
|
if got, want := atomic.LoadInt32(&reqsIfNoneMatchHit), int32(1); got != want {
|
|
|
|
t.Errorf("got %d etag hits; want %d", got, want)
|
|
|
|
}
|
|
|
|
if got, want := atomic.LoadInt32(&reqsIfNoneMatchMiss), int32(0); got != want {
|
|
|
|
t.Errorf("got %d etag misses; want %d", got, want)
|
|
|
|
}
|
|
|
|
|
|
|
|
}
|
2022-04-20 21:53:01 +01:00
|
|
|
|
|
|
|
func TestExpandPublicKeyURL(t *testing.T) {
|
2022-04-21 01:36:19 +01:00
|
|
|
c := &conn{
|
|
|
|
info: &sshConnInfo{
|
2022-10-09 01:54:53 +01:00
|
|
|
uprof: tailcfg.UserProfile{
|
2022-04-21 01:36:19 +01:00
|
|
|
LoginName: "bar@baz.tld",
|
|
|
|
},
|
2022-04-20 21:53:01 +01:00
|
|
|
},
|
|
|
|
}
|
2022-04-21 01:36:19 +01:00
|
|
|
if got, want := c.expandPublicKeyURL("foo"), "foo"; got != want {
|
2022-04-20 21:53:01 +01:00
|
|
|
t.Errorf("basic: got %q; want %q", got, want)
|
|
|
|
}
|
2022-04-21 01:36:19 +01:00
|
|
|
if got, want := c.expandPublicKeyURL("https://example.com/$LOGINNAME_LOCALPART.keys"), "https://example.com/bar.keys"; got != want {
|
2022-04-20 21:53:01 +01:00
|
|
|
t.Errorf("localpart: got %q; want %q", got, want)
|
|
|
|
}
|
2022-04-21 01:36:19 +01:00
|
|
|
if got, want := c.expandPublicKeyURL("https://example.com/keys?email=$LOGINNAME_EMAIL"), "https://example.com/keys?email=bar@baz.tld"; got != want {
|
2022-04-20 21:53:01 +01:00
|
|
|
t.Errorf("email: got %q; want %q", got, want)
|
|
|
|
}
|
2022-04-21 01:36:19 +01:00
|
|
|
c.info = new(sshConnInfo)
|
|
|
|
if got, want := c.expandPublicKeyURL("https://example.com/keys?email=$LOGINNAME_EMAIL"), "https://example.com/keys?email="; got != want {
|
2022-04-20 21:53:01 +01:00
|
|
|
t.Errorf("on empty: got %q; want %q", got, want)
|
|
|
|
}
|
|
|
|
}
|
2022-04-21 22:40:32 +01:00
|
|
|
|
|
|
|
func TestAcceptEnvPair(t *testing.T) {
|
|
|
|
tests := []struct {
|
|
|
|
in string
|
|
|
|
want bool
|
|
|
|
}{
|
|
|
|
{"TERM=x", true},
|
|
|
|
{"term=x", false},
|
|
|
|
{"TERM", false},
|
|
|
|
{"LC_FOO=x", true},
|
|
|
|
{"LD_PRELOAD=naah", false},
|
|
|
|
{"TERM=screen-256color", true},
|
|
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
|
|
if got := acceptEnvPair(tt.in); got != tt.want {
|
|
|
|
t.Errorf("for %q, got %v; want %v", tt.in, got, tt.want)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
2022-12-14 22:20:50 +00:00
|
|
|
|
|
|
|
func TestPathFromPAMEnvLine(t *testing.T) {
|
|
|
|
u := &user.User{Username: "foo", HomeDir: "/Homes/Foo"}
|
|
|
|
tests := []struct {
|
|
|
|
line string
|
|
|
|
u *user.User
|
|
|
|
want string
|
|
|
|
}{
|
2022-12-15 22:28:14 +00:00
|
|
|
{"", u, ""},
|
2022-12-14 22:20:50 +00:00
|
|
|
{`PATH DEFAULT="/run/wrappers/bin:@{HOME}/.nix-profile/bin:/etc/profiles/per-user/@{PAM_USER}/bin:/nix/var/nix/profiles/default/bin:/run/current-system/sw/bin"`,
|
|
|
|
u, "/run/wrappers/bin:/Homes/Foo/.nix-profile/bin:/etc/profiles/per-user/foo/bin:/nix/var/nix/profiles/default/bin:/run/current-system/sw/bin"},
|
|
|
|
{`PATH DEFAULT="@{SOMETHING_ELSE}:nope:@{HOME}"`,
|
|
|
|
u, ""},
|
|
|
|
}
|
|
|
|
for i, tt := range tests {
|
|
|
|
got := pathFromPAMEnvLine([]byte(tt.line), tt.u)
|
|
|
|
if got != tt.want {
|
|
|
|
t.Errorf("%d. got %q; want %q", i, got, tt.want)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-12-15 22:28:14 +00:00
|
|
|
func TestExpandDefaultPathTmpl(t *testing.T) {
|
|
|
|
u := &user.User{Username: "foo", HomeDir: "/Homes/Foo"}
|
|
|
|
tests := []struct {
|
|
|
|
t string
|
|
|
|
u *user.User
|
|
|
|
want string
|
|
|
|
}{
|
|
|
|
{"", u, ""},
|
|
|
|
{`/run/wrappers/bin:@{HOME}/.nix-profile/bin:/etc/profiles/per-user/@{PAM_USER}/bin:/nix/var/nix/profiles/default/bin:/run/current-system/sw/bin`,
|
|
|
|
u, "/run/wrappers/bin:/Homes/Foo/.nix-profile/bin:/etc/profiles/per-user/foo/bin:/nix/var/nix/profiles/default/bin:/run/current-system/sw/bin"},
|
|
|
|
{`@{SOMETHING_ELSE}:nope:@{HOME}`, u, ""},
|
|
|
|
}
|
|
|
|
for i, tt := range tests {
|
|
|
|
got := expandDefaultPathTmpl(tt.t, tt.u)
|
|
|
|
if got != tt.want {
|
|
|
|
t.Errorf("%d. got %q; want %q", i, got, tt.want)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-12-14 22:20:50 +00:00
|
|
|
func TestPathFromPAMEnvLineOnNixOS(t *testing.T) {
|
|
|
|
if runtime.GOOS != "linux" {
|
|
|
|
t.Skip("skipping on non-linux")
|
|
|
|
}
|
|
|
|
if distro.Get() != distro.NixOS {
|
|
|
|
t.Skip("skipping on non-NixOS")
|
|
|
|
}
|
|
|
|
u, err := user.Current()
|
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
got := defaultPathForUserOnNixOS(u)
|
|
|
|
if got == "" {
|
|
|
|
x, err := os.ReadFile("/etc/pam/environment")
|
|
|
|
t.Fatalf("no result. file was: err=%v, contents=%s", err, x)
|
|
|
|
}
|
|
|
|
t.Logf("success; got=%q", got)
|
|
|
|
}
|
2023-05-08 17:42:31 +01:00
|
|
|
|
|
|
|
func TestStdOsUserUserAssumptions(t *testing.T) {
|
2024-02-09 01:34:22 +00:00
|
|
|
v := reflect.TypeFor[user.User]()
|
2023-05-08 17:42:31 +01:00
|
|
|
if got, want := v.NumField(), 5; got != want {
|
|
|
|
t.Errorf("os/user.User has %v fields; this package assumes %v", got, want)
|
|
|
|
}
|
|
|
|
}
|