summaryrefslogtreecommitdiff
path: root/regress/cfgmatch.sh
diff options
context:
space:
mode:
Diffstat (limited to 'regress/cfgmatch.sh')
-rw-r--r--regress/cfgmatch.sh76
1 files changed, 32 insertions, 44 deletions
diff --git a/regress/cfgmatch.sh b/regress/cfgmatch.sh
index 05629639..2504d04f 100644
--- a/regress/cfgmatch.sh
+++ b/regress/cfgmatch.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: cfgmatch.sh,v 1.9 2015/03/03 22:35:19 markus Exp $
+# $OpenBSD: cfgmatch.sh,v 1.10 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain.
tid="sshd_config match"
@@ -13,7 +13,7 @@ echo "ExitOnForwardFailure=yes" >> $OBJ/ssh_proxy
start_client()
{
rm -f $pidfile
- ${SSH} -q -$p $fwd "$@" somehost \
+ ${SSH} -q $fwd "$@" somehost \
exec sh -c \'"echo \$\$ > $pidfile; exec sleep 100"\' \
>>$TEST_REGRESS_LOGFILE 2>&1 &
client_pid=$!
@@ -56,22 +56,18 @@ start_sshd
#set -x
# Test Match + PermitOpen in sshd_config. This should be permitted
-for p in ${SSH_PROTOCOLS}; do
- trace "match permitopen localhost proto $p"
- start_client -F $OBJ/ssh_config
- ${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true || \
- fail "match permitopen permit proto $p"
- stop_client
-done
+trace "match permitopen localhost"
+start_client -F $OBJ/ssh_config
+${SSH} -q -p $fwdport -F $OBJ/ssh_config somehost true || \
+ fail "match permitopen permit"
+stop_client
# Same but from different source. This should not be permitted
-for p in ${SSH_PROTOCOLS}; do
- trace "match permitopen proxy proto $p"
- start_client -F $OBJ/ssh_proxy
- ${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true && \
- fail "match permitopen deny proto $p"
- stop_client
-done
+trace "match permitopen proxy"
+start_client -F $OBJ/ssh_proxy
+${SSH} -q -p $fwdport -F $OBJ/ssh_config somehost true && \
+ fail "match permitopen deny"
+stop_client
# Retry previous with key option, should also be denied.
cp /dev/null $OBJ/authorized_keys_$USER
@@ -79,23 +75,19 @@ for t in ${SSH_KEYTYPES}; do
printf 'permitopen="127.0.0.1:'$PORT'" ' >> $OBJ/authorized_keys_$USER
cat $OBJ/$t.pub >> $OBJ/authorized_keys_$USER
done
-for p in ${SSH_PROTOCOLS}; do
- trace "match permitopen proxy w/key opts proto $p"
- start_client -F $OBJ/ssh_proxy
- ${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true && \
- fail "match permitopen deny w/key opt proto $p"
- stop_client
-done
+trace "match permitopen proxy w/key opts"
+start_client -F $OBJ/ssh_proxy
+${SSH} -q -p $fwdport -F $OBJ/ssh_config somehost true && \
+ fail "match permitopen deny w/key opt"
+stop_client
# Test both sshd_config and key options permitting the same dst/port pair.
# Should be permitted.
-for p in ${SSH_PROTOCOLS}; do
- trace "match permitopen localhost proto $p"
- start_client -F $OBJ/ssh_config
- ${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true || \
- fail "match permitopen permit proto $p"
- stop_client
-done
+trace "match permitopen localhost"
+start_client -F $OBJ/ssh_config
+${SSH} -q -p $fwdport -F $OBJ/ssh_config somehost true || \
+ fail "match permitopen permit"
+stop_client
cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
echo "PermitOpen 127.0.0.1:1 127.0.0.1:$PORT 127.0.0.2:2" >>$OBJ/sshd_proxy
@@ -103,13 +95,11 @@ echo "Match User $USER" >>$OBJ/sshd_proxy
echo "PermitOpen 127.0.0.1:1 127.0.0.1:2" >>$OBJ/sshd_proxy
# Test that a Match overrides a PermitOpen in the global section
-for p in ${SSH_PROTOCOLS}; do
- trace "match permitopen proxy w/key opts proto $p"
- start_client -F $OBJ/ssh_proxy
- ${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true && \
- fail "match override permitopen proto $p"
- stop_client
-done
+trace "match permitopen proxy w/key opts"
+start_client -F $OBJ/ssh_proxy
+${SSH} -q -p $fwdport -F $OBJ/ssh_config somehost true && \
+ fail "match override permitopen"
+stop_client
cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
echo "PermitOpen 127.0.0.1:1 127.0.0.1:$PORT 127.0.0.2:2" >>$OBJ/sshd_proxy
@@ -118,10 +108,8 @@ echo "PermitOpen 127.0.0.1:1 127.0.0.1:2" >>$OBJ/sshd_proxy
# Test that a rule that doesn't match doesn't override, plus test a
# PermitOpen entry that's not at the start of the list
-for p in ${SSH_PROTOCOLS}; do
- trace "nomatch permitopen proxy w/key opts proto $p"
- start_client -F $OBJ/ssh_proxy
- ${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true || \
- fail "nomatch override permitopen proto $p"
- stop_client
-done
+trace "nomatch permitopen proxy w/key opts"
+start_client -F $OBJ/ssh_proxy
+${SSH} -q -p $fwdport -F $OBJ/ssh_config somehost true || \
+ fail "nomatch override permitopen"
+stop_client